WO2021254172A1 - 一种通信方法以及相关装置 - Google Patents

一种通信方法以及相关装置 Download PDF

Info

Publication number
WO2021254172A1
WO2021254172A1 PCT/CN2021/098242 CN2021098242W WO2021254172A1 WO 2021254172 A1 WO2021254172 A1 WO 2021254172A1 CN 2021098242 W CN2021098242 W CN 2021098242W WO 2021254172 A1 WO2021254172 A1 WO 2021254172A1
Authority
WO
WIPO (PCT)
Prior art keywords
intermediate key
identifier
ausf
network
amf
Prior art date
Application number
PCT/CN2021/098242
Other languages
English (en)
French (fr)
Inventor
邓娟
李飞
何承东
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21824798.9A priority Critical patent/EP4161113A4/en
Publication of WO2021254172A1 publication Critical patent/WO2021254172A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/08—Mobility data transfer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H04W8/20—Transfer of user or subscriber data

Definitions

  • This application relates to the field of communication technology, and in particular to a communication method and related devices.
  • PLMN Public land mobile network
  • SNPN independent non-public network
  • 3GPP third generation partnership protection
  • terminal equipment or a visited network called User Equipment (UE)
  • UE User Equipment
  • SNPN Visited SNPN
  • PLMN Visited PLMN
  • UE's home network which may be SNPN or PLMN.
  • the UE’s home network When the UE’s home network is SNPN, the UE’s home network is called home SNPN (Home SNPN, H-SNPN); when the UE’s home network is PLMN, the UE’s home network is called home PLMN (Home PLMN, H-PLMN) ).
  • the UE's home network sends the UE's subscription permanent identifier (SUPI) to the UE's visited network.
  • the SUPI is used to identify the UE, and SUPI is private information. If the SUPI leaks, it will bring a great risk to the UE.
  • an embodiment of the present application proposes a communication method, including: First, the authentication server function AUSF receives the contract permanent identification SUPI of the terminal device sent by the unified data management function (Unified Data Management, UDM), where the terminal device is also called Is a user equipment (user equipment, UE), the SUPI is used to identify the UE; the AUSF generates a first identifier based on the SUPI; the first identifier is used to identify the UE; SEAF) sends the first identifier; the SEAF sends the first identifier to the Access and Mobility Management Function (AMF); the SEAF is based on the first intermediate key K SEAF , the first identifier, and the inter-architecture resistance Anti Bidding down Between Architectures (ABBA) parameters generate the second intermediate key K AMF ; the SEAF sends the second intermediate key K AMF to the Access and Mobility Management Function (AMF); the AMF A non-access stratum (NAS) key is generated based on the second intermediate key K AMF , where the ABBA)
  • the NAS message is a protocol message between the UE and the AMF.
  • SEAF and AMF are co-located. Externally displayed as a network function.
  • the information exchange between SEAF and AMF is an internal action of a network function.
  • SEAF and AMF can be used interchangeably.
  • the AUSF receives the SUPI of the UE sent by the UDM; the AUSF generates a first identifier based on the SUPI; the first identifier is used to identify the UE; AUSF AMF sends the first identification; the AMF generates K AMF K SEAF, ABBA and the first identification parameter; AMF generates the key based on the K NAS AMF, wherein the NAS message key is used to protect the NAS .
  • the UE sending a message or information element to the SEAF means that the UE sends the message or information element to the AMF, and the AMF sends the message or information element to the SEAF.
  • the SEAF sends a message or information element to the UE it means that the SEAF sends the message or information element to the AMF, and the AMF sends the message or information element to the UE.
  • AUSF sends a message or cell to AMF it means that AUSF sends the message or cell to SEAF, and SEAF sends the message or cell to AMF.
  • the message or information element sent by AMF to AUSF means that the AMF sends the message or information element to the SEAF, and the SEAF sends the message or information element to the AUSF.
  • the AUSF generates a first identifier, and the first identifier is used to identify the UE.
  • the AUSF sends the first identifier to the SEAF to prevent the AUSF from sending the SUPI to the SEAF, thereby avoiding the leakage of the UE's privacy information to the SEAF (or the UE's visited network). Thereby improving the security of communication.
  • the method further includes:
  • the AUSF sends the first identifier to the UDM; secondly, after the UDM receives the first identifier from the AUSF, the corresponding relationship between the first identifier and SUPI is stored.
  • the UDM also saves the subscription data of the UE identified by the SUPI. Therefore, the UDM optionally saves the correspondence between the first identifier, the SUPI corresponding to the first identifier, and the subscription data of the UE corresponding to the SUPI.
  • the AUSF sends the first identifier to the UDM through the authentication result confirmation service request.
  • the authentication result confirmation service request is used to notify UDM of the authentication result of the terminal device.
  • the authentication result confirmation service request is a "Nudm_UEAuthentication_Result Confirmation Request" message.
  • the UDM after the UDM receives the first identifier sent by the AUSF, the UDM saves the corresponding relationship between the first identifier and the SUPI.
  • the UDM receives a service request carrying the first identifier from the AMF or the Session Management Function (SMF) in the future, the UDM finds the corresponding SUPI according to the locally stored correspondence between the first identifier and the SUPI.
  • the UDM also finds the subscription data of the UE identified by the SUPI.
  • generating the first identifier by the AUSF further includes:
  • the AUSF receives the first authentication request message carrying the first service network identifier sent by the SEAF, and the first authentication request message is used to request the invocation of the authentication service provided by the AUSF; secondly, the AUSF generates the first identifier.
  • the AUSF when the first condition is met, the AUSF generates the first identifier.
  • the first condition includes:
  • the first serving network identifier received by AUSF includes PLMN ID and NID, or,
  • the first service network identifier received by AUSF includes PLMN ID and NID
  • the second service network identifier includes PLMN ID but does not include NID, or
  • the UE’s visited network is an SNPN network, or,
  • the UE's visited network is an SNPN network
  • the UE's home network is a PLMN network, or,
  • the UE’s visited network and the UE’s home network are two different networks, or,
  • the local configuration of the AUSF instructs to generate the first identifier.
  • the first serving network identifier is the identifier of the UE visited network, or the identifier of the network where the SEAF is located, or the identifier of the network where the AMF is located, or the identifier of the UE's serving network.
  • the first service The network identifier is the public land network identifier (PLMN ID) of the PLMN network; when the UE visits the network, or the network where the SEAF is located, or the network where the AMF is located, or the service network of the UE is an SNPN network, the first service network
  • PLMN ID public land network identifier
  • the first service network is the identifier of the SNPN network, that is, the first serving network identifier not only includes the PLMN ID, but also includes a network identifier (NID).
  • NID network identifier
  • the PLMN ID and NID jointly identify the SNPN network.
  • the first serving network identifier may also be the network name of the network visited by the UE, or the network name of the network where the SEAF is located, or the network name of the network where the AMF is located, or the name of the service network of the UE.
  • the first serving network identifier is "5G: SN id", where the serving network of the UE, or the visited network of the UE, or the SEAF When the network where the AMF is located, or the network where the AMF is located is a PLMN, the SN id is the PLMN ID of the PLMN; when the service network of the UE, or the visited network of the UE, or the network where the SEAF is located, or AMF When the network is an SNPN network, the SN id includes the PLMN ID and NID, and the PLMN ID and NID together identify the SNPN network.
  • the AMF may be referred to as the AMF serving the UE, and the SEAF may also be referred to as the SEAF serving the UE.
  • the second serving network identifier is the network identifier of the UE's home network, or the network identifier of the network where the AUSF is located, or the network identifier of the network where the UDM is located.
  • the second serving network identifier is the PLMN ID of the PLMN network;
  • the second service network identifier is the identifier of the SNPN network, that is, the second service network identifier includes PLMN ID and NID.
  • the second serving network identifier may also be the network name of the UE's home network, or the network name of the network where the AUSF is located, or the network name of the network where the UDM is located.
  • the second service network identifier is "5G: SN id", where, when the UE home network, or the network where the AUSF is located, or the network where the UDM is located is a PLMN network , The SN id is the PLMN ID of the PLMN network; when the UE’s home network, or the network where the UDM is located, or the network where the AUSF is located is the SNPN network, the SN id includes the PLMN ID and the NID, and the PLMN ID and NID together identify the SNPN network.
  • the first service network identifier is carried in a first authentication request, and the first authentication request is used to request to invoke the authentication service provided by AUSF.
  • the first authentication request is a "Nausf_UEAuthentication_Authenticate Request" message.
  • the AUSF determines whether to generate the first identifier.
  • the first service network identifier includes the PLMN ID and the NID, or when other determination conditions are met, the AUSF generates the first identifier.
  • the AUSF sends the first identifier to the SEAF or the visited network to avoid leaking the private information of the terminal device, thereby improving the security of communication.
  • the SEAF before the SEAF generates the second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the ABBA, it further includes :
  • the UDM or Authentication credential Respository and Processing Function generates a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE; the UDM or ARPF is based on the third The intermediate key CK and the fourth intermediate key IK generate a fifth intermediate key K AUSF ; the UDM sends the fifth intermediate key K AUSF to the AUSF; the AUSF is generated based on the fifth intermediate key K AUSF The first intermediate key K SEAF ; the AUSF sends the first intermediate key K SEAF to the SEAF.
  • ARPF Authentication credential Respository and Processing Function
  • the communication method can be applied to authentication methods: 5G authentication and key agreement (5G Authentication and Key Agreement, 5G AKA), which improves the flexibility of the solution.
  • 5G AKA 5G Authentication and Key Agreement
  • the SEAF before the SEAF generates the second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the ABBA, it further includes :
  • the UDM or ARPF generates a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE; the UDM or ARPF generates a third intermediate key CK and the fourth intermediate key IK based on the third intermediate key CK and the fourth intermediate key IK.
  • the communication method can be applied to authentication methods: Improved Extensible Authentication Protocol (Protocol Method for 3rd Generation Authentication and Key Agreement, EAP-AKA') for third-generation authentication and key agreement. To achieve the flexibility of the program.
  • EAP-AKA' Improved Extensible Authentication Protocol
  • the sending of the first identifier by the AUSF to SEAF further includes:
  • the AUSF sends a third authentication service response message to the SEAF, and the third authentication service response includes the first identifier.
  • the authentication service response is: "Nausf_UEAuthentication_Authenticate Response" message.
  • the SEAF after the SEAF sends the first identifier to the Access and Mobility Management Function (AMF), it further includes:
  • the AMF receives the first identifier.
  • the AMF sends the first identifier to the SMF.
  • the AMF sends the first identifier to the SMF through a session management context creation service request, and the session management context creation service request is used to request the SMF to create a session context of the UE or to request the SMF to create a session.
  • the session management context creation service request is a "Nsmf_PDUSession_CreateSMContext Request" message.
  • the method further includes:
  • the AUSF sends a first instruction to the AMF, which is used to instruct to generate the first identifier;
  • the AMF sends a second instruction to the UE according to the first instruction, which is used to instruct to generate the first identifier;
  • the UE generates a first identifier based on the second indication.
  • an embodiment of the present application proposes a communication method, including: a UE generates a first identity based on the SUPI of the UE; the UE based on a first intermediate key K SEAF , the first identity, and an inter-architecture anti-dimensionality reduction parameter ABBA generates a second intermediate key K AMF ; the UE generates a NAS key based on the second intermediate key K AMF , where the NAS key is used to protect the NAS message.
  • the UE generates a first identifier based on the SUPI of the UE, and the first identifier is used to identify the UE.
  • the UE generates a series of keys based on the first identifier, and finally generates a NAS key, which is used to protect the NAS message.
  • the UE and the network side use the same method to generate the first identifier and generate the NAS key, and use the NAS key to protect the NAS message. Ensure the normal communication between terminal equipment and network equipment.
  • the method before the UE generates the first identifier based on the SUPI, the method further includes:
  • the UE sends a registration request message to the AMF;
  • the UE generating the first identifier based on the SUPI includes: when the UE determines that the second condition is satisfied, the UE generates the first identifier based on the SUPI; otherwise, the UE does not generate the first identifier.
  • the second condition includes:
  • the first serving network identifier includes PLMN ID and NID, or,
  • the first service network identifier includes PLMN ID and NID
  • the second service network identifier includes PLMN ID but not NID, or
  • the UE’s visited network is an SNPN network, or,
  • the UE's visited network is an SNPN network
  • the UE's home network is a PLMN network, or,
  • the UE's visited network and the UE's home network are two different networks, or,
  • the UE local configuration instructs to generate the first identifier, or,
  • the UE receives the second indication from the AMF, and the second indication is used to instruct the UE to generate the first identity.
  • the UE before the UE sends the registration request, the UE selects the serving network and obtains the first network identifier.
  • the UE and the network side use the same method to generate the first identifier, and use the first identifier for key derivation to ensure normal communication between the network side and the UE.
  • the UE generates the second intermediate key based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA Before K AMF , it also includes:
  • the UE obtains a third intermediate key CK and a fourth intermediate key IK; the UE generates a fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK; the UE generates a fifth intermediate key K AUSF based on the first intermediate key
  • the fifth intermediate key K AUSF generates the first intermediate key K SEAF .
  • the UE acquiring the third intermediate key CK and the fourth intermediate key IK includes:
  • the Universal Subscriber Identity Module (USIM) on the UE generates the third intermediate key CK and the fourth intermediate key IK based on the long-term key of the UE.
  • the USIM sends the third intermediate key CK and the fourth intermediate key IK to the UE.
  • the communication method can be applied to the authentication mode 5G AKA, which improves the flexibility of implementation of the solution.
  • the UE generates a second intermediate key K based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA Before AMF , it also includes:
  • the UE obtains the third intermediate key CK and the fourth intermediate key IK; the UE generates the sixth intermediate key CK' and the seventh intermediate key based on the third intermediate key CK and the fourth intermediate key IK IK'; the UE generates a fifth intermediate key K AUSF based on the sixth intermediate key CK' and the seventh intermediate key IK'; the UE generates the first intermediate key based on the fifth intermediate key K AUSF K SEAF .
  • the communication method can be applied to the authentication method EAP-AKA', which improves the flexibility of implementation of the solution.
  • the UE generates the second intermediate key based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA K AMF includes:
  • the UE generates the second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, the length of the first identifier, the ABBA, and the length of the ABBA.
  • the method before the UE generates the first identifier based on the SUPI, the method further includes:
  • the UE receives the second instruction sent by the AMF, which is used to instruct to generate the first identifier;
  • the UE generates a first identifier according to the second instruction.
  • an embodiment of the present application proposes a communication method, including:
  • UDM generates the first identifier based on the SUPI of the terminal equipment UE
  • the UDM sends the first identifier to AUSF;
  • the AUSF sends the first identifier to SEAF
  • the SEAF sends the first identifier to the AMF
  • the SEAF generates a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA;
  • the SEAF sends the second intermediate key K AMF to the AMF ;
  • the AMF generates a NAS key based on the second intermediate key, where the NAS key is used to protect the NAS message.
  • the UDM generates a first identifier, and the first identifier is used to identify the UE.
  • the UE’s home network (UDM through AUSF) sends the first identifier to the UE’s visited network (AMF or SEAF), so as not to be attributed to the UE’s home network (UDM through AUSF) to the UE’s visited network (AMF or SEAF) Send the SUPI of the UE. Since the SUPI belongs to the privacy information of the UE, the leakage of the privacy information of the UE is avoided, and the security of communication is improved.
  • the UDM generating the first identifier based on the SUPI of the UE includes:
  • the AUSF receives a first authentication request message sent by the AMF, where the first authentication request message carries a first service network identifier, and the first authentication request message is used to request to invoke the authentication service provided by the AUSF;
  • the AUSF sends an authentication vector request message to the UDM, the authentication vector request message carries the first service network identifier, and the authentication vector request message is used to request the invocation of the authentication vector service provided by the UDM, or to request the invocation of the authentication service provided by the UDM ;
  • the UDM generates the first identifier.
  • a possible implementation of the third aspect includes: when the third condition is met, the UDM generates the first identifier based on the SUPI of the UE.
  • the third condition includes:
  • the first serving network identifier includes PLMN ID and NID, or,
  • the first service network identifier includes PLMN ID and NID
  • the second service network identifier includes PLMN ID but not NID, or
  • the UE’s visited network is an SNPN network, or,
  • the UE's visited network is an SNPN network
  • the UE's home network is a PLMN network, or,
  • the UE's visited network and the UE's home network are two different networks, or,
  • the UDM local configuration instructs to generate the first identifier.
  • the UE's visited network and the UE's home network are two different networks, which means that the UE's visited network is SNPN, and the UE's home network is PLMN, or the UE's visited network is PLMN, and the UE's home network is PLMN.
  • the home network is SNPN.
  • the method further includes:
  • the UDM saves the corresponding relationship between the first identifier and the SUPI.
  • the SEAF before the SEAF generates the second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the ABBA, it further includes :
  • the UDM or ARPF generates a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the UDM generates a fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK;
  • the UDM sends the fifth intermediate key K AUSF to the AUSF;
  • the AUSF sends the first intermediate key K SEAF to the SEAF.
  • the SEAF before the SEAF generates the second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the ABBA, it further includes :
  • the UDM generates a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the UDM generates a sixth intermediate key CK' and a seventh intermediate key IK' based on the third intermediate key CK and the fourth intermediate key IK;
  • the UDM sends the sixth intermediate key CK' and the seventh intermediate key IK' to the AUSF;
  • the sixth Ausf based on the intermediate key CK 'and the seventh intermediate key IK' generates a fifth intermediate key K AUSF, based on the fifth intermediate key K AUSF generate the first intermediate key K SEAF;
  • the AUSF sends the first intermediate key K SEAF to the SEAF.
  • the method further includes:
  • the UDM receives the service request carrying the first identifier from the AMF or SMF;
  • the UDM finds the corresponding SUPI according to the first identifier.
  • the UDM finds the subscription data of the UE identified by the SUPI.
  • an embodiment of the present application proposes a communication method, including:
  • UDM is configured with the authentication method supported by the first protocol network
  • the UDM receives the first service network identifier sent by the AUSF;
  • the UDM selects an authentication method to be used based on the first service network identifier and the authentication method supported by the locally configured first protocol network;
  • the UDM sends the selected authentication method to the AUSF.
  • the first protocol network refers to any network that can interoperate with the network where the UDM is located, such as the visited network of the UE, or the service network of the UE, or the network where the AMF serving the UE is located. Or the network where the SEAF serving the UE is located.
  • the authentication method supported by the first protocol network is also referred to as the authentication method supported by the AMF or SEAF serving the UE, or the authentication method supported by the visited network of the UE, or the authentication method supported by the serving network of the UE.
  • the UDM receiving the first service network identifier sent by the AUSF includes:
  • the UDM sends the selected authentication method to the AUSF, including:
  • UDM sends an authentication vector response message to AUSF, and the authentication vector response message carries the selected authentication method.
  • the authentication vector response message is used to respond to the received authentication vector request message.
  • UDM is pre-configured with an authentication method supported by the first protocol network. After UDM receives the first service network identifier from AUSF, UDM can select the authentication method to use based on the first service network identifier and the authentication method supported by the locally configured first protocol network, avoiding the home network (or UDM) ) choose an authentication method that is not supported by the visited network (or AMF, or SEAF), resulting in an authentication failure.
  • an embodiment of the present application proposes a communication method, including:
  • UDM receives the first authentication method sent by AUSF
  • the UDM selects the authentication method to be used according to the received first authentication method
  • the UDM sends the selected authentication method to the AUSF.
  • the UDM receiving the first authentication method sent by the AUSF includes:
  • the AUSF sends an authentication vector request message to the UDM.
  • the authentication vector request message is used to request the invocation of the authentication vector service or the authentication service provided by the UDM.
  • the authentication vector request message carries the first authentication method.
  • the UDM sends the selected authentication method to the AUSF, including:
  • UDM sends an authentication vector response message to AUSF, and the authentication vector response message carries the selected authentication method.
  • the authentication vector response message is used to respond to the received authentication vector request message.
  • the method before the UDM receives the first authentication method sent by the AUSF, the method includes:
  • the AUSF receives the first authentication method sent by the SEAF.
  • the AUSF receives the first authentication request message sent by the SEAF, the first authentication request message is used to request to invoke the authentication service provided by the AUSF, and the first authentication request message carries the first authentication method.
  • the first authentication method refers to the authentication method supported by the SEAF, or the authentication method supported by the service network of the UE, or the authentication method supported by the visited network of the UE.
  • an embodiment of the present application proposes a communication device, including:
  • the transceiver module is used to receive the signed permanent identification SUPI of the terminal equipment sent by the unified data management UDM, where SUPI is used to identify the UE;
  • the transceiver module is also used to send the first identifier to the security anchor function SEAF;
  • the processing module is further configured to generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA;
  • the transceiver module is also used to send the second intermediate key K AMF to the access mobility management function AMF;
  • the processing module is further configured to generate a non-access stratum NAS key based on the second intermediate key K AMF , where the NAS key is used to protect the NAS message.
  • the transceiver module is further configured to send the first identifier to the UDM;
  • the transceiver module is also used to receive the first identifier and save the corresponding relationship between the first identifier and SUPI.
  • the transceiver module is also used to receive the first service network identifier sent by the AMF;
  • the processing module is used to generate the first identifier, which specifically includes:
  • the first service network identity includes the public land mobile network identity PLMN ID and the network identity NID
  • the processing module is used to generate the first identifier.
  • the processing module is also used to generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the processing module is also used to generate a fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK;
  • the transceiver module is also used to send the fifth intermediate key K AUSF to AUSF;
  • the processing module is further based on a fifth intermediate key K AUSF generating a first intermediate key K SEAF;
  • the processing module is also used to send the first intermediate key K SEAF to SEAF.
  • the processing module is also used to generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the processing module is also used to generate a sixth intermediate key CK' and a seventh intermediate key IK' based on the third intermediate key CK and the fourth intermediate key IK;
  • the transceiver module is also used to send the sixth intermediate key CK' and the seventh intermediate key IK' to AUSF;
  • the processing module is further based on the sixth intermediate key CK 'and the seventh intermediate key IK' generates a fifth intermediate key K AUSF, based on the fifth intermediate key K AUSF generating a first intermediate key K SEAF;
  • the transceiver module is also used to send the first intermediate key K SEAF to SEAF.
  • the transceiver module is also used to receive the authentication methods supported by the AMF sent by the AMF;
  • the transceiver module is also used to send the received authentication method supported by AMF to UDM;
  • the processing module is also used to select the authentication method to be used based on the authentication method supported by AMF;
  • the transceiver module is also used to send the selected authentication method to AUSF;
  • the transceiver module is also used to send an authentication response to the AMF based on the selected authentication method.
  • an embodiment of the present application proposes a communication device, including:
  • a processing module configured to generate a first identifier based on the contracted permanent identifier SUPI of the terminal device
  • the processing module is further configured to generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA;
  • the processing module is also used to generate a NAS key based on the second intermediate key K AMF , where the NAS key is used to protect the NAS message.
  • the transceiver module is configured to send a registration request to the access mobility management function AMF, and the registration request carries the first service network identifier;
  • the processing module is used to generate the first identifier based on SUPI, which specifically includes:
  • the processing module determines that the second condition is satisfied, the processing module generates the first identifier based on the SUPI; otherwise, the UE does not generate the first identifier.
  • the second condition includes:
  • the first serving network identifier includes PLMN ID and NID, or,
  • the first service network identifier includes PLMN ID and NID
  • the second service network identifier includes PLMN ID but not NID, or
  • the UE’s visited network is an SNPN network, or,
  • the UE's visited network is an SNPN network
  • the UE's home network is a PLMN network, or,
  • the UE's visited network and the UE's home network are two different networks, or,
  • the UE local configuration instructs to generate the first identifier, or,
  • the UE receives the second indication from the AMF, and the second indication is used to instruct the UE to generate the first identity.
  • the transceiver module is also used to obtain the third intermediate key CK and the fourth intermediate key IK;
  • the processing module is also used to generate a fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK;
  • the processing module is further based on a fifth intermediate key K AUSF generating a first intermediate key K SEAF.
  • the transceiver module is also used to obtain the third intermediate key CK and the fourth intermediate key IK;
  • the processing module is also used to generate a sixth intermediate key CK' and a seventh intermediate key IK' based on the third intermediate key CK and the fourth intermediate key IK;
  • the processing module is further configured to generate a fifth intermediate key K AUSF based on the sixth intermediate key CK' and the seventh intermediate key IK';
  • the processing module is further based on a fifth intermediate key K AUSF generating a first intermediate key K SEAF.
  • the processing module is further configured to generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, the length of the first identifier, ABBA, and the length of ABBA.
  • an embodiment of the present application proposes a communication device, including:
  • the transceiver module is configured to send the first identifier to the authentication server function network element AUSF;
  • the transceiver module is also used to send the first identifier to the security anchor function network element SEAF;
  • the transceiver module is also used to send the first identifier to the mobility management function network element AMF;
  • the processing module is further configured to generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA;
  • the transceiver module is also used to send the second intermediate key to the mobility management function network element AMF;
  • the processing module is further configured to generate a non-access stratum NAS key based on the second intermediate key, where the NAS key is used to protect the NAS message.
  • the transceiver module is also used to receive the first service network identifier sent by the AMF;
  • the transceiver module is also used to send the first service network identifier to UDM;
  • the processing module is used to generate the first identifier, which specifically includes:
  • the processing module is configured to generate the first identifier based on the SUPI of the UE, and the third condition includes:
  • the first serving network identifier includes PLMN ID and NID, or,
  • the first service network identifier includes PLMN ID and NID
  • the second service network identifier includes PLMN ID but not NID, or
  • the UE’s visited network is an SNPN network, or,
  • the UE's visited network is an SNPN network
  • the UE's home network is a PLMN network, or,
  • the UE's visited network and the UE's home network are two different networks, or,
  • the UDM local configuration instructs to generate the first identifier.
  • the processing module is also used to save the corresponding relationship between the first identifier and the SUPI.
  • the processing module is also used to generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the processing module is also used to generate a fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK;
  • the transceiver module is also used to send the fifth intermediate key K AUSF to AUSF;
  • the processing module is further based on a fifth intermediate key K AUSF generating a first intermediate key K SEAF;
  • the transceiver module is also used to send the first intermediate key K SEAF to SEAF.
  • the processing module is also used to generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the processing module is also used to generate a sixth intermediate key CK' and a seventh intermediate key IK' based on the third intermediate key CK and the fourth intermediate key IK;
  • the transceiver module is also used to send the sixth intermediate key CK' and the seventh intermediate key IK' to AUSF;
  • the processing module is further based on the sixth intermediate key CK 'and the seventh intermediate key IK' generates a fifth intermediate key K AUSF, based on the fifth intermediate key K AUSF generating a first intermediate key K SEAF;
  • the transceiver module is also used to send the first intermediate key K SEAF to SEAF.
  • an embodiment of the present application proposes a communication device, including:
  • the transceiver module is used to configure the authentication method supported by the first protocol network
  • the transceiver module is also used to receive the first service network identifier sent by the authentication server function network element AUSF;
  • the transceiver module is also used to send the selected authentication method to AUSF.
  • the transceiver module is also used to send an authentication vector request message carrying the first service network identifier to the UDM, where the authentication vector request message is used to request to invoke the authentication vector service or the authentication service provided by the UDM.
  • the transceiver module is also used to send an authentication vector response message to AUSF, and the authentication vector response message carries the selected authentication method.
  • the authentication vector response message is used to respond to the received authentication vector request message.
  • an embodiment of the present application proposes a communication device, including:
  • the transceiver module is used to receive the first authentication method sent by AUSF;
  • the processing module is used to select the authentication method to be used according to the received first authentication method
  • the transceiver module is also used to send the selected authentication method to the AUSF.
  • the tenth aspect in a possible implementation manner of the tenth aspect, it may include:
  • the transceiver module is also used to send an authentication vector request message to the UDM.
  • the authentication vector request message is used to request the invocation of the authentication vector service or the authentication service provided by the UDM.
  • the authentication vector request message carries the first authentication method.
  • the tenth aspect in a possible implementation manner of the tenth aspect, it may include:
  • the transceiver module is also used to send an authentication vector response message to AUSF, and the authentication vector response message carries the selected authentication method.
  • the authentication vector response message is used to respond to the received authentication vector request message.
  • the tenth aspect in a possible implementation manner of the tenth aspect, it may include:
  • the transceiver module is also used to receive the first authentication method sent by SEAF.
  • an embodiment of the present application provides a network device, including:
  • the transceiver is also used to receive the signed permanent identification SUPI of the terminal equipment sent by the unified data management UDM, where SUPI is used to identify the UE;
  • the processor is further configured to generate a first identifier based on SUPI;
  • the transceiver is also used to send the first identifier to the security anchor function SEAF;
  • the processor is further configured to generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA;
  • the transceiver is also used to send the second intermediate key K AMF to the access mobility management function AMF;
  • the processor is further configured to generate a non-access stratum NAS key based on the second intermediate key K AMF , where the NAS key is used to protect the NAS message.
  • the transceiver is also used to send the first identifier to the UDM;
  • the transceiver is also used to receive the first identifier and save the corresponding relationship between the first identifier and SUPI.
  • the transceiver is also used to receive the first service network identifier sent by the AMF;
  • the processor is used to generate the first identifier, which specifically includes:
  • the first service network identity includes the public land mobile network identity PLMN ID and the network identity NID
  • the processor is configured to generate the first identifier.
  • the processor is further configured to generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the processor is further configured to generate a fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK;
  • the transceiver is also used to send the fifth intermediate key K AUSF to AUSF;
  • the processor is also based on a fifth intermediate key K AUSF generating a first intermediate key K SEAF;
  • the processor is also used to send the first intermediate key K SEAF to SEAF.
  • the processor is further configured to generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the processor is further configured to generate a sixth intermediate key CK' and a seventh intermediate key IK' based on the third intermediate key CK and the fourth intermediate key IK;
  • the transceiver is also used to send the sixth intermediate key CK' and the seventh intermediate key IK' to AUSF;
  • the processor is also based on the sixth intermediate key CK 'and the seventh intermediate key IK' generates a fifth intermediate key K AUSF, based on the fifth intermediate key K AUSF generating a first intermediate key K SEAF;
  • the transceiver is also used to send the first intermediate key K SEAF to SEAF.
  • the transceiver is also used to receive the authentication methods supported by AMF sent by AMF;
  • the transceiver is also used to send the received authentication method supported by AMF to UDM;
  • the processor is also used to select the authentication method to be used based on the authentication method supported by AMF;
  • the transceiver is also used to send the selected authentication method to AUSF;
  • the transceiver is also used to send an authentication response to the AMF based on the selected authentication method.
  • an embodiment of the present application provides a terminal device, including:
  • the processor is further configured to generate a first identifier based on the contract permanent identifier SUPI of the terminal device;
  • the processor is further configured to generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA;
  • the processor is further configured to generate a NAS key based on the second intermediate key K AMF , where the NAS key is used to protect the NAS message.
  • the terminal device further includes a transceiver
  • the transceiver is also used to send a registration request to the access mobility management function AMF, and the registration request carries the first service network identifier;
  • the processor is configured to generate the first identifier based on SUPI, which specifically includes:
  • the processor determines that the second condition is satisfied, the processor generates the first identifier based on the SUPI; otherwise, the processor does not generate the first identifier, and the second condition includes:
  • the first serving network identifier includes PLMN ID and NID, or,
  • the first service network identifier includes PLMN ID and NID
  • the second service network identifier includes PLMN ID but not NID, or
  • the UE's visited network is an SNPN network, or,
  • the UE's visited network is an SNPN network
  • the UE's home network is a PLMN network, or,
  • the UE's visited network and the UE's home network are two different networks, or,
  • the UE local configuration instructs to generate the first identifier, or,
  • the UE receives the second indication from the AMF, and the second indication is used to instruct the UE to generate the first identity.
  • the transceiver is also used to obtain the third intermediate key CK and the fourth intermediate key IK;
  • the processor is further configured to generate a fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK;
  • the processor is also based on a fifth intermediate key K AUSF generating a first intermediate key K SEAF.
  • the transceiver is also used to obtain the third intermediate key CK and the fourth intermediate key IK;
  • the processor is further configured to generate a sixth intermediate key CK' and a seventh intermediate key IK' based on the third intermediate key CK and the fourth intermediate key IK;
  • the processor is further configured to generate a fifth intermediate key K AUSF based on the sixth intermediate key CK' and the seventh intermediate key IK';
  • the processor is also based on a fifth intermediate key K AUSF generating a first intermediate key K SEAF.
  • the processor is further configured to generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, the length of the first identifier, ABBA, and the length of ABBA.
  • an embodiment of the present application provides a network device, including:
  • a processor configured to generate a first identifier based on SUPI
  • a transceiver configured to send the first identifier to the authentication server function network element AUSF;
  • the transceiver is also used to send the first identifier to the security anchor function network element SEAF;
  • the processor is further configured to generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA;
  • the transceiver is also used to send the second intermediate key to the mobility management function network element AMF;
  • the processor is further configured to generate a non-access stratum NAS key based on the second intermediate key, where the NAS key is used to protect the NAS message.
  • the transceiver is also used to receive the first service network identifier sent by the AMF;
  • the transceiver is also used to send the first service network identifier to UDM;
  • the processor is used to generate the first identifier, which specifically includes:
  • the processor is configured to generate the first identifier based on the SUPI of the UE, and the third condition includes:
  • the first serving network identifier includes PLMN ID and NID, or,
  • the first service network identifier includes PLMN ID and NID
  • the second service network identifier includes PLMN ID but not NID, or
  • the UE's visited network is an SNPN network, or,
  • the UE's visited network is an SNPN network
  • the UE's home network is a PLMN network, or,
  • the UE's visited network and the UE's home network are two different networks, or,
  • the UDM local configuration instructs to generate the first identifier.
  • the processor is also used to store the corresponding relationship between the first identifier and the SUPI.
  • the processor is further configured to generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the processor is further configured to generate a fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK;
  • the transceiver is also used to send the fifth intermediate key K AUSF to AUSF;
  • the processor is also based on a fifth intermediate key K AUSF generating a first intermediate key K SEAF;
  • the transceiver is also used to send the first intermediate key K SEAF to SEAF.
  • the processor is further configured to generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the processor is further configured to generate a sixth intermediate key CK' and a seventh intermediate key IK' based on the third intermediate key CK and the fourth intermediate key IK;
  • the transceiver is also used to send the sixth intermediate key CK' and the seventh intermediate key IK' to AUSF;
  • the processor is also based on the sixth intermediate key CK 'and the seventh intermediate key IK' generates a fifth intermediate key K AUSF, based on the fifth intermediate key K AUSF generating a first intermediate key K SEAF;
  • the transceiver is also used to send the first intermediate key K SEAF to SEAF.
  • an embodiment of the present application provides a network device, including:
  • the transceiver is used to configure the authentication method supported by the first protocol network
  • the transceiver is also used to receive the first service network identifier sent by the authentication server function network element AUSF;
  • a processor configured to select an authentication method to be used based on the first service network identifier and the authentication method supported by the locally configured first protocol network;
  • the transceiver is also used to send the selected authentication method to AUSF.
  • the transceiver is also used to send an authentication vector request message carrying the first service network identifier to the UDM, where the authentication vector request message is used to request to invoke the authentication vector service or the authentication service provided by the UDM.
  • the transceiver is also used to send an authentication vector response message to AUSF, and the authentication vector response message carries the selected authentication method.
  • the authentication vector response message is used to respond to the received authentication vector request message.
  • an embodiment of the present application provides a network device, including:
  • the transceiver module is used to receive the first authentication method sent by AUSF;
  • the processing module is used to select the authentication method to be used according to the received first authentication method
  • the transceiver module is also used to send the selected authentication method to the AUSF.
  • a possible implementation of the fifteenth aspect may include:
  • the transceiver is also used to send an authentication vector request message to the UDM, where the authentication vector request message is used to request the invocation of the authentication vector service or the authentication service provided by the UDM, and the authentication vector request message carries the first authentication method.
  • a possible implementation of the fifteenth aspect may include:
  • the transceiver is also used to send an authentication vector response message to AUSF, and the authentication vector response message carries the selected authentication method.
  • the authentication vector response message is used to respond to the received authentication vector request message.
  • a possible implementation of the fifteenth aspect may include:
  • the transceiver is also used to receive the first authentication mode sent by SEAF.
  • the embodiments of the present application provide a communication device that can implement the AUSF, UDM, AMF (or SEAF) in the methods involved in the first, second, third, fourth, and fifth aspects above Or the function performed by the terminal device.
  • the communication device includes a processor, a memory, and a transceiver connected to the processor; the memory is used to store program code and transmit the program code to the processor; the processor is used to drive the processor based on instructions in the program code
  • the transceiver executes the methods of the first, second, third, fourth or fifth aspects mentioned above; the receiver and the transmitter are respectively connected to the processor to execute the AUSF, UDM, AMF (or SEAF) of the methods of the above aspects Or the operation of terminal equipment.
  • the transceiver may be a radio frequency circuit that receives and sends messages through an antenna; the transceiver may also be a communication interface, and the processor is connected to the communication interface through a bus, and the processor realizes receiving or sending through the communication interface. Send a message.
  • an embodiment of the present application provides a communication device.
  • the communication device may include entities such as a network device, a terminal device, or a chip.
  • the communication device includes: a processor and a memory; the memory is used to store instructions; By executing the instruction in the memory, the communication device executes the possible implementation method of any one of the foregoing first aspect, second aspect, third aspect, fourth aspect, or fifth aspect.
  • the embodiments of the present application provide a computer-readable storage medium storing one or more computer-executable instructions.
  • the processor executes the first aspect or the first aspect described above. Any one of the possible implementation manners of the second aspect or the third aspect or the fourth aspect.
  • the embodiments of the present application provide a computer program product (or computer program) that stores one or more computer-executable instructions.
  • the processor executes the aforementioned first Aspect, or the second aspect, the third aspect, the fourth aspect, or the fifth aspect.
  • the present application provides a chip system including a processor, which is used to support a computer device to implement the functions involved in the above aspects.
  • the chip system further includes a memory for storing necessary program instructions and data for the computer equipment.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • the present application provides a communication system, which includes the network equipment as in the tenth aspect, the twelfth aspect, the thirteenth aspect, or the fourteenth aspect, and/or the foregoing The terminal equipment of the eleventh aspect.
  • Figure 1a is a schematic diagram of a 5G communication system provided by an embodiment of this application.
  • Figure 1b is a schematic diagram of the key architecture of the fifth-generation mobile communication system
  • Fig. 1c is a schematic diagram of a 5G authentication process in an embodiment of the application.
  • FIG. 2 is a schematic diagram of the hardware structure of the communication device in an embodiment of the application.
  • FIG. 3 is a schematic diagram of an embodiment of a communication method provided by an embodiment of this application.
  • FIG. 4 is a schematic diagram of an embodiment of yet another communication method in an embodiment of this application.
  • FIG. 5 is a schematic diagram of an embodiment of yet another communication method in an embodiment of this application.
  • FIG. 6 is a schematic diagram of an embodiment of yet another communication method in an embodiment of this application.
  • FIG. 7 is a schematic diagram of an embodiment of a communication device in an embodiment of the application.
  • FIG. 8 is a schematic diagram of another embodiment of a communication device in an embodiment of this application.
  • FIG. 9 is a schematic diagram of an embodiment of a communication device in an embodiment of the application.
  • FIG. 10 is a schematic diagram of an embodiment of a communication device in an embodiment of this application.
  • FIG. 11 is a schematic diagram of an embodiment of a communication device in an embodiment of this application.
  • At least one item (a) refers to any combination of these items, including any combination of a single item (a) or a plurality of items (a).
  • at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple .
  • network functions for example: access and mobility management functions, security anchor functions, unified data management functions, or authentication server functions, etc.
  • terminal equipment UE generates B based on A, which can indicate that the network function receives A Then generate B, or the network function uses A as a parameter to generate B.
  • the network function generates B after receiving A, which can be generated at any time after the network function receives A.
  • the network function uses A as a parameter to generate B, it means that the parameters used when the network function generates B include A, and may also include other parameters besides A.
  • the network function generates B according to A, which means that the parameters used by the network function to generate B include A, and may also include other parameters besides A.
  • FIG. 1a shows a schematic diagram of a 5G communication system provided by an embodiment of the present application.
  • the control plane function of the mobile gateway is decoupled from the forwarding plane function.
  • the separated control plane function is the third generation partnership project (3GPP) traditional control network element mobility management Entity (mobility management entity, MME), etc. are merged into a unified control plane (control plane) function.
  • the user plane function (UPF) can implement the user plane functions (SGW-U and PGW-U) of a serving gateway (serving gateway, SGW) and a packet data network gateway (packet data network gateway, PGW).
  • the unified control plane function can be decomposed into access and mobility management function (AMF) and session management function (SMF).
  • AMF access and mobility management function
  • SMF access and mobility management function
