WO2022017158A1 - 用户与多终端间的安全性管理方法、装置及设备 - Google Patents

用户与多终端间的安全性管理方法、装置及设备 Download PDF

Info

Publication number
WO2022017158A1
WO2022017158A1 PCT/CN2021/104236 CN2021104236W WO2022017158A1 WO 2022017158 A1 WO2022017158 A1 WO 2022017158A1 CN 2021104236 W CN2021104236 W CN 2021104236W WO 2022017158 A1 WO2022017158 A1 WO 2022017158A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
user
network
security
access
Prior art date
Application number
PCT/CN2021/104236
Other languages
English (en)
French (fr)
Inventor
王妍
谌丽
Original Assignee
大唐移动通信设备有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 大唐移动通信设备有限公司 filed Critical 大唐移动通信设备有限公司
Publication of WO2022017158A1 publication Critical patent/WO2022017158A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security

Definitions

  • the present disclosure relates to the field of communication technologies, and in particular, to a method, apparatus, and device for security management between a user and multiple terminals.
  • the key between the user terminal and the network node is shown in Figure 1, including the root key K AMF of the terminal and the core network node derived from the long-term key signed by the user and the network side, and the root key K AMF between the terminal and the core network node is derived from K
  • the NAS signaling keys K NASint and K NASenc derived by AMF are used for encryption and integrity protection of NAS signaling; it also includes related keys of access network nodes, such as terminal and access keys derived from K AMF
  • the key K gNB between nodes, and the AS signaling and data keys K RRCint , K RRCenc , K UPint , K UPenc derived from K gNB by the terminal and the access node are used for the communication between the terminal and the access node. Encryption and integrity protection of signaling and data transmission.
  • the terminal can be connected to one MN (Master Node, master node) and one SN (Secondary Node, secondary node).
  • MN Master Node, master node
  • SN Secondary Node, secondary node
  • the MN When the MN first establishes a security context between the SN and the UE for a given AS security context shared between the MN and the UE, the MN generates a K SN for the SN and sends it to the SN via the Xn-C interface. To generate KSN , the MN associates a counter called the SN counter with the current AS security context. When a new K SN needs to be generated, the MN sends the value of the SN counter to the UE through the RRC signaling path. KSN is used to obtain further RRC and UP keys used between UE and SN.
  • the MN sends the KSN and the UE security capability calculated by the MN according to the SN counter parameter. to SN.
  • the SN performs relevant configuration and calculates the required RRC and UP keys according to the K SN.
  • the MN configures a new DRB and/or SRB for the UE by sending an RRC link reconfiguration request to the UE, and includes the SN counter parameter.
  • the UE will calculate the KSN of the SN and the RRC and UP keys required by the related DRB and/or SRB, the UE will send the reconfiguration completion to the MN, and activate the encryption and integrity protection keys selected by the SN. After the SN receives the complete reconfiguration sent by the MN, it activates the encryption and integrity protection selected by the UE.
  • the above is the security process between the UE and multiple access nodes, only for the exchange of keys required by the MN to the SN of a single terminal.
  • a user can have multiple terminal devices in different places, such as various types of terminal devices that can be used in companies, private cars, and homes. These separate terminal devices are establishing affiliation with the user. Then jointly provide services for a user. When the user moves, one or more terminal devices can be activated for use. In this single-user multi-terminal scenario, the security management method for a single terminal is no longer applicable to the single-user multi-terminal mode.
  • the security of information data transmission in the cellular network is aimed at a single terminal.
  • a user can have multiple subordinate terminals that are separated from each other, and multiple terminals are related to each other to provide services for one user.
  • the technology cannot yet support data transmission security management in a single-user multi-terminal scenario.
  • Embodiments of the present disclosure provide a method, apparatus, and device for security management between a user and multiple terminals.
  • the affiliation of the user terminal takes effect to access the network
  • the input parameters of the security key between the user terminal and the network side are transmitted through the network node to ensure the security of the connection between the user terminal and the network.
  • a security management method between a user and multiple terminals, applied to a terminal comprising:
  • the target terminal derives the security key according to the security key input parameter, and performs data transmission with the network.
  • store security root keys including:
  • the preset parameters include: an identifier signed by the user with the network side and/or a first key signed by the user with the network side;
  • the security root key is stored.
  • the security root key is generated and stored according to the first key signed by the user and the network side;
  • the plurality of terminals directly receive the first key from the user, and store the first key as a security root key.
  • acquiring the security key input parameters of the network side node corresponding to the target terminal including:
  • the first terminal that establishes a affiliation with the user, after the affiliation with the user is activated and accesses the network, performs initial authentication and key negotiation procedures to determine the first key of the first terminal Derivative collection;
  • the network node After the non-first target terminal that establishes a affiliation with the user accesses the network, the network node triggers the network node to transmit the corresponding network side node of the target terminal according to the first key derivation set of the first terminal security key input parameter.
  • the network node triggers the network node to transmit the target terminal's information according to the first key derivation set of the first terminal.
  • the security key input parameters of the corresponding network side node including:
  • the second terminal After the second terminal that is not the first to establish a affiliation with the user accesses the network, after the core network determines that the second terminal belongs to the user of the first terminal, the second terminal receives the non-access message sent by the core network.
  • the core network notifies the first access network node to send a security key input parameter to the second access network node, and the second terminal receives the information from the second access network node The security key input parameter sent;
  • the core network triggers the access network node to transmit security key input parameters, and the second terminal receives the access network node.
  • the security key input parameter of the access network node sent by the network access node.
  • the network node triggers the network node to transmit the target terminal according to the first key derivation set of the first terminal.
  • the security key input parameters of the corresponding access node including:
  • the access network node determines that the first terminal and the second terminal access the same access network node.
  • a terminal and the second terminal belong to the same user, and report to the core network to trigger the transmission of the non-access NAS layer key and the access network node root key input parameters, and the second terminal receives the access network
  • the access AS layer security key input parameters sent by the node and the security input parameters sent by the core network are received.
  • the security root key is generated and stored according to the first key signed by the user and the network side and the terminal count value when the terminal establishes the affiliation with the user;
  • the user In the process of establishing affiliation between the user and multiple terminals, the user updates the first key signed by the user and the network side according to the terminal count value, and each terminal obtains the updated first key corresponding to it as the security of the terminal and store the root key.