  • SMF session management function
  • the communication system includes at least terminal equipment, also known as user equipment (UE), access and mobility management function AMF, authentication server function (authentication server function, AUSF), unified data management (unified data management) data management (UDM) function, radio access network (RAN) network element, and session management function (Session Management Function, SMF).
  • UE user equipment
  • AMF authentication server function
  • AUSF authentication server function
  • UDM unified data management
  • RAN radio access network
  • Session Management Function Session Management Function
  • the interaction between the UE and the AMF is through the RAN, that is, in the embodiment of this application, the message sent by the UE to the AMF refers to the message sent by the UE to the RAN, and the RAN sends the message to the AMF; AMF The message sent to the UE refers to the message sent by the AMF to the RAN, and the RAN sends the message to the UE.
  • UE communicates with AMF through N1 interface; AMF communicates with AUSF through N12 interface; AMF communicates with UDM through N8 interface; AUSF communicates with UDM through N13 interface; AMF communicates with SMF through N11 interface.
  • the terminal equipment involved in this system is not limited to 5G networks, including: mobile phones, Internet of Things equipment, smart home equipment, industrial control equipment, vehicle equipment, and so on.
  • the terminal equipment is a variety of terminal equipment or devices with line communication functions, such as mobile phones (or "cellular" phones) and computers with mobile terminals, and can also be portable, pocket-sized, or handheld.
  • PCS personal communication service
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDAs personal digital assistants
  • Communication equipment can also be called system, subscriber unit, subscriber station, mobile station, mobile station, remote station, access point, Remote terminal (remote terminal), access terminal (access terminal), user terminal (user terminal), user agent (user agent), user equipment (user device), or user equipment (user equipment, UE).
  • Remote terminal remote terminal
  • access terminal access terminal
  • user terminal user terminal
  • user agent user agent
  • user equipment user device
  • user equipment user equipment, UE
  • vehicles, vehicle-mounted equipment, vehicle-mounted modules or units drive test basic equipment, handheld devices, wearable devices, computing devices or other processing equipment connected to wireless modems, such as vehicle user equipment (VUE) or air-conditioning user equipment etc.
  • RAN The main function of RAN is to control users to access the mobile communication network through wireless.
  • RAN is a part of mobile communication system. It implements a wireless access technology. Conceptually, it resides between a certain device (such as a mobile phone, a computer, or any remote control machine) and provides a connection to its core network.
  • RAN equipment includes but is not limited to: 5G (gnodeB, gNB), evolved node B (evolved node B, eNB), radio network controller (RNC), node B (node B, NB), base station Controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or home node B, HNB), base band unit (Base Band Unit, BBU), transmission point (transmitting and receiving point, TRP), transmitting point (TP), mobile switching center, etc., in addition, can also include wireless fidelity (wireless fidelity, wifi) access point (AP), etc.
  • the AMF network elements involved in this system can be responsible for terminal device registration, mobility management, tracking area update procedures, etc.
  • AMF network elements may also be referred to as AMF devices or AMF entities.
  • the AUSF network elements involved in this system can provide authentication control for user equipment.
  • the UDM network elements involved in this system can store user subscription data.
  • the user's subscription data includes subscription data related to mobility management and subscription data related to session management.
  • the UDM network element may also be referred to as UDM equipment or UDM entity.
  • SMF is also involved in this system, which is responsible for session management of terminal equipment.
  • session management includes selection of user plane devices, reselection of user plane devices, IP address allocation, quality of service (QoS) control, and session establishment, modification, or release.
  • QoS quality of service
  • the above 5G communication system further includes a radio access network (radio access network, RAN) equipment.
  • RAN equipment is a device used to provide wireless communication functions for terminal equipment.
  • the RAN equipment may include various forms of base stations, such as: macro base stations, micro base stations (also referred to as small stations), relay stations, access points, and so on.
  • base stations such as: macro base stations, micro base stations (also referred to as small stations), relay stations, access points, and so on.
  • the names of devices with base station functions may be different.
  • LTE systems they are called evolved NodeB (evolved NodeB, eNB, or eNodeB).
  • NodeB NodeB
  • gNodeB In the new generation system, it is called gNB (gNodeB).
  • the above 5G communication system also includes UPF network elements, which can implement functions such as forwarding, statistics, and detection of user messages.
  • UPF network elements may also be referred to as UPF devices or UPF entities.
  • the aforementioned 5G communication system further includes a policy control function (PCF) network element.
  • the network element includes policy control and flow-based charging control functions.
  • PCF network elements can implement user subscription data management functions, policy control functions, charging policy control functions, QoS control, etc.
  • PCF network elements may also be referred to as PCF entities or PCF devices.
  • the network element shown in FIG. 1a may also include a security anchor function (SEAF) network element, where the SEAF network element and the AMF network element are co-located.
  • SEAF security anchor function
  • SMF network element responsible for terminal sessions; for example, session management such as establishing user plane transmission paths, releasing and changing Function, selection of UPF network element allocation, internet protocol (IP) address, session quality of service (QoS) management, acquisition of policy control and charging (PCC) policies from PCF network elements Wait.
  • NEF network element responsible for connecting SMF network elements with external DN networks, which can include third-party authentication network elements.
  • UPF network element As the anchor point of the session connection of the PDU network element, it is responsible for the data message filtering, data transmission/forwarding, rate control, and charging information generation of the terminal.
  • PCF network element Assign reference information to network network elements, for example, assign reference information to SMF network elements or NEF network elements.
  • Network slice selection function network slice selection function, NSSF: used to select a suitable network slice for the UE.
  • CAN policy and charging control.
  • Nx interface for example, N1, N8, etc. in the figure.
  • UPF network elements and SMF network elements are unique network elements for each network slice, while AMF network elements, PCF network elements, AUSF network elements, and UDM network elements are shared by multiple network slices Network element. Therefore, in the existing architecture, the security and privacy information (for example: user identification, subscription data, policy, communication data security, etc.) of the terminal equipment in the AUSF network element and UDM network element is still controlled and managed by the operator's public network.
  • the aforementioned network elements can be either network elements implemented on dedicated hardware, software instances running on dedicated hardware, or instances of virtualized functions on a suitable platform.
  • the aforementioned virtualization platform can be a cloud platform. .
  • embodiments of the present application may also be applicable to other future-oriented communication technologies, such as 6G.
  • the network architecture and business scenarios described in this application are intended to explain the technical solutions of this application more clearly, and do not constitute a limitation on the technical solutions provided by this application. Those of ordinary skill in the art will know that with the evolution of the network architecture and new business scenarios The technical solutions provided in this application are equally applicable to similar technical problems.
  • 3GPP has proposed a Standalone Non-Public Network (SNPN) architecture that can support Service Providers (SP).
  • SP assumes the role of the home network (home network), and the SNPN assumes the role of the visited network (Visited Network), where the SP owns the subscription data (Subscription) and credentials (Credential) of the terminal device.
  • the smart phone selects the service network of the smart phone and obtains the first service network identifier. When the smart phone accesses the Visited Network through the base station, the smart phone sends a registration request to the AMF in the visited network.
  • the smart phone On the UE side, the smart phone is based on the registration request message sent to the AMF.
  • the AMF initiates the authentication process.
  • the AMF sends a first authentication request message to the AUSF.
  • the first authentication request message is used to request the invocation of the authentication service provided by the AUSF.
  • the first authentication request message carries the first service network identifier.
  • the AUSF belongs to the home network of the UE.
  • the first authentication request message also carries the authentication mode supported by AMF.
  • the AUSF sends an authentication vector request message to the UDM, and the authentication vector request message carries the first service network identifier and the received authentication method supported by the AMF.
  • UDM selects the authentication method to be used according to the authentication method supported by the received AMF.
  • UDM generates an authentication vector based on the selected authentication method.
  • UDM sends an authentication vector response message to AUSF, and the authentication vector response message carries the authentication method selected to be used and the authentication vector generated by UDM.
  • the authentication vector response message also includes the SUPI of the UE.
  • the authentication vector may include an authentication token (authentication token, AUTN), a random number (RAND), and an expected response (eXpected response, XRES or XRES*).
  • the authentication vector may also include the fifth intermediate key K AUSF , or the sixth intermediate key CK' and the seventh intermediate key IK'.
  • the AUSF After the AUSF receives the authentication vector response message, it sends the first authentication response message to the AMF, and the authentication response carries AUTN and RAND. After the AUSF receives the sixth intermediate key CK' and the seventh intermediate key IK', the AUSF calculates the fifth intermediate key K AUSF .
  • the AMF After receiving the first authentication response message carrying the authentication tokens AUTN and RAND, the AMF sends a second authentication request message to the smart phone, and the second authentication request message carries AUTN and RAND.
  • the smart phone calculates a response (Response, RES or RES*) according to the received second authentication request message.
  • the smart phone sends a second authentication response message to the AMF, and the second authentication response message carries the calculated response (RES or RES*).
  • the UE also determines whether to generate the first identifier. If the second condition is met, the UE generates a first identifier.
  • the second condition includes:
  • the first serving network identifier includes PLMN ID and NID, or,
  • the first service network identifier includes PLMN ID and NID
  • the second service network identifier includes PLMN ID but not NID, or
  • the UE’s visited network is an SNPN network, or,
  • the UE's visited network is an SNPN network
  • the UE's home network is a PLMN network, or,
  • the UE's visited network and the UE's home network are two different networks, or,
  • the UE local configuration instructs to generate the first identifier, or,
  • the UE receives the second indication from the AMF, and the second indication is used to instruct the UE to generate the first identity.
  • the UE also generates a key. Specifically, the UE (or the universal subscriber identity module (USIM)) generates the third intermediate key CK and the fourth intermediate key IK based on the received RAND and the long-term key K. The UE generates the fifth intermediate key K AUSF .
  • the UE or the universal subscriber identity module (USIM)
  • the UE generates the third intermediate key CK and the fourth intermediate key IK based on the received RAND and the long-term key K.
  • the UE generates the fifth intermediate key K AUSF .
  • the UE generating the fifth intermediate key K AUSF may include: the UE generates the fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK , or the UE generates the fifth intermediate key K AUSF based on the third intermediate key CK,
  • the intermediate key IK generates a sixth intermediate key CK' and a seventh intermediate key IK', and then the UE generates a fifth intermediate key K AUSF based on the sixth intermediate key CK' and the seventh intermediate key IK'.
  • the UE generates a fifth intermediate key K AUSF a first intermediate key K SEAF.
  • the UE generates a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the ABBA parameters.
  • the smart phone generates a Non-Access Stratum (NAS) key based on the second intermediate key K AMF , and the NAS key is used to protect NAS layer information.
  • NAS Non-Access Stratum
  • the AMF sends a third authentication request message to the AUSF to the AUSF, and the third authentication request message carries the received RES or RES*.
  • AUSF verifies the received RES or RES*, specifically, verifies whether the received RES or RES* is the same as the expected response (XRES or XRES*) obtained from UDM. After the verification is successful, the AUSF determines whether to generate the first identifier. Specifically, if the first condition is met, the AUSF generates the first identifier.
  • the first condition includes:
  • the first serving network identifier received by AUSF includes PLMN ID and NID, or,
  • the first service network identifier received by AUSF includes PLMN ID and NID
  • the second service network identifier includes PLMN ID but not NID, or
  • the UE’s visited network is an SNPN network, or,
  • the UE's visited network is an SNPN network
  • the UE's home network is a PLMN network, or,
  • the UE's visited network and the UE's home network are two different networks, or,
  • the AUSF local configuration instructs to generate the first identifier.
  • the AUSF generates the first identification based on the SUPI of the smartphone. After the AUSF generates the first identifier, it sends the first identifier to the SEAF. SEAF generates a second intermediate key K AMF based on the first intermediate key K SEAF , ABBA parameters and the first identifier; SEAF sends the second intermediate key K AMF to AMF ; AMF generates non-access based on the second intermediate key K AMF Layer NAS key, where the NAS key is used to protect NAS messages. After the AUSF generates the first identifier, it sends the first identifier to the UDM. The UDM receives the first identifier and saves the corresponding relationship between the first identifier and SUPI.
  • AUSF generates a first identifier, which is used to identify the UE.
  • AUSF sends the first identifier to SEAF to avoid sending SUPI to SEAF, thereby avoiding leakage of UE’s privacy information and improving communication safety.
  • Fig. 1b is a schematic diagram of the key architecture of the fifth-generation mobile communication system.
  • the UE (or USIM) and UDM (or ARPF or Unified Data Repoitory (UDR)) store the long-term key K of the UE.
  • UDM or ARPF On the network device side, UDM or ARPF generates a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE.
  • the authentication method selected by UDM is different, and the method of generating the fifth intermediate key K AUSF is different.
  • UDM or ARPF When the authentication method selected by UDM is 5G AKA, UDM or ARPF generates the fifth intermediate key K AUSF according to the third intermediate key CK and the fourth intermediate key IK.
  • UDM sends the generated fifth intermediate key K AUSF to AUSF.
  • the authentication method selected by UDM is EAP-AKA'
  • UDM or ARPF generates a sixth intermediate key CK' and a seventh intermediate key IK' according to the third intermediate key CK and the fourth intermediate key IK.
  • UDM sends the generated sixth intermediate key CK' and seventh intermediate key IK' to AUSF.
  • AUSF generates a fifth intermediate key K AUSF according to the sixth intermediate key
  • the fifth intermediate Ausf key K AUSF generating a first intermediate key K SEAF, and a first intermediate key K SEAF sent to SEAF.
  • SEAF generates a second intermediate key K AMF according to the first intermediate key K SEAF and sends the second intermediate key K AMF to AMF.
  • the AMF generates the NAS key according to the second intermediate key K AMF.
  • the USIM On the terminal device side, first, the USIM generates a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE. The USIM sends the third intermediate key CK and the fourth intermediate key IK to the UE.
  • the UE Similar to the network side, there are differences in the ways of generating the fifth intermediate key K AUSF under different authentication methods.
  • the authentication method used is 5G AKA
  • the UE When the authentication method used is 5G AKA, the UE generates the fifth intermediate key K AUSF according to the third intermediate key CK and the fourth intermediate key IK.
  • the authentication method used is EAP-AKA'
  • the UE When the authentication method used is EAP-AKA', the UE generates a sixth intermediate key CK' and a seventh intermediate key IK' according to the third intermediate key CK and the fourth intermediate key IK.
  • the UE generates the fifth intermediate key K AUSF according to the sixth intermediate key CK' and the seventh intermediate
  • the UE generates a fifth intermediate key K AUSF a first intermediate key K SEAF.
  • the UE generates a second intermediate key K AMF according to the first intermediate key K SEAF .
  • the UE generates a NAS key according to the second intermediate key K AMF.
  • FIG. 1c is a schematic diagram of the 5G authentication process in the embodiment of this application.
  • the key generation involved in the authentication process is described in Figure 1b.
  • SEAF sends a first authentication request message to AUSF.
  • step S1 the SEAF decides to initiate a master authentication, which is used for mutual authentication between the network side and the UE and generates a key.
  • the SEAF sends a first authentication request message to the AUSF, and the first authentication request message is used to request to invoke the authentication service provided by the AUSF.
  • the first authentication request message carries the identity of the UE and the identity of the first serving network.
  • the UE identifier carried in the first authentication request may be a subscription concealed identifier (SUCI) or SUPI.
  • SUCI subscription concealed identifier
  • SUPI subscription concealed identifier
  • AUSF sends an authentication vector request message to UDM.
  • step S2 the AUSF sends an authentication vector request message to the UDM according to the received first authentication request message, where the authentication vector request message is used to request the invocation of the authentication vector service provided by the UDM, or to request the authentication vector.
  • the first authentication request message carries the received first serving network identifier and the UE identifier.
  • step S3 if the UDM receives the SUCI, the UDM obtains the SUPI of the UE according to the SUCI. UDM selects the authentication method used, and generates an authentication vector based on the selected authentication method.
  • the authentication vector generated by UDM is called the first authentication vector; if the authentication method selected by UDM is EAP-AKA', the authentication vector generated by UDM is called the second authentication vector.
  • the second authentication vector includes: a random number (RAND), an authentication token (Authentication Token, AUTN), a second expected response (XRES), a sixth intermediate key (CK') and a seventh intermediate key ( IK').
  • the first authentication vector includes: a random number (RAND), an authentication token (Authentication Token, AUTN), a first expected response (XRES*), and a fifth intermediate key ( KAUSF ).
  • AUTN includes an authentication management field (Authentication Management Field), an exclusive OR of a sequence number (Sequence number, SQN) and an anonymous key AK, and a message authentication code MAC.
  • AK is UDM or ARPF generated according to the UE's long-term key K and RAND.
  • MAC is UDM or ARPF based on the UE's long-term key K, authentication management fields, RAND, and SQN.
  • XRES is UDM or ARPF generated based on the UE's long-term key K and RAND.
  • XRES* is UDM or ARPF generated based on the third intermediate key CK and the fourth intermediate key IK, the first service network identifier, RAND, and XRES.
  • a part of the authentication vector is any one or more of the following: RAND, AUTN, CK, IK, CK', IK', XRES, AK, authentication management fields, K, SQN, and MAC.
  • a part of the authentication vector may also be the result of any one or more of RAND, AUTN, CK, IK, CK', IK', XRES, AK, authentication management fields, K, SQN, and MAC.
  • Operations include, but are not limited to, exclusive-or operations, concatenation operations, hash operations, etc.
  • a part of the authentication vector can also be any one or more of the following: RAND, AUTN, K AUSF , XRES*, XRES, CK, IK, AK, AMF, K, SQN, and MAC.
  • a part of the authentication vector may also be the result of any one or more of RAND, AUTN, K AUSF , XRES*, XRES, CK, IK, AK, AMF, K, SQN, and MAC.
  • Operations include, but are not limited to, exclusive OR operations, concatenation operations, and hash operations.
  • the UDM sends the generated authentication vector, the selected authentication method, and the SUPI authentication vector response message to the AUSF.
  • step S4 the authentication vector response message is UDM's response to the received authentication vector request message.
  • AUSF After receiving the authentication vector response message, AUSF sends a first authentication response message carrying RAND and AUTN to SEAF.
  • step S5 the first authentication response message is the AUSF's response to the first authentication request message.
  • the AUSF before the AUSF sends the first authentication response to the SEAF, the AUSF also generates the first intermediate key K SEAF .
  • the SEAF sends a second authentication request message to the UE.
  • step S6 the SEAF sends a second authentication request message to the UE, and the second authentication request message is used to request the UE to perform primary authentication.
  • the second authentication request message carries RAND and AUTN.
  • the UE verifies the second authentication request message.
  • step S7 after receiving the second authentication message, the UE checks the second authentication request message to check whether the AUTN is acceptable.
  • the UE determines the authentication method used by the network side according to the second authentication request message:
  • the UE If the authentication method used by the network side is 5G AKA, the UE generates RES*.
  • the UE generates the RES* in the same way as the UDM generates the XRES*, that is, the UE generates the RES* according to the third intermediate key CK and the fourth intermediate key IK, the first service network identifier, RAND, and RES.
  • RES is generated by the UE according to the UE's long-term key K and RAND.
  • the UE If the authentication method used by the network side is EAP-AKA', the UE generates an RES.
  • the UE uses the same method as the UDM to generate the XRES to generate the RES, that is, the UE generates the RES according to the UE long-term key K and RAND.
  • the third intermediate key CK and the fourth intermediate key IK are generated.
  • the UE sends a second authentication response message to the SEAF.
  • the second authentication response message includes RES or RES*.
  • the SEAF sends a third authentication request message to AUSF.
  • the third authentication request message includes the received RES or RES*.
  • step S10 when the received RES is the same as XRES, or the received RES* is the same as XRES*, AUSF verifies that RES or RES* succeeds. If the AUSF verification is successful, proceed to step S11; if the AUSF verification fails, then an error is returned to the SEAF.
  • AUSF sends a third authentication response message to SEAF.
  • step S11 the third authentication response message carries the first intermediate key K SEAF .
  • AUSF If the authentication method selected is EAP-AKA', then AUSF generates the first intermediate key K SEAF before sending the third authentication response message.
  • step S12 after verifying RES or RES*, AUSF sends an authentication result confirmation service request message to UDM.
  • the authentication result confirmation service request message is used to notify UDM of the authentication result.
  • SEAF generates a second intermediate key K AMF .
  • step S13 after receiving the third authentication response message, the SEAF generates the second intermediate key K AMF and sends the second intermediate key K AMF to the AMF.
  • the SUPI of the UE is used to identify the UE.
  • SUPI is defined as: SUPI type and SUPI value.
  • the SUPI type may be an International Mobile Subscriber Identity (IMSI) or a network specific identifier (Network specific identifier).
  • IMSI International Mobile Subscriber Identity
  • Network specific identifier the value of SUPI is IMSI.
  • the SUPI type is a network specific identifier
  • the SUPI value adopts the network access identifier (NAI) format, which is username@realm. Where username is the username and realm is the realm corresponding to the username.
  • IMSI is also used to identify the UE.
  • IMSI includes Mobile Country Code (MCC), Mobile Network Code (Mobile Network Code) and Mobile Subscriber Identification Number (MSIN).
  • MCC Mobile Country Code
  • MSIN Mobile Subscriber Identification Number
  • a part of SUPI refers to one or more of the following information: IMSI, MCC, MNC, MSIN, username, or realm.
  • the PLMN ID is used to identify a PLMN network.
  • PLMN ID includes MCC and MNC.
  • an SNPN network uses PLMN ID and NID identification.
  • NID includes assignment mode and NID value.
  • the allocation mode may be self-assignment (self-assignment), that is, each SNPN assigns itself during deployment, or coordinated assignment.
  • Fig. 2 is a schematic diagram of the hardware structure of a communication device in an embodiment of the application.
  • the communication device may be a possible implementation manner of AUSF, UDM, AMF (or SEAF) or terminal equipment in the embodiment of the present application.
  • the communication device includes at least a processor 204, a memory 203, and a transceiver 202.
  • the memory 203 is further used to store instructions 2032 and data 2032.
  • the communication device may further include an antenna 206, an I/O (Input/Output) interface 210, and a bus 212.
  • the transceiver 202 further includes a transmitter 2022 and a receiver 2022.
  • the processor 204, the transceiver 202, the memory 203, and the I/O interface 210 are communicatively connected to each other through the bus 212, and the antenna 206 is connected to the transceiver 202.
  • the processor 204 may be a general-purpose processor, such as but not limited to a central processing unit (CPU), or a dedicated processor, such as, but not limited to, a digital signal processor (DSP). Application Specific Integrated Circuit (ASIC) and Field Programmable Gate Array (FPGA), etc.
  • the processor 204 may also be a combination of multiple processors.
  • the processor 204 may be used to execute the relevant steps of the communication method in the subsequent method embodiment.
  • the processor 204 may be a processor specifically designed to perform the foregoing steps and/or operations, or may be a processor that performs the foregoing steps and/or operations by reading and executing instructions 2032 stored in the memory 203.
  • the processor 204 The data 2032 may be used in the process of performing the above steps and/or operations.
  • the transceiver 202 includes a transmitter 2022 and a receiver 2022.
  • the transmitter 2022 is used to transmit signals through an antenna 206.
  • the receiver 2022 is used to receive signals through at least one antenna among the antennas 206.
  • the transmitter 2022 may be specifically used to perform at least one antenna among the antennas 206.
  • the communication method in the subsequent method embodiments is applied to AUSF, UDM, AMF ( Or SEAF) or terminal equipment, AUSF, UDM, AMF (or SEAF) or the operation performed by the receiving module or sending module in the terminal equipment.
  • the transceiver 202 is used to support the communication device to perform the aforementioned receiving function and sending function.
  • the processor having processing functions is regarded as the processor 204.
  • the receiver 2022 may also be called a receiver, an input port, a receiving circuit, etc.
  • the transmitter 2022 may be called a transmitter, a transmitter, or a transmitting circuit, etc.
  • the processor 204 may be configured to execute instructions stored in the memory 203 to control the transceiver 202 to receive messages and/or send messages, so as to complete the functions of the communication device in the method embodiment of the present application.
  • the function of the transceiver 202 may be implemented by a transceiver circuit or a dedicated chip for transceiver.
  • the memory 203 may be various types of storage media, such as random access memory (Random Access Memory, RAM), read only memory (Read Only Memory, ROM), non-volatile RAM (Non-Volatile RAM, NVRAM), Programmable ROM (Programmable ROM, PROM), erasable PROM (Erasable PROM, EPROM), electrically erasable PROM (Electrically Erasable PROM, EEPROM), flash memory, optical memory and registers, etc.
  • the memory 203 is specifically used to store instructions 2032 and data 2032.
  • the processor 204 can read and execute the instructions 2032 stored in the memory 203 to execute the steps and/or operations described in the method embodiments of the present application. Data 2032 may be used in the process of operations and/or steps in the method embodiments.
  • the communication device may further include an I/O interface 210, and the I/O interface 210 is used to receive instructions and/or data from a peripheral device, and output instructions and/or data to the peripheral device.
  • I/O interface 210 is used to receive instructions and/or data from a peripheral device, and output instructions and/or data to the peripheral device.
  • FIG. 3 is a schematic diagram of an embodiment of a communication method provided by an embodiment of the present application.
  • the key generation process shown in FIG. 1b and the key transfer process shown in FIG. 1c are applicable to FIG. 3.
  • a communication method proposed in an embodiment of the present application includes:
  • the UE sends a registration request message to the AMF.
  • the registration request message carries the identity of the UE, for example, it may be a hidden identity of the contract
  • the SEAF sends a first authentication request message to AUSF, where the first authentication request message carries the first service network identifier.
  • the AMF after receiving the registration request message of the UE, notifies the SEAF of the registration request message. Specifically, in response to the registration request message, SEAF initiates master authentication. First, SEAF sends a first authentication request message to AUSF. The first authentication request message is used to request to call the authentication service provided by AUSF. The main authentication is used to achieve mutual authentication with the UE and the network side and to generate a key. The first authentication request message also carries the UE identity, such as the received SUCI.
  • the first authentication request message is a Nausf_UEAuthentication_Authenticate Request message.
  • the network where the AMF or SEAF is located is the service network of the UE.
  • the UE's serving network is also called the UE's visited network.
  • the first serving network identifier is the identifier of the serving network of the UE, and is used to identify the serving network of the UE.
  • the first serving network identifier includes PLMN ID and NID, and the PLMN ID and NID are used together to identify the serving network.
  • the UE's serving network is a PLMN
  • the first serving network identifier includes the PLMN ID but not the NID, and the PLMN ID may identify the serving network.
  • the network where the AUSF is located is called the UE's home network.
  • the home network can be PLMN or SNPN.
  • the second serving network identifier is used to identify the home network of the UE.
  • the second serving network identity includes PLMN ID and NID, and the PLMN ID and NID are used together to identify the home network.
  • the home network of the UE is a PLMN
  • the second serving network identity includes the PLMN ID but does not include the NID, and the PLMN ID can identify the home network.
  • the first authentication request message carries the first authentication method
  • the first authentication method is an authentication method supported by AMF, or an authentication method supported by SEAF, or an authentication method supported by the visited network of the UE. Or the authentication method supported by the service network of the UE.
  • the first authentication request message may not carry the first authentication method.
  • the first authentication method can be sent to AUSF through other messages, for example, a newly defined message.
  • AUSF sends an authentication vector request message to UDM, where the authentication vector request message carries the first service network identifier.
  • the authentication vector request message is used to request to invoke the authentication service provided by UDM (or authentication vector service, or used to request authentication vector).
  • the authentication vector request message is Nudm_UEAuthentication_Get Request message.
  • the authentication vector request message may also carry the identity of the UE.
  • the authentication vector request message carries the first authentication method received by the AUSF.
  • the authentication vector request message may not carry the first authentication method.
  • the first authentication method can be sent to the UDM through other messages, for example, a newly defined message.
  • the UDM selects the authentication method to be used according to the received first authentication method.
  • EAP-AKA EAP-AKA’ or 5G AKA.
  • the UDM sends an authentication vector response message to AUSF, where the authentication vector response message carries the selected authentication method.
  • UDM before UDM sends an authentication vector response message to AUSF, UDM generates an authentication vector. Specifically, UDM generates a corresponding authentication vector according to the authentication method selected for use. For the specific process of generating the authentication vector, please refer to the related description in Fig. 1c, which will not be repeated here.
  • the UDM obtains the SUPI of the UE and the subscription data of the UE according to the SUCI, including the long-term key K of the UE.
  • the authentication vector response message carries the generated authentication vector.
  • the authentication vector response message also carries the SUPI of the UE.
  • the authentication vector response message is Nudm_UEAuthentication_Get Response message.
  • AUSF sends a first authentication response message to SEAF.
  • the first authentication response message is a Nausf_UEAuthentication_Authenticate Response message.
  • the first authentication response message carries RAND and AUTN in the authentication vector received by AUSF.
  • the AMF sends a second authentication request message to the UE.
  • the SEAF notifies the AMF, and the SEAF receives the first authentication response message from the AUSF.
  • the AMF sends a second authentication request message to the UE, and the second authentication request message carries the received RAND and AUTN.
  • the second authentication request message is an Authenticate Request message.
  • the UE sends a second authentication response message to the AMF.
  • the UE verifies whether AUTN is acceptable, and generates a response (RES or RES*).
  • RES response
  • RES* response
  • the UE sends the generated response (RES or RES*) to the AMF, specifically, the response is sent to the AMF through the second authentication response message.
  • the second authentication response message includes RES or RES*. This response is used to verify the UE on the network side.
  • the second authentication response message is an Authenticate Response message.
  • the SEAF sends a third authentication request message to AUSF, and the third authentication request message carries RES or RES*.
  • the AMF after receiving the second authentication response message from the UE, the AMF notifies the SEAF of the second authentication response message.
  • SEAF sends a third authentication request message to AUSF.
  • the third authentication request message carries the RES or RES* received by the AMF.
  • the third authentication request message is a Nausf_UEAuthentication_Authenticate Request message.
  • AUSF verifies the received response.
  • AUSF checks the response from the UE (carried in the third authentication request message), which is RES or RES*. If the AUSF verification response is successful, the AUSF authenticates the UE successfully.
  • AUSF If the authentication method selected is EAP-AKA', after the AUSF verification response succeeds, AUSF generates the first intermediate key K SEAF .
  • the AUSF If the authentication method selected is 5G-AKA, the AUSF generates the first intermediate key K SEAF after step 305 (that is, the AUSF receives the authentication vector).
  • AUSF generates a first identifier.
  • the AUSF after the AUSF verification response succeeds, the AUSF generates the first identifier.
  • the first identifier is used to identify the UE.
  • the first identifier is called SUPI*.
  • the AUSF determines that when the first condition is met, the AUSF generates the first identifier.
  • the first condition includes:
  • the first serving network identifier received by AUSF includes PLMN ID and NID, or,
  • the first service network identifier received by AUSF includes PLMN ID and NID
  • the second service network identifier includes PLMN ID but does not include NID, or
  • the UE’s visited network is an SNPN network, or,
  • the UE's visited network is an SNPN network
  • the UE's home network is a PLMN network, or,
  • the UE's visited network and the UE's home network are two different networks, or,
  • the AUSF local configuration instructs to generate the first identifier.
  • step 310 when the AUSF check response succeeds, the above determination of whether to generate the first identifier is not required, and the AUSF directly generates the first identifier.
  • AUSF may generate the first identifier based on a variety of parameters or fields, specifically including any one or more of the following:
  • Network identification including the first service network identification and/or the second service network identification;
  • Routing information including routing indication (Routing Indicator, RI), and/or, AUSF Group ID (AUSF Group ID), and/or, AUSF Instance ID (AUSF Instance ID);
  • the shared key between the UE and the AUSF includes but is not limited to the fifth intermediate key K AUSF and/or the sixth intermediate key CK', and/or, and the seventh intermediate key IK'.
  • the authentication vector and a part of the authentication vector please refer to the related description of the aforementioned Figure 1c, which will not be repeated here.
  • the first identifier may specifically have multiple implementation manners, including but not limited to: the first identifier carries a certain parameter, field, or bit.
  • the parameter, field or bit indicates that the first identifier is associated with a specific SUPI. Exemplary, as shown in Table 1:
  • the first identifier is generated according to a preset preset rule
  • the preset rule is pre-configured in the AUSF and the UE, and the AUSF and the UE generate the first identifier according to the same preset rule.
  • step 311 AUSF generating the first identifier can occur at any time after step 305, before step 312, or step 313, which is not limited in the embodiment of the present application.
  • AUSF sends the first identifier to SEAF.
  • AUSF sends the first identifier to SEAF. Specifically, the AUSF sends the first identifier to the SEAF through the third authentication service response message.
  • the authentication service response is: Nausf_UEAuthentication_Authenticate Response message.
  • the third authentication service response message carries K SEAF .
  • the third authentication service response message carries a first instruction for instructing to generate the first identifier.
  • AUSF sends the first identifier to UDM.
  • AUSF sends the first identifier to UDM.
  • the AUSF sends the first identifier to the UDM through an authentication result confirmation service request message.
  • the authentication result confirmation service request message is used to notify the UDM terminal device of the authentication result.
  • the authentication result confirmation service request message is a Nudm_UEAuthentication_ResultConfirmation Request message.
  • steps 312 and 313 are not limited here. You can execute step 312 and then execute step 313, or you can execute step 313 and then execute step 312, or you can execute step 312 and step 312 at the same time. 313.
  • the UDM saves the correspondence between the first identifier and the SUPI.
  • the UDM after the UDM receives the first identifier from the AUSF, it saves the correspondence between the first identifier and the SUPI corresponding to the first identifier. Both the SUPI and the first identifier are used to identify the UE.
  • the UDM stores the subscription data of the UE identified by the SUPI. Therefore, the UDM stores the correspondence between the first identifier, the SUPI corresponding to the first identifier, and the subscription data of the UE corresponding to the SUPI.
  • the SEAF generates a second intermediate key K AMF based on the first identifier.
  • SEAF generates a second intermediate key K AMF based on the first identifier, that is, SEAF generates a second intermediate key based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA K AMF ;
  • SEAF sends the K AMF to AMF.
  • the AMF generates the NAS key according to the K AMF; again, the SEAF sends the first identifier to the AMF.
  • the SEAF sends a second instruction for instructing the generation of the first identifier to the UE.
  • the first instruction and the second instruction may be the same instruction or different instructions, and there is no limitation here.
  • the UE generates a first identifier.
  • the UE generates the first identifier, and uses the same parameters and the same method as the AUSF to generate the first identifier. Refer to the description in step 311 for the parameters used by the AUSF to generate the first identifier. In the embodiment of the present application, the method used by the AUSF and the UE to generate the first identifier is not limited.
  • the UE if the second condition is met, the UE generates a first identifier.
  • the second condition includes:
  • the first serving network identifier includes PLMN ID and NID, or,
  • the first service network identifier includes PLMN ID and NID
  • the second service network identifier includes PLMN ID but does not include NID, or
  • the UE’s visited network is an SNPN network, or,
  • the UE's visited network is an SNPN network
  • the UE's home network is a PLMN network, or,
  • the UE's visited network and the UE's home network are two different networks, or,
  • the UE local configuration instructs to generate the first identifier, or,
  • the UE receives the second indication from the AMF, and the second indication is used to instruct the UE to generate the first identity.
  • step 316 can be performed at any time after step 301, and there is no limitation here.
  • the UE generates a second intermediate key K AMF based on the first identifier.
  • UE based on the first identifier generating a second intermediate key K AMF, i.e. UE based on the first intermediate key K SEAF, anti-dimensionality reduction generates a second intermediate parameter ABBA and architecture between the first identification key K AMF
  • the UE generates the second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, the length of the first identifier, ABBA, and the length of ABBA.
  • the UE generates a NAS key based on the second intermediate key, which is used to protect the NAS communication message between the UE and the AMF.
  • the UE generates the first intermediate key K SEAF, please refer to the related description of the aforementioned FIG. 1b-FIG. 1c, which will not be repeated here.
  • the UE may also generate an authentication vector or a part of the authentication vector used in the authentication according to the received RAND in the same manner as the network side.
  • step 317 can be performed at any time after step 307.
  • the AMF may send a service request to the UDM, carrying the first identifier.
  • the services requested by AMF from UDM include:
  • A subscription data management service (example Nudm_SubscriberDataManagement service), used for AMF to request UDM to obtain UE's subscription data, used for AMF to request UDM to subscribe to the notification when UE data changes, used for AMF to unsubscribe UE data from UDM Notifications when changes, and notifications when AMF requests UDM to subscribe to data changes, etc.;
  • UE context management service (example Nudm_UEContextManagement service), used to request 3GPP access AMF registration, used to request non-3GPP access AMF registration, used to request 3GPP access AMF to register, used to request Non-3GPP access AMF to register, to request to update AMF registration parameters, and to request to register AMF, etc.
  • the UDM After the UDM receives the service request carrying the first identifier sent by the AMF, the UDM finds the corresponding SUPI according to the first identifier, and optionally, finds the subscription data of the UE corresponding to the SUPI.
  • the SMF may send a service request to the UDM, carrying the first identifier.
  • the services requested by SMF from UDM include:
  • A subscription data management service (example Nudm_SubscriberDataManagement service), used for SMF to request UDM to obtain UE's subscription data, used for SMF to request UDM to subscribe to the notification when UE data changes, used for SMF to unsubscribe UE data from UDM Notification when changes are made, as well as notification when SMF requests UDM to subscribe to data changes, etc.;
  • UE context management service exemplarily Nudm_UEContextManagement service
  • Nudm_UEContextManagement service used to request the creation of a new registration or SMF registration, and used to request SMF to register.
  • the UDM After the UDM receives the service request carrying the first identifier sent by the SMF, the UDM finds the corresponding SUPI according to the first identifier, and optionally, finds the subscription data of the UE corresponding to the SUPI.
  • SEAF may decide to initiate primary authentication.
  • SEAF sends first authentication request information to AUSF.
  • the first authentication request message carries the first identifier; AUSF receives the first authentication request message.
  • an authentication vector request message is sent to the UDM, and the authentication vector request message carries the received first identification.
  • the UDM finds the corresponding SUPI and the long-term key of the UE corresponding to the SUPI according to the first identifier, and generates an authentication vector. Then, UDM sends the SUPI to AUSF.
  • the home network and the visited network determine the authentication method of both parties through message interaction. This avoids the result that the home network chooses an authentication method that is not supported by the visited network, resulting in an authentication failure.
  • the AUSF generates a first identifier, which is used to identify the SUPI of the terminal device.
  • the home network (AUSF) sends the first identifier to the visited network (AMF) to prevent the home network (AUSF) from sending the SUPI of the UE to the visited network (AMF).
  • AMF visited network
  • SUPI belongs to private information, it avoids leaking the private information of the terminal device. Thereby improving the security of communication.
  • FIG. 4 is a schematic diagram of an embodiment of another communication method in an embodiment of this application.
  • the key generation process shown in FIG. 1b and the key transfer process shown in FIG. 1c are applicable to FIG. 4.
  • Another communication method proposed in the embodiment of this application includes:
  • the UE sends a registration request message to the AMF.
  • the registration request message carries the identity of the UE, for example, it may be a Subscriber Concealed Identifier (SUCI). Specifically, it is similar to the foregoing step 301, and will not be repeated here.
  • SUCI Subscriber Concealed Identifier
  • SEAF sends a first authentication request message to AUSF.
  • the first authentication request message carries the first service network identifier.
  • the first authentication request message is used to request to call the authentication service provided by AUSF.
  • the AMF After the AMF receives the registration request message, it notifies the SEAF. SEAF initiates primary authentication, and SEAF sends a first authentication request message to AUSF. Please refer to the related description of FIG. 3 for the first service network identification, which will not be repeated here.
  • the first authentication request message also carries a UE identity, such as the received SUCI.
  • AUSF sends an authentication vector request message to UDM, where the authentication vector request carries the received first service network identifier.
  • the authentication vector request message is used to request the invocation of the authentication service provided by UDM, or the authentication message service, or to request the authentication vector.
  • the authentication vector request is a "Nudm_UEAuthentication_Get Request” message.
  • the authentication vector request message carries the received UE identity.
  • the UDM generates a first identifier.
  • the first identifier is used to identify the UE.
  • the first identifier is called SUPI*.
  • the UDM obtains the SUPI of the UE and the subscription data of the UE according to the received SUCI.
  • the UDM determines that when the third condition is met, the UDM generates the first identifier.
  • the third condition includes:
  • the first service network identifier received by UDM includes PLMN ID and NID, or,
  • the first service network identifier received by UDM includes PLMN ID and NID
  • the second service network identifier includes PLMN ID but does not include NID, or
  • the UE’s visited network is an SNPN network, or,
  • the UE's visited network is an SNPN network
  • the UE's home network is a PLMN network, or,
  • the UE's visited network and the UE's home network are two different networks, or,
  • the UDM local configuration instructs to generate the first identifier.
  • step 403 the above process of determining whether to generate the first identifier is not required, and the UDM directly generates the first identifier.
  • UDM may generate the first identifier based on a variety of parameters or fields, specifically including any one or more of the following:
  • Network identification including the first service network identification and/or the second service network identification;
  • Routing information including routing indication (Routing Indicator, RI), and/or, AUSF Group ID (AUSF Group ID), and/or, AUSF Instance ID (AUSF Instance ID);
  • the shared key between the UE and the AUSF includes but is not limited to the fifth intermediate key K AUSF and/or the sixth intermediate key CK', and/or, and the seventh intermediate key IK'.
  • the authentication vector and a part of the authentication vector please refer to the related description of the aforementioned Figure 1b- Figure 1c, which will not be repeated here.
  • the first identifier may specifically have multiple implementation manners, including but not limited to: the first identifier carries a certain parameter, field, or bit.
  • the parameter, field or bit indicates that the first identifier is associated with a specific SUPI. Exemplary, as shown in Table 1 above.
  • the UDM saves the corresponding relationship between the first identifier and SUPI.
  • the UDM After the UDM generates the first identifier, the corresponding relationship between the first identifier and the SUPI corresponding to the first identifier is stored.
  • the UDM saves the subscription data of the UE corresponding to the SUPI. Therefore, the UDM saves the correspondence between the first identifier, the SUPI corresponding to the first identifier, and the subscription data of the UE corresponding to the SUPI.
  • the UDM sends an authentication vector response message to AUSF, where the authentication vector response carries the first identifier.
  • UDM sends an authentication vector response message to AUSF, and the authentication vector response message carries the first identifier.
  • UDM Before UDM sends an authentication vector response message to AUSF, UDM generates an authentication vector. Specifically, UDM generates a corresponding authentication vector according to the authentication method selected for use. For the specific process of generating the authentication vector, please refer to the related description of the aforementioned Figure 1c, which will not be repeated here.
  • the authentication vector response is a "Nudm_UEAuthentication_Get Response” message.
  • the UDM carries a third instruction for instructing to generate the first identifier in the authentication vector response message.
  • AUSF sends a first authentication response message to SEAF.
  • AUSF sends a first authentication response message to SEAF.
  • the first authentication response message carries RAND and AUTN in the received authentication vector.
  • the first authentication response is a "Nausf_UEAuthentication_Authenticate Response" message.
  • the AUSF If the AUSF receives the third instruction, the AUSF carries the first instruction for instructing the generation of the first identifier in the first authentication response message.
  • the AMF sends a second authentication request message to the UE.
  • the SEAF after receiving the first authentication response message, notifies the AMF of the first authentication response message.
  • the AMF sends a second authentication request message to the UE.
  • the second authentication request message carries the received AUTN and RAND.
  • the second authentication request is an Authenticate Request message.
  • the SEAF receives the first instruction, the SEAF notifies the AMF of the first instruction, and the AMF sends the second instruction for instructing the generation of the first identifier to the UE according to the first instruction.
  • the first instruction, the second instruction, and the third instruction may be the same instruction or different instructions.
  • the UE sends a second authentication response message to the AMF.
  • the UE verifies AUTN and generates a response (RES or RES*).
  • RES response
  • RES* response
  • the UE sends the generated response (RES or RES*) to the AMF, specifically, the response is sent to the AMF through the second authentication response message.
  • the second authentication response message includes RES or RES*. This response is used to verify the UE on the network side.
  • the second authentication response message is an Authenticate Response message.
  • the SEAF sends a third authentication request message to AUSF, and the third authentication request carries the received RES or RES*.
  • the AMF after receiving the second authentication response message from the UE, the AMF notifies the SEAF of the second authentication response message.
  • SEAF sends a third authentication request message to AUSF, and the third authentication request message carries the received response.
  • the third authentication request message is a Nausf_UEAuthentication_Authenticate Request message.
  • AUSF verifies the received RES or RES*.
  • the two-way authentication is implemented between the AUSF and the UE.
  • AUSF After the AUSF verification response RES or RES* succeeds, AUSF generates the first intermediate key K SEAF . Possibly, the AUSF generates the first intermediate key K SEAF after receiving the authentication vector (that is, after step 406).
  • AUSF sends the first identifier to AMF.
  • AUSF sends the first identifier to AMF.
  • the AUSF sends the first identifier to the AMF through a third authentication service response message, and the third authentication service response message includes the first identifier.
  • the authentication service response is: Nausf_UEAuthentication_Authenticate Response message.
  • the third authentication service response message includes the first intermediate key K SEAF .
  • the SEAF generates a second intermediate key K AMF based on the first identifier.
  • a second intermediate key K AMF i.e., based on the first intermediate key K SEAF SEAF
  • anti-dimensionality reduction generates a second intermediate parameter ABBA and architecture between the first identification key K AMF ;
  • SEAF sends the second intermediate key K AMF to AMF.
  • the AMF generates a NAS key according to the second intermediate key K AMF.
  • the UE generates a first identifier.
  • the UE generates the first identifier, and uses the same parameters and the same method as the AUSF to generate the first identifier. Refer to the description in step 311 for the parameters used by the AUSF to generate the first identifier. In the embodiment of the present application, the method used by the AUSF and the UE to generate the first identifier is not limited.
  • the UE if the second condition is met, the UE generates a first identifier.
  • the second condition includes:
  • the first serving network identifier includes PLMN ID and NID, or,
  • the first service network identifier includes PLMN ID and NID
  • the second service network identifier includes PLMN ID but does not include NID, or
  • the UE’s visited network is an SNPN network, or,
  • the UE's visited network is an SNPN network
  • the UE's home network is a PLMN network, or,
  • the UE's visited network and the UE's home network are two different networks, or,
  • the UE local configuration instructs to generate the first identifier, or,
  • the UE receives the second instruction from the AMF, and the second instruction is used to instruct to generate the first identifier.
  • step 414 can be performed at any time after step 401.
  • the UE generates a second intermediate key K AMF based on the first identifier.
  • UE based on the first identifier generating a second intermediate key K AMF, i.e. UE based on the first intermediate key K SEAF, anti-dimensionality reduction generates a second intermediate parameter ABBA and architecture between the first identification key K AMF
  • the UE generates the second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, the length of the first identifier, ABBA, and the length of ABBA.
  • the UE generates a NAS key based on the second intermediate key, which is used to protect the NAS communication message between the UE and the AMF.
  • the UE generates the first intermediate key K SEAF, please refer to the related description of the aforementioned FIG. 1b-FIG. 1c, which will not be repeated here.
  • the UE may also generate an authentication vector or a part of the authentication vector used in the authentication according to the received RAND in the same manner as the network side.
  • step 415 can be executed at any time after step 408.
  • the AMF may send a service request to the UDM, carrying the first identifier.
  • the services requested by AMF from UDM include:
  • A subscription data management service (example Nudm_SubscriberDataManagement service), used for AMF to request UDM to obtain UE's subscription data, used for AMF to request UDM to subscribe to the notification when UE data changes, used for AMF to unsubscribe UE data from UDM Notifications when changes, and notifications when AMF requests UDM to subscribe to data changes, etc.;
  • UE context management service (example Nudm_UEContextManagement service), used to request 3GPP access AMF registration, used to request non-3GPP access AMF registration, used to request 3GPP access AMF to register, used to request Non-3GPP access AMF to register, to request to update AMF registration parameters, and to request to register AMF, etc.
  • the UDM After the UDM receives the service request carrying the first identifier sent by the AMF, the UDM finds the corresponding SUPI according to the first identifier, and optionally, finds the subscription data of the UE corresponding to the SUPI.
  • the SMF may send a service request to the UDM, carrying the first identifier.
  • the services requested by SMF from UDM include:
  • A subscription data management service (example Nudm_SubscriberDataManagement service), used for SMF to request UDM to obtain UE's subscription data, used for SMF to request UDM to subscribe to the notification when UE data changes, used for SMF to unsubscribe UE data from UDM Notification when changes are made, as well as notification when SMF requests UDM to subscribe to data changes, etc.;
  • UE context management service exemplarily Nudm_UEContextManagement service
  • Nudm_UEContextManagement service used to request the creation of a new registration or SMF registration, and used to request SMF to register.
  • the UDM After the UDM receives the service request carrying the first identifier sent by the SMF, the UDM finds the corresponding SUPI according to the first identifier, and optionally, finds the subscription data of the UE corresponding to the SUPI.
  • SEAF may decide to initiate primary authentication.
  • SEAF sends first authentication request information to AUSF.
  • the first authentication request message carries the first identifier; AUSF receives the first authentication request message.
  • an authentication vector request message is sent to the UDM, and the authentication vector request message carries the received first identification.
  • the UDM finds the corresponding SUPI and the subscription data of the UE corresponding to the SUPI according to the first identifier, and generates an authentication vector. Then, UDM sends the SUPI to AUSF.
  • the UDM generates the first identifier, which is used to identify the terminal device.
  • the home network (UDM through AUSF) sends the first identifier to the visited network (AMF or SEAF) to prevent the home network (UDM through AUSF) from sending the SUPI of the UE to the visited network (AMF or SEAF). Since SUPI is the UE's private information, it avoids leaking the private information of the terminal equipment. Thereby improving the security of communication.
  • Fig. 3 and Fig. 4 respectively describe the related steps of how AUSF or UDM generates the first identifier and uses the first identifier to replace the original SUPI for communication.
  • it also describes the authentication method between the home network and the visited network to determine the authentication method of both parties through message interaction.
  • the embodiments of this application also propose a communication method. Based on pre-configured authentication methods supported by the network to AMF or UDM, the home network is determined through message interaction. The authentication method with the visited network.
  • the following is an explanation in conjunction with the drawings. It should be explained that how this method can generate the first identifier with the AUSF or UDM described in the embodiment of FIG. 3 or FIG. In this case, the method replaces the message interaction between the home network and the visited network described in the embodiment of FIG. 3 or FIG. 4 to determine the authentication method of both parties (such as the foregoing steps 302-306).
  • FIG. 5 is a schematic diagram of an embodiment of yet another communication method proposed in an embodiment of the application.
  • Another communication method proposed in the embodiment of this application includes:
  • UDM is configured with an authentication method supported by the first protocol network.
  • the first protocol network refers to any network that can communicate with the network where the UDM is located, such as the UE's visited network.
  • the authentication method supported by the first protocol network is also referred to as the authentication method supported by AMF or SEAF, or the authentication method supported by the UE's visited network, or the authentication method supported by the UE's service network.
  • the identification of the first protocol network includes the PLMN ID but does not include the NID, and the PLMN ID identifies the first protocol network.
  • the identity of the first protocol network includes PLMN ID and NID.
  • the PLMN ID and NID identify the first protocol network.
  • the authentication methods supported by the first protocol network are configured in the UDM in the form of a correspondence list
  • the correspondence list includes: the correspondence between the identity of the first protocol network and the authentication methods supported by the first protocol network relation.
  • the correspondence list may be pre-configured in UDM.
  • PLMN ID1 5G AKA PLMN ID2, NID2
  • EAP-AKA PLMN ID2, NID3
  • the UE sends a registration request to the AMF.
  • this step is similar to the aforementioned step 401, and will not be repeated here.
  • the SEAF sends a first authentication request message, and the first authentication request message carries the first service network identifier.
  • this step is the same as the aforementioned step 402, and will not be repeated here.
  • AUSF sends an authentication vector request message to UDM, where the authentication vector request message carries the first service network identifier.
  • this step is the same as the aforementioned step 403, and will not be repeated here.
  • the UDM selects an authentication method to be used based on the first service network identifier and the authentication method supported by the locally configured first protocol network.
  • the UDM after the UDM receives the first service network identifier, it selects the used authentication method based on the first service network identifier, the identifier of the locally configured first protocol network, and the authentication method supported by the first protocol network. Specifically, based on the first service network identifier, the identifier of the first protocol network consistent with the first service network identifier is determined from the configured correspondence list, and then the authentication method supported by the first protocol network is determined.
  • the correspondence list includes: the correspondence between the identifier of the first protocol network and the authentication method supported by the first protocol network.
  • the authentication method supported by the first protocol network may be an authentication method supported by the service network of the UE, or an authentication method supported by AMF, or an authentication method supported by SEAF.
  • UDM selects the authentication method to be used based on the authentication method supported by the first protocol network.
  • the UDM sends an authentication vector response message to AUSF, where the authentication vector response message carries the selected authentication method.
  • UDM is pre-configured with an authentication method supported by the first protocol network. After the UDM receives the first service network identifier from the AMF or SEAF, the UDM can select the authentication method to be used based on the authentication method supported by the locally configured first protocol network. The home network and the visited network determine the authentication method of both parties through message interaction. This avoids the result that the home network chooses an authentication method that is not supported by the visited network, resulting in an authentication failure.
  • FIG. 6 is a schematic diagram of an embodiment of yet another communication method proposed in an embodiment of the application.
  • Another communication method proposed in the embodiment of the present application includes:
  • An authentication method supported by the second protocol network is configured on AMF or SEAF.
  • the second protocol network refers to any network that can communicate with AMF or SEAF, such as the home network of the UE.
  • the authentication method supported by the second protocol network is also referred to as the authentication method supported by AUSF, or the authentication method supported by UDM, or the authentication method supported by the home network.
  • the identifier of the protocol network includes the PLMN ID but does not include the NID, and the PLMN ID identifies the second protocol network.
  • the identifier of the protocol network includes PLMN ID and NID.
  • the PLMN ID and NID together identify the second protocol network.
  • the authentication methods supported by the second protocol network are configured in the AMF or SEAF in the form of a correspondence list
  • the correspondence list includes: the identity of the second protocol network and the authentication methods supported by the second protocol network.
  • the correspondence list may be pre-configured in AMF or SEAF.
  • the UE sends a registration request message to the AMF.
  • the AMF or SEAF selects the authentication method to be used according to the authentication method supported by the locally configured second protocol network.
  • the AMF notifies the SEAF of the registration request message.
  • AMF or SEAF determines the identity of the UE's home network. If the SUCI is received at the AMF or SEAF, the AMF or SEAF obtains the identity of the UE's home network from the SUCI. AMF or SEAF can also obtain the identity of the UE's home network from the context of the UE. For example, the context of the UE includes the identity of the UE (such as SUPI), and the identity of the UE includes the identity of the home network of the UE.
  • AMF or SEAF selects the authentication method to be used based on the authentication method supported by the locally configured second protocol network. Specifically, AMF or SEAF is based on the correspondence list (the correspondence list includes the identification of the second protocol network and the second protocol network Supported authentication methods), determine the identity of the second protocol network consistent with the UE's home network identity, and then determine the authentication methods supported by the second protocol network.
  • the authentication method supported by the second protocol network is the authentication method supported by the home network of the UE, or the authentication method supported by AUSF, or the authentication method supported by UDM.
  • the SEAF sends a first authentication request message to AUSF.
  • the first authentication request message carries the first service network identifier and the selected authentication method.
  • the AMF or SEAF after receiving the registration request, the AMF or SEAF initiates an authentication process to the UE's home network.
  • the home network can be PLMN or SNPN.
  • the AMF sends a first authentication request to AUSF, and the first authentication request carries the first service network identifier.
  • the first authentication request message is used to call the authentication request service provided by AUSF.
  • the first authentication request message also carries the selected authentication method.
  • the first authentication request is a Nausf_UEAuthentication_Authenticate Request message.
  • the authentication method selected for use may also be carried in other independent messages.
  • AUSF sends an authentication vector request message to UDM, where the authentication vector request carries the first service network identifier and the received authentication method selected for use.
  • AUSF sends an authentication vector (authentication vector, AV) request message to UDM.
  • the authentication vector message request is used to request an authentication vector, or call an authentication service provided by UDM, or call an authentication vector service provided by UDM.
  • the authentication vector request message carries the received authentication method selected for use and the first service network identifier.
  • the authentication vector request is a Nudm_UEAuthentication_Get Request message.
  • the UDM uses the received authentication method selected for use.
  • the UDM uses the received authentication method selected for use to generate an authentication vector.
  • the received authentication method selected is: 5G AKA
  • UDM generates the first authentication vector
  • the received authentication method selected is: EAP-AKA'
  • UDM generates the second authentication vector.
  • the first authentication vector and the second authentication vector please refer to the related description of the aforementioned FIG. 1c, which will not be repeated here.
  • step 606 continue the communication process, such as the aforementioned steps 306-317, or the aforementioned steps 407-415, or the related steps of using SUPI for communication in the prior art solution, which is not limited here.
  • the AMF is pre-configured with the authentication method or authentication method associated with the network identity and the network identity.
  • the AMF can select an authentication method to be used based on the first service network identity, the locally configured network identity, and the authentication method associated with the network identity. Or, AMF selects the authentication method to use based on the configured authentication method.
  • AMF sends the authentication method selected to be used to AUSF.
  • the home network and the visited network determine the authentication method of both parties through message interaction. This avoids the result that the home network chooses an authentication method that is not supported by the visited network, resulting in an authentication failure.
  • the communication device includes hardware structures and/or software modules corresponding to each function.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered as going beyond the scope of this application.
  • the embodiment of the present application may divide the communication device into functional modules based on the foregoing method examples.
  • each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or software function modules. It should be noted that the division of modules in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.
  • FIG. 7 is a schematic diagram of an embodiment of the communication device in an embodiment of this application.
  • the communication device 700 may be deployed in a network device, and the communication device 700 includes:
  • the transceiver module 701 is configured to receive the contract permanent identification SUPI of the terminal equipment sent by the unified data management UDM, where SUPI is used to identify the UE;
  • the processing module 702 is configured to generate a first identifier based on SUPI;
  • the transceiver module 701 is further configured to send the first identifier to the security anchor function SEAF;
  • the processing module 702 is further configured to generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA;
  • the transceiver module 701 is further configured to send the second intermediate key K AMF to the access mobility management function AMF;
  • the processing module 702 is further configured to generate a non-access stratum NAS key based on the second intermediate key K AMF , where the NAS key is used to protect the NAS message.
  • the transceiver module 701 is also used to send a first identifier to UDM;
  • the transceiver module 701 is also configured to receive the first identifier and save the corresponding relationship between the first identifier and SUPI.
  • the transceiver module 701 is also configured to receive the first service network identifier sent by the AMF;
  • the processing module 702 is configured to generate a first identifier, which specifically includes:
  • the first service network identity includes the public land mobile network identity PLMN ID and the network identity NID
  • the processing module 702 is configured to generate the first identifier.
  • the processing module 702 is further configured to generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the processing module 702 is further configured to generate a fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK;
  • the transceiver module 701 is also used to send the fifth intermediate key K AUSF to AUSF;
  • the processing module 702 further based on the fifth intermediate key K AUSF generating a first intermediate key K SEAF;
  • the processing module 702 is further configured to send the first intermediate key K SEAF to the SEAF.
  • the processing module 702 is further configured to generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the processing module 702 is further configured to generate a sixth intermediate key CK' and a seventh intermediate key IK' based on the third intermediate key CK and the fourth intermediate key IK;
  • the transceiver module 701 is also used to send the sixth intermediate key CK' and the seventh intermediate key IK' to AUSF;
  • the processing module 702 further based on the sixth intermediate key CK 'and the seventh intermediate key IK' generates a fifth intermediate key K AUSF, based on the fifth intermediate key K AUSF generating a first intermediate key K SEAF;
  • the transceiver module 701 is also used to send the first intermediate key K SEAF to the SEAF.
  • the transceiver module 701 is also used to receive AMF-supported authentication methods sent by AMF;
  • the transceiver module 701 is also used to send the received authentication mode supported by AMF to UDM;
  • the processing module 702 is also used to select the authentication method to be used based on the authentication method supported by AMF;
  • the transceiver module 701 is also used to send the selected authentication method to AUSF;
  • the transceiver module 701 is also configured to send an authentication response to the AMF based on the selected authentication method.
  • FIG. 8 is a schematic diagram of another embodiment of the communication device in the embodiment of the application.
  • the communication device 800 may be deployed in terminal equipment, and the communication device 800 includes:
  • the processing module 801 is configured to generate a first identifier based on the contract permanent identifier SUPI of the terminal device;
  • the processing module 801 is further configured to generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA;
  • the processing module 801 is further configured to generate a NAS key based on the second intermediate key K AMF , where the NAS key is used to protect the NAS message.
  • the transceiver module 802 is configured to send a registration request to the access mobility management function AMF, and the registration request carries the first service network identifier;
  • the processing module 801 is configured to generate a first identifier based on SUPI, which specifically includes:
  • the processing module 801 determines that the second condition is satisfied, the processing module 801 generates the first identifier based on the SUPI; otherwise, the UE does not generate the first identifier.
  • the second condition includes:
  • the first serving network identifier includes PLMN ID and NID, or,
  • the first service network identifier includes PLMN ID and NID
  • the second service network identifier includes PLMN ID but not NID, or
  • the UE's visited network is an SNPN network, or,
  • the UE's visited network is an SNPN network
  • the UE's home network is a PLMN network, or,
  • the UE's visited network and the UE's home network are two different networks, or,
  • the UE local configuration instructs to generate the first identifier, or,
  • the UE receives the second indication from the AMF, and the second indication is used to instruct the UE to generate the first identity.
  • the transceiver module 802 is also used to obtain the third intermediate key CK and the fourth intermediate key IK;
  • the processing module 801 is further configured to generate a fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK;
  • the processing module 801 further based on the fifth intermediate key K AUSF generating a first intermediate key K SEAF.
  • the transceiver module 802 is also used to obtain the third intermediate key CK and the fourth intermediate key IK;
  • the processing module 801 is further configured to generate a sixth intermediate key CK' and a seventh intermediate key IK' based on the third intermediate key CK and the fourth intermediate key IK;
  • the processing module 801 is further configured to generate a fifth intermediate key K AUSF based on the sixth intermediate key CK' and the seventh intermediate key IK';
  • the processing module 801 further based on the fifth intermediate key K AUSF generating a first intermediate key K SEAF.
  • the processing module 801 is further configured to generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, the length of the first identifier, ABBA, and the length of ABBA.
  • FIG. 9 is a schematic diagram of an embodiment of a communication device in an embodiment of the application.
  • the communication device 900 may be deployed in a network device, and the communication device 900 includes:
  • the processing module 901 is configured to generate a first identifier based on SUPI;
  • the transceiver module 902 is configured to send the first identifier to the authentication server function network element AUSF;
  • the transceiver module 902 is further configured to send the first identifier to the security anchor function network element SEAF;
  • the processing module 901 is further configured to generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA;
  • the transceiver module 902 is further configured to send the second intermediate key to the mobility management function network element AMF;
  • the processing module 901 is further configured to generate a non-access stratum NAS key based on the second intermediate key, where the NAS key is used to protect NAS messages.
  • the transceiver module 902 is further configured to receive the first service network identifier sent by the AMF;
  • the transceiver module 902 is also used to send the first service network identifier to UDM;
  • the processing module 901 is configured to generate a first identifier, which specifically includes:
  • the processing module 901 is configured to generate the first identifier based on the SUPI of the UE, and the third condition includes:
  • the first serving network identifier includes PLMN ID and NID, or,
  • the first service network identifier includes PLMN ID and NID
  • the second service network identifier includes PLMN ID but not NID, or
  • the UE's visited network is an SNPN network, or,
  • the UE's visited network is an SNPN network
  • the UE's home network is a PLMN network, or,
  • the UE's visited network and the UE's home network are two different networks, or,
  • the UDM local configuration instructs to generate the first identifier.
  • the processing module 901 is also used to store the corresponding relationship between the first identifier and the SUPI.
  • the processing module 901 is further configured to generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the processing module 901 is further configured to generate a fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK;
  • the transceiver module 902 is also used to send the fifth intermediate key K AUSF to AUSF;
  • the processing module 901 further based on the fifth intermediate key K AUSF generating a first intermediate key K SEAF;
  • the transceiver module 902 is also used to send the first intermediate key K SEAF to the SEAF.
  • the processing module 901 is further configured to generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the processing module 901 is further configured to generate a sixth intermediate key CK' and a seventh intermediate key IK' based on the third intermediate key CK and the fourth intermediate key IK;
  • the transceiver module 902 is also used to send the sixth intermediate key CK' and the seventh intermediate key IK' to AUSF;
  • the processing module 901 is further configured to sixth intermediate key CK 'and the seventh intermediate key IK' generates a fifth intermediate key K AUSF, based on the fifth intermediate key K AUSF generating a first intermediate key K SEAF based;
  • the transceiver module 902 is also used to send the first intermediate key K SEAF to the SEAF.
  • FIG. 10 is a schematic diagram of an embodiment of a communication device in an embodiment of the application.
  • the communication device 1000 may be deployed in a network device, and the communication device 1000 includes:
  • the transceiver module 1001 is configured to be configured with an authentication method supported by the first protocol network;
  • the transceiver module 1001 is further configured to receive the first service network identifier sent by the authentication server function network element AUSF;
  • the processing module 1002 is configured to select an authentication method to be used based on the first service network identifier and the authentication method supported by the locally configured first protocol network;
  • the transceiver module 1001 is also used to send the selected authentication method to AUSF.
  • the transceiver module 1001 is also used to send an authentication vector request message carrying the first service network identifier to the UDM, where the authentication vector request message is used to request the invocation of the authentication vector service or the authentication service provided by the UDM.
  • the transceiver module 1001 is also used to send an authentication vector response message to AUSF, and the authentication vector response message carries the selected authentication method.
  • the authentication vector response message is used to respond to the received authentication vector request message.
  • FIG. 11 is a schematic diagram of an embodiment of a communication device in an embodiment of this application.
  • the communication device 1100 may be deployed in a network device, and the communication device 1100 includes:
  • the transceiver module 1101 is configured to receive the first authentication mode sent by AUSF;
  • the processing module 1102 is configured to select an authentication method to be used according to the received first authentication method
  • the transceiver module 1101 is also used to send the selected authentication method to the AUSF.
  • it may include:
  • the transceiver module 1101 is further configured to send an authentication vector request message to the UDM.
  • the authentication vector request message is used to request the invocation of the authentication vector service or the authentication service provided by the UDM, and the authentication vector request message carries the first authentication method.
  • it may include:
  • the transceiver module 1101 is also used to send an authentication vector response message to AUSF, and the authentication vector response message carries the selected authentication method.
  • the authentication vector response message is used to respond to the received authentication vector request message.
  • it may include:
  • the transceiver module 1101 is also configured to receive the first authentication mode sent by the SEAF.
  • the communication device in the foregoing embodiment may be a network device, or a chip applied to the network device, or other combination devices, components, etc. that can realize the functions of the foregoing network device. It may also be a terminal device, a chip applied in a terminal device, or other combination devices, components, etc. that can realize the functions of the above-mentioned terminal device.
  • the receiving module and the sending module may be transceivers, the transceiver may include an antenna and a radio frequency circuit, etc., and the processing module may be a processor, such as a baseband chip.
  • the receiving module and the sending module may be radio frequency units, and the processing module may be a processor.
  • the receiving module and the sending module may be transceivers, the transceiver may include an antenna and a radio frequency circuit, etc., and the processing module may be a processor, such as a baseband chip.
  • the receiving module and the sending module may be radio frequency units, and the processing module may be a processor.
  • the receiving module may be the input port of the chip system
  • the sending module may be the output interface of the chip system
  • the processing module may be the processor of the chip system, for example: central processing unit (CPU) .
  • CPU central processing unit
  • the memory included in the network device is mainly used to store software programs and data, for example, to store the first identifier described in the foregoing embodiment.
  • the network device also has the following functions:
  • the network equipment includes:
  • the transceiver is also used to receive the signed permanent identification SUPI of the terminal equipment sent by the unified data management UDM, where SUPI is used to identify the UE;
  • the processor is further configured to generate a first identifier based on SUPI;
  • the transceiver is also used to send the first identifier to the security anchor function SEAF;
  • the processor is further configured to generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA;
  • the transceiver is also used to send the second intermediate key K AMF to the access mobility management function AMF;
  • the processor is further configured to generate a non-access stratum NAS key based on the second intermediate key K AMF , where the NAS key is used to protect the NAS message.
  • the transceiver is also used to send the first identifier to UDM;
  • the transceiver is also used to receive the first identifier and save the corresponding relationship between the first identifier and SUPI.
  • the transceiver is also used to receive the first service network identifier sent by the AMF;
  • the processor is used to generate the first identifier, which specifically includes:
  • the first service network identity includes the public land mobile network identity PLMN ID and the network identity NID
  • the processor is configured to generate the first identifier.
  • the processor is further configured to generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the processor is further configured to generate a fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK;
  • the transceiver is also used to send the fifth intermediate key K AUSF to AUSF;
  • the processor is also based on a fifth intermediate key K AUSF generating a first intermediate key K SEAF;
  • the processor is also used to send the first intermediate key K SEAF to SEAF.
  • the processor is further configured to generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the processor is further configured to generate a sixth intermediate key CK' and a seventh intermediate key IK' based on the third intermediate key CK and the fourth intermediate key IK;
  • the transceiver is also used to send the sixth intermediate key CK' and the seventh intermediate key IK' to AUSF;
  • the processor is also based on the sixth intermediate key CK 'and the seventh intermediate key IK' generates a fifth intermediate key K AUSF, based on the fifth intermediate key K AUSF generating a first intermediate key K SEAF;
  • the transceiver is also used to send the first intermediate key K SEAF to SEAF.
  • the transceiver is also used to receive the authentication methods supported by AMF sent by AMF;
  • the transceiver is also used to send the received authentication method supported by AMF to UDM;
  • the processor is also used to select the authentication method to be used based on the authentication method supported by AMF;
  • the transceiver is also used to send the selected authentication method to AUSF;
  • the transceiver is also used to send an authentication response to the AMF based on the selected authentication method.
  • the processor is further configured to generate a first identifier based on the contract permanent identifier SUPI of the terminal device;
  • the processor is further configured to generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA;
  • the processor is further configured to generate a NAS key based on the second intermediate key K AMF , where the NAS key is used to protect the NAS message.
  • the terminal device further includes a transceiver
  • the transceiver is also used to send a registration request to the access mobility management function AMF, and the registration request carries the first service network identifier;
  • the processor is configured to generate the first identifier based on SUPI, which specifically includes:
  • the processor determines that the second condition is satisfied, the processor generates the first identifier based on the SUPI; otherwise, the processor does not generate the first identifier, and the second condition includes:
  • the first serving network identifier includes PLMN ID and NID, or,
  • the first service network identifier includes PLMN ID and NID
  • the second service network identifier includes PLMN ID but not NID, or
  • the UE’s visited network is an SNPN network, or,
  • the UE's visited network is an SNPN network
  • the UE's home network is a PLMN network, or,
  • the UE's visited network and the UE's home network are two different networks, or,
  • the UE local configuration instructs to generate the first identifier, or,
  • the UE receives the second indication from the AMF, and the second indication is used to instruct the UE to generate the first identity.
  • the transceiver is also used to obtain the third intermediate key CK and the fourth intermediate key IK;
  • the processor is further configured to generate a fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK;
  • the processor is also based on a fifth intermediate key K AUSF generating a first intermediate key K SEAF.
  • the transceiver is also used to obtain the third intermediate key CK and the fourth intermediate key IK;
  • the processor is further configured to generate a sixth intermediate key CK' and a seventh intermediate key IK' based on the third intermediate key CK and the fourth intermediate key IK;
  • the processor is further configured to generate a fifth intermediate key K AUSF based on the sixth intermediate key CK' and the seventh intermediate key IK';
  • the processor is also based on a fifth intermediate key K AUSF generating a first intermediate key K SEAF.
  • the processor is further configured to generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, the length of the first identifier, ABBA, and the length of ABBA.
  • a processor configured to generate a first identifier based on SUPI
  • a transceiver configured to send the first identifier to the authentication server function network element AUSF;
  • the transceiver is also used to send the first identifier to the security anchor function network element SEAF;
  • the processor is further configured to generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA;
  • the transceiver is also used to send the second intermediate key to the mobility management function network element AMF;
  • the processor is further configured to generate a non-access stratum NAS key based on the second intermediate key, where the NAS key is used to protect the NAS message.
  • the transceiver is also used to receive the first service network identifier sent by the AMF;
  • the transceiver is also used to send the first service network identifier to UDM;
  • the processor is used to generate the first identifier, which specifically includes:
  • the processor is configured to generate the first identifier based on the SUPI of the UE, and the third condition includes:
  • the first serving network identifier includes PLMN ID and NID, or,
  • the first service network identifier includes PLMN ID and NID
  • the second service network identifier includes PLMN ID but not NID, or
  • the UE’s visited network is an SNPN network, or,
  • the UE's visited network is an SNPN network
  • the UE's home network is a PLMN network, or,
  • the UE's visited network and the UE's home network are two different networks, or,
  • the UDM local configuration instructs to generate the first identifier.
  • the processor is also used to store the corresponding relationship between the first identifier and the SUPI.
  • the processor is further configured to generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the processor is further configured to generate a fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK;
  • the transceiver is also used to send the fifth intermediate key K AUSF to AUSF;
  • the processor is also based on a fifth intermediate key K AUSF generating a first intermediate key K SEAF;
  • the transceiver is also used to send the first intermediate key K SEAF to SEAF.
  • the processor is further configured to generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • the processor is further configured to generate a sixth intermediate key CK' and a seventh intermediate key IK' based on the third intermediate key CK and the fourth intermediate key IK;
  • the transceiver is also used to send the sixth intermediate key CK' and the seventh intermediate key IK' to AUSF;
  • the processor is also based on the sixth intermediate key CK 'and the seventh intermediate key IK' generates a fifth intermediate key K AUSF, based on the fifth intermediate key K AUSF generating a first intermediate key K SEAF;
  • the transceiver is also used to send the first intermediate key K SEAF to SEAF.
  • the transceiver is used to configure the authentication method supported by the first protocol network
  • the transceiver is also used to receive the first service network identifier sent by the authentication server function network element AUSF;
  • a processor configured to select an authentication method to be used based on the first service network identifier and the authentication method supported by the locally configured first protocol network;
  • the transceiver is also used to send the selected authentication method to AUSF.
  • the transceiver is also used to send an authentication vector request message carrying the first service network identifier to the UDM, where the authentication vector request message is used to request to invoke the authentication vector service or the authentication service provided by the UDM.
  • the transceiver is also used to send an authentication vector response message to AUSF, and the authentication vector response message carries the selected authentication method.
  • the authentication vector response message is used to respond to the received authentication vector request message.
  • Transceiver used to receive the first authentication method sent by AUSF
  • the processor is configured to select the authentication method to be used according to the received first authentication method
  • the transceiver is also used to send the selected authentication method to the AUSF.
  • the UDM receiving the first authentication method sent by the AUSF may include:
  • the transceiver is also used to send an authentication vector request message to the UDM, where the authentication vector request message is used to request the invocation of the authentication vector service or the authentication service provided by the UDM, and the authentication vector request message carries the first authentication method.
  • the UDM sending the selected authentication method to the AUSF may include:
  • the transceiver is also used to send an authentication vector response message to AUSF, and the authentication vector response message carries the selected authentication method.
  • the authentication vector response message is used to respond to the received authentication vector request message.
  • the UDM before the UDM receives the first authentication method sent by AUSF, it may include:
  • the transceiver is also used to receive the first authentication mode sent by SEAF.
  • An embodiment of the present application also provides a processing device, including a processor and an interface; the processor is configured to execute the communication method described in any of the foregoing method embodiments.
  • the foregoing processing device may be a chip, and the processor may be implemented by hardware or software.
  • the processor When implemented by hardware, the processor may be a logic circuit, an integrated circuit, etc.; when implemented by software, At this time, the processor may be a general-purpose processor, which is implemented by reading software codes stored in the memory.
  • the memory may be integrated in the processor, may be located outside the processor, and exist independently.
  • This application also provides a communication system, which includes a network device and a terminal device.
  • An embodiment of the present application also provides a computer-readable storage medium, including instructions, which when run on a computer, cause the computer to execute:
  • Step A Receive the contract permanent identification SUPI of the terminal equipment sent by the unified data management UDM, where SUPI is used to identify the UE;
  • Step B Generate a first identifier based on SUPI
  • Step C Send the first identifier to the security anchor function SEAF;
  • Step D Generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA;
  • Step E Send the second intermediate key K AMF to the access mobility management function AMF;
  • Step F Generate a non-access stratum NAS key based on the second intermediate key K AMF , where the NAS key is used to protect the NAS message.
  • Step G Send the first identifier to UDM
  • Step H Receive the first identifier, and save the corresponding relationship between the first identifier and SUPI.
  • Step I Receive the first service network identifier sent by AMF
  • Step J for generating the first identifier, specifically including: when the first service network identifier includes the public land mobile network identifier PLMN ID and the network identifier NID, or when the first service network identifier includes PLMN ID and NID, and authentication When the identifier of the network where the server function AUSF is located includes the PLMN ID but does not include the NID, the first identifier is generated.
  • Step K Generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • Step L Generate a fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK;
  • Step M Send the fifth intermediate key K AUSF to AUSF;
  • Step N fifth intermediate key K AUSF based on generating a first intermediate key K SEAF;
  • Step O Send the first intermediate key K SEAF to SEAF.
  • Step P Generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • Step Q Generate a sixth intermediate key CK' and a seventh intermediate key IK' based on the third intermediate key CK and the fourth intermediate key IK;
  • Step R Send the sixth intermediate key CK' and the seventh intermediate key IK' to AUSF;
  • Step S sixth intermediate key CK 'and the seventh intermediate key IK' generates a fifth intermediate key K AUSF, and based on the fifth intermediate key K AUSF generating a first intermediate key K SEAF based;
  • Step T Send the first intermediate key K SEAF to SEAF.
  • Step U Receive AMF-supported authentication methods sent by AMF
  • Step V Send the received authentication method supported by AMF to UDM;
  • Step W Choose the authentication method to be used based on the authentication method supported by AMF;
  • Step X Send the selected authentication method to AUSF;
  • Step Y Send an authentication response to the AMF based on the selected authentication method.
  • Step Z Generate a first identifier based on the contract permanent identifier SUPI of the terminal device
  • Step AA Generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA;
  • Step AB Generate a NAS key based on the second intermediate key K AMF , where the NAS key is used to protect the NAS message.
  • Step AC Send a registration request to the access mobility management function AMF, and the registration request carries the first service network identifier;
  • Step AD Generate a first identifier based on SUPI, which specifically includes:
  • the first service network identity includes the public land mobile network identity PLMN ID and the network identity NID
  • the first service network identifier includes the PLMN ID and the NID
  • the identifier of the network where the AUSF is located includes the PLMN ID but does not include the NID
  • the first identifier is generated based on the SUPI.
  • Step AE Obtain the third intermediate key CK and the fourth intermediate key IK;
  • Step AF Generate a fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK;
  • Step AG based on the fifth intermediate key K AUSF generating a first intermediate key K SEAF.
  • Step AH Obtain the third intermediate key CK and the fourth intermediate key IK;
  • Step AI Generate a sixth intermediate key CK' and a seventh intermediate key IK' based on the third intermediate key CK and the fourth intermediate key IK;
  • Step AJ Generate a fifth intermediate key K AUSF based on the sixth intermediate key CK' and the seventh intermediate key IK';
  • Step AK fifth intermediate key K AUSF based on generating a first intermediate key K SEAF.
  • Step AL Generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, the length of the first identifier, ABBA and the length of ABBA.
  • Step AM Generate a first identifier based on SUPI
  • Step AN Send the first identifier to the authentication server function network element AUSF;
  • Step AO Send the first identifier to the security anchor function network element SEAF;
  • Step AP Generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA;
  • Step AQ Send the second intermediate key to the mobility management function network element AMF;
  • Step AR Generate a non-access stratum NAS key based on the second intermediate key, where the NAS key is used to protect NAS messages.
  • Step AS Generate a first identifier based on the SUPI of the terminal equipment UE;
  • Step AT Send the first identifier to AUSF;
  • Step AU Send the first identifier to SEAF
  • Step AV Send the first identifier to the AMF
  • Step AW Generate a second intermediate key K AMF based on the first intermediate key K SEAF , the first identifier, and the inter-architecture anti-dimensionality reduction parameter ABBA;
  • Step AX Send the second intermediate key K AMF to AMF ;
  • Step AY Generate a NAS key based on the second intermediate key, where the NAS key is used to protect the NAS message.
  • Step AZ Receive a first authentication request message sent by the AMF, where the first authentication request message carries a first service network identifier, and the first authentication request message is used to request to invoke the authentication service provided by AUSF;
  • Step BA Send an authentication vector request message to the UDM, the authentication vector request message carrying the first service network identifier, and the authentication vector request message is used to request the invocation of the authentication vector service provided by the UDM, or to request the invocation of the authentication provided by the UDM Serve;
  • Step BB Generate the first identifier.
  • Step BC When the third condition is met, the first identifier is generated based on the SUPI of the UE.
  • Step BD Save the corresponding relationship between the first identifier and the SUPI.
  • Step BE Generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • Step BF Generate a fifth intermediate key K AUSF based on the third intermediate key CK and the fourth intermediate key IK;
  • Step BG Send the fifth intermediate key K AUSF to the AUSF;
  • Step BH the first key K AUSF generated based on the intermediate key K SEAF fifth intermediate
  • Step BI Send the first intermediate key K SEAF to the SEAF.
  • Step BJ Generate a third intermediate key CK and a fourth intermediate key IK based on the long-term key K of the UE;
  • Step BK Based on the third intermediate key CK and the fourth intermediate key IK, a sixth intermediate key CK' and a seventh intermediate key IK' are generated;
  • Step BL Send the sixth intermediate key CK' and the seventh intermediate key IK' to the AUSF;
  • Step BM based on the sixth intermediate key CK 'and the seventh intermediate key IK' generates a fifth intermediate key K AUSF, based on the fifth intermediate key K AUSF generate the first intermediate key K SEAF;
  • Step BN Send the first intermediate key K SEAF to the SEAF.
  • Step BO A service request carrying the first identifier from the AMF or SMF is received.
  • Step BP the authentication method supported by the first protocol network is configured
  • Step BQ Receive the first service network identifier sent by AUSF;
  • Step BR Select an authentication method to be used based on the first service network identifier and the authentication method supported by the locally configured first protocol network;
  • Step BS Send the selected authentication method to the AUSF.
  • Step BT An authentication vector request message carrying the first service network identifier is sent to the UDM, where the authentication vector request message is used to request the invocation of the authentication vector service or the authentication service provided by the UDM.
  • Step BU Send an authentication vector response message to AUSF, and the authentication vector response message carries the selected authentication mode.
  • the authentication vector response message is used to respond to the received authentication vector request message.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例公开了一种通信方法以及相关装置，可以应用于独立非公共网络架构。网络设备中认证服务器功能AUSF生成第一标识，该第一标识用于标识终端设备。AUSF向接入与移动管理功能AMF发送第一标识，避免AUSF向AMF发送终端设备的签约永久标识。由于终端设备的签约永久标识属于隐私信息，因此避免了泄露终端设备的隐私信息，提升通信的安全性。