  • acquiring the security key input parameters of the access node corresponding to the target terminal including:
  • the first terminal that establishes the affiliation with the user after the affiliation with the user is activated and accesses the network, and the first terminal that is not the first target terminal that establishes the affiliation with the user accesses the network
  • the relationship between the first terminal and the target terminal and the count value of the target terminal are reported to the core network
  • the second terminal receives the security password triggered and transmitted by the network side node according to the count value of the target terminal. key input parameter.
  • the second terminal receives the security key input parameter that the network side node triggers and transmits according to the count value of the target terminal, including:
  • the core network After determining that the second terminal belongs to the user of the first terminal, the core network updates the root key according to the terminal count value of the second terminal, and sends the root key derivation parameters of the core network and the access network node to the second terminal and the The key input parameter of the non-access NAS layer, the core network triggers the access network node to transmit the key input parameter of the AS layer.
  • the core network updates the root key according to the count value of the second terminal, and sends the root key input parameters of the core network and access network nodes and the non-access NAS to the second terminal the key input parameter of the layer, the core network notifies the first access network node to send the security key input parameter to the second access network node, and the second terminal receives the network node root key input sent by the core network Parameters and security key input parameters of the non-access NAS layer and security key input parameters of the access network node AS layer;
  • the core network updates the root key according to the count value of the second terminal, and sends the core network and the second terminal to the second terminal.
  • the root key input parameter of the access network node and the key input parameter of the non-access NAS layer the core network triggers the access network node to transmit the security key input parameter, and the second terminal receives the core network
  • the second terminal receives the security key input parameter triggered and transmitted by the network side node according to the count value of the target terminal, including:
  • the second terminal After the second terminal that is not the first to establish a affiliation with the user accesses the network, the second terminal reports the terminal count value corresponding to the second terminal to the network side, and the access network node performs the operation according to the terminal count value of the second terminal.
  • the update of the corresponding key input parameter; the access network node determines that the first terminal and the second terminal belong to the same user, and reports it to the core network, and the core network passes the first terminal and the second terminal through the first terminal and the second terminal.
  • the second terminal receives the network node root key input parameters sent by the core network and the security key input of the non-access NAS layer parameters and the security key input parameters of the access network node.
  • the target terminal performs data transmission with the network according to the security key input parameter, including:
  • the second terminal activates the security of the non-access NAS layer and the access AS layer according to the security key input parameter, and performs data transmission with the network.
  • the multiple terminals delete the stored second key.
  • Embodiments of the present disclosure also provide a method for managing security between a user and multiple terminals, which is applied to the network side, and the method includes:
  • the network side triggers the network side node to transmit the security key input parameter of the network side node corresponding to the target terminal;
  • the network side triggers the network side node to transmit the security key input parameter of the access node corresponding to the target terminal, including:
  • the first terminal that establishes a affiliation with the user, after the affiliation with the user is activated and accesses the network, performs initial authentication and key negotiation procedures to determine the first key of the first terminal Derivative collection;
  • the network node When a target terminal that is not the first target terminal that establishes a affiliation relationship with the user accesses the network, the network node is triggered to transmit the security key input parameter of the network side node corresponding to the target terminal according to the affiliation relationship between the user and the terminal.
  • triggering the network node to transmit the security key input parameters of the access node corresponding to the target terminal according to the first key derivation set of the first terminal including:
  • the core network After the core network determines that the second terminal belongs to the user of the first terminal, it sends the non-access NAS layer security key input parameter set and the derived parameters of the access network node root key to the second terminal, and then the The core network notifies the access network node to access the AS layer security key input parameter set.
  • triggering the network node to transmit the security key input parameters of the access node corresponding to the target terminal according to the first key derivation set of the first terminal including:
  • the access network node determines that the first terminal and the second terminal belong to the same user, and reports to the core network, the The core network triggers the transmission of the non-access NAS layer key and the access network node root key input parameter, and the access network node sends the access AS layer security key input parameter to the second terminal.
  • the network side triggers the network side node to transmit the security key input parameter of the network side node corresponding to the target terminal, including:
  • the first terminal that establishes the affiliation with the user after the affiliation with the user is activated and accesses the network, and the first terminal that is not the first target terminal that establishes the affiliation with the user accesses the network. Then, the relationship between the first terminal and the target terminal and the count value of the target terminal are reported to the core network, and the network side node triggers and transmits the security key input parameter according to the count value of the target terminal.
  • the network side node triggers and transmits the security key input parameters according to the count value of the target terminal, including:
  • the core network After determining that the second terminal belongs to the user of the first terminal, the core network updates the root key according to the terminal count value of the second terminal, and sends to the second terminal the key input parameters and connection parameters of the non-access NAS layer of the core network.
  • the root key input parameter of the network access node the core network triggers the access network node to transmit the AS layer key input parameter.
  • the network side node triggers and transmits the security key input parameters according to the count value of the target terminal, including:
  • the network side receives the terminal count value corresponding to the second terminal reported by the second terminal, and the access network node receives the terminal count value of the second terminal according to the terminal count value of the second terminal Update the corresponding key input parameters;
  • the access network node sends the security key input parameter to the second terminal.
  • An embodiment of the present disclosure further provides a terminal, including: a transceiver, a processor, and a memory, where a program executable by the processor is stored in the memory; when the processor executes the program, Each terminal establishes a subordinate relationship, and the multiple terminals store the security root key; among the multiple terminals, when at least one target terminal accesses the network, the security key input parameter of the network side node corresponding to the target terminal is obtained; The target terminal derives the security key according to the security key input parameter, and performs data transmission with the network.
  • store security root keys including:
  • the preset parameters include: an identifier signed by the user with the network side and/or a first key signed by the user with the network side;
  • the security root key is stored.
  • the security root key is generated and stored according to the first key signed by the user and the network side;
  • the plurality of terminals directly receive the first key from the user, and store the first key as a security root key.
  • acquiring the security key input parameters of the network side node corresponding to the target terminal including:
  • the first terminal that establishes a affiliation with the user, after the affiliation with the user is activated and accesses the network, performs initial authentication and key negotiation procedures to determine the first key of the first terminal Derivative collection;
  • the network node After the non-first target terminal that establishes a affiliation with the user accesses the network, the network node triggers the network node to transmit the corresponding network side node of the target terminal according to the first key derivation set of the first terminal security key input parameter.