Description

一种通信方法以及相关装置
本申请要求于2020年06月15日提交中国专利局、申请号为202010544961.4、发明名称为“一种通信方法以及相关装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种通信方法以及相关装置。
背景技术
在第三代合作伙伴计划(the third generation partnership protect，3GPP)标准中定义了公共陆地移动网络(public land mobile network，PLMN)与独立非公共网络(Standalone Non-Public Network，SNPN)。
在漫游架构中，终端设备，或称为用户设备(User Equipment，UE)的拜访网络，可能是SNPN或者PLMN。当UE的拜访网络为SNPN时，UE的拜访网络称为拜访SNPN(Visited SNPN，V-SNPN)；当UE的拜访网络为PLMN时，UE的拜访网络称为拜访PLMN(Visited PLMN，V-PLMN)；UE的归属网络，可能是SNPN或者PLMN。当UE的归属网络为SNPN时，UE的归属网络称为归属SNPN(Home SNPN，H-SNPN)；当UE的归属网络为PLMN时，UE的归属网络称为归属PLMN(Home PLMN，H-PLMN)。
在认证流程中，UE的归属网络向UE的拜访网络发送UE的签约永久标识(subscription permanent identifier，SUPI)。该SUPI用于地标识UE，而且SUPI属于隐私信息。若所述SUPI泄露，将给所述UE带来很大的风险。
发明内容
第一方面，本申请实施例提出一种通信方法，包括：首先，认证服务器功能AUSF接收统一数据管理功能(Unified Data Management，UDM)发送的终端设备的签约永久标识SUPI，其中，终端设备也称为用户设备(user equipment，UE)，该SUPI用于标识该UE；该AUSF基于该SUPI生成第一标识；该第一标识用于标识该UE；该AUSF向安全锚点功能(Security Anchor Function，SEAF)发送该第一标识；该SEAF向接入移动管理功能(Access and Mobility Management Function，AMF)发送该第一标识；该SEAF基于第一中间密钥K SEAF、该第一标识以及架构间抗降维(Anti Bidding down Between Architectures，ABBA)参数生成第二中间密钥K AMF；该SEAF向接入移动管理功能(Access and Mobility Management Function，AMF)发送该第二中间密钥K AMF；该AMF基于该第二中间密钥K AMF生成非接入层(Non-access stratum，NAS)密钥，其中，该NAS密钥用于对NAS消息进行保护。
其中，可以理解的是，NAS消息为UE与AMF之间的协议消息。
需要说明的是，本申请实施例中，在无特别说明的情况下，SEAF与AMF合设。对外显示为一个网络功能。SEAF和AMF之间的信息交互属于一个网络功能的内部动作。在本申请实施例中，SEAF与AMF可交替使用，示例性的：首先，AUSF接收UDM发送的UE的SUPI；该AUSF基于该SUPI生成第一标识；该第一标识用于标识该UE；该AUSF向AMF发送该第 一标识；该AMF基于K SEAF、该第一标识以及ABBA参数生成K AMF；该AMF基于该K AMF生成NAS密钥，其中，该NAS密钥用于对NAS消息进行保护。
在本申请实施例中，UE向SEAF发送消息或者信元，指的是UE向AMF发送该消息或信元，AMF将该消息或信元发送给SEAF。SEAF向UE发送消息或者信元，指的是SEAF向AMF发送该消息或信元，AMF将该消息或信元发送给UE。AUSF向AMF发送消息或者信元，指的是AUSF向SEAF发送该消息或信元，SEAF将该消息或信元发送给AMF。AMF向AUSF发送消息或者信元，指的是AMF向SEAF发送该消息或信元，SEAF将该消息或信元发送给AUSF。
本申请实施例中，AUSF生成第一标识，该第一标识用于标识UE。AUSF向SEAF发送第一标识，避免AUSF向SEAF发送SUPI，从而避免了向SEAF(或者UE的拜访网络)泄露UE的隐私信息。从而提升通信的安全性。
结合第一方面，在第一方面的一种可能的实现方式中，该AUSF基于该SUPI生成该第一标识之后，还包括：
首先，该AUSF向该UDM发送该第一标识；其次，UDM接收来自AUSF的第一标识后，保存该第一标识与SUPI之间的对应关系。UDM中还保存了该SUPI标识的UE的签约数据，因此，UDM可选的保存该第一标识、该第一标识对应的SUPI、和该SUPI对应的UE的签约数据之间的对应关系。
可选的，该AUSF通过认证结果确认服务请求向该UDM发送该第一标识。该认证结果确认服务请求，用于通知UDM该终端设备的认证结果，示例性的，该认证结果确认服务请求为“Nudm_UEAuthentication_ResultConfirmation Request”消息。
本申请实施例中，UDM接收AUSF发送的第一标识后，UDM保存该第一标识与SUPI之间的对应关系。当UDM将来接收到来自AMF或者会话管理功能(Session Management Function，SMF)的携带所述第一标识的服务请求时，UDM根据本地存储的该第一标识与SUPI的对应关系，找到对应SUPI。可选的，UDM还找到该SUPI标识的UE的签约数据。
结合第一方面，在第一方面的一种可能的实现方式中，该AUSF生成该第一标识，还包括：
首先，该AUSF接收该SEAF发送的携带第一服务网络标识的第一认证请求消息，该第一认证请求消息用于请求调用AUSF提供的认证服务；其次，AUSF生成第一标识。
可选的，当满足第一条件时，则该AUSF生成该第一标识。该第一条件包括：
AUSF接收到的该第一服务网络标识包括PLMN ID和NID，或者，
AUSF接收到的该第一服务网络标识包括PLMN ID和NID，并且，第二服务网络标识包括PLMN ID不包括NID，或者，
UE的拜访网络为SNPN网络，或者，
UE的拜访网络为SNPN网络，并且UE的归属网络为PLMN网络，或者，
UE的拜访网络和UE的归属网络为两个不同的网络，或者,
AUSF的本地配置指示生成第一标识。
具体的，在本申请实施例中，该第一服务网络标识为UE拜访网络的标识，或者所述SEAF所在网络的标识，或所述AMF所在网络的标识，或者UE的服务网络的标识。在一种 可选的实现方式中，示例性的，当UE拜访网络、或所述SEAF所在的网络、或所述AMF所在网络、或者所述UE的服务网络为PLMN网络时，该第一服务网络标识为该PLMN网络的公共陆地网络标识(PLMN ID)；当UE拜访网络、或所述SEAF所在网络、或AMF所在网络、或所述UE的服务网络为SNPN网络时，该第一服务网络标识为该SNPN网络的标识，即该第一服务网络标识除了包括PLMN ID外，还包括网络标识(network identifier，NID)。PLMN ID和NID共同地标识该SNPN网络。该第一服务网络标识也可以为UE拜访网络的网络名称，或者所述SEAF所在网络的网络名称，或AMF所在网络的网络名称，或者UE的服务网络的名称。在一种可选的实现方式中，示例性的，该第一服务网络标识为“5G：SN id”，其中，当所述UE的服务网络，或者所述UE的拜访网络，或所述SEAF所在的网络，或所述AMF所在网络为PLMN时，该SN id为该PLMN的PLMN ID；当所述UE的服务网络，或所述UE的拜访网络，或所述SEAF所在的网络，或AMF所在的网络为SNPN网络时，该SN id包括PLMN ID和NID，该PLMN ID和NID一起标识该SNPN网络。
在本申请实施例中，AMF可以称为服务UE的AMF，SEAF也可以称为服务UE的SEAF。
具体的，该第二服务网络标识为UE归属网络的网络标识，或者所述AUSF所在网络的网络标识，或UDM所在网络的网络标识。在一种可选的实现方式中，示例性的，当UE归属网络，或所述AUSF所在网络，或UDM所在网络为PLMN网络时，该第二服务网络标识为该PLMN网络的PLMN ID；当UE归属网络，或所述AUSF所在网络，或UDM所在网络为SNPN网络时，该第二服务网络标识为该SNPN网络的标识，即该第二服务网络标识包括PLMN ID和NID。PLMN ID和NID共同标识SNPN网络。该第二服务网络标识也可以为UE归属网络的网络名称，或者所述AUSF所在网络的网络名称，或UDM所在网络的网络名称。在一种可选的实现方式中，示例性的，该第二服务网络标识为“5G：SN id”，其中，当UE归属网络，或所述AUSF所在网络，或UDM所在网络为PLMN网络时，该SN id为该PLMN网络的PLMN ID；当UE归属网络，或所述UDM所在网络，或AUSF所在网络为SNPN网络时，该SN id包括PLMN ID和NID，该PLMN ID和NID一起标识该SNPN网络。
可选的，该第一服务网络标识携带在第一认证请求中，该第一认证请求用于请求调用AUSF提供的认证服务。可选的，该第一认证请求为“Nausf_UEAuthentication_Authenticate Request”消息。
本申请实施例中，AUSF接收SEAF发送的第一服务网络标识后，确定是否生成第一标识。当该第一服务网络标识包括PLMN ID和NID时，或者其他确定条件满足时，AUSF生成第一标识。AUSF将该第一标识发送给SEAF或者拜访网络，避免了泄露终端设备的隐私信息，从而提升通信的安全性。
结合第一方面，在第一方面的一种可能的实现方式中，该SEAF基于该第一中间密钥K SEAF、该第一标识以及该ABBA生成该第二中间密钥K AMF之前，还包括：
该UDM或者认证凭据仓库及处理功能(Authentication credential Respository and Processing Function，ARPF)基于该UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；该UDM或ARPF基于该第三中间密钥CK和该第四中间密钥IK，生成第五中间密钥K AUSF；该UDM将该第五中间密钥K AUSF发送至该AUSF；该AUSF基于该第五中间密钥K AUSF生成 该第一中间密钥K SEAF；该AUSF将该第一中间密钥K SEAF发送给该SEAF。
本申请实施例中，该通信方法可以应用于认证方式：5G认证和密钥协商(5G Authentication and Key Agreement，5G AKA)，提升了方案的实现灵活性。
结合第一方面，在第一方面的一种可能的实现方式中，该SEAF基于该第一中间密钥K SEAF、该第一标识以及该ABBA生成该第二中间密钥K AMF之前，还包括：
该UDM或ARPF基于该UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；该UDM或ARPF基于该第三中间密钥CK和该第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；该UDM将该第六中间密钥CK’和该第七中间密钥IK’发送至该AUSF；该AUSF基于该第六中间密钥CK’和该第七中间密钥IK’生成第五中间密钥K AUSF，并基于该第五中间密钥K AUSF生成该第一中间密钥K SEAF；该AUSF将该第一中间密钥K SEAF发送给该SEAF。
本申请实施例中，该通信方法可以应用于认证方式：第三代认证和密钥协商的改进扩展认证协议方式(Improved Extensible Authentication Protocol Method for 3rd Generation Authentication and Key Agreement，EAP-AKA')，提升了方案的实现灵活性。
结合第一方面，在第一方面的一种可能的实现方式中，该AUSF向SEAF发送该第一标识，还包括：
该AUSF向SEAF发送第三认证服务响应消息，该第三认证服务响应中包括该第一标识。示例性的，该认证服务响应为：“Nausf_UEAuthentication_Authenticate Response”消息。
结合第一方面，在第一方面的一种可能的实现方式中，该SEAF向接入移动管理功能(Access and Mobility Management Function，AMF)发送该第一标识之后，还包括：
AMF接收该第一标识。AMF向SMF发送该第一标识。比如，AMF通过会话管理上下文创建服务请求向SMF发送该第一标识，该会话管理上下文创建服务请求用于向SMF请求创建UE的会话上下文或者用于向SMF请求创建会话。示例性的，该会话管理上下文创建服务请求为“Nsmf_PDUSession_CreateSMContext Request”消息。
结合第一方面，在第一方面的一种可能的实现方式中，该AUSF生成第一标识之后，还包括：
AUSF向AMF发送第一指示，用于指示生成第一标识；
AMF根据该第一指示，向UE发送第二指示，用于指示生成第一标识；
UE基于第二指示，生成第一标识。
第二方面，本申请实施例提出了一种通信方法，包括：UE基于该UE的SUPI生成第一标识；该UE基于第一中间密钥K SEAF、该第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；该UE基于该第二中间密钥K AMF生成NAS密钥，其中，该NAS密钥用于对NAS消息进行保护。
本申请实施例中，UE基于UE的SUPI生成第一标识，该第一标识用于标识该UE。该UE基于该第一标识生成一系列密钥，并最终生成NAS密钥，该NAS密钥用于对NAS消息进行保护。UE与网络侧采用相同的方法生成第一标识，以及生成NAS密钥，并使用该NAS密钥对NAS消息进行保护。保障了终端设备与网络设备之间的正常通信。
结合第二方面，在第二方面的一种可能的实现方式中，该UE基于该SUPI生成该第一 标识之前，还包括：
该UE向AMF发送注册请求消息；
该UE基于该SUPI生成该第一标识，包括：UE确定第二条件满足时，则UE基于该SUPI生成第一标识；否则UE不生成第一标识。第二条件包括：
第一服务网络标识包括PLMN ID和NID，或者，
第一服务网络标识包括PLMN ID和NID，并且，第二服务网络标识包括PLMN ID但不包括NID，或者，
UE的拜访网络为SNPN网络，或者，
UE的拜访网络为SNPN网络，并且UE的归属网络为PLMN网络，或者，
UE的拜访网络和UE的归属网络为两个不同的网络，或者，
UE本地配置指示生成第一标识，或者，
UE接收来自AMF的第二指示，第二指示用于指示UE生成第一标识。
本申请实施例中，UE在发送注册请求之前，UE选择服务网络，获取第一网络标识。UE和网络侧采用相同的方法生成第一标识，将第一标识用于密钥推衍，保证网络侧与UE之间正常通信。
结合第二方面，在第二方面的一种可能的实现方式中，该UE基于该第一中间密钥K SEAF、该第一标识以及该架构间抗降维参数ABBA生成该第二中间密钥K AMF之前，还包括：
该UE获取第三中间密钥CK和第四中间密钥IK；该UE基于该第三中间密钥CK和该第四中间密钥IK，生成第五中间密钥K AUSF；该UE基于该第五中间密钥K AUSF生成该第一中间密钥K SEAF。
在本申请实施例中，该UE获取第三中间密钥CK和第四中间密钥IK，包括：
该UE上的全球签约用户身份模块(Universal Subscriber Identity Module，USIM)基于UE的长期密钥生成第三中间密钥CK和第四中间密钥IK。该USIM将该第三中间密钥CK和第四中间密钥IK发送给UE。
本申请实施例中，该通信方法可以应用于认证方式5G AKA，提升了方案的实现灵活性。
结合第二方面，在第二方面的一种可能的实现方式中，该UE基于该第一中间密钥K SEAF、该第一标识以及该架构间抗降维参数ABBA生成第二中间密钥K AMF之前，还包括：
该UE获取第三中间密钥CK和第四中间密钥IK；该UE基于该第三中间密钥CK和该第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；该UE基于该第六中间密钥CK’和该第七中间密钥IK’生成第五中间密钥K AUSF；该UE基于该第五中间密钥K AUSF生成该第一中间密钥K SEAF。
本申请实施例中，该通信方法可以应用于认证方式EAP-AKA’，提升了方案的实现灵活性。
结合第二方面，在第二方面的一种可能的实现方式中，该UE基于该第一中间密钥K SEAF、该第一标识以及该架构间抗降维参数ABBA生成该第二中间密钥K AMF，包括：
该UE基于该第一中间密钥K SEAF、该第一标识、该第一标识的长度、该ABBA以及该ABBA的长度生成该第二中间密钥K AMF。
结合第二方面，在第二方面的一种可能的实现方式中，该UE基于该SUPI生成该第一标识之前，还包括：
UE接收到AMF发送的第二指示，用于指示生成第一标识；
UE根据该第二指示，生成第一标识。
第三方面，本申请实施例提出了一种通信方法，包括：
UDM基于终端设备UE的SUPI生成第一标识；
该UDM向AUSF发送该第一标识；
该AUSF向SEAF发送该第一标识；
该SEAF向该AMF发送该第一标识；
该SEAF基于第一中间密钥K SEAF、该第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
该SEAF向AMF发送该第二中间密钥K AMF；
该AMF基于该第二中间密钥生成NAS密钥，其中，该NAS密钥用于对NAS消息进行保护。
本申请实施例中，UDM生成第一标识，该第一标识用于标识该UE。该UE的归属网络(UDM通过AUSF)向该UE的拜访网络(AMF或SEAF)发送该第一标识，避免归该UE的属网络(UDM通过AUSF)向该UE的拜访网络(AMF或SEAF)发送UE的SUPI。由于该SUPI属于该UE的隐私信息，从而避免了泄露该UE的隐私信息，提升了通信的安全性。
结合第三方面，在第三方面的一种可能的实现方式中，该UDM基于该UE的SUPI生成该第一标识，包括：
该AUSF接收该AMF发送的第一认证请求消息，该第一认证请求消息携带第一服务网络标识，该第一认证请求消息用于请求调用AUSF提供的认证服务；
该AUSF向该UDM发送认证向量请求消息，该认证向量请求消息携带该第一服务网络标识，该认证向量请求消息用于请求调用UDM提供的认证向量服务，或者用于请求调用UDM提供的认证服务；
该UDM生成该第一标识。
结合第三方面，在第三方面的一种可能的实现方式中，包括：该第三条件满足时，UDM基于该UE的SUPI生成该第一标识。
该第三条件包括：
第一服务网络标识包括PLMN ID和NID，或者，
第一服务网络标识包括PLMN ID和NID，并且，第二服务网络标识包括PLMN ID但不包括NID，或者，
UE的拜访网络为SNPN网络，或者，
UE的拜访网络为SNPN网络，并且UE的归属网络为PLMN网络，或者，
UE的拜访网络和UE的归属网络为两个不同的网络，或者，
UDM本地配置指示生成第一标识。
在本申请实施例中，UE的拜访网络和UE的归属网络为两个不同的网络，表示，UE的 拜访网络是SNPN，UE的归属网络是PLMN，或者，UE的拜访网络是PLMN，UE的归属网络是SNPN。
结合第三方面，在第三方面的一种可能的实现方式中，UDM生成该第一标识之后，还包括：
该UDM保存该第一标识与该SUPI的对应关系。
结合第三方面，在第三方面的一种可能的实现方式中，该SEAF基于该第一中间密钥K SEAF、该第一标识以及该ABBA生成该第二中间密钥K AMF之前，还包括：
该UDM或ARPF基于该UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
该UDM基于该第三中间密钥CK和该第四中间密钥IK，生成第五中间密钥K AUSF；
该UDM将该第五中间密钥K AUSF发送至该AUSF；
该AUSF基于该第五中间密钥K AUSF生成该第一中间密钥K SEAF；
该AUSF将该第一中间密钥K SEAF发送给该SEAF。
结合第三方面，在第三方面的一种可能的实现方式中，该SEAF基于该第一中间密钥K SEAF、该第一标识以及该ABBA生成该第二中间密钥K AMF之前，还包括：
该UDM基于该UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
该UDM基于该第三中间密钥CK和该第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
该UDM将该第六中间密钥CK’和该第七中间密钥IK’发送至该AUSF；
该AUSF基于该第六中间密钥CK’和该第七中间密钥IK’生成第五中间密钥K AUSF，并基于该第五中间密钥K AUSF生成该第一中间密钥K SEAF；
该AUSF将该第一中间密钥K SEAF发送给该SEAF。
结合第三方面，在第三方面的一种可能的实现方式中，UDM生成该第一标识之后，还包括：
UDM接收到AMF或者SMF的携带第一标识的服务请求；
UDM根据该第一标识，找到对应的SUPI。可选的，UDM找到该SUPI标识的UE的签约数据。
第四方面，本申请实施例提出一种通信方法，包括：
UDM被配置第一协议网络支持的认证方式；
该UDM接收AUSF发送的第一服务网络标识；
该UDM基于该第一服务网络标识以及本地配置的第一协议网络支持的认证方式，选择使用的认证方式；
该UDM向该AUSF发送该选择使用的认证方式。
需要说明的是，在本申请实施例中，该第一协议网络指与UDM所在的网络可互通的任何网络，比如UE的拜访网络，或者UE的服务网络，或者服务UE的AMF所在的网络，或者服务UE的SEAF所在的网络。该第一协议网络支持的认证方式也称为服务UE的AMF或SEAF支持的认证方式，或者UE的拜访网络支持的认证方式，或者UE的服务网络支持的认证方式。
结合第四方面，在第四方面的一种可能的实现方式中，该UDM接收AUSF发送的第一服务网络标识，包括：
AUSF向UDM发送的携带第一服务网络标识的认证向量请求消息，该认证向量请求消息用于请求调用UDM提供的认证向量服务或者认证服务。
结合第四方面，在第四方面的一种可能的实现方式中，该UDM向该AUSF发送该选择使用的认证方式，包括：
UDM向AUSF发送认证向量响应消息，在该认证向量响应消息中携带选择的认证方式。该认证向量响应消息，用于响应接收到的认证向量请求消息。
本申请实施例中，UDM预先被配置了第一协议网络支持的认证方式。当UDM接收到来自AUSF的第一服务网络标识后，UDM可以基于该第一服务网络标识和本地被配置的第一协议网络支持的认证方式，选择使用的认证方式，避免了归属网络(或UDM)选择拜访网络(或AMF，或SEAF)不支持的认证方法，导致认证失败的结果。
第五方面，本申请实施例提出一种通信方法，包括：
UDM接收AUSF发送的第一认证方式；
该UDM根据接收到的第一认证方式选择使用的认证方式；
该UDM向该AUSF发送该选择使用的认证方式。
结合第五方面，在第五方面的一种可能的实现方式中，该UDM接收AUSF发送的第一认证方式，包括：
AUSF向UDM发送认证向量请求消息，该认证向量请求消息用于请求调用UDM提供的认证向量服务或者认证服务，该认证向量请求消息中携带第一认证方式。
结合第五方面，在第五方面的一种可能的实现方式中，该UDM向该AUSF发送该选择使用的认证方式，包括：
UDM向AUSF发送认证向量响应消息，在该认证向量响应消息中携带选择的认证方式。该认证向量响应消息，用于响应接收到的认证向量请求消息。
结合第五方面，在第五方面的一种可能的实现方式中，该UDM接收AUSF发送的第一认证方式之前，包括：
AUSF接收到SEAF发送的第一认证方式。
示例性的，AUSF接收SEAF发送的第一认证请求消息，该第一认证请求消息用于请求调用AUSF提供的认证服务，该第一认证请消息中携带第一认证方式。第一认证方式指的是SEAF支持的认证方式，或者UE的服务网络支持的认证方式，或者UE的拜访网络支持的认证方式。
第六方面，本申请实施例提出一种通信装置，包括：
收发模块，用于接收统一数据管理UDM发送的终端设备的签约永久标识SUPI，其中，SUPI用于标识UE；
处理模块，用于基于SUPI生成第一标识；
收发模块，还用于向安全锚点功能SEAF发送第一标识；
处理模块，还用于基于第一中间密钥K SEAF、第一标识以及架构间抗降维参数ABBA生成 第二中间密钥K AMF；
收发模块，还用于向接入移动管理功能AMF发送第二中间密钥K AMF；
处理模块，还用于基于第二中间密钥K AMF生成非接入层NAS密钥，其中，NAS密钥用于对NAS消息进行保护。
结合第六方面，在第六方面的一种可能的实现方式中，收发模块，还用于向UDM发送第一标识；
收发模块，还用于接收第一标识，并保存第一标识与SUPI之间的对应关系。
结合第六方面，在第六方面的一种可能的实现方式中，
收发模块，还用于接收AMF发送的第一服务网络标识；
处理模块，用于生成第一标识，具体包括：
当第一服务网络标识包括公共陆地移动网络标识PLMN ID和网络标识NID时，
或者，当第一服务网络标识包括PLMN ID和NID，并且，认证服务模块功能AUSF所在网络的标识包括PLMN ID但不包括NID时，处理模块用于生成第一标识。
结合第六方面，在第六方面的一种可能的实现方式中，
处理模块，还用于基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
处理模块，还用于基于第三中间密钥CK和第四中间密钥IK，生成第五中间密钥K AUSF；
收发模块，还用于将第五中间密钥K AUSF发送至AUSF；
处理模块，还用于基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
处理模块，还用于将第一中间密钥K SEAF发送给SEAF。
结合第六方面，在第六方面的一种可能的实现方式中，
处理模块，还用于基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
处理模块，还用于基于第三中间密钥CK和第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
收发模块，还用于将第六中间密钥CK’和第七中间密钥IK’发送至AUSF；
处理模块，还用于基于第六中间密钥CK’和第七中间密钥IK’生成第五中间密钥K AUSF，并基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
收发模块，还用于将第一中间密钥K SEAF发送给SEAF。
结合第六方面，在第六方面的一种可能的实现方式中，
收发模块，还用于接收AMF发送的AMF支持的认证方式；
收发模块，还用于向UDM发送接收到的AMF支持的认证方式；
处理模块，还用于基于AMF支持的认证方式选择使用的认证方式；
收发模块，还用于向AUSF发送选择使用的认证方式；
收发模块，还用于基于选择使用的认证方式向AMF发送认证响应。
第七方面，本申请实施例提出一种通信装置，包括：
处理模块，用于基于终端设备的签约永久标识SUPI生成第一标识；
处理模块，还用于基于第一中间密钥K SEAF、第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
处理模块，还用于基于第二中间密钥K AMF生成NAS密钥，其中，NAS密钥用于对NAS消息进行保护。
结合第七方面，在第七方面的一种可能的实现方式中，
收发模块，用于向接入移动管理功能AMF发送注册请求，注册请求中携带第一服务网络标识；
处理模块，用于基于SUPI生成第一标识，具体包括：
处理模块确定第二条件满足时，则处理模块基于该SUPI生成第一标识；否则UE不生成第一标识。第二条件包括：
第一服务网络标识包括PLMN ID和NID，或者，
第一服务网络标识包括PLMN ID和NID，并且，第二服务网络标识包括PLMN ID但不包括NID，或者，
UE的拜访网络为SNPN网络，或者，
UE的拜访网络为SNPN网络，并且UE的归属网络为PLMN网络，或者，
UE的拜访网络和UE的归属网络为两个不同的网络，或者，
UE本地配置指示生成第一标识，或者，
UE接收来自AMF的第二指示，第二指示用于指示UE生成第一标识。
结合第七方面，在第七方面的一种可能的实现方式中，
收发模块，还用于获取第三中间密钥CK和第四中间密钥IK；
处理模块，还用于基于第三中间密钥CK和第四中间密钥IK，生成第五中间密钥K AUSF；
处理模块，还用于基于第五中间密钥K AUSF生成第一中间密钥K SEAF。
结合第七方面，在第七方面的一种可能的实现方式中，
收发模块，还用于获取第三中间密钥CK和第四中间密钥IK；
处理模块，还用于基于第三中间密钥CK和第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
处理模块，还用于基于第六中间密钥CK’和第七中间密钥IK’生成第五中间密钥K AUSF；
处理模块，还用于基于第五中间密钥K AUSF生成第一中间密钥K SEAF。
结合第七方面，在第七方面的一种可能的实现方式中，
处理模块，还用于基于第一中间密钥K SEAF、第一标识、第一标识的长度、ABBA以及ABBA的长度生成第二中间密钥K AMF。
第八方面，本申请实施例提出一种通信装置，包括：
处理模块，用于基于SUPI生成第一标识；
收发模块，用于向认证服务器功能网元AUSF发送该第一标识；
收发模块，还用于向安全锚点功能网元SEAF发送该第一标识；
收发模块，还用于向移动管理功能网元AMF发送该第一标识；
处理模块，还用于基于第一中间密钥K SEAF、该第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
收发模块，还用于向移动管理功能网元AMF发送该第二中间密钥；
处理模块，还用于基于该第二中间密钥生成非接入层NAS密钥，其中，该NAS密钥用于对NAS消息进行保护。
结合第八方面，在第八方面的一种可能的实现方式中，
收发模块，还用于接收该AMF发送的第一服务网络标识；
收发模块，还用于向UDM发送第一服务网络标识；
处理模块，用于生成第一标识，具体包括：
该第三条件满足时，处理模块，用于基于该UE的SUPI生成该第一标识，该第三条件包括：
第一服务网络标识包括PLMN ID和NID，或者，
第一服务网络标识包括PLMN ID和NID，并且，第二服务网络标识包括PLMN ID但不包括NID，或者，
UE的拜访网络为SNPN网络，或者，
UE的拜访网络为SNPN网络，并且UE的归属网络为PLMN网络，或者，
UE的拜访网络和UE的归属网络为两个不同的网络，或者，
UDM本地配置指示生成第一标识。
结合第八方面，在第八方面的一种可能的实现方式中，
处理模块，还用于保存第一标识与SUPI的对应关系。
结合第八方面，在第八方面的一种可能的实现方式中，
处理模块，还用于基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
处理模块，还用于基于第三中间密钥CK和第四中间密钥IK，生成第五中间密钥K AUSF；
收发模块，还用于将第五中间密钥K AUSF发送至AUSF；
处理模块，还用于基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
收发模块，还用于将第一中间密钥K SEAF发送给SEAF。
结合第八方面，在第八方面的一种可能的实现方式中，
处理模块，还用于基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
处理模块，还用于基于第三中间密钥CK和第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
收发模块，还用于将第六中间密钥CK’和第七中间密钥IK’发送至AUSF；
处理模块，还用于基于第六中间密钥CK’和第七中间密钥IK’生成第五中间密钥K AUSF，并基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
收发模块，还用于将第一中间密钥K SEAF发送给SEAF。
第九方面，本申请实施例提出一种通信装置，包括：
收发模块，用于被配置第一协议网络支持的认证方式；
收发模块，还用于接收认证服务器功能网元AUSF发送的第一服务网络标识；
处理模块，用于基于该第一服务网络标识以及本地配置的第一协议网络支持的认证方式，选择使用的认证方式；
收发模块，还用于向AUSF发送选择使用的认证方式。
结合第九方面，在第九方面的一种可能的实现方式中，
收发模块，还用于向UDM发送的携带第一服务网络标识的认证向量请求消息，该认证向量请求消息用于请求调用UDM提供的认证向量服务或者认证服务。
结合第九方面，在第九方面的一种可能的实现方式中，
收发模块，还用于向AUSF发送认证向量响应消息，在该认证向量响应消息中携带选择的认证方式。该认证向量响应消息，用于响应接收到的认证向量请求消息。
第十方面，本申请实施例提出一种通信装置，包括：
收发模块，用于接收AUSF发送的第一认证方式；
处理模块，用于根据接收到的第一认证方式选择使用的认证方式；
收发模块，还用于向该AUSF发送该选择使用的认证方式。
结合第十方面，在第十方面的一种可能的实现方式中，可以包括：
收发模块，还用于向UDM发送认证向量请求消息，该认证向量请求消息用于请求调用UDM提供的认证向量服务或者认证服务，该认证向量请求消息中携带第一认证方式。
结合第十方面，在第十方面的一种可能的实现方式中，可以包括：
收发模块，还用于向AUSF发送认证向量响应消息，在该认证向量响应消息中携带选择的认证方式。该认证向量响应消息，用于响应接收到的认证向量请求消息。
结合第十方面，在第十方面的一种可能的实现方式中，可以包括：
收发模块，还用于接收到SEAF发送的第一认证方式。
第十一方面，本申请实施例提供了一种网络设备，包括：
收发器，还用于接收统一数据管理UDM发送的终端设备的签约永久标识SUPI，其中，SUPI用于标识UE；
处理器，还用于基于SUPI生成第一标识；
收发器，还用于向安全锚点功能SEAF发送第一标识；
处理器，还用于基于第一中间密钥K SEAF、第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
收发器，还用于向接入移动管理功能AMF发送第二中间密钥K AMF；
处理器，还用于基于第二中间密钥K AMF生成非接入层NAS密钥，其中，NAS密钥用于对NAS消息进行保护。
结合第十一方面，在第十一方面的一种可能的实现方式中，
收发器，还用于向UDM发送第一标识；
收发器，还用于接收第一标识，并保存第一标识与SUPI之间的对应关系。
结合第十一方面，在第十一方面的一种可能的实现方式中，
收发器，还用于接收AMF发送的第一服务网络标识；
处理器，用于生成第一标识，具体包括：
当第一服务网络标识包括公共陆地移动网络标识PLMN ID和网络标识NID时，
或者，当第一服务网络标识包括PLMN ID和NID，并且，认证服务器功能AUSF所在网络的标识包括PLMN ID但不包括NID时，处理器，用于生成第一标识。
结合第十一方面，在第十一方面的一种可能的实现方式中，
处理器，还用于基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
处理器，还用于基于第三中间密钥CK和第四中间密钥IK，生成第五中间密钥K AUSF；
收发器，还用于将第五中间密钥K AUSF发送至AUSF；
处理器，还用于基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
处理器，还用于将第一中间密钥K SEAF发送给SEAF。
结合第十一方面，在第十一方面的一种可能的实现方式中，
处理器，还用于基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
处理器，还用于基于第三中间密钥CK和第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
收发器，还用于将第六中间密钥CK’和第七中间密钥IK’发送至AUSF；
处理器，还用于基于第六中间密钥CK’和第七中间密钥IK’生成第五中间密钥K AUSF，并基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
收发器，还用于将第一中间密钥K SEAF发送给SEAF。
结合第十一方面，在第十一方面的一种可能的实现方式中，
收发器，还用于接收AMF发送的AMF支持的认证方式；
收发器，还用于向UDM发送接收到的AMF支持的认证方式；
处理器，还用于基于AMF支持的认证方式选择使用的认证方式；
收发器，还用于向AUSF发送选择使用的认证方式；
收发器，还用于基于选择使用的认证方式向AMF发送认证响应。
第十二方面，本申请实施例提供了一种终端设备，包括：
处理器，还用于基于终端设备的签约永久标识SUPI生成第一标识；
处理器，还用于基于第一中间密钥K SEAF、第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
处理器，还用于基于第二中间密钥K AMF生成NAS密钥，其中，NAS密钥用于对NAS消息进行保护。
结合第十二方面，在第十二方面的一种可能的实现方式中，终端设备还包括收发器；
收发器，还用于向接入移动管理功能AMF发送注册请求，注册请求中携带第一服务网络标识；
处理器，用于基于SUPI生成第一标识，具体包括：
处理器确定第二条件满足时，则处理器基于该SUPI生成第一标识；否则处理器不生成第一标识，第二条件包括：
第一服务网络标识包括PLMN ID和NID，或者，
第一服务网络标识包括PLMN ID和NID，并且，第二服务网络标识包括PLMN ID但不包括NID，或者，
UE的拜访网络为SNPN网络，或者，
UE的拜访网络为SNPN网络，并且UE的归属网络为PLMN网络，或者，
UE的拜访网络和UE的归属网络为两个不同的网络，或者，
UE本地配置指示生成第一标识，或者，
UE接收来自AMF的第二指示，第二指示用于指示UE生成第一标识。
结合第十二方面，在第十二方面的一种可能的实现方式中，
收发器，还用于获取第三中间密钥CK和第四中间密钥IK；
处理器，还用于基于第三中间密钥CK和第四中间密钥IK，生成第五中间密钥K AUSF；
处理器，还用于基于第五中间密钥K AUSF生成第一中间密钥K SEAF。
结合第十二方面，在第十二方面的一种可能的实现方式中，
收发器，还用于获取第三中间密钥CK和第四中间密钥IK；
处理器，还用于基于第三中间密钥CK和第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
处理器，还用于基于第六中间密钥CK’和第七中间密钥IK’生成第五中间密钥K AUSF；
处理器，还用于基于第五中间密钥K AUSF生成第一中间密钥K SEAF。
结合第十二方面，在第十二方面的一种可能的实现方式中，
处理器，还用于基于第一中间密钥K SEAF、第一标识、第一标识的长度、ABBA以及ABBA的长度生成第二中间密钥K AMF。
第十三方面，本申请实施例提供了一种网络设备，包括：
处理器，用于基于SUPI生成第一标识；
收发器，用于向认证服务器功能网元AUSF发送该第一标识；
收发器，还用于向安全锚点功能网元SEAF发送该第一标识；
处理器，还用于基于第一中间密钥K SEAF、该第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
收发器，还用于向移动管理功能网元AMF发送该第二中间密钥；
处理器，还用于基于该第二中间密钥生成非接入层NAS密钥，其中，该NAS密钥用于对NAS消息进行保护。
结合第十三方面，在第十三方面的一种可能的实现方式中，
收发器，还用于接收该AMF发送的第一服务网络标识；
收发器，还用于向UDM发送第一服务网络标识；
处理器，用于生成第一标识，具体包括：
该第三条件满足时，处理器，用于基于该UE的SUPI生成该第一标识，该第三条件包括：
第一服务网络标识包括PLMN ID和NID，或者，
第一服务网络标识包括PLMN ID和NID，并且，第二服务网络标识包括PLMN ID但不包括NID，或者，
UE的拜访网络为SNPN网络，或者，
UE的拜访网络为SNPN网络，并且UE的归属网络为PLMN网络，或者，
UE的拜访网络和UE的归属网络为两个不同的网络，或者，
UDM本地配置指示生成第一标识。
结合第十三方面，在第十三方面的一种可能的实现方式中，
处理器，还用于保存第一标识与SUPI的对应关系。
结合第十三方面，在第十三方面的一种可能的实现方式中，
处理器，还用于基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
处理器，还用于基于第三中间密钥CK和第四中间密钥IK，生成第五中间密钥K AUSF；
收发器，还用于将第五中间密钥K AUSF发送至AUSF；
处理器，还用于基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
收发器，还用于将第一中间密钥K SEAF发送给SEAF。
结合第十三方面，在第十三方面的一种可能的实现方式中，
处理器，还用于基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
处理器，还用于基于第三中间密钥CK和第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
收发器，还用于将第六中间密钥CK’和第七中间密钥IK’发送至AUSF；
处理器，还用于基于第六中间密钥CK’和第七中间密钥IK’生成第五中间密钥K AUSF，并基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
收发器，还用于将第一中间密钥K SEAF发送给SEAF。
第十四方面，本申请实施例提供了一种网络设备，包括：
收发器，用于被配置第一协议网络支持的认证方式；
收发器，还用于接收认证服务器功能网元AUSF发送的第一服务网络标识；
处理器，用于基于该第一服务网络标识以及本地配置的第一协议网络支持的认证方式，选择使用的认证方式；
收发器，还用于向AUSF发送选择使用的认证方式。
结合第十四方面，在第十四方面的一种可能的实现方式中，
收发器，还用于向UDM发送的携带第一服务网络标识的认证向量请求消息，该认证向量请求消息用于请求调用UDM提供的认证向量服务或者认证服务。
结合第十四方面，在第十四方面的一种可能的实现方式中，
收发器，还用于向AUSF发送认证向量响应消息，在该认证向量响应消息中携带选择的认证方式。该认证向量响应消息，用于响应接收到的认证向量请求消息。
第十五方面，本申请实施例提供了一种网络设备，包括：
收发模块，用于接收AUSF发送的第一认证方式；
处理模块，用于根据接收到的第一认证方式选择使用的认证方式；
收发模块，还用于向该AUSF发送该选择使用的认证方式。
结合第十五方面，在第十五方面的一种可能的实现方式中，可以包括：
收发器，还用于向UDM发送认证向量请求消息，该认证向量请求消息用于请求调用UDM提供的认证向量服务或者认证服务，该认证向量请求消息中携带第一认证方式。
结合第十五方面，在第十五方面的一种可能的实现方式中，可以包括：
收发器，还用于向AUSF发送认证向量响应消息，在该认证向量响应消息中携带选择的认证方式。该认证向量响应消息，用于响应接收到的认证向量请求消息。
结合第十五方面，在第十五方面的一种可能的实现方式中，可以包括：
收发器，还用于接收到SEAF发送的第一认证方式。
第十六方面，本申请实施例提供了一种通信装置，该通信装置可以实现上述第一、第二、第三、第四、第五方面所涉及方法中AUSF、UDM、AMF(或SEAF)或终端设备所执行的功能。该通信装置包括处理器、存储器以及与该处理器连接的收发器；该存储器用于存储程序代码，并将该程序代码传输给该处理器；该处理器用于基于该程序代码中的指令驱动该收发器执行如上述第一、二、三、四或五方面的方法；接收器和发射器分别与该处理器连接，以执行上述各个方面的该的方法中AUSF、UDM、AMF(或SEAF)或终端设备的操作。具体地，收发器可以是射频电路，该射频电路通过天线实现接收与发送消息；该收发器还可以是通信接口，处理器与该通信接口通过总线连接，该处理器通过该通信接口实现接收或发送消息。
第十七方面，本申请实施例提供一种通信装置，该通信装置可以包括网络设备或终端设备或者芯片等实体，该通信装置包括：处理器，存储器；该存储器用于存储指令；该处理器用于执行该存储器中的该指令，使得该通信装置执行如前述第一方面或第二方面或第三方面或第四方面或第五方面中任一项可能的实现方法。
第十八方面，本申请实施例提供了一种存储一个或多个计算机执行指令的计算机可读存储介质，当该计算机执行指令被处理器执行时，该处理器执行如前述第一方面或第二方面或第三方面或第四方面中任意一种可能的实现方式。
第十九方面，本申请实施例提供一种存储一个或多个计算机执行指令的计算机程序产品(或称计算机程序)，当该计算机执行指令被该处理器执行时，该处理器执行前述第一方面或第二方面或第三方面或第四方面或第五方面中任一项可能的实现方法。
第二十方面，本申请提供了一种芯片系统，该芯片系统包括处理器，用于支持计算机设备实现上述方面中所涉及的功能。在一种可能的设计中，该芯片系统还包括存储器，该存储器，用于保存计算机设备必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
第二十一方面，本申请提供了一种通信系统，该通信系统包括如上述第十方面、第十二方面、第十三方面、或第十四方面中的网络设备，和/或，上述第十一方面的终端设备。
附图说明
图1a为本申请实施例提供的5G通信系统示意图；
图1b为第五代移动通信系统的密钥架构示意图；
图1c为本申请实施例中5G认证的流程示意图；
图2为本申请实施例中通信装置的硬件结构示意图；
图3为本申请实施例提供的一种通信方法的实施例示意图；
图4为本申请实施例中又一种通信方法的实施例示意图；
图5为本申请实施例中又一种通信方法的实施例示意图；
图6为本申请实施例中又一种通信方法的实施例示意图；
图7为本申请实施例中通信装置的一种实施例示意图；
图8为本申请实施例中通信装置的又一种实施例示意图；
图9为本申请实施例中通信装置的一种实施例示意图；
图10为本申请实施例中通信装置的一种实施例示意图；
图11为本申请实施例中通信装置的一种实施例示意图。
具体实施方式
本申请的说明书和权利要求书及上述附图中的术语“第一”、第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的术语在适当情况下可以互换，这仅仅是描述本申请的实施例中对相同属性的对象在描述时所采用的区分方式。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，以便包含一系列单元的过程、方法、系统、产品或设备不必限于那些单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它单元。
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚地描述。在本申请的描述中，除非另有说明，“/”表示或的意思，例如，A/B可以表示A或B；本申请中的“和/或”仅仅是一种描述关联对象的对应关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，在本申请的描述中，“至少一项”是指一项或者多项，“多项”是指两项或两项以上。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b，或c中的至少一项(个)，可以表示：a，b，c，a-b，a-c，b-c，或a-b-c，其中a，b，c可以是单个，也可以是多个。
在本申请中，网络功能(例如：接入和移动管理功能，安全锚点功能，统一数据管理功能，或认证服务器功能等等)或者终端设备UE基于A生成B，可以表示网络功能接收到A之后生成B，或者网络功能使用A作为参数生成B。网络功能接收到A之后生成B，可以是网络功能接收到A之后任意时刻生成B。当网络功能使用A作为参数生成B时，指网络功能生成B时使用的参数包括A，也可能包括除了A之外的其他参数。在本申请中，网络功能根据A生成B，指网络功能生成B使用的参数包括A，也可能包括除了A之外的其他参数。