  • the security root key is generated and stored according to the first key signed by the user and the network side and the terminal count value when the terminal establishes the affiliation with the user;
  • the user In the process of establishing affiliation between the user and multiple terminals, the user updates the first key signed by the user and the network side according to the terminal count value, and each terminal obtains the updated first key corresponding to it as the security of the terminal and store the root key.
  • acquiring the security key input parameters of the access node corresponding to the target terminal including:
  • the first terminal that establishes the affiliation with the user after the affiliation with the user is activated and accesses the network, and the first terminal that is not the first target terminal that establishes the affiliation with the user accesses the network
  • the relationship between the first terminal and the target terminal and the count value of the target terminal are reported to the core network
  • the second terminal receives the security password triggered and transmitted by the network side node according to the count value of the target terminal. key input parameter.
  • Embodiments of the present disclosure also provide a security management device between a user and multiple terminals, which is applied to the terminal, and the device includes:
  • the storage module is used for the user to establish affiliation with multiple terminals, and multiple terminals store the security root key
  • an obtaining module configured to obtain the security key input parameter of the network side node corresponding to the target terminal when at least one target terminal accesses the network among the plurality of terminals;
  • the processing module is used for deriving the security key and performing data transmission on the network according to the security key input parameter.
  • Embodiments of the present disclosure further provide a network-side device, including: a transceiver, a processor, and a memory, where a program executable by the processor is stored in the memory; when the processor executes the program, the processor implements: a slave When at least one target terminal among multiple terminals of the same user accesses the network, the network side triggers the network side node to transmit the security key input parameter of the network side node corresponding to the target terminal; according to the security key input parameter and terminal for data transmission.
  • a network-side device including: a transceiver, a processor, and a memory, where a program executable by the processor is stored in the memory; when the processor executes the program, the processor implements: a slave When at least one target terminal among multiple terminals of the same user accesses the network, the network side triggers the network side node to transmit the security key input parameter of the network side node corresponding to the target terminal; according to the security key input parameter and terminal for data transmission.
  • the embodiments of the present disclosure also provide a security management apparatus between a user and multiple terminals, which is applied to a network side device, and the apparatus includes:
  • a processing module configured to trigger the network side node to transmit the security key input parameter of the network side node corresponding to the target terminal when the network side triggers the network side node to access the network from at least one target terminal in the multiple terminals belonging to the same user;
  • the transceiver module is used for data transmission with the terminal according to the security key input parameter.
  • Embodiments of the present disclosure also provide a processor-readable storage medium storing processor-executable instructions for causing the processor to execute the above-mentioned Methods.
  • a user establishes affiliation with multiple terminals, and multiple terminals store the security root key; among the multiple terminals, when at least one target terminal accesses the network, obtains the corresponding data of the target terminal.
  • the affiliation of the user terminal takes effect to access the network
  • the input parameters of the security key between the user terminal and the network side are transmitted through the network node to ensure the security of the connection between the user terminal and the network.
  • FIG. 1 is a schematic diagram of a key system
  • Figure 2 is a schematic diagram of a dual-connection security mechanism
  • FIG. 3 is a schematic flowchart of a security management method between a user and multiple terminals of the present disclosure
  • FIG. 4 is a schematic flowchart of multi-terminal security management triggered by a core network node in an embodiment of the present disclosure
  • FIG. 5 is a schematic flowchart of multi-terminal security management triggered by an access network node in an embodiment of the present disclosure
  • FIG. 6 is a schematic flowchart of multi-terminal security management triggered by a core network node in an embodiment of the present disclosure
  • FIG. 7 is a schematic flowchart of multi-terminal security management triggered by an access network node in an embodiment of the present disclosure
  • FIG. 8 is a schematic structural diagram of a terminal according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic block diagram of a security management apparatus under a user and multi-terminal separation architecture according to an embodiment of the present disclosure.
  • an embodiment of the present disclosure provides a security management method between a user and multiple terminals, which is applied to a terminal, and the method includes:
  • Step 31 the user establishes affiliation with multiple terminals, and multiple terminals store security root keys
  • Step 32 In the multiple terminals, when at least one target terminal accesses the network, obtain the security key input parameter of the network side node corresponding to the target terminal;
  • Step 33 the target terminal derives the security key according to the security key input parameter, and performs data transmission with the network.
  • a user can establish affiliation with multiple terminals, and store user security root keys on the terminal side.
  • affiliation of the user terminal takes effect to access the network
  • the input parameters of the security key between the user terminal and the network side are transmitted through the network node to ensure the security of the connection between the user terminal and the network.
  • storing the security root key includes:
  • Step 311 Acquire preset parameters of the user, where the preset parameters include: an identifier signed by the user with the network side and/or a first key signed by the user with the core network side;
  • Step 312 Store the security root key according to the preset parameter.
  • step 312 may include:
  • Manner 1 During the process of establishing the affiliation between the multiple terminals and the user, the security root key is generated and stored according to the first key signed by the user and the network side; or, the multiple terminals directly receive the information from the user. The first key is stored, and the first key is stored as a security root key.
  • Mode 2 In the process of establishing affiliation between the user and multiple terminals, the security root key is generated and stored according to the first key signed by the user and the network side and the terminal count value when the terminal establishes the affiliation relationship with the user; or, In the process of establishing affiliation between the user and multiple terminals, the user updates the first key signed by the user and the network side according to the terminal count value, and each terminal obtains the updated first key corresponding to it as the security of the terminal and store the root key.
  • the user can establish affiliation with multiple terminals, that is, when the user establishes the affiliation with the terminal, the user transmits the unique parameter information to the terminal, such as the user's subscription identifier and the long-term security root key signed by the user and the core network side, and sends the information to the terminal. It is stored on the side to determine that the terminal belongs to the user and provide services for it.
  • the security root key stored on the terminal side adopts one of the following methods:
  • the user has a long-term security root key signed with the core network side. After establishing a subordinate relationship with the terminal, the long-term key will automatically generate security keys, such as encryption and integrity root keys. All terminals subordinate to the user have the same root key. key and stored inside the terminal. Or, the user directly transfers and stores the same long-term root key of the user in the slave terminal.