图1a示出了本申请实施例提供的5G通信系统示意图。在5G移动网络架构中，移动网关的控制面功能和转发面功能解耦，其分离出来的控制面功能与第三代合作伙伴计划(third generation partnership project，3GPP)传统的控制网元移动性管理实体(mobility management entity，MME)等合并成统一的控制面(control plane)功能。用户面功能(User plane function，UPF)能实现服务网关(serving gateway，SGW)和分组数据网络网关(packet data network gateway，PGW)的用户面功能(SGW-U和PGW-U)。进一步的，统一的控制面功能可以分解成接入和移动管理功能(access and mobility management function，AMF)和会话管理功能(session management function，SMF)。
如图1a所示，该通信系统至少包括终端设备，也称为用户设备(user equipment，UE)、 接入与移动管理功能AMF、认证服务器功能(authentication server function，AUSF)，统一数据管理(unified data management，UDM)功能，无线接入网(Radio Access Network，RAN)网元，和会话管理功能(Session Management Function，SMF)。
需要说明的是，UE与AMF之间的交互都是通过RAN，即本申请实施例中，UE向AMF发送的消息，指的是UE向RAN发送该消息，RAN将该消息发送给AMF；AMF向UE发送的消息，指的是AMF向RAN发送该消息，RAN将该消息发送给UE。
具体的，UE过N1接口与AMF通信；AMF通过N12接口与AUSF通信；AMF通过N8接口与UDM通信；AUSF通过N13接口与UDM通信；AMF通过N11接口与SMF通信。
其中，本系统中所涉及到的终端设备不受限于5G网络，包括：手机、物联网设备、智能家居设备、工业控制设备、车辆设备等等。本申请实施例中，终端设备为各种具有线通信功能的终端设备或装置，例如：移动电话(或称为“蜂窝”电话)和具有移动终端的计算机，还可以是便携式、袖珍式、手持式、计算机内置的或者车载的移动装置，它们与无线接入网交换语言和/或数据。例如，个人通信业务(personal communication service，PCS)电话、无绳电话、会话发起协议(SIP)话机、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)等设备。通信设备也可以称为系统、订户单元(subscriber unit)、订户站(subscriber station)，移动站(mobile station)、移动台(mobile)、远程站(remote station)、接入点(access point)、远程终端(remote terminal)、接入终端(access terminal)、用户终端(user terminal)、用户代理(user agent)、用户设备(user device)、或用户装备(user equipment，UE)。例如车辆、车载设备、车载模块或单元、路测基础设备、手持设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备，例如车辆用户设备(vehicle user equipment，VUE)或空调用户设备等等。
RAN的主要功能是控制用户通过无线接入到移动通信网络。RAN是移动通信系统的一部分。它实现了一种无线接入技术。从概念上讲，它驻留某个设备之间(如移动电话、一台计算机，或任何远程控制机)，并提供与其核心网的连接。RAN设备包括但不限于：5G中的(gnodeB，gNB)、演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(Base Band Unit，BBU)、传输点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、移动交换中心等，此外，还可以包括无线保真(wireless fidelity，wifi)接入点(access point，AP)等。
本系统中所涉及到的AMF网元可负责终端设备的注册、移动性管理、跟踪区更新流程等。AMF网元也可称为AMF设备或AMF实体。
本系统中所涉及到的AUSF网元能够提供对用户设备的鉴权控制。
本系统中所涉及到的UDM网元能够存储用户的签约数据。例如，用户的签约数据包括移动性管理相关的签约数据以及会话管理相关的签约数据。所述UDM网元也可称为UDM设备或UDM实体。
本系统中所涉及到的还包括SMF，可负责终端设备的会话管理。例如，会话管理包括用户面设备的选择、用户面设备的重选、IP地址分配、服务质量(quality of service，QoS)控制，以及会话的建立、修改或释放等。
可选的，上述5G通信系统中还包括无线接入网(radio access network，RAN)设备。RAN设备是一种用于为终端设备提供无线通信功能的装置。RAN设备可以包括各种形式的基站，例如：宏基站，微基站(也称为小站)，中继站，接入点等。在采用不同的无线接入技术的系统中，具备基站功能的设备的名称可能会有所不同，例如，在LTE系统中，称为演进的节点B(evolved NodeB，eNB或者eNodeB)，在第三代(3rd generation，3G)系统中，称为节点B(NodeB)等。在新一代系统中，称为gNB(gNodeB)。
可选的，上述5G通信系统中还包括UPF网元，可以实现用户报文的转发、统计和检测等功能。UPF网元也可称为UPF设备或UPF实体。
可选的，上述5G通信系统中还包括策略控制功能(policy control function，PCF)网元。该网元包括策略控制和基于流计费控制的功能。例如，PCF网元可实现用户签约数据管理功能、策略控制功能、计费策略控制功能、QoS控制等。PCF网元可也称为PCF实体或PCF设备。
可选的，图1a所示的网元中，还可以包括安全锚点功能(security anchor function，SEAF)网元，其中，SEAF网元与AMF网元合设。
需要说明的是，在图1a中，还可包括其它的网元(或称为功能实体)，例如：SMF网元：负责终端会话；例如有，建立用户面传输路径、释放和更改等会话管理功能、选择UPF网元分配、互联网协议(internet protocol，IP)地址、会话的服务质量(quality of service，QoS)管理、从PCF网元获取策略控制和计费(policy control and charging，PCC)策略等。NEF网元：负责连接SMF网元与外部DN网络，可以包括第三方认证网元。UPF网元：作为PDU网元会话连接的锚定点，负责对终端的数据报文过滤、数据传输/转发、速率控制、生成计费信息等。PCF网元：为网络网元分配参考信息，例如，为SMF网元或NEF网元分配参考信息。网络切片选择功能(network slice selection function，NSSF)：用于为UE选择合适的网络切片。数据网络(data network，DN)：提供外部数据网络服务。应用功能(application function，AF)：应用功能，用于为外部应用与核心网的PCF网元之间进行交互，主要用于对应用所对应的IP连接访问网络(IP-connectivity access network，IP-CAN)进行策略和计费控制。在这里仅重点描述本申请涉及的几个网元(功能实体)。各网元之间通过Nx接口连接(例如图中的N1、N8等)。
对于现有技术中的网络切片架构，UPF网元和SMF网元是每个网络切片独有的网元，而AMF网元、PCF网元、AUSF网元和UDM网元是多个网络切片共享的网元。所以在现有架构中，AUSF网元和UDM网元中的终端设备的安全和隐私信息(例如：用户的标识、签约数据、策略、通信数据安全等)还是由运营商公网进行控制管理。
上述各网元既可以是在专用硬件上实现的网络元件，也可以是在专用硬件上运行的软件实例，或者是在适当平台上虚拟化功能的实例，例如，上述虚拟化平台可以为云平台。
此外，本申请实施例还可以适用于面向未来的其他通信技术，例如6G等。本申请描述 的网络架构以及业务场景是为了更加清楚的说明本申请的技术方案，并不构成对本申请提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请提供的技术方案对于类似的技术问题，同样适用。
作为一种新的应用场景，3GPP提出了一种可支持服务提供商(Service Provider，SP)的独立非公共网络(Standalone Non-Public Network，SNPN)架构。在该架构中，SP承担归属网络(home network)的角色，SNPN承担了拜访网络(Visited Network)的角色，其中，SP拥有终端设备的签约数据(Subscription)和凭据(Credential)。示例性的，智能手机选择智能手机的服务网络，获取第一服务网络标识。智能手机通过基站接入拜访网络(Visited Network)时，该智能手机向拜访网络中AMF发送注册请求。
在UE侧，该智能手机基于向AMF发送的注册请求消息。
在网络侧，该AMF发起认证流程，该AMF向AUSF发送第一认证请求消息，第一认证请求消息用于请求调用AUSF提供的认证服务，该第一认证请求消息中携带第一服务网络标识。该AUSF属于UE的归属网络(home network)。第一认证请求消息中还携带AMF支持的认证方式。
该AUSF向UDM发送认证向量请求消息，该认证向量请求消息中携带第一服务网络标识和接收到到AMF支持的认证方式。UDM根据接收到的AMF支持的认证方式，选择使用的认证方式。UDM基于该选择使用的认证方式，生成认证向量。UDM向AUSF发送认证向量响应消息，该认证向量响应消息中携带该选择使用的认证方式和UDM生成的认证向量。该认证向量响应消息中还包括UE的SUPI。该认证向量中可以包括认证令牌(authentication token，AUTN)，随机数(RAND)，以及预期响应(eXpected response，XRES或XRES*)。该认证向量中还可以包括第五中间密钥K AUSF，或者，第六中间密钥CK’和第七中间密钥IK’。
AUSF接收该认证向量响应消息后，向AMF发送认第一认证响应消息，该认证响应中携带AUTN和RAND。当AUSF接收到第六中间密钥CK’和第七中间密钥IK’后，AUSF计算第五中间密钥K AUSF。
收到携带认证令牌AUTN和RAND的第一认证响应消息后，AMF向该智能手机发送第二认证请求消息，该第二认证请求消息中携带AUTN和RAND。
在UE侧，该智能手机根据接收到的第二认证请求消息，计算响应(Response，RES或RES*)。该智能手机向AMF发送第二认证响应消息，该第二认证响应消息中携带计算的响应(RES或RES*)。UE还确定是否要生成第一标识。如果第二条件满足，则UE生成第一标识。第二条件包括：
第一服务网络标识包括PLMN ID和NID，或者，
第一服务网络标识包括PLMN ID和NID，并且，第二服务网络标识包括PLMN ID但不包括NID，或者，
UE的拜访网络为SNPN网络，或者，
UE的拜访网络为SNPN网络，并且UE的归属网络为PLMN网络，或者，
UE的拜访网络和UE的归属网络为两个不同的网络，或者，
UE本地配置指示生成第一标识，或者，
UE接收来自AMF的第二指示，第二指示用于指示UE生成第一标识。
UE还生成密钥。具体的，UE(或者全球签约用户身份模块(universal subscriber identity module，USIM))基于接收到的RAND和长期密钥K，生成第三中间密钥CK和第四中间密钥IK。UE生成第五中间密钥K AUSF。UE生成第五中间密钥K AUSF，可以包括：UE基于第三中间密钥CK，第四中间密钥IK生成第五中间密钥K AUSF，或者，UE基于第三中间密钥CK，第四中间密钥IK生成第六中间密钥CK’和第七中间密钥IK’，然后UE基于第六中间密钥CK’和第七中间密钥IK’，生成第五中间密钥K AUSF。UE根据第五中间密钥K AUSF生成第一中间密钥K SEAF。UE基于第一中间密钥K SEAF，第一标识，和ABBA参数，生成第二中间密钥K AMF。该智能手机基于该第二中间密钥K AMF生成非接入层(Non-Access Stratum，NAS)密钥，该NAS密钥用于对NAS层信息进行保护。
在网络侧，AMF接收到来自该智能手机的第二认证响应消息后，AMF向AUSF发送第三认证请求消息给AUSF，该第三认证请求消息中携带接收到的RES或RES*。AUSF验证接收到的RES或RES*，具体的，验证接收到的RES或RES*与从UDM获取到的预期响应(XRES或XRES*)是否相同。校验成功后，AUSF确定是否生成第一标识，具体的，如果第一条件满足时，AUSF生成第一标识。第一条件包括：
AUSF接收到的该第一服务网络标识包括PLMN ID和NID，或者，
AUSF接收到的该第一服务网络标识包括PLMN ID和NID，并且，第二服务网络标识包括PLMN ID但不包括NID，或者，
UE的拜访网络为SNPN网络，或者，
UE的拜访网络为SNPN网络，并且UE的归属网络为PLMN网络，或者，
UE的拜访网络和UE的归属网络为两个不同的网络，或者，
AUSF本地配置指示生成第一标识。
AUSF基于该智能手机的SUPI生成第一标识。AUSF生成该第一标识后，向SEAF发送第一标识。SEAF基于第一中间密钥K SEAF、ABBA参数和第一标识生成第二中间密钥K AMF；SEAF向AMF发送第二中间密钥K AMF；AMF基于第二中间密钥K AMF生成非接入层NAS密钥，其中，NAS密钥用于对NAS消息进行保护。AUSF生成第一标识后，向UDM发送该第一标识。UDM接收第一标识，并保存第一标识与SUPI之间的对应关系。在本应用场景中，AUSF生成第一标识，该第一标识用于标识UE，AUSF向SEAF发送该第一标识，避免了向SEAF发送SUPI，从而避免了泄露UE的隐私信息，提升了通信的安全性。
接下来，介绍第五代移动通信系统的密钥架构，请参阅图1b，图1b为第五代移动通信系统的密钥架构示意图。
UE(或USIM)和UDM(或ARPF或统一数据存储(Unified Data Repoitory，UDR))上保存UE的长期密钥K。
在网络设备侧，UDM或者ARPF基于UE的长期密钥K，生成第三中间密钥CK和第四中间密钥IK。UDM选择的认证方式不同，生成第五中间密钥K AUSF的方式存在差异。当UDM选择使用的认证方式为5G AKA时，UDM或者ARPF根据第三中间密钥CK和第四中间密钥IK，生成第五中间密钥K AUSF。UDM将生成的第五中间密钥K AUSF发送给AUSF。当UDM选择使用的认 证方式为EAP-AKA’时，UDM或者ARPF根据第三中间密钥CK和第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’。UDM将生成的第六中间密钥CK’和第七中间密钥IK’发送给AUSF。AUSF根据第六中间密钥CK’和第七中间密钥IK’生成第五中间密钥K AUSF。
AUSF根据第五中间密钥K AUSF生成第一中间密钥K SEAF，并将第一中间密钥K SEAF发送给SEAF。SEAF根据第一中间密钥K SEAF生成第二中间密钥K AMF并将第二中间密钥K AMF发送给AMF。AMF根据第二中间密钥K AMF生成NAS密钥。
在终端设备侧，首先，USIM基于UE的长期密钥K，生成第三中间密钥CK和第四中间密钥IK。USIM将第三中间密钥CK和第四中间密钥IK发送给UE。其次，与网络侧类似，不同认证方式下生成第五中间密钥K AUSF的方式存在差异。当使用的认证方式为5G AKA时，UE根据第三中间密钥CK和第四中间密钥IK，生成第五中间密钥K AUSF。当使用的认证方式为EAP-AKA’时，UE根据第三中间密钥CK和第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’。UE根据第六中间密钥CK’和第七中间密钥IK’生成第五中间密钥K AUSF。
UE根据第五中间密钥K AUSF生成第一中间密钥K SEAF。UE根据第一中间密钥K SEAF生成第二中间密钥K AMF。UE根据第二中间密钥K AMF生成NAS密钥。
其次，介绍本申请实施例涉及的认证流程，请参阅图1c，图1c为本申请实施例中5G认证的流程示意图。该认证流程中涉及到的密钥生成请见图1b描述。
S1、SEAF向AUSF发送第一认证请求消息。
步骤S1中，SEAF决定发起主认证，主认证用于网络侧和UE进行双向认证并生成密钥。
具体的，SEAF向AUSF发送第一认证请求消息，该第一认证请求消息用于请求调用AUSF提供的认证服务。该第一认证请求消息中携带UE的标识和第一服务网络标识。
第一认证请求中携带的UE标识可能为签约隐藏标识符(subscription concealed identifier，SUCI)或者SUPI。
S2、AUSF向UDM发送认证向量请求消息。
步骤S2中，AUSF根据接收到第一认证请求消息向UDM发送认证向量请求消息，其中，该认证向量请求消息用于请求调用UDM提供的认证向量服务，或用于请求认证向量。第一认证请求消息中携带接收到的第一服务网络标识和UE的标识。
S3、UDM选择使用的认证方式。
步骤S3中，如果UDM接收到SUCI，则UDM根据SUCI获取UE的SUPI。UDM选择使用的认证方式，并根据选择的认证方式，生成认证向量。
如果UDM选择的认证方式是5G AKA，则UDM生成的认证向量，称为第一认证向量；如果UDM选择的认证方式是EAP-AKA'，则UDM生成的认证向量，称为第二认证向量。具体的，第二认证向量，包括：随机数(RAND)，认证令牌(Authentication Token，AUTN)，第二预期响应(XRES)，第六中间密钥(CK’)和第七中间密钥(IK’)。第一认证向量，包括：随机数(RAND)、认证令牌(Authentication Token，AUTN)，第一预期响应(XRES*)，第五中间密钥(K AUSF)。其中，AUTN包括认证管理字段(Authentication Management Field)，序列号(Sequence number，SQN)与匿名密钥AK的异或，和消息认证码MAC。AK为UDM或ARPF根据UE的长期密钥K和RAND生成。MAC为UDM或ARPF根据UE的长期密钥K，认证 管理字段，RAND，SQN生成。XRES为UDM或ARPF根据UE的长期密钥K和RAND生成。XRES*为UDM或ARPF根据第三中间密钥CK和第四中间密钥IK，第一服务网络标识，RAND，和XRES生成。
在本申请实施例中，认证向量的一部分为以下中的任意一项或者多项：RAND，AUTN，CK、IK、CK’、IK’、XRES、AK、认证管理字段、K、SQN以及MAC。认证向量的一部分还可以为，对RAND，AUTN，CK、IK、CK’、IK’、XRES、AK、认证管理字段、K、SQN以及MAC中的任意一项或者多项进行任意运算的结果。运算包括但不限于，异或运算、串联运算、哈希运算等。认证向量的一部分还可以为以下中的任意一项或者多项：RAND，AUTN，K AUSF、XRES*、XRES、CK、IK、AK、AMF、K、SQN以及MAC。认证向量的一部分还可以为，对RAND，AUTN，K AUSF、XRES*、XRES、CK、IK、AK、AMF、K、SQN以及MAC中的任意一项或者多项进行任意运算的结果。运算包括但不限于，异或运算、串联运算、以及哈希运算等。
S4、UDM向AUSF发送生成的认证向量、选择使用的认证方式、和SUPI的认证向量响应消息。
步骤S4中，认证向量响应消息是UDM对接收到的认证向量请求消息的响应。
S5、AUSF在接收到认证向量响应消息之后，向SEAF发送携带RAND，AUTN的第一认证响应消息。
步骤S5中，第一认证响应消息是AUSF对第一认证请求消息的响应。
如果选择使用的认证方式为5G AKA，则AUSF在向SEAF发送第一认证响应之前，AUSF还生成第一中间密钥K SEAF。
S6、SEAF向UE发送第二认证请求消息。
步骤S6中，SEAF向UE发送第二认证请求消息，该第二认证请求消息用于请求UE进行主认证。第二认证请求消息携带RAND和AUTN。
S7、UE校验第二认证请求消息。
步骤S7中，UE接收到第二认证消息之后，对第二认证请求消息进行校验，校验AUTN是否可接受。
如果可以接受，则UE生成响应RES或RES*。具体的，UE根据第二认证请求消息，确定网络侧使用的认证方式：
如果网络侧使用的认证方式为5G AKA，则UE生成RES*。UE采用与UDM生成XRES*相同的方法生成RES*，即UE根据第三中间密钥CK和第四中间密钥IK，第一服务网络标识，RAND，和RES生成。RES为UE根据UE长期密钥K和RAND生成。
如果网络侧使用的认证方式为EAP-AKA’则UE生成RES。UE采用与UDM生成XRES相同的方法生成RES，即UE根据UE长期密钥K和RAND生成RES。
UE生成RES或RES*之前，生成第三中间密钥CK和第四中间密钥IK。
S8、UE向SEAF发送第二认证响应消息。第二认证响应消息中包括RES或RES*。
S9、SEAF向AUSF发送第三认证请求消息。第三认证请求消息中包括接收到的RES或RES*。
S10、AUSF验证接收到的RES或者RES*。
步骤S10中，当接收到RES与XRES相同，或接收到的RES*与XRES*相同时，则AUSF验证RES或RES*成功。如果AUSF验证成功，则进行步骤S11；如果AUSF验证失败，则向SEAF返回错误。
S11、AUSF向SEAF发送第三认证响应消息。
步骤S11中，第三认证响应消息中携带第一中间密钥K SEAF。
如果选择使用的认证方式是EAP-AKA’，则AUSF在发送第三认证响应消息之前，AUSF生成第一中间密钥K SEAF。
S12、AUSF向UDM发送认证结果确认服务请求消息。
步骤S12中，AUSF在验证RES或RES*之后，向UDM发送认证结果确认服务请求消息。该认证结果确认服务请求消息用于向UDM通知认证结果。
S13、SEAF生成第二中间密钥K AMF。
步骤S13中，SEAF在接收到第三认证响应消息之后，生成第二中间密钥K AMF，并将第二中间密钥K AMF发送给AMF。
在本申请实施例中，UE的SUPI用于标识UE。SUPI的定义为：SUPI类型和SUPI值。SUPI类型可能是国际移动用户识别码(International Mobile Subscriber Identity，IMSI)，或者网络特定标识(Network specific identifier)。当SUPI类型为IMSI时，SUPI的值为IMSI。当SUPI类型为网络特定标识时，则SUPI值采用网络接入标识(Network Access Identifier，NAI)格式，即为username@realm。其中username为用户名，realm为用户名对应的领域。
上述IMSI也用于标识UE。IMSI包括移动国际代码(Mobile Country Code，MCC)，移动网络代码(Mobile Network Code)和移动签约识别号码(Mobile Subscriber Identification Number，MSIN)。MSIN用于标识一个PLMN或者SNPN中的移动签约。SUPI的一部分是指以下信息中的一项或者多项：IMSI，MCC，MNC，MSIN，username，或realm。
在本申请实施例中，PLMN ID用于标识一个PLMN网络。PLMN ID包括MCC和MNC。
在本申请实施例中，一个SNPN网络使用PLMN ID和NID标识。NID包括分配模式(assignment mode)和NID值。分配模式可以是自分配(self-assignment)，即在部署时由各SNPN自行分配，或者，协作分配(Coordinated assignment)。
图2为本申请实施例中通信装置的硬件结构示意图。该通信装置可以是本申请实施例中AUSF、UDM、AMF(或SEAF)或终端设备的一种可能的实现方式。如图2所示，通信装置至少包括处理器204，存储器203，和收发器202，存储器203进一步用于存储指令2032和数据2032。可选的，该通信装置还可以包括天线206，I/O(输入/输出，Input/Output)接口210和总线212。收发器202进一步包括发射器2022和接收器2022。此外，处理器204，收发器202，存储器203和I/O接口210通过总线212彼此通信连接，天线206与收发器202相连。
处理器204可以是通用处理器，例如但不限于，中央处理器(Central Processing Unit，CPU)，也可以是专用处理器，例如但不限于，数字信号处理器(Digital Signal Processor，DSP)，应用专用集成电路(Application Specific Integrated Circuit，ASIC)和现场可编 程门阵列(Field Programmable Gate Array，FPGA)等。此外，处理器204还可以是多个处理器的组合。特别的，在本申请实施例提供的技术方案中，处理器204可以用于执行，后续方法实施例中通信方法的相关步骤。处理器204可以是专门设计用于执行上述步骤和/或操作的处理器，也可以是通过读取并执行存储器203中存储的指令2032来执行上述步骤和/或操作的处理器，处理器204在执行上述步骤和/或操作的过程中可能需要用到数据2032。
收发器202包括发射器2022和接收器2022，在一种可选的实现方式中，发射器2022用于通过天线206发送信号。接收器2022用于通过天线206之中的至少一根天线接收信号。特别的，在本申请实施例提供的技术方案中，发射器2022具体可以用于通过天线206之中的至少一根天线执行，例如，后续方法实施例中通信方法应用于AUSF、UDM、AMF(或SEAF)或终端设备时，AUSF、UDM、AMF(或SEAF)或终端设备中接收模块或发送模块所执行的操作。
在本申请实施例中，收发器202用于支持通信装置执行前述的接收功能和发送功能。将具有处理功能的处理器视为处理器204。接收器2022也可以称为接收机、输入口、接收电路等，发射器2022可以称为发射机、发射器或者发射电路等。
处理器204可用于执行该存储器203存储的指令，以控制收发器202接收消息和/或发送消息，完成本申请方法实施例中通信装置的功能。作为一种实现方式，收发器202的功能可以考虑通过收发电路或者收发的专用芯片实现。
存储器203可以是各种类型的存储介质，例如随机存取存储器(Random Access Memory，RAM)，只读存储器(Read Only Memory，ROM)，非易失性RAM(Non-Volatile RAM，NVRAM)，可编程ROM(Programmable ROM，PROM)，可擦除PROM(Erasable PROM，EPROM)，电可擦除PROM(Electrically Erasable PROM，EEPROM)，闪存，光存储器和寄存器等。存储器203具体用于存储指令2032和数据2032，处理器204可以通过读取并执行存储器203中存储的指令2032，来执行本申请方法实施例中所述的步骤和/或操作，在执行本申请方法实施例中操作和/或步骤的过程中可能需要用到数据2032。
可选的，该通信装置还可以包括I/O接口210，该I/O接口210用于接收来自外围设备的指令和/或数据，以及向外围设备输出指令和/或数据。
下面介绍本申请实施例的方法部分，在前述图1a-图1c的基础上，请参阅图3，图3为本申请实施例提供的一种通信方法的实施例示意图。图1b中的所示的密钥生成流程，和图1c中所示的密钥传递流程，适用于图3。本申请实施例提出的一种通信方法包括：
301、UE向AMF发送注册请求消息。
本实施例中，该注册请求消息中携带UE的标识，比如可能是签约隐藏标识
(Subscription Concealed Identifier，SUCI)。
302、SEAF向AUSF发送第一认证请求消息，第一认证请求消息中携带第一服务网络标识。
本实施例中，AMF接收到UE的注册请求消息之后，通知SEAF该注册请求消息。具体的，SEAF响应于该注册请求消息，SEAF发起主认证。首先，SEAF向AUSF发送第一认证请 求消息。第一认证请求消息用于请求调用AUSF提供的认证服务。主认证用于实现和UE和网络侧的双向认证并生成密钥。该第一认证请求消息中还携带UE标识，比如接收到的SUCI。
示例的，该第一认证请求消息为Nausf_UEAuthentication_Authenticate Request消息。
该AMF或SEAF所在的网络，为UE的服务网络。在漫游场景中，该UE的服务网络，也称为UE的拜访网络。
在本申请实施例中，第一服务网络标识为UE的服务网络的标识，用于标识该UE的服务网络。当UE的服务网络为SNPN，第一服务网络标识包括PLMN ID和NID，该PLMN ID和NID一起用于标识该服务网络。当UE的服务网络为PLMN时，第一服务网络标识包括PLMN ID但不包括NID，该PLMN ID可以标识该服务网络。
AUSF所在的网络称为UE的归属网络。该归属网络可以是PLMN或SNPN。
在本申请实施例中，第二服务网络标识，用于标识该UE的归属网络。当UE的归属网络为SNPN，第二服务网络标识包括PLMN ID和NID，该PLMN ID和NID一起用于标识该归属网络。当UE的归属网络为PLMN时，第二服务网络标识包括PLMN ID但不包括NID，该PLMN ID可以标识该归属网络。
在一种可选的实现方式中，第一认证请求消息中携带第一认证方式，第一认证方式为AMF支持的认证方式，或者SEAF支持的认证方式，或者UE的拜访网络支持的认证方式，或者UE的服务网络支持的认证方式。
在另一种可选的实现方式中，该第一认证请求消息中，也可以不携带第一认证方式。在这种情况下，该第一认证方式可以通过其它消息发送至AUSF中，例如是新定义的消息。
303、AUSF向UDM发送认证向量请求消息，该认证向量请求消息中携带第一服务网络标识。
本实施例中，该认证向量请求消息用于请求调用UDM提供的认证服务(或者认证向量服务，或者用于请求认证向量)。示例地的，该认证向量请求消息为Nudm_UEAuthentication_Get Request消息。该认证向量请求消息还可以携带UE的标识。
在一种可选的实现方式中，该认证向量请求消息中携带AUSF接收到的第一认证方式。
在一种可选的实现方式中，该认证向量请求消息中也可以不携带第一认证方式。在这种情况下，该第一认证方式可以通过其它消息发送至UDM中，例如是新定义的消息。
304、UDM选择使用的认证方式。
本实施例中，UDM根据接收到的第一认证方式，选择使用的认证方式。例如：EAP-AKA’或5G AKA。
305、UDM向AUSF发送认证向量响应消息，该认证向量响应消息中携带该选择使用的认证方式。
本实施例中，在UDM向AUSF发送认证向量响应消息之前，UDM生成认证向量。具体的，UDM根据该选择使用的认证方式，生成对应的认证向量。具体生成认证向量的流程，请参阅前述图1c相关描述，此处不再赘述。
可选的，在UDM生成认证向量之前，如果UDM接收到的UE标识是SUCI，则UDM根据 SUCI获取UE的SUPI，以及UE的签约数据，包括UE的长期密钥K。
该认证向量响应消息中携带该生成的认证向量。
该认证向量响应消息中还携带该UE的SUPI。
示例的，该认证向量响应消息为Nudm_UEAuthentication_Get Response消息。
306、AUSF向SEAF发送第一认证响应消息。
本实施例中，示例的，该第一认证响应消息为Nausf_UEAuthentication_Authenticate Response消息。该第一认证响应消息中携带AUSF接收到的认证向量中的RAND和AUTN。
307、AMF向UE发送第二认证请求消息。
本实施例中，首先，SEAF通知AMF，SEAF接收到来自AUSF的第一认证响应消息。其次，AMF响应于该第一认证响应消息，AMF向UE发送第二认证请求消息，该第二认证请求消息中携带接收到的RAND和AUTN。
示例的，该第二认证请求消息为Authenticate Request消息。
308、UE向AMF发送第二认证响应消息。
本实施例中，首先，UE在接收到RAND和AUTN之后，验证AUTN是否可接受，并生成响应(RES或RES*)。具体生成响应的步骤，请参阅前述图1c的相关描述，此处不再赘述。
其次，UE向AMF发送生成的响应(RES或RES*)，具体的，通过第二认证响应消息向AMF发送该响应。该第二认证响应消息中包括RES或RES*。该响应用于网络侧验证UE。示例的，该第二认证响应消息为Authenticate Response消息。
309、SEAF向AUSF发送第三认证请求消息，第三认证请求消息携带RES或RES*。
本实施例中，AMF在接收到来自UE的第二认证响应消息之后，通知SEAF该第二认证响应消息。SEAF响应于该第二认证响应消息，SEAF向AUSF发送第三认证请求消息，该第三认证请求消息携带AMF接收到的RES或RES*。
示例的，该第三认证请求消息为Nausf_UEAuthentication_Authenticate Request消息。
310、AUSF校验接收到的响应。
本实施例中，AUSF校验来自UE的响应(携带于第三认证请求消息中)，该响应即RES或RES*。若AUSF校验响应成功，则AUSF认证UE成功。
如果选择使用的认证方式为EAP-AKA’，则AUSF校验响应成功之后，AUSF生成第一中间密钥K SEAF。
如果选择使用的认证方式为5G-AKA，则AUSF在步骤305(即AUSF接收到认证向量)之后，生成第一中间密钥K SEAF。
311、AUSF生成第一标识。
本实施例中，AUSF校验响应成功后，AUSF生成第一标识。该第一标识，用于标识UE。在本申请实施例中，该第一标识称为SUPI*。
可选的，在AUSF生成第一标识之前，AUSF确定当满足第一条件时，则该AUSF生成该第一标识。该第一条件包括：
AUSF接收到的该第一服务网络标识包括PLMN ID和NID，或者，
AUSF接收到的该第一服务网络标识包括PLMN ID和NID，并且，第二服务网络标识包括PLMN ID不包括NID，或者，
UE的拜访网络为SNPN网络，或者，
UE的拜访网络为SNPN网络，并且UE的归属网络为PLMN网络，或者，
UE的拜访网络和UE的归属网络为两个不同的网络，或者，
AUSF本地配置指示生成第一标识。
在一种可选的实现方式中，在步骤310后，当AUSF校验响应成功后，无需上述确定是否生成第一标识的确定，AUSF直接生成第一标识。
具体的，AUSF可以基于多种参数或字段生成第一标识，具体包括以下中的任意一种或者多种：
(A)、SUPI或者SUPI的一部分；
(B)、UE和AUSF之间的共享密钥；
(C)、网络标识：包括第一服务网络标识，和/或，第二服务网络标识；
(D)、路由信息：包括路由指示(Routing Indicator，RI)，和/或，AUSF组标识符(AUSF Group ID)，和/或，AUSF实例标识(AUSF Instance ID)；
(E)、认证向量或者认证向量中的一部分。
其中，关于SUPI以及SUPI的一部分，请参阅前述图1c的相关描述，这里不再赘述。该UE和AUSF之间的共享密钥，包括但不限于第五中间密钥K AUSF，和/或，第六中间密钥CK’，和/或，以及第七中间密钥IK’。关于认证向量以及认证向量的一部分，请参阅前述图1c的相关描述，这里不再赘述。
该第一标识具体可以有多种实现方式，包括但不限于：第一标识中携带某个参数、字段或比特位。该参数、字段或比特位指示该第一标识与特定的SUPI关联。示例性的，如表1所示：
Figure PCTCN2021098242-appb-000001
表1
在一种可选的实现方式中，该第一标识按照预设的预设规则生成，该预设规则预先配置于AUSF中和UE中，AUSF和UE按照相同的预设规则生成第一标识。
需要说明的是，步骤311：AUSF生成第一标识可以发生在步骤305之后、步骤312或步骤313之前的任意时刻，本申请实施例不做限制。
312、AUSF向SEAF发送第一标识。
本实施例中，AUSF向SEAF发送第一标识。具体的，AUSF通过第三认证服务响应消息向SEAF发送该第一标识。示例性的，该认证服务响应为：Nausf_UEAuthentication_Authenticate Response消息。
可选的，该第三认证服务响应消息中携带K SEAF。
可选的，该第三认证服务响应消息中携带用于指示生成第一标识的第一指示。
313、AUSF向UDM发送第一标识。
本实施例中，AUSF向UDM发送第一标识。
在一种可选的实现方式中，该AUSF通过认证结果确认服务请求消息向该UDM发送该第一标识。该认证结果确认服务请求消息，用于通知UDM终端设备的认证结果，示例性的，该认证结果确认服务请求消息为Nudm_UEAuthentication_ResultConfirmation Request消息。
需要说明的是，此处不对步骤312与313之间的执行顺序进行限定，既可以先执行步骤312再执行步骤313，也可以先执行步骤313再执行步骤312，还可以同时执行步骤312和步骤313。
314、UDM保存第一标识与SUPI之间的对应关系。
本实施例中，UDM接收来自AUSF的第一标识后，保存该第一标识与该第一标识对应的SUPI之间的对应关系。SUPI与第一标识均用于标识UE。
UDM中保存了该SUPI标识的UE的签约数据，因此，UDM保存该第一标识、第一标识对应的SUPI、和该SUPI对应的UE的签约数据之间的对应关系。
示例性的，该对应关系如表2所示：
Figure PCTCN2021098242-appb-000002
表2
315、SEAF基于第一标识，生成第二中间密钥K AMF。
本实施例中，首先，SEAF基于第一标识，生成第二中间密钥K AMF，即SEAF基于第一中间密钥K SEAF、第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；其次，SEAF将该K AMF发送给AMF。AMF根据该K AMF生成NAS密钥；再次，SEAF向AMF发送该第一标识。
如果SEAF接收到第一指示，则SEAF向UE发送用于指示生成第一标识的第二指示。
在本申请实施例中，第一指示和第二指示可以是同一个指示或者不同的指示，此处不做限制。
316、UE生成第一标识。
本实施例中，UE生成第一标识，采用与AUSF生成第一标识相同的参数和相同的方法。AUSF生成第一标识采用的参数请参阅步骤311中的描述。本申请实施例中对AUSF和UE生成第一标识使用的方法不做限定。
可选的，如果第二条件满足，则UE生成第一标识。第二条件包括：
第一服务网络标识包括PLMN ID和NID，或者，
第一服务网络标识包括PLMN ID和NID，并且，第二服务网络标识包括PLMN ID不包括NID，或者，
UE的拜访网络为SNPN网络，或者，
UE的拜访网络为SNPN网络，并且UE的归属网络为PLMN网络，或者，
UE的拜访网络和UE的归属网络为两个不同的网络，或者，
UE本地配置指示生成第一标识，或者，
UE接收来自AMF的第二指示，第二指示用于指示UE生成第一标识。
需要说明的是，步骤316可以执行于步骤301后的任意时刻，此处不做限制。
317、UE基于第一标识，生成第二中间密钥K AMF。
本实施例中，UE基于第一标识，生成第二中间密钥K AMF，即UE基于第一中间密钥K SEAF、第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF，或者，UE基于第一中间密钥K SEAF、第一标识、第一标识的长度、ABBA以及ABBA的长度生成第二中间密钥K AMF。
UE基于第二中间密钥生成NAS密钥，用于保护UE和AMF之间的NAS通信消息。
UE生成第一中间密钥K SEAF，请参阅前述图1b-图1c的相关描述，此处不再赘述。
可选的，UE还可以采用与网络侧相同的方式，根据接收到的RAND，生成该认证中使用的认证向量或者该认证向量的一部分。
需要说明的是，步骤317可以执行于步骤307后的任意时刻。
在一种可选的实现方式中，步骤315后，AMF可能向UDM发送服务请求，携带第一标识。具体的，AMF向UDM请求的服务包括：
(A)、签约数据管理服务(示例地Nudm_SubscriberDataManagement服务)，用于AMF向UDM请求获取UE的签约数据、用于AMF向UDM请求订阅UE数据改变时的通知、用于AMF向UDM取消订阅UE数据改变时的通知、以及用于AMF向UDM请求订阅数据改变时的通知等；
(B)、UE上下文管理服务(示例地Nudm_UEContextManagement服务)，用于请求3GPP接入的AMF注册、用于请求非3GPP接入的AMF注册、用于请求3GPP接入的AMF去注册、用于请求非3GPP接入的AMF去注册、用于请求更新AMF注册参数、以及请求去注册AMF等。
当UDM接收到AMF发送的携带第一标识的服务请求之后，UDM根据第一标识，找到对应的SUPI，可选的，找到该SUPI对应的UE的签约数据。
在一种可选的实现方式中，步骤315后，SMF可能向UDM发送服务请求，携带第一标识。具体的，SMF向UDM请求的服务包括：
(A)、签约数据管理服务(示例地Nudm_SubscriberDataManagement服务)，用于SMF向UDM请求获取UE的签约数据、用于SMF向UDM请求订阅UE数据改变时的通知、用于SMF向UDM取消订阅UE数据改变时的通知、以及用于SMF向UDM请求订阅数据改变时的通知等；
(B)、UE上下文管理服务(示例地Nudm_UEContextManagement服务)，用于请求创建一个新的注册或SMF注册、以及用于请求SMF去注册等。
当UDM接收到SMF发送的携带第一标识的服务请求之后，UDM根据第一标识，找到对 应的SUPI，可选的，找到该SUPI对应的UE的签约数据。
在一种可选的实现方式中，步骤315后，SEAF可能决定发起主认证，SEAF向AUSF发送第一认证请求信息，该第一认证请求消息中携带第一标识；AUSF接收到该携带第一标识的第一认证请求消息后,向UDM发送认证向量请求消息，该认证向量请求消息中携带接收到的第一标识。UDM根据该第一标识，找到对应的SUPI，以及SUPI对应的UE的长期密钥，进行认证向量的生成。然后，UDM向AUSF发送该SUPI。
本申请实施例中，首先，归属网络与拜访网络之间通过消息交互，确定双方的认证方法。避免了归属网络选择拜访网络不支持的认证方法，导致认证失败的结果。其次，AUSF生成第一标识，该第一标识用于标识标识终端设备的SUPI。归属网络(AUSF)向拜访网络(AMF)发送该第一标识，避免归属网络(AUSF)向拜访网络(AMF)发送UE的SUPI。由于SUPI属于隐私信息，从而避免了泄露终端设备的隐私信息。从而提升通信的安全性。
需要说明的是，图3所示实施例中，拜访网络与归属网络之间确定认证方式的相关步骤(步骤302-306)，与，网络侧和终端侧分别生成第一标识并基于第一标识进行交互(步骤311-317)，这两部分内容之间是相互独立的。即：首先，拜访网络与归属网络之间确定认证方式(与图3中步骤302-306类似)，其次，UDM通过AUSF向AMF发送该UE的SUPI。或者，拜访网络与归属网络之间不确定认证方式(类似步骤302-306，但是相关请求与响应不携带认证方式)，其次，网络侧和终端侧分别生成第一标识并基于第一标识进行交互(类似步骤310-317)。
除了如图3所示实施例中描述的：AUSF生成第一标识，本申请实施例还提出了一种通信方法，由UDM生成第一标识。具体的，在前述图1a-图1c的基础上，请参阅图4，图4为本申请实施例中又一种通信方法的实施例示意图。图1b中的所示的密钥生成流程，和图1c中所示的密钥传递流程，适用于图4。本申请实施例提出的又一种通信方法包括：
401、UE向AMF发送注册请求消息。
本实施例中，该注册请求消息中携带UE的标识，比如可能是签约隐藏标识(Subscriber Concealed Identifier，SUCI)。具体的，与前述步骤301类似，此处不再赘述。
402、SEAF向AUSF发送第一认证请求消息。
本实施例中，第一认证请求消息中携带第一服务网络标识。第一认证请求消息用于请求调用AUSF提供的认证服务。
具体的，AMF收到注册请求消息后，通知SEAF。SEAF发起主认证，SEAF向AUSF发送第一认证请求消息。第一服务网络标识请参阅前述图3的相关描述，此处不再赘述。
可选的，该第一认证请求消息中还携带UE标识，例如接收到的SUCI。
403、AUSF向UDM发送认证向量请求消息，该认证向量请求中携带接收到的第一服务网络标识。
本实施例中，该认证向量请求消息用于请求调用UDM提供的认证服务，或者认证消息服务，或者用于请求认证向量。
示例的，该认证向量请求为“Nudm_UEAuthentication_Get Request”消息。
该认证向量请求消息携带接收到的UE标识。
404、UDM生成第一标识。
本实施例中，该第一标识，用于标识UE。在本申请实施例中，该第一标识称为SUPI*。
可选的，如果UDM接收到SUCI，在UDM生成第一标识之前，UDM根据接收到的SUCI，获取UE的SUPI以及UE的签约数据。
可选的，在UDM生成第一标识之前，UDM确定当满足第三条件时，则该UDM生成该第一标识。该第三条件包括：
UDM接收到的该第一服务网络标识包括PLMN ID和NID，或者，
UDM接收到的该第一服务网络标识包括PLMN ID和NID，并且，第二服务网络标识包括PLMN ID不包括NID，或者，
UE的拜访网络为SNPN网络，或者，
UE的拜访网络为SNPN网络，并且UE的归属网络为PLMN网络，或者，
UE的拜访网络和UE的归属网络为两个不同的网络，或者，
UDM本地配置指示生成第一标识。
在一种可选的实现方式中，在步骤403后，无需上述确定是否生成第一标识的流程，UDM直接生成第一标识。
具体的，UDM可以基于多种参数或字段生成第一标识，具体包括以下中的任意一种或者多种：
(A)、SUPI或者SUPI的一部分；
(B)、UE和AUSF之间的共享密钥；
(C)、网络标识：包括第一服务网络标识，和/或，第二服务网络标识；
(D)、路由信息：包括路由指示(Routing Indicator，RI)，和/或，AUSF组标识符(AUSF Group ID)，和/或，AUSF实例标识(AUSF Instance ID)；
(E)、认证向量或者认证向量中的一部分。
其中，关于SUPI以及SUPI的一部分，请参阅前述图1b-图1c的相关描述，这里不再赘述。该UE和AUSF之间的共享密钥，包括但不限于第五中间密钥K AUSF，和/或，第六中间密钥CK’，和/或，以及第七中间密钥IK’。关于认证向量以及认证向量的一部分，请参阅前述图1b-图1c的相关描述，这里不再赘述。
该第一标识具体可以有多种实现方式，包括但不限于：第一标识中携带某个参数、字段或比特位。该参数、字段或比特位指示该第一标识与特定的SUPI关联。示例性的，如前述表1所示。
405、UDM保存第一标识与SUPI之间的对应关系。
本实施例中，UDM生成第一标识后，保存该第一标识与该第一标识对应的SUPI之间的对应关系。
UDM中保存了该SUPI对应的UE的签约数据，因此，UDM保存该第一标识、第一标识对应的SUPI、和该SUPI对应的UE的签约数据的对应关系。
406、UDM向AUSF发送认证向量响应消息，该认证向量响应中携带第一标识。
本实施例中，UDM向AUSF发送认证向量响应消息，该认证向量响应消息中携带第一标 识。
在UDM向AUSF发送认证向量响应消息之前，UDM生成认证向量。具体的，UDM根据该选择使用的认证方式，生成对应的认证向量。具体生成认证向量的流程，请参阅前述图1c的相关描述，此处不再赘述。
示例的，该认证向量响应为“Nudm_UEAuthentication_Get Response”消息。
可选的，UDM在认证向量响应消息中携带用于指示生成第一标识的第三指示。
407、AUSF向SEAF发送第一认证响应消息。
本实施例中，AUSF向SEAF发送第一认证响应消息。该第一认证响应消息中携带接收到的认证向量中的RAND和AUTN。
示例的，该第一认证响应为“Nausf_UEAuthentication_Authenticate Response”消息。
如果AUSF接收到第三指示，则AUSF在第一认证响应消息中携带用于指示生成第一标识的第一指示。
408、AMF向UE发送第二认证请求消息。
本实施例中，SEAF在接受到第一认证响应消息之后，通知AMF该第一认证响应消息。响应于该第一认证响应消息，AMF向UE发送第二认证请求消息。该第二认证请求消息携带接收到的AUTN和RAND。
可选的，该第二认证请求为Authenticate Request消息。
如果SEAF接收到第一指示，则SEAF通知AMF该第一指示，AMF根据该第一指示，向UE发送用于指示生成第一标识的第二指示。
本实施例中，第一指示、第二指示和第三指示，可以为同一个指示，或者不同的指示。
409、UE向AMF发送第二认证响应消息。
本实施例中，首先，UE在接收到RAND和AUTN之后，验证AUTN，并生成响应(RES或RES*)。具体生成响应的步骤，请参阅前述图1c的相关描述，此处不再赘述。