  • the long-term security root key possessed by the user is used to generate the security key of the subordinate terminal according to the UE COUNT value, such as encryption and integrity root key.
  • the user updates the long-term security root key signed by the user and the network side according to the UE COUNT value, and different terminals store the security long-term root key corresponding to the UE COUNT value.
  • the initial authentication and key negotiation process is carried out, and the security key parameters of the access network and the core network are deduced according to parameters such as the root key, so as to ensure that the user plane and the core network are connected with each other. Security transport of the control plane.
  • step 32 may include:
  • Step 321 Among the multiple terminals, the first terminal that establishes a affiliation with the user, after the affiliation with the user is activated and accesses the network, performs an initial authentication and key negotiation process to determine the first terminal of the first terminal. a key derivation set;
  • Step 322 After the non-first target terminal that establishes a affiliation with the user accesses the network, according to the first key derivation set of the first terminal, trigger the network node to transmit the corresponding information of the target terminal through the network node.
  • Step 322 may include:
  • the second terminal After the second terminal that is not the first to establish a affiliation with the user accesses the network, after the core network determines that the second terminal belongs to the user of the first terminal, the second terminal receives the non-access message sent by the core network.
  • the core network node Based on the manner in which the core network node triggers parameter transmission, optionally, if the first terminal accesses the first access network node, the second terminal accesses the second access network node, the first access network node node and the second access network node are different network nodes, the core network notifies the first access network node to send the security key input parameter to the second access network node, the second terminal receiving a security key input parameter sent by the second access network node;
  • the core network triggers the access network node to transmit security key input parameters, and the second terminal receives the access network node.
  • the security key input parameter of the access network node sent by the network access node.
  • the core network node when the second terminal 2 (not the first terminal that establishes a affiliation with the user) accesses the network, the core network determines that it belongs to the first terminal (and the user After establishing the affiliation relationship with the user of the first terminal), send the core network and access network root key calculation parameters of the first terminal, and the key derivation set of the NAS layer (such as algorithm type, algorithm identifier) to the user.
  • the second terminal is used to derive the security parameters of the NAS layer. And notify the access network node to send the key derivation set of the AS layer to the second terminal, so as to derive the parameters of the AS layer.
  • Access network node If the first terminal (the first terminal that establishes a affiliation with the user) and the second terminal (the non-first terminal that establishes a affiliation with the user) access the same access network node, the access network node is directly The node transmits the AS key parameter derivation set; if the first terminal and the second terminal access different access network nodes, the access node key parameters (such as derived keys, counter parameters, etc.) are sent to the second access node of the second terminal through the interface, and the counter parameters are sent to the core network side, which is then forwarded to the second terminal by the core network side for its access network.
  • the node key is calculated to ensure the security of data transmission between the second terminal and its access node.
  • User-affiliated second terminal after receiving the derivation set of key parameters at the NAS and AS layers, calculate the relevant key parameters, and activate the security process of the NAS layer and the AS layer to ensure the security of signaling and user data transmission sex.
  • Step 322 may include:
  • the access network node determines that the first terminal and the second terminal access the same access network node.
  • a terminal and the second terminal belong to the same user, and report to the core network to trigger the transmission of the non-access NAS layer key and the access network node root key input parameters, and the second terminal receives the access network
  • the access AS layer security key input parameters sent by the node and the security input parameters sent by the core network are received.
  • Access network node After the second terminal (the non-first terminal that establishes a affiliation with the user) accesses the network, if the first terminal (the first terminal that establishes the affiliation with the user) and the second terminal access the same access network node, the access network node determines that the two terminals belong to the same user, sends the AS layer key derivation set to the second terminal, and reports the relationship between the two terminals in the core network, triggering the transmission of key parameters.
  • Core network node The core network sends the core network and access network root key calculation parameters of the first terminal (the first terminal that establishes a affiliation with the user) to the second terminal (the non-first terminal that establishes a affiliation with the user). And the key derivation set of the NAS layer.
  • the user is subordinate to the second terminal: the second terminal derives the relevant key parameters and activates the security process to ensure the security of data transmission between the second terminal and the network.
  • the access network node sends the terminal information to the core network node, and the core network side triggers the security key parameter transfer process under different access nodes.
  • step 32 may include:
  • the first terminal that establishes the affiliation with the user after the affiliation with the user is activated and accesses the network, and the first terminal that is not the first target terminal that establishes the affiliation with the user accesses the network
  • the relationship between the first terminal and the target terminal and the count value of the target terminal are reported to the core network
  • the second terminal receives the security password triggered and transmitted by the network side node according to the count value of the target terminal. key input parameter.
  • the second terminal receives the security key input parameter triggered and transmitted by the network side node according to the count value of the target terminal, including:
  • the core network After the core network determines that the second terminal belongs to the user of the first terminal, it updates the root key according to the terminal count value of the second terminal, and sends the root key input parameters of the core network and the access network node and the non-root key to the second terminal. Access the key input parameters of the NAS layer, and the core network triggers the access network node to transmit the key input parameters of the AS layer.
  • the core network updates the root key according to the count value of the second terminal, and sends the root key input parameters of the core network and access network nodes and the non-access NAS to the second terminal the key input parameter of the layer, the core network notifies the first access network node to send the security key input parameter to the second access network node, and the second terminal receives the network node root key input sent by the core network Parameters and security key input parameters of the non-access NAS layer and security key input parameters of the access network node AS layer;
  • the core network updates the root key according to the count value of the second terminal, and sends the core network and the second terminal to the second terminal.
  • the root key input parameter of the access network node and the key input parameter of the non-access NAS layer the core network triggers the access network node to transmit the security key input parameter, and the second terminal receives the core network
  • the core network when triggered by the core network, after the second terminal (not the first terminal that establishes a affiliation with the user) accesses the network, it reports its corresponding UE COUNT value to the core network side, and the core network determines when After it is subordinate to the user of the first terminal (the first terminal that establishes a subordinate relationship with the user), the key update of the second terminal is performed according to the stored core network key of the first terminal according to the UE COUNT value, and the first terminal is updated.