其次，UE向AMF发送生成的响应(RES或RES*)，具体的，通过第二认证响应消息向AMF发送该响应。该第二认证响应消息中包括RES或RES*。该响应用于网络侧验证UE。示例的，该第二认证响应消息为Authenticate Response消息。
410、SEAF向AUSF发送第三认证请求消息，第三认证请求携带接收到的RES或RES*。
本实施例中，AMF在接收到来自UE的第二认证响应消息之后，通知SEAF该第二认证响应消息。SEAF响应于该第二认证响应消息，SEAF向AUSF发送第三认证请求消息，该第三认证请求消息携带接收到的响应。
示例的，该第三认证请求消息为Nausf_UEAuthentication_Authenticate Request消息。
411、AUSF验证接收到的RES或者RES*。
本实施例中，若AUSF校验响应成功，则AUSF与UE之间实现了双向认证。
AUSF校验响应RES或RES*成功之后，AUSF生成第一中间密钥K SEAF。可能地，AUSF在接受到认证向量之后(即步骤406之后)，生成第一中间密钥K SEAF。
412、AUSF向AMF发送第一标识。
本实施例中，AUSF向AMF发送该第一标识。可选的，AUSF通过认第三证服务响应消息向AMF发送第一标识，该第三认证服务响应消息中包括该第一标识。示例性的，该认证服务响应为：Nausf_UEAuthentication_Authenticate Response消息。该第三认证服务响应消息中包括第一中间密钥K SEAF。
413、SEAF基于第一标识，生成第二中间密钥K AMF。
本实施例中，SEAF基于第一标识，生成第二中间密钥K AMF，即SEAF基于第一中间密钥K SEAF、第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
SEAF将该第二中间密钥K AMF发送给AMF。AMF根据该第二中间密钥K AMF生成NAS密钥。
414、UE生成第一标识。
本实施例中，UE生成第一标识，采用与AUSF生成第一标识相同的参数和相同的方法。AUSF生成第一标识采用的参数请参阅步骤311中的描述。本申请实施例中对AUSF和UE生成第一标识使用的方法不做限定。
可选的，如果第二条件满足，则UE生成第一标识。第二条件包括：
第一服务网络标识包括PLMN ID和NID，或者，
第一服务网络标识包括PLMN ID和NID，并且，第二服务网络标识包括PLMN ID不包括NID，或者，
UE的拜访网络为SNPN网络，或者，
UE的拜访网络为SNPN网络，并且UE的归属网络为PLMN网络，或者，
UE的拜访网络和UE的归属网络为两个不同的网络，或者，
UE本地配置指示生成第一标识，或者，
UE接收来自AMF的第二指示，第二指示用于指示生成第一标识。
需要说明的是，步骤414可以执行于步骤401后的任意时刻。
415、UE基于第一标识，生成第二中间密钥K AMF。
本实施例中，UE基于第一标识，生成第二中间密钥K AMF，即UE基于第一中间密钥K SEAF、第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF，或者，UE基于第一中间密钥K SEAF、第一标识、第一标识的长度、ABBA以及ABBA的长度生成第二中间密钥K AMF。
UE基于第二中间密钥生成NAS密钥，用于保护UE和AMF之间的NAS通信消息。
UE生成第一中间密钥K SEAF，请参阅前述图1b-图1c的相关描述，此处不再赘述。
可选的，UE还可以采用与网络侧相同的方式，根据接收到的RAND，生成该认证中使用的认证向量或者该认证向量的一部分。
需要说明的是，步骤415可以执行于步骤408后的任意时刻。
在一种可选的实现方式中，步骤413后，AMF可能向UDM发送服务请求，携带第一标识。具体的，AMF向UDM请求的服务包括：
(A)、签约数据管理服务(示例地Nudm_SubscriberDataManagement服务)，用于AMF向UDM请求获取UE的签约数据、用于AMF向UDM请求订阅UE数据改变时的通知、用于AMF向UDM取消订阅UE数据改变时的通知、以及用于AMF向UDM请求订阅数据改变时的通知等；
(B)、UE上下文管理服务(示例地Nudm_UEContextManagement服务)，用于请求3GPP接入的AMF注册、用于请求非3GPP接入的AMF注册、用于请求3GPP接入的AMF去注册、用于请求非3GPP接入的AMF去注册、用于请求更新AMF注册参数、以及请求去注册AMF等。
当UDM接收到AMF发送的携带第一标识的服务请求之后，UDM根据第一标识，找到对应的SUPI，可选的，找到该SUPI对应的UE的签约数据。
在一种可选的实现方式中，步骤413后，SMF可能向UDM发送服务请求，携带第一标识。具体的，SMF向UDM请求的服务包括：
(A)、签约数据管理服务(示例地Nudm_SubscriberDataManagement服务)，用于SMF向UDM请求获取UE的签约数据、用于SMF向UDM请求订阅UE数据改变时的通知、用于SMF向UDM取消订阅UE数据改变时的通知、以及用于SMF向UDM请求订阅数据改变时的通知等；
(B)、UE上下文管理服务(示例地Nudm_UEContextManagement服务)，用于请求创建一个新的注册或SMF注册、以及用于请求SMF去注册等。
当UDM接收到SMF发送的携带第一标识的服务请求之后，UDM根据第一标识，找到对应的SUPI，可选的，找到该SUPI对应的UE的签约数据。
在一种可选的实现方式中，步骤413后，SEAF可能决定发起主认证，SEAF向AUSF发送第一认证请求信息，该第一认证请求消息中携带第一标识；AUSF接收到该携带第一标识的第一认证请求消息后,向UDM发送认证向量请求消息，该认证向量请求消息中携带接收到的第一标识。UDM根据该第一标识，找到对应的SUPI，以及SUPI对应的UE的签约数据，进行认证向量的生成。然后，UDM向AUSF发送该SUPI。
本申请实施例中，UDM生成第一标识，用于标识标识终端设备。归属网络(UDM通过AUSF)向拜访网络(AMF或SEAF)发送该第一标识，避免归属网络(UDM通过AUSF)向拜访网络(AMF或SEAF)发送UE的SUPI。由于SUPI为UE隐私信息，避免了泄露终端设备的隐私信息。从而提升通信的安全性。
上述图3和图4所示的实施例，分别描述了AUSF或UDM如何生成第一标识，并使用第一标识替代原有SUPI进行通信的相关步骤。并且，还描述了归属网络与拜访网络之间通过消息交互，确定双方的认证方法。除了图3与图4实施例中描述的通信方法外，本申请实施例还提出了一种通信方法，在预先向AMF或UDM配置网络支持的认证方式的基础上，通过消息交互，确定归属网络与拜访网络之间的认证方法。下面结合附图进行说明，需要说明的是，该方法可以与前述图3或图4实施例中描述的AUSF或UDM如何生成第一标识，并使用第一标识替代原有SUPI进行通信的相关步骤进行结合，此时，该方法替换前述图3或图4实施例中描述的归属网络与拜访网络之间通过消息交互，确定双方的认证方法(如前述步骤302-306)。
请参阅图5，图5为本申请实施例提出的又一种通信方法的实施例示意图。本申请实施例提出的又一种通信方法包括：
501、UDM被配置第一协议网络支持的认证方式。
本实施例中，第一协议网络指与UDM所在的网络可以互通的任何网络，比如UE的拜访网络。在本申请实施例中，第一协议网络支持的认证方式也称为AMF或SEAF支持的认证方 式、或UE的拜访网络支持的认证方式、或UE的服务网络支持的认证方式。
当该第一协议网络为PLMN时，该第一协议网络的标识包括PLMN ID但不包括NID，该PLMN ID标识该第一协议网络。
当该第一协议网络为SNPN时，该第一协议网络的标识包括PLMN ID和NID。该PLMN ID和NID标识该第一协议网络。
具体的，该第一协议网络支持的认证方式以对应关系列表的形式被配置于UDM中，该对应关系列表包括：第一协议网络的标识与该第一协议网络支持的认证方式之间的对应关系。可选的，该对应关系列表可以预配置于UDM中。
示例性的，该对应关系列表如表3所示：
第一协议网络的标识 第一协议网络支持的认证方式
PLMN ID1 5G AKA
(PLMN ID2，NID2) EAP-AKA’
(PLMN ID2，NID3) 5G AKA和EAP-AKA’
表3
502、UE向AMF发送注册请求。
本实施例中，该步骤与前述步骤401类似，此处不再赘述。
503、SEAF发送第一认证请求消息，第一认证请求消息中携带第一服务网络标识。
本实施例中，该步骤与前述步骤402相同，此处不再赘述。
504、AUSF向UDM发送认证向量请求消息，该认证向量请求消息中携带第一服务网络标识。
本实施例中，该步骤与前述步骤403相同，此处不再赘述。
505、UDM基于该第一服务网络标识、和本地被配置的第一协议网络支持的认证方式，选择使用的认证方式。
本实施例中，UDM接收第一服务网络标识后，基于该第一服务网络标识、本地被配置的第一协议网络的标识、和该第一协议网络支持的认证方式，选择使用的认证方式。具体的，基于该第一服务网络标识，从被配置的对应关系列表中，确定与该第一服务网络标识一致的第一协议网络的标识，进而确定该第一协议网络支持的认证方式。该对应关系列表包括：第一协议网络的标识与该第一协议网络支持的认证方式之间的对应关系。该第一协议网络支持的认证方式可以是UE的服务网络支持的认证方式，或者AMF支持的认证方式，或者SEAF支持的认证方式。UDM基于该第一协议网络支持的认证方式选择使用的认证方式。
506、UDM向AUSF发送认证向量响应消息，该认证向量响应消息中携带选择使用的认证方式。
本申请实施例中，UDM预先被配置了第一协议网络支持的认证方式。当UDM接收到来自AMF或SEAF的第一服务网络标识后，UDM可以基于本地被配置的第一协议网络支持的认证方式，选择使用的认证方式。归属网络与拜访网络之间通过消息交互，确定双方的认证方法。避免了归属网络选择拜访网络不支持的认证方法，导致认证失败的结果。
图6为本申请实施例提出的又一种通信方法的实施例示意图。本申请实施例提出的又 一种通信方法包括：
601、AMF或SEAF上被配置第二协议网络支持的认证方式。
本实施例中，第二协议网络指与AMF或SEAF可以互通的任何网络，比如UE的归属网络。在本申请实施例中，第二协议网络支持的认证方式也称为AUSF支持的认证方式，或UDM支持的认证方式，或归属网络支持的认证方式。
当该第二协议网络为PLMN时，该协议网络的标识包括PLMN ID不包括NID，该PLMN ID标识该第二协议网络。
当第二该协议网络为SNPN时，该协议网络的标识包括PLMN ID和NID。该PLMN ID和NID一起标识该第二协议网络。
具体地，第二协议网络支持的认证方式以对应关系列表的形式被配置于AMF或SEAF中，该对应关系列表包括：第二协议网络的标识与该第二协议网络支持的认证方式之间的对应关系。可选的，该对应关系列表可以预配置于AMF或SEAF中。
示例性的，该对应关系列表如表4所示：
第二协议网络的标识 第二协议网络支持的认证方式
PLMN ID1 5G AKA
(PLMN ID2，NID2) EAP-AKA’
(PLMN ID2，NID3) 5G AKA和EAP-AKA’
表4
602、UE向AMF发送注册请求消息。
本实施例中，与前述步骤401类似，此处不再赘述。
603、AMF或SEAF根据本地配置的第二协议网络支持的认证方式，选择使用的认证方式。
本实施例中，首先，AMF接收到该注册请求消息之后，AMF通知SEAF该注册请求消息。其次，AMF或SEAF确定UE的归属网络的标识。如果AMF或SEAF处接收到SUCI，则AMF或SEAF从SUCI中获取UE的归属网络的标识。AMF或SEAF还可以从UE的上下文中获取UE的归属网络的标识。比如UE的上下文中包括UE的标识(比如SUPI)，UE的标识中包括UE的归属网络的标识。
AMF或SEAF基于本地被配置的第二协议网络支持的认证方式，选择使用的认证方式，具体的，AMF或SEAF基于对应关系列表(该对应关系列表包括第二协议网络的标识和第二协议网络支持的认证方式)，确定与该与UE的归属网络标识一致的第二协议网络的标识，进而确定该第二协议网络支持的认证方式。该第二协议网络支持的认证方式，为该UE的归属网络支持的认证方式，或AUSF支持的认证方式，或UDM支持的认证方式。
604、SEAF向AUSF发送第一认证请求消息，第一认证请求消息中携带第一服务网络标识，和该选择使用的认证方式。
本实施例中，AMF或SEAF收到注册请求后，向该UE的归属网络发起认证流程。该归属网络可以是PLMN或SNPN。
具体的，AMF向AUSF发送第一认证请求，该第一认证请求中携带第一服务网络标识。 第一认证请求消息用于调用AUSF提供的认证请求服务。该第一认证请求消息中还携带该选择使用的认证方式。
示例的，该第一认证请求为Nausf_UEAuthentication_Authenticate Request消息。
在另一种可选的实现方式中，该选择使用的认证方式还可以携带于其它独立消息中。
605、AUSF向UDM发送认证向量请求消息，该认证向量请求中携带第一服务网络标识，和接收到的该选择使用的认证方式。
本实施例中，AUSF向UDM发送认证向量(authentication vector，AV)请求消息，该认证向量消息请求用于请求认证向量，或调用UDM提供的认证服务，或者调用UDM提供的认证向量服务。具体的，该认证向量请求消息中携带接收到的该选择使用的认证方式，和第一服务网络标识。
可选的，该认证向量请求为Nudm_UEAuthentication_Get Request消息。
606、UDM使用接收的该选择使用的认证方式。
本实施例中，UDM使用接收的该选择使用的认证方式，生成认证向量。例如：当接收的该选择使用的认证方式为：5G AKA时，UDM生成第一认证向量；当当接收的该选择使用的认证方式为：EAP-AKA’时，UDM生成第二认证向量。第一认证向量和第二认证向量请参阅前述图1c的相关描述，此处不再赘述。
步骤606后，继续通信流程，例如前述步骤306-317，或，前述步骤407-415，或，现有技术方案中使用SUPI进行通信的相关步骤，此处不作限制。
本申请实施例中，AMF预先被配置了网络标识和网络标识关联的认证方式，或认证方式。AMF可以基于该第一服务网络标识、本地被配置的网络标识、和该网络标识关联的认证方式，选择使用的认证方式。或者，AMF基于被配置的认证方式，选择使用的认证方式。AMF向AUSF发送该选择使用的认证方式。归属网络与拜访网络之间通过消息交互，确定双方的认证方法。避免了归属网络选择拜访网络不支持的认证方法，导致认证失败的结果。
上述主要以方法的角度对本申请实施例提供的方案进行了介绍。可以理解的是，通信装置为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的模块及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以基于上述方法示例对通信装置进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
下面对本申请中的通信装置进行详细描述，请参阅图7，图7为本申请实施例中通信装置的一种实施例示意图。通信装置700可以部署于网络设备中，通信装置700包括：
收发模块701，用于接收统一数据管理UDM发送的终端设备的签约永久标识SUPI，其中，SUPI用于标识UE；
处理模块702，用于基于SUPI生成第一标识；
收发模块701，还用于向安全锚点功能SEAF发送第一标识；
处理模块702，还用于基于第一中间密钥K SEAF、第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
收发模块701，还用于向接入移动管理功能AMF发送第二中间密钥K AMF；
处理模块702，还用于基于第二中间密钥K AMF生成非接入层NAS密钥，其中，NAS密钥用于对NAS消息进行保护。
在本申请的一些可选实施例中，
收发模块701，还用于向UDM发送第一标识；
收发模块701，还用于接收第一标识，并保存第一标识与SUPI之间的对应关系。
在本申请的一些可选实施例中，
收发模块701，还用于接收AMF发送的第一服务网络标识；
处理模块702，用于生成第一标识，具体包括：
当第一服务网络标识包括公共陆地移动网络标识PLMN ID和网络标识NID时，
或者，当第一服务网络标识包括PLMN ID和NID，并且，认证服务模块功能AUSF所在网络的标识包括PLMN ID但不包括NID时，处理模块702，用于生成第一标识。
在本申请的一些可选实施例中，
处理模块702，还用于基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
处理模块702，还用于基于第三中间密钥CK和第四中间密钥IK，生成第五中间密钥K AUSF；
收发模块701，还用于将第五中间密钥K AUSF发送至AUSF；
处理模块702，还用于基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
处理模块702，还用于将第一中间密钥K SEAF发送给SEAF。
在本申请的一些可选实施例中，
处理模块702，还用于基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
处理模块702，还用于基于第三中间密钥CK和第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
收发模块701，还用于将第六中间密钥CK’和第七中间密钥IK’发送至AUSF；
处理模块702，还用于基于第六中间密钥CK’和第七中间密钥IK’生成第五中间密钥K AUSF，并基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
收发模块701，还用于将第一中间密钥K SEAF发送给SEAF。
在本申请的一些可选实施例中，
收发模块701，还用于接收AMF发送的AMF支持的认证方式；
收发模块701，还用于向UDM发送接收到的AMF支持的认证方式；
处理模块702，还用于基于AMF支持的认证方式选择使用的认证方式；
收发模块701，还用于向AUSF发送选择使用的认证方式；
收发模块701，还用于基于选择使用的认证方式向AMF发送认证响应。
请参阅图8，图8为本申请实施例中通信装置的又一种实施例示意图。通信装置800可以部署于终端设备中，通信装置800包括：
处理模块801，用于基于终端设备的签约永久标识SUPI生成第一标识；
处理模块801，还用于基于第一中间密钥K SEAF、第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
处理模块801，还用于基于第二中间密钥K AMF生成NAS密钥，其中，NAS密钥用于对NAS消息进行保护。
在本申请的一些可选实施例中，
收发模块802，用于向接入移动管理功能AMF发送注册请求，注册请求中携带第一服务网络标识；
处理模块801，用于基于SUPI生成第一标识，具体包括：
处理模块801确定第二条件满足时，则处理模块801基于该SUPI生成第一标识；否则UE不生成第一标识。第二条件包括：
第一服务网络标识包括PLMN ID和NID，或者，
第一服务网络标识包括PLMN ID和NID，并且，第二服务网络标识包括PLMN ID但不包括NID，或者，
UE的拜访网络为SNPN网络，或者，
UE的拜访网络为SNPN网络，并且UE的归属网络为PLMN网络，或者，
UE的拜访网络和UE的归属网络为两个不同的网络，或者，
UE本地配置指示生成第一标识，或者，
UE接收来自AMF的第二指示，第二指示用于指示UE生成第一标识。
在本申请的一些可选实施例中，
收发模块802，还用于获取第三中间密钥CK和第四中间密钥IK；
处理模块801，还用于基于第三中间密钥CK和第四中间密钥IK，生成第五中间密钥K AUSF；
处理模块801，还用于基于第五中间密钥K AUSF生成第一中间密钥K SEAF。
在本申请的一些可选实施例中，
收发模块802，还用于获取第三中间密钥CK和第四中间密钥IK；
处理模块801，还用于基于第三中间密钥CK和第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
处理模块801，还用于基于第六中间密钥CK’和第七中间密钥IK’生成第五中间密钥K AUSF；
处理模块801，还用于基于第五中间密钥K AUSF生成第一中间密钥K SEAF。
在本申请的一些可选实施例中，
处理模块801，还用于基于第一中间密钥K SEAF、第一标识、第一标识的长度、ABBA以 及ABBA的长度生成第二中间密钥K AMF。
请参阅图9，图9为本申请实施例中通信装置的一种实施例示意图。通信装置900可以部署于网络设备中，通信装置900包括：
处理模块901，用于基于SUPI生成第一标识；
收发模块902，用于向认证服务器功能网元AUSF发送所述第一标识；
收发模块902，还用于向安全锚点功能网元SEAF发送所述第一标识；
处理模块901，还用于基于第一中间密钥K SEAF、所述第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
收发模块902，还用于向移动管理功能网元AMF发送所述第二中间密钥；
处理模块901，还用于基于所述第二中间密钥生成非接入层NAS密钥，其中，所述NAS密钥用于对NAS消息进行保护。
在本申请的一些可选实施例中，
收发模块902，还用于接收所述AMF发送的第一服务网络标识；
收发模块902，还用于向UDM发送第一服务网络标识；
处理模块901，用于生成第一标识，具体包括：
该第三条件满足时，处理模块901，用于基于该UE的SUPI生成该第一标识，该第三条件包括：
第一服务网络标识包括PLMN ID和NID，或者，
第一服务网络标识包括PLMN ID和NID，并且，第二服务网络标识包括PLMN ID但不包括NID，或者，
UE的拜访网络为SNPN网络，或者，
UE的拜访网络为SNPN网络，并且UE的归属网络为PLMN网络，或者，
UE的拜访网络和UE的归属网络为两个不同的网络，或者，
UDM本地配置指示生成第一标识。
在本申请的一些可选实施例中，
处理模块901，还用于保存第一标识与SUPI的对应关系。
在本申请的一些可选实施例中，
处理模块901，还用于基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
处理模块901，还用于基于第三中间密钥CK和第四中间密钥IK，生成第五中间密钥K AUSF；
收发模块902，还用于将第五中间密钥K AUSF发送至AUSF；
处理模块901，还用于基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
收发模块902，还用于将第一中间密钥K SEAF发送给SEAF。
在本申请的一些可选实施例中，
处理模块901，还用于基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
处理模块901，还用于基于第三中间密钥CK和第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
收发模块902，还用于将第六中间密钥CK’和第七中间密钥IK’发送至AUSF；
处理模块901，还用于基于第六中间密钥CK’和第七中间密钥IK’生成第五中间密钥K AUSF，并基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
收发模块902，还用于将第一中间密钥K SEAF发送给SEAF。
请参阅图10，图10为本申请实施例中通信装置的一种实施例示意图。通信装置1000可以部署于网络设备中，通信装置1000包括：
收发模块1001，用于被配置第一协议网络支持的认证方式；
收发模块1001，还用于接收认证服务器功能网元AUSF发送的第一服务网络标识；
处理模块1002，用于基于该第一服务网络标识以及本地配置的第一协议网络支持的认证方式，选择使用的认证方式；
收发模块1001，还用于向AUSF发送选择使用的认证方式。
收发模块1001，还用于向UDM发送的携带第一服务网络标识的认证向量请求消息，该认证向量请求消息用于请求调用UDM提供的认证向量服务或者认证服务。
在本申请的一些可选实施例中，
收发模块1001，还用于向AUSF发送认证向量响应消息，在该认证向量响应消息中携带选择的认证方式。该认证向量响应消息，用于响应接收到的认证向量请求消息。
请参阅图11，图11为本申请实施例中通信装置的一种实施例示意图。通信装置1100可以部署于网络设备中，通信装置1100包括：
收发模块1101，用于接收AUSF发送的第一认证方式；
处理模块1102，用于根据接收到的第一认证方式选择使用的认证方式；
收发模块1101，还用于向该AUSF发送该选择使用的认证方式。
在本申请的一些可选实施例中，可以包括：
收发模块1101，还用于向UDM发送认证向量请求消息，该认证向量请求消息用于请求调用UDM提供的认证向量服务或者认证服务，该认证向量请求消息中携带第一认证方式。
在本申请的一些可选实施例中，可以包括：
收发模块1101，还用于向AUSF发送认证向量响应消息，在该认证向量响应消息中携带选择的认证方式。该认证向量响应消息，用于响应接收到的认证向量请求消息。
在本申请的一些可选实施例中，可以包括：
收发模块1101，还用于接收到SEAF发送的第一认证方式。
上述实施例中的通信装置，可以是网络设备，也可以是应用于网络设备中的芯片或者其他可实现上述网络设备功能的组合器件、部件等。还可以是终端设备，也可以是应用于终端设备中的芯片或者其他可实现上述终端设备功能的组合器件、部件等。当通信装置是网络设备时，接收模块与发送模块可以是收发器，该收发器可以包括天线和射频电路等，处理模块可以是处理器，例如基带芯片等。当通信装置是具有上述网络设备功能的部件时，接收模块与发送模块可以是射频单元，处理模块可以是处理器。当通信装置是终端设备时，接收模块与发送模块可以是收发器，该收发器可以包括天线和射频电路等，处理模块可以是处理器，例如基带芯片等。当通信装置是具有上述终端设备功能的部件时，接收模块与 发送模块可以是射频单元，处理模块可以是处理器。当通信装置是芯片系统时，接收模块可以是芯片系统的输入端口，发送模块可以是芯片系统的输出接口、处理模块可以是芯片系统的处理器，例如：中央处理器(central processing unit，CPU)。
在本申请实施例中，网络设备所包括的存储器主要用于存储软件程序和数据，例如存储上述实施例中所描述的第一标识等。该网络设备还具有以下功能：
该网络设备，包括：
收发器，还用于接收统一数据管理UDM发送的终端设备的签约永久标识SUPI，其中，SUPI用于标识UE；
处理器，还用于基于SUPI生成第一标识；
收发器，还用于向安全锚点功能SEAF发送第一标识；
处理器，还用于基于第一中间密钥K SEAF、第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
收发器，还用于向接入移动管理功能AMF发送第二中间密钥K AMF；
处理器，还用于基于第二中间密钥K AMF生成非接入层NAS密钥，其中，NAS密钥用于对NAS消息进行保护。
在本申请的一些可选实施例中，
收发器，还用于向UDM发送第一标识；
收发器，还用于接收第一标识，并保存第一标识与SUPI之间的对应关系。
在本申请的一些可选实施例中，
收发器，还用于接收AMF发送的第一服务网络标识；
处理器，用于生成第一标识，具体包括：
当第一服务网络标识包括公共陆地移动网络标识PLMN ID和网络标识NID时，
或者，当第一服务网络标识包括PLMN ID和NID，并且，认证服务器功能AUSF所在网络的标识包括PLMN ID但不包括NID时，处理器，用于生成第一标识。
在本申请的一些可选实施例中，
处理器，还用于基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
处理器，还用于基于第三中间密钥CK和第四中间密钥IK，生成第五中间密钥K AUSF；
收发器，还用于将第五中间密钥K AUSF发送至AUSF；
处理器，还用于基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
处理器，还用于将第一中间密钥K SEAF发送给SEAF。
在本申请的一些可选实施例中，
处理器，还用于基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
处理器，还用于基于第三中间密钥CK和第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
收发器，还用于将第六中间密钥CK’和第七中间密钥IK’发送至AUSF；
处理器，还用于基于第六中间密钥CK’和第七中间密钥IK’生成第五中间密钥K AUSF，并基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
收发器，还用于将第一中间密钥K SEAF发送给SEAF。
在本申请的一些可选实施例中，
收发器，还用于接收AMF发送的AMF支持的认证方式；
收发器，还用于向UDM发送接收到的AMF支持的认证方式；
处理器，还用于基于AMF支持的认证方式选择使用的认证方式；
收发器，还用于向AUSF发送选择使用的认证方式；
收发器，还用于基于选择使用的认证方式向AMF发送认证响应。
本申请实施例提供的一种终端设备，包括：
处理器，还用于基于终端设备的签约永久标识SUPI生成第一标识；
处理器，还用于基于第一中间密钥K SEAF、第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
处理器，还用于基于第二中间密钥K AMF生成NAS密钥，其中，NAS密钥用于对NAS消息进行保护。
在本申请的一些可选实施例中，该终端设备还包括收发器；
收发器，还用于向接入移动管理功能AMF发送注册请求，注册请求中携带第一服务网络标识；
处理器，用于基于SUPI生成第一标识，具体包括：
处理器确定第二条件满足时，则处理器基于该SUPI生成第一标识；否则处理器不生成第一标识，第二条件包括：
第一服务网络标识包括PLMN ID和NID，或者，
第一服务网络标识包括PLMN ID和NID，并且，第二服务网络标识包括PLMN ID但不包括NID，或者，
UE的拜访网络为SNPN网络，或者，
UE的拜访网络为SNPN网络，并且UE的归属网络为PLMN网络，或者，
UE的拜访网络和UE的归属网络为两个不同的网络，或者，
UE本地配置指示生成第一标识，或者，
UE接收来自AMF的第二指示，第二指示用于指示UE生成第一标识。
在本申请的一些可选实施例中，
收发器，还用于获取第三中间密钥CK和第四中间密钥IK；
处理器，还用于基于第三中间密钥CK和第四中间密钥IK，生成第五中间密钥K AUSF；
处理器，还用于基于第五中间密钥K AUSF生成第一中间密钥K SEAF。
在本申请的一些可选实施例中，
收发器，还用于获取第三中间密钥CK和第四中间密钥IK；
处理器，还用于基于第三中间密钥CK和第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
处理器，还用于基于第六中间密钥CK’和第七中间密钥IK’生成第五中间密钥K AUSF；
处理器，还用于基于第五中间密钥K AUSF生成第一中间密钥K SEAF。
在本申请的一些可选实施例中，
处理器，还用于基于第一中间密钥K SEAF、第一标识、第一标识的长度、ABBA以及ABBA的长度生成第二中间密钥K AMF。
本申请实施例提供的一种网络设备，包括：
处理器，用于基于SUPI生成第一标识；
收发器，用于向认证服务器功能网元AUSF发送该第一标识；
收发器，还用于向安全锚点功能网元SEAF发送该第一标识；
处理器，还用于基于第一中间密钥K SEAF、该第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
收发器，还用于向移动管理功能网元AMF发送该第二中间密钥；
处理器，还用于基于该第二中间密钥生成非接入层NAS密钥，其中，该NAS密钥用于对NAS消息进行保护。
在本申请的一些可选实施例中，
收发器，还用于接收该AMF发送的第一服务网络标识；
收发器，还用于向UDM发送第一服务网络标识；
处理器，用于生成第一标识，具体包括：
该第三条件满足时，处理器，用于基于该UE的SUPI生成该第一标识，该第三条件包括：
第一服务网络标识包括PLMN ID和NID，或者，
第一服务网络标识包括PLMN ID和NID，并且，第二服务网络标识包括PLMN ID但不包括NID，或者，
UE的拜访网络为SNPN网络，或者，
UE的拜访网络为SNPN网络，并且UE的归属网络为PLMN网络，或者，
UE的拜访网络和UE的归属网络为两个不同的网络，或者，
UDM本地配置指示生成第一标识。
在本申请的一些可选实施例中，
处理器，还用于保存第一标识与SUPI的对应关系。
在本申请的一些可选实施例中，
处理器，还用于基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
处理器，还用于基于第三中间密钥CK和第四中间密钥IK，生成第五中间密钥K AUSF；
收发器，还用于将第五中间密钥K AUSF发送至AUSF；
处理器，还用于基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
收发器，还用于将第一中间密钥K SEAF发送给SEAF。
在本申请的一些可选实施例中，
处理器，还用于基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
处理器，还用于基于第三中间密钥CK和第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
收发器，还用于将第六中间密钥CK’和第七中间密钥IK’发送至AUSF；
处理器，还用于基于第六中间密钥CK’和第七中间密钥IK’生成第五中间密钥K AUSF，并基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
收发器，还用于将第一中间密钥K SEAF发送给SEAF。
本申请实施例提供的一种网络设备，包括：
收发器，用于被配置第一协议网络支持的认证方式；
收发器，还用于接收认证服务器功能网元AUSF发送的第一服务网络标识；
处理器，用于基于该第一服务网络标识以及本地配置的第一协议网络支持的认证方式，选择使用的认证方式；
收发器，还用于向AUSF发送选择使用的认证方式。
在本申请的一些可选实施例中，
收发器，还用于向UDM发送的携带第一服务网络标识的认证向量请求消息，该认证向量请求消息用于请求调用UDM提供的认证向量服务或者认证服务。
在本申请的一些可选实施例中，
收发器，还用于向AUSF发送认证向量响应消息，在该认证向量响应消息中携带选择的认证方式。该认证向量响应消息，用于响应接收到的认证向量请求消息。
本申请实施例提供的一种网络设备，包括：
收发器，用于接收AUSF发送的第一认证方式；
处理器，用于根据接收到的第一认证方式选择使用的认证方式；
收发器，还用于向该AUSF发送该选择使用的认证方式。
在本申请的一些可选实施例中，该UDM接收AUSF发送的第一认证方式，可以包括：
收发器，还用于向UDM发送认证向量请求消息，该认证向量请求消息用于请求调用UDM提供的认证向量服务或者认证服务，该认证向量请求消息中携带第一认证方式。
在本申请的一些可选实施例中，该UDM向该AUSF发送该选择使用的认证方式，可以包括：
收发器，还用于向AUSF发送认证向量响应消息，在该认证向量响应消息中携带选择的认证方式。该认证向量响应消息，用于响应接收到的认证向量请求消息。
在本申请的一些可选实施例中，该UDM接收AUSF发送的第一认证方式之前，可以包括：
收发器，还用于接收到SEAF发送的第一认证方式。
本申请实施例还提供了一种处理装置，包括处理器和接口；所述处理器，用于执行上述任一方法实施例所述的通信方法。
应理解，上述处理装置可以是一个芯片，所述处理器可以通过硬件来实现也可以通过软件来实现，当通过硬件实现时，该处理器可以是逻辑电路、集成电路等；当通过软件来实现时，该处理器可以是一个通用处理器，通过读取存储器中存储的软件代码来实现，该存储器可以集成在处理器中，可以位于所述处理器之外，独立存在。
本申请还提供一种通信系统，其包括网络设备和终端设备。
本申请实施例还提供的一种计算机可读存储介质，包括指令，当其在计算机上运行时， 使得计算机执行：
步骤A：接收统一数据管理UDM发送的终端设备的签约永久标识SUPI，其中，SUPI用于标识UE；
步骤B：基于SUPI生成第一标识；
步骤C：向安全锚点功能SEAF发送第一标识；
步骤D：基于第一中间密钥K SEAF、第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
步骤E：向接入移动管理功能AMF发送第二中间密钥K AMF；
步骤F：基于第二中间密钥K AMF生成非接入层NAS密钥，其中，NAS密钥用于对NAS消息进行保护。
步骤G：向UDM发送第一标识；
步骤H：接收第一标识，并保存第一标识与SUPI之间的对应关系。
步骤I：接收AMF发送的第一服务网络标识；
步骤J：用于生成第一标识，具体包括：当第一服务网络标识包括公共陆地移动网络标识PLMN ID和网络标识NID时，或者，当第一服务网络标识包括PLMN ID和NID，并且，认证服务器功能AUSF所在网络的标识包括PLMN ID但不包括NID时，生成第一标识。
步骤K：基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
步骤L：基于第三中间密钥CK和第四中间密钥IK，生成第五中间密钥K AUSF；
步骤M：将第五中间密钥K AUSF发送至AUSF；
步骤N：基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
步骤O：将第一中间密钥K SEAF发送给SEAF。
步骤P：基于UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
步骤Q：基于第三中间密钥CK和第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
步骤R：将第六中间密钥CK’和第七中间密钥IK’发送至AUSF；
步骤S：基于第六中间密钥CK’和第七中间密钥IK’生成第五中间密钥K AUSF，并基于第五中间密钥K AUSF生成第一中间密钥K SEAF；
步骤T：将第一中间密钥K SEAF发送给SEAF。
步骤U：接收AMF发送的AMF支持的认证方式；
步骤V：向UDM发送接收到的AMF支持的认证方式；
步骤W：基于AMF支持的认证方式选择使用的认证方式；
步骤X：向AUSF发送选择使用的认证方式；
步骤Y：基于选择使用的认证方式向AMF发送认证响应。
和/或，
步骤Z：基于终端设备的签约永久标识SUPI生成第一标识；
步骤AA：基于第一中间密钥K SEAF、第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
步骤AB：基于第二中间密钥K AMF生成NAS密钥，其中，NAS密钥用于对NAS消息进行保护。
步骤AC：向接入移动管理功能AMF发送注册请求，注册请求中携带第一服务网络标识；
步骤AD：基于SUPI生成第一标识，具体包括：
当第一服务网络标识包括公共陆地移动网络标识PLMN ID和网络标识NID时，
或者，当第一服务网络标识包括PLMN ID和NID，并且，AUSF所在网络的标识包括PLMN ID但不包括NID时，基于SUPI生成第一标识。
步骤AE：获取第三中间密钥CK和第四中间密钥IK；
步骤AF：基于第三中间密钥CK和第四中间密钥IK，生成第五中间密钥K AUSF；
步骤AG：基于第五中间密钥K AUSF生成第一中间密钥K SEAF。
步骤AH：获取第三中间密钥CK和第四中间密钥IK；
步骤AI：基于第三中间密钥CK和第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
步骤AJ：基于第六中间密钥CK’和第七中间密钥IK’生成第五中间密钥K AUSF；
步骤AK：基于第五中间密钥K AUSF生成第一中间密钥K SEAF。
步骤AL：基于第一中间密钥K SEAF、第一标识、第一标识的长度、ABBA以及ABBA的长度生成第二中间密钥K AMF。
步骤AM：基于SUPI生成第一标识；
步骤AN：向认证服务器功能网元AUSF发送所述第一标识；
步骤AO：向安全锚点功能网元SEAF发送所述第一标识；
步骤AP：基于第一中间密钥K SEAF、所述第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
步骤AQ：向移动管理功能网元AMF发送所述第二中间密钥；
步骤AR：基于所述第二中间密钥生成非接入层NAS密钥，其中，所述NAS密钥用于对NAS消息进行保护。
在本申请的一些可选实施例中，
步骤AS：基于终端设备UE的SUPI生成第一标识；
步骤AT：向AUSF发送该第一标识；
步骤AU：向SEAF发送该第一标识；
步骤AV：向该AMF发送该第一标识；
步骤AW：基于第一中间密钥K SEAF、该第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
步骤AX：向AMF发送该第二中间密钥K AMF；
步骤AY：基于该第二中间密钥生成NAS密钥，其中，该NAS密钥用于对NAS消息进行保护。
步骤AZ：接收该AMF发送的第一认证请求消息，该第一认证请求消息携带第一服务网络标识，该第一认证请求消息用于请求调用AUSF提供的认证服务；
步骤BA：向该UDM发送认证向量请求消息，该认证向量请求消息携带该第一服务网络标识，该认证向量请求消息用于请求调用UDM提供的认证向量服务，或者用于请求调用UDM提供的认证服务；
步骤BB：生成该第一标识。
步骤BC：该第三条件满足时，基于该UE的SUPI生成该第一标识。
步骤BD：保存该第一标识与该SUPI的对应关系。
步骤BE：基于该UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
步骤BF：基于该第三中间密钥CK和该第四中间密钥IK，生成第五中间密钥K AUSF；
步骤BG：将该第五中间密钥K AUSF发送至该AUSF；
步骤BH：基于该第五中间密钥K AUSF生成该第一中间密钥K SEAF；
步骤BI：将该第一中间密钥K SEAF发送给该SEAF。
步骤BJ：基于该UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
步骤BK：基于该第三中间密钥CK和该第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
步骤BL：将该第六中间密钥CK’和该第七中间密钥IK’发送至该AUSF；
步骤BM：基于该第六中间密钥CK’和该第七中间密钥IK’生成第五中间密钥K AUSF，并基于该第五中间密钥K AUSF生成该第一中间密钥K SEAF；
步骤BN：将该第一中间密钥K SEAF发送给该SEAF。
步骤BO：接收到AMF或者SMF的携带第一标识的服务请求。
在本申请的一些可选实施例中，
步骤BP：被配置第一协议网络支持的认证方式；
步骤BQ：接收AUSF发送的第一服务网络标识；
步骤BR：基于该第一服务网络标识以及本地配置的第一协议网络支持的认证方式，选择使用的认证方式；
步骤BS：向该AUSF发送该选择使用的认证方式。
步骤BT：向UDM发送的携带第一服务网络标识的认证向量请求消息，该认证向量请求消息用于请求调用UDM提供的认证向量服务或者认证服务。
步骤BU：向AUSF发送认证向量响应消息，在该认证向量响应消息中携带选择的认证方式。该认证向量响应消息，用于响应接收到的认证向量请求消息。
在本申请的一些可选实施例中，
步骤BV：接收AUSF发送的第一认证方式；
步骤BW：根据接收到的第一认证方式选择使用的认证方式；
步骤BX：向该AUSF发送该选择使用的认证方式。
步骤BY：向UDM发送认证向量请求消息，该认证向量请求消息用于请求调用UDM提供的认证向量服务或者认证服务，该认证向量请求消息中携带第一认证方式。
步骤BZ：向AUSF发送认证向量响应消息，在该认证向量响应消息中携带选择的认证方式。该认证向量响应消息，用于响应接收到的认证向量请求消息。
步骤CA：接收到SEAF发送的第一认证方式。
本申请实施例还提供的一种计算机程序产品，所述计算机程序产品包括计算机程序代码，当所述计算机程序代码在计算机上运行时，使得计算机执行上述步骤A-步骤Y，和/或，步骤Z-步骤AR，和/或，步骤AS-步骤BO，和/或，步骤BP-步骤BU，和/或，步骤BV-步骤CA。
本申请实施例还提供一种芯片，包括存储器和处理器，所述存储器用于存储计算机程序，所述处理器用于从所述存储器中调用并运行所述计算机程序，使得芯片执行上述步骤A-步骤Y，和/或，步骤Z-步骤AR，和/或，步骤AS-步骤BO，和/或，步骤BP-步骤BU，和/或，步骤BV-步骤CA。
本申请实施例还提供一种芯片，包括处理器，所述处理器用于调用并运行计算机程序，使得芯片执行上述步骤A-步骤Y，和/或，步骤Z-步骤AR，和/或，步骤AS-步骤BO，和/或，步骤BP-步骤BU，和/或，步骤BV-步骤CA。
另外需说明的是，以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以基于实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。另外，本申请提供的装置实施例附图中，模块之间的连接关系表示它们之间具有通信连接，具体可以实现为一条或多条通信总线或信号线。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本申请可借助软件加必需的通用硬件的方式来实现，当然也可以通过专用硬件包括专用集成电路、专用CPU、专用存储器、专用元器件等来实现。一般情况下，凡由计算机程序完成的功能都可以很容易地用相应的硬件来实现，而且，用来实现同一功能的具体硬件结构也可以是多种多样的，例如模拟电路、数字电路或专用电路等。但是，对本申请而言更多情况下软件程序实现是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在可读取的存储介质中，如计算机的软盘、U盘、移动硬盘、ROM、RAM、磁碟或者光盘等，包括若干指令用以使得一台计算机设备执行本申请各个实施例所述的方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、通信装置、计算设备或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、通信装置、计算设备或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质 集成的通信装置、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。
应理解，说明书通篇中提到的“一个实施例”或“一实施例”意味着与实施例有关的特定特征、结构或特性包括在本申请的至少一个实施例中。因此，在整个说明书各处出现的“在一个实施例中”或“在一实施例中”未必一定指相同的实施例。此外，这些特定的特征、结构或特性可以任意适合的方式结合在一个或多个实施例中。应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
另外，本文中术语“系统”和“网络”在本文中常被可互换使用。本文中术语“和/或”，仅仅是一种描述关联对象的对应关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
应理解，在本申请实施例中，“与A相应的B”表示B与A相关联，基于A可以确定B。但还应理解，基于A确定B并不意味着仅仅基于A确定B，还可以基于A和/或其它信息确定B。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以基于实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存 储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例方法的全部或部分步骤。
总之，以上所述仅为本申请技术方案的较佳实施例而已，并非用于限定本申请的保护范围。凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (24)