  • the core network and access network root key calculation parameters of the terminal and the key derivation set of the NAS layer are sent to the second terminal to derive the security parameters of the NAS layer. And notify the access network node to update the key of the AS layer according to the UE COUNT value, and send the derivation set to the second terminal to derive the parameters of the AS layer.
  • the same or different terminal nodes use the same method—the same method.
  • the access network node triggers: the second terminal receives the security key input parameter triggered and transmitted by the network side node according to the count value of the target terminal, include:
  • the second terminal After the second terminal that is not the first to establish a affiliation with the user accesses the network, the second terminal reports the terminal count value corresponding to the second terminal to the network side, and the access network node performs the operation according to the terminal count value of the second terminal.
  • the update of the corresponding key input parameter; the access network node determines that the first terminal and the second terminal belong to the same user, and reports it to the core network, and the core network passes the first terminal and the second terminal through the first terminal and the second terminal.
  • the relationship between the NAS or AS root key parameters is performed according to the count value of the second terminal, and the second terminal receives the network node root key input parameters sent by the core network and the security key input parameters of the non-access NAS layer. and the security key input parameter of the access network node.
  • the second terminal after the second terminal accesses the network, different from the first method, the second terminal first reports the UE COUNT parameter corresponding to the second terminal to the network side, and the network side node The corresponding key parameters are updated according to the UE COUNT value, and then the second terminal key derivation set is transmitted.
  • step 33 may include:
  • the second terminal inputs the parameters according to the security key, activates the security of the non-access NAS layer and the access layer, and performs data transmission with the network.
  • the multiple terminals delete the stored second key.
  • the terminal side deletes the stored user-related parameter information.
  • Embodiment 1 Based on the above-mentioned method 1, the multi-terminal security management triggered by the core network node, the two terminals that establish the affiliation with the user access different access nodes respectively:
  • the process includes:
  • Step 0 Terminal 1 (the first terminal that establishes a affiliation with the user) and Terminal 2 (the non-first terminal that establishes a affiliation with the user) establishes a affiliation with the user, and obtains the same user-specific parameter information, such as the user subscription identifier such as user-specific identifiers and security keys corresponding to the network side.
  • Terminal 1 the first terminal that establishes a affiliation with the user
  • Terminal 2 the non-first terminal that establishes a affiliation with the user
  • the user directly stores his long-term security root key inside the slave terminal;
  • the encryption and integrity protection root key is self-generated by the user's long-term security root key, stored in the terminal, and the security key of each terminal is the same.
  • Step 1 The first terminal 1 that establishes a affiliation with the user accesses the network (access node 1 and the core network), completes the user registration and authentication process, and establishes a key system with the network side.
  • Step 2 After the user activates the subordinate terminal 2 (for example, the second terminal that establishes a subordinate relationship with the user), the user accesses the network through the access node 2, and the core network side determines the subordinate terminal according to the user-specific identifier carried by the terminal 2. user, and identify all subordinate terminals of the user.
  • the subordinate terminal 2 for example, the second terminal that establishes a subordinate relationship with the user
  • Step 3 The core network sends the core network and access network root key calculation parameters corresponding to the terminal 1 and the NAS layer key derivation set (such as algorithm type, algorithm identifier, etc.) to the terminal 2, so that the terminal performs the NAS layer. Derivation of key parameters.
  • Step 4 Activate the security of the terminal 2 and the core network side, including the security process of encryption and integrity protection of signaling and user data.
  • Step 5 The access node 1 is triggered by the core network side to transmit the access network key set, and the trigger message includes the access node information of the terminal 2 and related parameter information.
  • Step 6 The access node 1 derives the key of the access node 2 according to the access node root key of the terminal 1, sends the derived key to the access node 2, and in the message fed back to the core network, Send the key derivation set of the access node of terminal 2 to the core network side.
  • Step 7 The core network forwards the access node key derivation set (such as algorithm type, algorithm identifier, etc.) of the terminal 2 to the terminal 2.
  • the access node key derivation set such as algorithm type, algorithm identifier, etc.
  • Step 8 The terminal 2 uses the key derivation set parameter information to derive the relevant key parameter information of the access node, and activates the security with the access node 2, including the encryption of signaling and user data and the security of integrity protection process.
  • Step 9 After completing the security activation process of the access network and the core network of the user's subordinate terminal 2, the terminal can securely transmit data information with the network side.
  • Embodiment 2 Multi-terminal security management triggered by a core network node (mode 1), in an implementation mode in which two terminals that establish a affiliation with a user access the same access node respectively, the difference from Embodiment 1 above is that, The access node 1 and the access node 2 are combined into one access node.
  • the access node derives the key of the access node according to the access node root key of the terminal 1, and sends the derived key to the access node.
  • Core network feedback is included in Step 1 a core network node
  • Embodiment 3 Multi-terminal security management triggered by the access network node in the case of the above-mentioned first mode (two terminals are the same access node):
  • the process includes:
  • Step 0 Terminal 1 and Terminal 2 establish a affiliation with the user, and obtain the same user-specific parameter information, such as user-specific identifiers such as user subscription identifiers and security keys corresponding to the network side.
  • the obtained security key parameters are as follows:
  • the user directly stores his long-term security root key inside the slave terminal;
  • the encryption and integrity protection root key generated by the user's long-term key is stored inside the terminal, and the security key of each terminal is the same.
  • Step 1 The first subordinate terminal 1 of the user accesses the network (access node and core network), completes the user registration and authentication process, and establishes a key system with the network side.
  • Step 2 After the user activates the subordinate terminal 2, the access node accesses the network through the access node, and the access network node determines the subordinate user according to the user identifier carried by the terminal 2, and identifies all subordinate terminals of the user.
  • Step 3 The access node reports the relationship between the user's subordinate terminal 1 and the terminal 2 to the core network side, and instructs the transmission of the NAS/AS key parameters of the terminal 2.
  • Step 4 The core network forwards the core network and access network root key calculation parameters of the terminal 1 and the NAS layer key derivation set (such as algorithm type, algorithm identifier, etc.) to the terminal 2.
  • the NAS layer key derivation set such as algorithm type, algorithm identifier, etc.
  • Step 5 Terminal 2 uses the core network and access network root key calculation parameters to derive the root key parameters of its core network and access network, and then uses the key derivation set parameter information to derive the relevant secrets with the core network nodes. key parameters, and activate the security on the core network side, including the encryption and integrity protection of signaling and user data.
  • Step 6 Terminal 1 and Terminal 2 belong to the same access node, and the access node directly sends the AS key derivation set (such as algorithm type, algorithm identifier, etc.) associated with Terminal 1 to Terminal 2.
  • AS key derivation set such as algorithm type, algorithm identifier, etc.
  • Step 7 The terminal 2 uses the key derivation set parameter information to derive the relevant key parameter information of the access network node, and activates the security of the terminal 2 and the access network side, including the encryption and integrity of signaling and user data. Security process for sexual protection.
  • Step 8 After completing the security activation process of the access network and the core network of the user's subordinate terminal 2, the terminal can securely transmit data information with the network side.
  • Embodiment 4 Multi-terminal security management triggered by the access network node (method 1, if two terminals access different access nodes), the access network node sends the terminal information to the core network node, which is triggered by the core network side
  • the security key parameter transfer process under different access nodes reference may be made to the corresponding process in Embodiment 1.
  • Embodiment 5 Multi-terminal security management triggered by the core network node based on the above-mentioned second method (two terminals access different access nodes):
  • the process includes:
  • Step 0 Terminal 1 and Terminal 2 establish a affiliation with the user, and obtain user-specific parameter information, such as user-specific identifiers such as user subscription identifiers, and security keys corresponding to the network side.
  • user-specific parameter information such as user-specific identifiers such as user subscription identifiers, and security keys corresponding to the network side.
  • security key parameters are as follows:
  • the user uses the UE COUNT value to update the security root key of the slave terminal according to its long-term key, and stores it inside the terminal.
  • the UE COUNT corresponding to the first subordinate terminal of the user is equal to 0, and has the same long-term key as the user, and then the UE COUNT value of the terminal that establishes the subordinate relationship with the user is incremented;
  • the encryption and integrity root key is self-generated by the user's long-term key using the UE COUNT value, stored in the terminal, and the security key parameters of each terminal are different.
  • Step 1 The first subordinate terminal 1 of the user accesses the network (access node 1 and the core network), completes the user registration and authentication process, and establishes a key system with the network side.
  • Step 2 After the user activates the subordinate terminal 2 and accesses the network through the access node, the core network node determines the subordinate user according to the user identifier carried by the terminal 2, and identifies all subordinate terminals of the user.
  • Step 3 The core network side updates the NAS root key parameter of the terminal 2 according to the UE COUNT value and the user long-term key of the network side through the relationship between the user subordinate terminal 1 and the terminal 2.
  • Step 4 The core network sends the core network and access network root key calculation parameters corresponding to the terminal 2 and the NAS layer key derivation set (such as algorithm type, algorithm identifier, etc.) to the terminal 2, so that the terminal performs the NAS layer. Derivation of key parameters.
  • Step 5 Activate the security of the terminal 2 and the core network side, including the security process of encryption and integrity protection of signaling and user data.
  • Step 6 The access node 1 is triggered by the core network side to transmit the access network key set, and the trigger message includes the access node information of the terminal 2 and related parameter information.
  • Step 7 The access node 1 derives the key of the access node 2 according to the access node root key of the terminal 1 and the UE COUNT value, sends the derived key to the access node 2, and feeds back to the core network In the message, the key derivation set of the access node of terminal 2 is sent to the core network side.
  • Step 8 The core network forwards the access node key derivation set (such as algorithm type, algorithm identifier, etc.) of the terminal 2 to the terminal 2.
  • the access node key derivation set such as algorithm type, algorithm identifier, etc.
  • Step 9 The terminal 2 uses the key derivation set parameter information to derive the relevant key parameter information of the access node, and activates the security with the access node 2, including the encryption of signaling and user data and the security of integrity protection process.
  • Step 10 After completing the security activation process of the access network and the core network of the user's subordinate terminal 2, the terminal can securely transmit data information with the network side.
  • Embodiment 6 Multi-terminal security management triggered by the core network node (mode 2, two terminals access the same access node), the difference from the above Embodiment 5 is that the access node 1 and the access node 2 are combined into An access node, in step 7: the access node derives the key of the access node according to the access node root key of the terminal 1, and feeds back the derived key to the core network. In step 8, the core network forwards the access node key derivation set (such as algorithm type, algorithm identification, etc.) to the terminal 2.
  • the access node key derivation set such as algorithm type, algorithm identification, etc.
  • Embodiment 7 Multi-terminal security management triggered by the access network node in the case of the above-mentioned second mode (two terminals are the same access node)
  • the process includes:
  • Step 0 Terminal 1 and Terminal 2 establish a affiliation with the user, and obtain user-specific parameter information, such as user-specific identifiers such as user subscription identifiers, and security keys corresponding to the network side.
  • user-specific parameter information such as user-specific identifiers such as user subscription identifiers, and security keys corresponding to the network side.
  • security key parameters are as follows:
  • the user uses the UE COUNT value to update the security root key of the slave terminal according to its long-term key, and stores it inside the terminal.
  • the UE COUNT corresponding to the first subordinate terminal of the user is equal to 0, and has the same long-term key as the user, and then the UE COUNT value of the terminal that establishes the subordinate relationship with the user is incremented;
  • the root key for encryption and integrity protection is self-generated by the user's long-term key using the UE COUNT value, and stored in the terminal, and the security key parameters of each terminal are different.
  • Step 1 The first subordinate terminal 1 of the user accesses the network (access node and core network), completes the user registration and authentication process, and establishes a key system with the network side.
  • Step 2 After the user activates the subordinate terminal 2, the access node accesses the network through the access node, and the access network node determines the subordinate user according to the user identifier carried by the terminal 2, and identifies all subordinate terminals of the user.
  • Step 3 The access node updates the access node key parameter according to the UE COUNT value of the terminal 2.
  • Step 4 The access node reports the relationship between the user's subordinate terminal 1 and the terminal 2 to the core network side, and instructs to update and transfer the NAS key parameters of the terminal 2.
  • Step 5 The core network side calculates and updates the NAS/AS root key parameter of terminal 2 according to the UE COUNT value and the long-term key of terminal 1 through the relationship between the user's subordinate terminal 1 and terminal 2.
  • Step 6 The core network sends the core network and access network root key calculation parameters of the terminal 1 and the NAS layer key derivation set (such as algorithm type, algorithm identifier, etc.) to the terminal 2.