  1. 一种通信方法，其特征在于，包括：
    认证服务器功能AUSF接收统一数据管理功能UDM发送的终端设备UE的签约永久标识SUPI，其中，所述SUPI用于标识所述UE；
    所述AUSF基于所述SUPI生成第一标识；
    所述AUSF向安全锚点功能SEAF发送所述第一标识；
    所述SEAF基于第一中间密钥K SEAF、所述第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
    所述SEAF向接入移动管理功能AMF发送所述第二中间密钥K AMF；
    所述AMF基于所述第二中间密钥K AMF生成非接入层NAS密钥，其中，所述NAS密钥用于对NAS消息进行保护。
  2. 根据权利要求1所述的方法，其特征在于，所述AUSF基于所述SUPI生成所述第一标识之后，所述方法还包括：
    所述AUSF向所述UDM发送所述第一标识；
    所述UDM接收所述第一标识，并保存所述第一标识与所述SUPI之间的对应关系。
  3. 根据权利要求1至2中任一项所述的方法，其特征在于，所述AUSF生成所述第一标识之前，所述方法还包括：
    所述AUSF接收所述AMF发送的第一服务网络标识；
    所述AUSF生成所述第一标识，包括：
    当所述第一服务网络标识包括公共陆地移动网络标识PLMN ID和网络标识NID时，
    或者，当所述第一服务网络标识包括PLMN ID和NID，并且，所述AUSF所在网络的标识包括PLMN ID但不包括NID时，所述AUSF生成所述第一标识。
  4. 根据权利要求1-3中任一项所述的方法，其特征在于，所述SEAF基于所述第一中间密钥K SEAF、所述第一标识以及所述ABBA生成所述第二中间密钥K AMF之前，所述方法还包括：
    所述UDM基于所述UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
    所述UDM基于所述第三中间密钥CK和所述第四中间密钥IK，生成第五中间密钥K AUSF；
    所述UDM将所述第五中间密钥K AUSF发送至所述AUSF；
    所述AUSF基于所述第五中间密钥K AUSF生成所述第一中间密钥K SEAF；
    所述AUSF将所述第一中间密钥K SEAF发送给所述SEAF。
  5. 根据权利要求1-3中任一项所述的方法，其特征在于，所述SEAF基于所述第一中间密钥K SEAF、所述第一标识以及所述ABBA生成所述第二中间密钥K AMF之前，所述方法还包括：
    所述UDM基于所述UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
    所述UDM基于所述第三中间密钥CK和所述第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
    所述UDM将所述第六中间密钥CK’和所述第七中间密钥IK’发送至所述AUSF；
    所述AUSF基于所述第六中间密钥CK’和所述第七中间密钥IK’生成第五中间密钥K AUSF，并基于所述第五中间密钥K AUSF生成所述第一中间密钥K SEAF；
    所述AUSF将所述第一中间密钥K SEAF发送给所述SEAF。
  6. 根据权利要求1-5中任一项所述的方法，其特征在于，所述AUSF接收所述UDM发送的所述UE的所述SUPI之前，所述方法还包括：
    所述AUSF接收所述AMF发送的所述AMF支持的认证方式；
    所述AUSF向所述UDM发送接收到的所述AMF支持的认证方式；
    所述UDM基于所述AMF支持的认证方式选择使用的认证方式；
    所述UDM向所述AUSF发送所述选择使用的认证方式；
    所述AUSF基于所述选择使用的认证方式向所述AMF发送认证响应。
  7. 一种通信方法，其特征在于，包括：
    终端设备UE基于所述UE的签约永久标识SUPI生成第一标识；
    所述UE基于第一中间密钥K SEAF、所述第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
    所述UE基于所述第二中间密钥K AMF生成非接入层NAS密钥，其中，所述NAS密钥用于对NAS消息进行保护。
  8. 根据权利要求7所述的方法，其特征在于，所述UE基于所述SUPI生成所述第一标识之前，所述方法还包括：
    所述UE向接入移动管理功能AMF发送注册请求，所述注册请求中携带第一服务网络标识；
    所述UE基于所述SUPI生成所述第一标识，包括：
    当所述第一服务网络标识包括公共陆地移动网络标识PLMN ID和网络标识NID时，
    或者，当所述第一服务网络标识包括PLMN ID和NID，并且，所述AUSF所在网络的标识包括PLMN ID但不包括NID时，所述UE基于所述SUPI生成所述第一标识。
  9. 根据权利要求7或8所述的方法，其特征在于，所述UE基于所述第一中间密钥K SEAF、所述第一标识以及所述架构间抗降维参数ABBA生成所述第二中间密钥K AMF之前，所述方法还包括：
    所述UE获取第三中间密钥CK和第四中间密钥IK；
    所述UE基于所述第三中间密钥CK和所述第四中间密钥IK，生成第五中间密钥K AUSF；
    所述UE基于所述第五中间密钥K AUSF生成所述第一中间密钥K SEAF。
  10. 根据权利要求7或8所述的方法，其特征在于，所述UE基于所述第一中间密钥K SEAF、所述第一标识以及所述架构间抗降维参数ABBA生成第二中间密钥K AMF之前，所述方法还包括：
    所述UE获取第三中间密钥CK和第四中间密钥IK；
    所述UE基于所述第三中间密钥CK和所述第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
    所述UE基于所述第六中间密钥CK’和所述第七中间密钥IK’生成第五中间密钥K AUSF；
    所述UE基于所述第五中间密钥K AUSF生成所述第一中间密钥K SEAF。
  11. 根据权利要求7-10中任一项所述的方法，其特征在于，所述UE基于所述第一中间密钥K SEAF、所述第一标识以及所述架构间抗降维参数ABBA生成所述第二中间密钥K AMF，包括：
    所述UE基于所述第一中间密钥K SEAF、所述第一标识、所述第一标识的长度、所述ABBA以及所述ABBA的长度生成所述第二中间密钥K AMF。
  12. 一种网络设备，其特征在于，包括：
    收发器，用于接收统一数据管理UDM发送的终端设备的签约永久标识SUPI，其中，所述SUPI用于标识所述UE；
    处理器，用于基于所述SUPI生成第一标识；
    所述收发器，还用于向安全锚点功能SEAF发送所述第一标识；
    所述处理器，还用于基于第一中间密钥K SEAF、所述第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
    所述收发器，还用于向接入移动管理功能AMF发送所述第二中间密钥K AMF；
    所述处理器，还用于基于所述第二中间密钥K AMF生成非接入层NAS密钥，其中，所述NAS密钥用于对NAS消息进行保护。
  13. 根据权利要求12所述的网络设备，其特征在于，
    所述收发器，还用于向所述UDM发送所述第一标识；
    所述收发器，还用于接收所述第一标识，并保存所述第一标识与所述SUPI之间的对应关系。
  14. 根据权利要求12至13中任一项所述的网络设备，其特征在于，
    所述收发器，还用于接收所述AMF发送的第一服务网络标识；
    所述处理器，用于生成所述第一标识，具体包括：
    当所述第一服务网络标识包括公共陆地移动网络标识PLMN ID和网络标识NID时，
    或者，当所述第一服务网络标识包括PLMN ID和NID，并且，认证服务器功能AUSF所在网络的标识包括PLMN ID但不包括NID时，生成所述第一标识。
  15. 根据权利要求12-14中任一项所述的网络设备，其特征在于，
    所述处理器，还用于基于所述UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
    所述处理器，还用于基于所述第三中间密钥CK和所述第四中间密钥IK，生成第五中间密钥K AUSF；
    所述收发器，还用于将所述第五中间密钥K AUSF发送至所述AUSF；
    所述处理器，还用于基于所述第五中间密钥K AUSF生成所述第一中间密钥K SEAF；
    所述处理器，还用于将所述第一中间密钥K SEAF发送给所述SEAF。
  16. 根据权利要求12-14中任一项所述的网络设备，其特征在于，
    所述处理器，还用于基于所述UE的长期密钥K生成第三中间密钥CK和第四中间密钥IK；
    所述处理器，还用于基于所述第三中间密钥CK和所述第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
    所述收发器，还用于将所述第六中间密钥CK’和所述第七中间密钥IK’发送至所述AUSF；
    所述处理器，还用于基于所述第六中间密钥CK’和所述第七中间密钥IK’生成第五中间密钥K AUSF，并基于所述第五中间密钥K AUSF生成所述第一中间密钥K SEAF；
    所述收发器，还用于将所述第一中间密钥K SEAF发送给所述SEAF。
  17. 根据权利要求12-16中任一项所述的网络设备，其特征在于，
    所述收发器，还用于接收所述AMF发送的所述AMF支持的认证方式；
    所述收发器，还用于向所述UDM发送接收到的所述AMF支持的认证方式；
    所述处理器，还用于基于所述AMF支持的认证方式选择使用的认证方式；
    所述收发器，还用于向所述AUSF发送所述选择使用的认证方式；
    所述收发器，还用于基于所述选择使用的认证方式向所述AMF发送认证响应。
  18. 一种终端设备，其特征在于，包括：
    处理器，用于基于终端设备的签约永久标识SUPI生成第一标识；
    所述处理器，还用于基于第一中间密钥K SEAF、所述第一标识以及架构间抗降维参数ABBA生成第二中间密钥K AMF；
    所述处理器，还用于基于所述第二中间密钥K AMF生成非接入层NAS密钥，其中，所述NAS密钥用于对NAS消息进行保护。
  19. 根据权利要求18所述的终端设备，其特征在于，所述终端设备还包括收发器；
    所述收发器，还用于向接入移动管理功能AMF发送注册请求，所述注册请求中携带第一服务网络标识；
    所述处理器，用于基于所述SUPI生成所述第一标识，具体包括：
    当所述第一服务网络标识包括公共陆地移动网络标识PLMN ID和网络标识NID时，
    或者，当所述第一服务网络标识包括PLMN ID和NID，并且，所述AUSF所在网络的标识包括PLMN ID但不包括NID时，基于所述SUPI生成所述第一标识。
  20. 根据权利要求18或19所述的终端设备，其特征在于，
    所述收发器，还用于获取第三中间密钥CK和第四中间密钥IK；
    所述处理器，还用于基于所述第三中间密钥CK和所述第四中间密钥IK，生成第五中间密钥K AUSF；
    所述处理器，还用于基于所述第五中间密钥K AUSF生成所述第一中间密钥K SEAF。
  21. 根据权利要求18或19所述的终端设备，其特征在于，
    所述收发器，还用于获取第三中间密钥CK和第四中间密钥IK；
    所述处理器，还用于基于所述第三中间密钥CK和所述第四中间密钥IK，生成第六中间密钥CK’和第七中间密钥IK’；
    所述处理器，还用于基于所述第六中间密钥CK’和所述第七中间密钥IK’生成第五中间密钥K AUSF；
    所述处理器，还用于基于所述第五中间密钥K AUSF生成所述第一中间密钥K SEAF。
  22. 根据权利要求18-21中任一项所述的终端设备，其特征在于，
    所述处理器，还用于基于所述第一中间密钥K SEAF、所述第一标识、所述第一标识的长度、所述ABBA以及所述ABBA的长度生成所述第二中间密钥K AMF。
  23. 一种计算机程序存储介质，其特征在于，所述计算机程序存储介质具有程序指令，当所述程序指令被直接或者间接执行时，使得如权利要求1-6或7-11中任一所述的方法被执行。
  24. 一种芯片系统，其特征在于，所述芯片系统包括至少一个处理器，当程序指令在所述至少一个处理器中执行时，使得如权利要求1-6或7-11中任一所述的方法被执行。
PCT/CN2021/098242 2020-06-15 2021-06-04 一种通信方法以及相关装置 WO2021254172A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP21824798.9A EP4161113A4 (en) 2020-06-15 2021-06-04 COMMUNICATION METHOD AND ASSOCIATED DEVICE