  • the NAS layer key derivation set such as algorithm type, algorithm identifier, etc.
  • Step 7 The terminal 2 uses the core network and access network root key calculation parameters to update the root keys of the access network and the core network, and then derives the key parameter information related to the core network node according to the key derivation set parameter information , and activate the security on the core network side, including the encryption and integrity protection of signaling and user data.
  • Step 8 If terminal 1 and terminal 2 belong to the same access node, the access node directly sends the AS key derivation set (such as algorithm type, algorithm identification, etc.) after updating according to the UE COUNT value to terminal 2.
  • AS key derivation set such as algorithm type, algorithm identification, etc.
  • Step 9 The terminal 2 uses the key derivation set parameter information to derive the relevant key parameter information with the access network node, and activates the security on the access network side, including the encryption and integrity protection of signaling and user data. safety process.
  • Step 10 After completing the security activation process of the access network and the core network of the user's subordinate terminal 2, the terminal can securely transmit data information with the network side.
  • Embodiment 8 If two terminals access different access nodes, the access network node sends the terminal information to the core network node, and the core network side triggers the security key parameter update and transfer process under different access nodes, Refer to the corresponding process in Example 5.
  • an embodiment of the present disclosure further provides a terminal 80, including: a transceiver 81, a processor 82, and a memory 83, where the memory 83 stores a program executable by the processor 82; the When the processor 82 executes the program, it realizes: the user establishes affiliation with multiple terminals, and the multiple terminals store the security root key; among the multiple terminals, when at least one target terminal accesses the network, the target terminal is acquired The security key input parameter of the corresponding network side node; the target terminal derives the security key according to the security key input parameter, and performs data transmission with the network.
  • store security root keys including:
  • the preset parameters include: an identifier signed by the user with the network side and/or a first security root key signed by the user with the network side corresponding to the core network side;
  • the security root key is stored.
  • the security root key is generated and stored according to the first key signed by the user and the network side;
  • the plurality of terminals directly receive the first key from the user, and store the first key as a security root key.
  • acquiring the security key input parameters of the network side node corresponding to the target terminal including:
  • the first terminal that establishes a affiliation with the user, after the affiliation with the user is activated and accesses the network, performs initial authentication and key negotiation procedures to determine the first key of the first terminal Derivative collection;
  • the network node After the target terminal that is not the first target terminal that establishes a affiliation with the user accesses the network, according to the first key derivation set of the first terminal, the network node is triggered by the network node to transmit the corresponding network side node of the target terminal. security key input parameter.
  • the network node triggers the network node to transmit the target terminal's information according to the first key derivation set of the first terminal.
  • the security key input parameters of the corresponding network side node including:
  • the second terminal After the second terminal that is not the first to establish a affiliation with the user accesses the network, after the core network determines that the second terminal belongs to the user of the first terminal, the second terminal receives the non-access message sent by the core network.
  • the core network notifies the first access network node to send the security key input parameter to the second access network node, and the second terminal receives the information from the second access network node.
  • the core network triggers the access network node to transmit the security key input parameter, and the second terminal receives the access network node.
  • the security key input parameter of the access network node sent by the network access node.
  • the network node triggers the network node to transmit the target terminal according to the first key derivation set of the first terminal.
  • the security key input parameters of the corresponding access node including:
  • the access network node determines that the first terminal and the second terminal access the same access network node.
  • a terminal and the second terminal belong to the same user, and report to the core network to trigger the transmission of the non-access NAS layer key and the access network node root key input parameters, and the second terminal receives the access network
  • the access AS layer security key input parameters sent by the node and the security input parameters sent by the core network are received.
  • the security root key is generated and stored according to the first key signed by the user and the network side and the terminal count value when the terminal establishes the affiliation with the user;
  • the user In the process of establishing affiliation between the user and multiple terminals, the user updates the first key signed by the user and the network side according to the terminal count value, and each terminal obtains the updated first key corresponding to it as the security of the terminal and store the root key.
  • acquiring the security key input parameters of the access node corresponding to the target terminal including:
  • the first terminal that establishes the affiliation with the user after the affiliation with the user is activated and accesses the network, and the first terminal that is not the first target terminal that establishes the affiliation with the user accesses the network
  • the relationship between the first terminal and the target terminal and the count value of the target terminal are reported to the core network
  • the second terminal receives the security password triggered and transmitted by the network side node according to the count value of the target terminal. key input parameter.
  • the second terminal receives the security key input parameter triggered and transmitted by the network side node according to the count value of the target terminal, including:
  • the core network After the core network determines that the second terminal belongs to the user of the first terminal, it updates the root key according to the terminal count value of the second terminal, and sends the root key input parameters of the core network and the access network node and the non-root key to the second terminal. Access the key input parameters of the NAS layer, and the core network triggers the access network node to transmit the key input parameters of the AS layer.
  • the core network updates the root key according to the count value of the second terminal, and sends the root key input parameters of the core network and access network nodes and the non-access NAS to the second terminal the key input parameter of the layer, the core network notifies the first access network node to send the security key input parameter to the second access network node, and the second terminal receives the network node root key input sent by the core network Parameters and security key input parameters of the non-access NAS layer and security key input parameters of the access network node AS layer;
  • the core network updates the root key according to the count value of the second terminal, and sends the core network and the second terminal to the second terminal.
  • the root key input parameter of the access network node and the key input parameter of the non-access NAS layer the core network triggers the access network node to transmit the security key input parameter, and the second terminal receives the core network
  • the second terminal receives the security key input parameter triggered and transmitted by the network side node according to the count value of the target terminal, including:
  • the second terminal After the second terminal that is not the first to establish a affiliation with the user accesses the network, the second terminal reports the terminal count value corresponding to the second terminal to the network side, and the access network node performs the operation according to the terminal count value of the second terminal.
  • the update of the corresponding key input parameter; the access network node determines that the first terminal and the second terminal belong to the same user, and reports it to the core network, and the core network passes the first terminal and the second terminal through the first terminal and the second terminal.
  • the second terminal receives the network node root key input parameters sent by the core network and the security key input of the non-access NAS layer parameters and the security key input parameters of the access network node.