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010544961.4A CN113873492B (zh) 2020-06-15 2020-06-15 一种通信方法以及相关装置
CN202010544961.4 2020-06-15

Publications (1)

Publication Number Publication Date
WO2021254172A1 true WO2021254172A1 (zh) 2021-12-23

Family

ID=78980890

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/098242 WO2021254172A1 (zh) 2020-06-15 2021-06-04 一种通信方法以及相关装置

Country Status (3)

Country Link
EP (1) EP4161113A4 (zh)
CN (1) CN113873492B (zh)
WO (1) WO2021254172A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024092844A1 (en) * 2022-11-05 2024-05-10 Nokia Shanghai Bell Co., Ltd. Using routing indicator

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022036336A1 (en) * 2020-08-13 2022-02-17 Alibaba Group Holding Limited Network communication method and apparatus

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108901018A (zh) * 2018-07-27 2018-11-27 中国电子科技集团公司第三十研究所 一种终端发起的移动通信系统用户身份隐匿方法
US20190149521A1 (en) * 2017-11-16 2019-05-16 Nokia Technologies Oy Privacy managing entity selection in communication system
CN110312305A (zh) * 2018-03-27 2019-10-08 华为技术有限公司 终端设备的位置确定方法和设备
CN111147421A (zh) * 2018-11-02 2020-05-12 中兴通讯股份有限公司 一种基于通用引导架构gba的认证方法及相关设备

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108810890B (zh) * 2017-05-05 2019-06-11 华为技术有限公司 锚密钥生成方法、设备以及系统
ES2885499T3 (es) * 2017-07-25 2021-12-14 Ericsson Telefon Ab L M Identificador oculto de suscripción
KR102425582B1 (ko) * 2018-05-11 2022-07-26 삼성전자주식회사 무선통신 시스템에서 정보 보호 방법 및 장치
CN108848502B (zh) * 2018-05-18 2021-07-23 兴唐通信科技有限公司 一种利用5g-aka对supi进行保护的方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190149521A1 (en) * 2017-11-16 2019-05-16 Nokia Technologies Oy Privacy managing entity selection in communication system
CN110312305A (zh) * 2018-03-27 2019-10-08 华为技术有限公司 终端设备的位置确定方法和设备
CN108901018A (zh) * 2018-07-27 2018-11-27 中国电子科技集团公司第三十研究所 一种终端发起的移动通信系统用户身份隐匿方法
CN111147421A (zh) * 2018-11-02 2020-05-12 中兴通讯股份有限公司 一种基于通用引导架构gba的认证方法及相关设备

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
HUAWEI, HISILICON: "Editorial corrections to TS 33.501", 3GPP DRAFT; S3-182279-EDITORIAL CORRECTIONS TO TS 33.501, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. Dalian (China); 20180820 - 20180824, 13 August 2018 (2018-08-13), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051541380 *
See also references of EP4161113A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024092844A1 (en) * 2022-11-05 2024-05-10 Nokia Shanghai Bell Co., Ltd. Using routing indicator

Also Published As

Publication number Publication date
EP4161113A4 (en) 2023-11-22
EP4161113A1 (en) 2023-04-05
CN113873492B (zh) 2022-12-30
CN113873492A (zh) 2021-12-31

Similar Documents

Publication Publication Date Title
CN108574969B (zh) 多接入场景中的连接处理方法和装置
US11812496B2 (en) User group session management method and apparatus
US11570617B2 (en) Communication method and communications apparatus
US20230319556A1 (en) Key obtaining method and communication apparatus
US11871223B2 (en) Authentication method and apparatus and device
WO2021012736A1 (zh) 一种会话管理网元的选择方法、装置及系统
WO2021136211A1 (zh) 授权结果的确定方法及装置
EP3834448A1 (en) Delegated data connection
US20200275269A1 (en) Secure Communication Method and Secure Communications Apparatus
WO2019029691A1 (zh) 数据完整性保护方法和装置
EP3648488B1 (en) Methods, devices, system and computer-readable storage medium for acquiring identifier of terminal device
WO2021254172A1 (zh) 一种通信方法以及相关装置
US20220086145A1 (en) Secondary Authentication Method And Apparatus
US20230048066A1 (en) Slice authentication method and apparatus
US20220272533A1 (en) Identity authentication method and communications apparatus
WO2021063298A1 (zh) 实现外部认证的方法、通信装置及通信系统
CN114071639A (zh) 接入网络的方法、通信系统和通信装置
TWI799064B (zh) 一種金鑰標識的生成方法以及相關裝置
WO2021180209A1 (zh) 传输寻呼信息的方法和通信装置
CN115412911A (zh) 一种鉴权方法、通信装置和系统
WO2023016160A1 (zh) 一种会话建立方法和相关装置
US20220330010A1 (en) Online Signup Method and Apparatus
US20220264435A1 (en) Access control method and communications apparatus
WO2021195816A1 (zh) 一种通信方法、装置及系统
WO2023246457A1 (zh) 安全决策协商方法及网元

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21824798

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2021824798

Country of ref document: EP

Effective date: 20221228