  • the target terminal performs data transmission with the network according to the security key input parameter, including:
  • the second terminal activates the security of the non-access NAS layer and the access AS layer according to the security key input parameter, and performs data transmission with the network.
  • the multiple terminals delete the stored second key.
  • the terminal in this embodiment is a terminal corresponding to the method shown in FIG. 3 above, and the implementation manners in each of the above embodiments are applicable to this embodiment, and the same technical effect can also be achieved.
  • the transceiver 81 and the memory 83, as well as the transceiver 81 and the processor 82 can be communicated and connected through a bus interface, the function of the processor 82 can also be realized by the transceiver 81, and the function of the transceiver 81 can also be realized by the processor 82 realized.
  • the above-mentioned communication device provided by the embodiments of the present disclosure can implement all the method steps implemented by the above-mentioned method embodiments, and can achieve the same technical effect. The same parts and beneficial effects will be described in detail.
  • an embodiment of the present disclosure further provides a security management device 90 between a user and multiple terminals, which is applied to a terminal.
  • the device 90 includes:
  • the storage module 91 is used for the user to establish affiliation with multiple terminals, and multiple terminals store security root keys;
  • an obtaining module 92 configured to obtain the security key input parameter of the network side node corresponding to the target terminal when at least one target terminal accesses the network among the plurality of terminals;
  • the processing module 93 is used for deriving the security key according to the security key input parameter, and performing data transmission with the network.
  • the preset parameters include: an identifier signed by the user with the network side and/or a first security root key signed by the user with the network side corresponding to the core network side;
  • the security root key is stored.
  • the security root key is generated and stored according to the first key signed by the user and the network side;
  • the plurality of terminals directly receive the first key from the user, and store the first key as a security root key.
  • acquiring the security key input parameters of the network side node corresponding to the target terminal including:
  • the first terminal that establishes a affiliation with the user, after the affiliation with the user is activated and accesses the network, performs initial authentication and key negotiation procedures to determine the first key of the first terminal Derivative collection;
  • the network node After the non-first target terminal that establishes a affiliation with the user accesses the network, the network node triggers the network node to transmit the corresponding network side node of the target terminal according to the first key derivation set of the first terminal security key input parameter.
  • the network node triggers the network node to transmit the target terminal's information according to the first key derivation set of the first terminal.
  • the security key input parameters of the corresponding network side node including:
  • the second terminal After the second terminal that is not the first to establish a affiliation with the user accesses the network, after the core network determines that the second terminal belongs to the user of the first terminal, the second terminal receives the non-access message sent by the core network.
  • the core network notifies the first access network node to send a security key input parameter to the second access network node, and the second terminal receives the information from the second access network node The security key input parameter sent;
  • the core network triggers the access network node to transmit security key input parameters, and the second terminal receives the access network node.
  • the security key input parameter of the access network node sent by the network access node.
  • the network node triggers the network node to transmit the target terminal according to the first key derivation set of the first terminal.
  • the security key input parameters of the corresponding access node including:
  • the access network node determines that the first terminal and the second terminal access the same access network node.
  • a terminal and the second terminal belong to the same user, and report to the core network to trigger the transmission of the non-access NAS layer key and the access network node root key input parameters, and the second terminal receives the access network
  • the access AS layer security key input parameters sent by the node and the security input parameters sent by the core network are received.
  • the security root key is generated and stored according to the first key signed by the user and the network side and the terminal count value when the terminal establishes the affiliation with the user;
  • the user In the process of establishing affiliation between the user and multiple terminals, the user updates the first key signed by the user and the network side according to the terminal count value, and each terminal obtains the updated first key corresponding to it as the security of the terminal and store the root key.
  • acquiring the security key input parameters of the access node corresponding to the target terminal including:
  • the first terminal that establishes the affiliation with the user after the affiliation with the user is activated and accesses the network, and the first terminal that is not the first target terminal that establishes the affiliation with the user accesses the network
  • the relationship between the first terminal and the target terminal and the count value of the target terminal are reported to the core network
  • the second terminal receives the security password triggered and transmitted by the network side node according to the count value of the target terminal. key input parameter.
  • the second terminal receives the security key input parameter that the network side node triggers and transmits according to the count value of the target terminal, including:
  • the core network After the core network determines that the second terminal belongs to the user of the first terminal, it updates the root key according to the terminal count value of the second terminal, and sends the root key input parameters of the core network and the access network node and the non-root key to the second terminal. Access the key input parameters of the NAS layer, and the core network triggers the access network node to transmit the key input parameters of the AS layer.
  • the core network updates the root key according to the count value of the second terminal, and sends the root key input parameters of the core network and access network nodes and the non-access NAS to the second terminal the key input parameter of the layer, the core network notifies the first access network node to send the security key input parameter to the second access network node, and the second terminal receives the network node root key input sent by the core network Parameters and security key input parameters of the non-access NAS layer and security key input parameters of the access network node AS layer;
  • the core network updates the root key according to the count value of the second terminal, and sends the core network and the second terminal to the second terminal.
  • the root key input parameter of the access network node and the key input parameter of the non-access NAS layer the core network triggers the access network node to transmit the security key input parameter, and the second terminal receives the core network
  • the second terminal receives the security key input parameter triggered and transmitted by the network side node according to the count value of the target terminal, including:
  • the second terminal After the second terminal that is not the first to establish a affiliation with the user accesses the network, the second terminal reports the terminal count value corresponding to the second terminal to the network side, and the access network node performs the operation according to the terminal count value of the second terminal.
  • the update of the corresponding key input parameter; the access network node determines that the first terminal and the second terminal belong to the same user, and reports it to the core network, and the core network passes the first terminal and the second terminal through the first terminal and the second terminal.
  • the second terminal receives the network node root key input parameters sent by the core network and the security key input of the non-access NAS layer parameters and the security key input parameters of the access network node.
  • the target terminal performs data transmission with the network according to the security key input parameter, including:
  • the second terminal activates the security of the non-access NAS layer and the access AS layer according to the security key input parameter, and performs data transmission with the network.
  • the multiple terminals delete the stored second key.
  • the apparatus in this embodiment is an apparatus corresponding to the method on the terminal side, and the implementation manners in the foregoing embodiments are all applicable to the embodiments of the apparatus, and the same technical effect can also be achieved.
  • the above-mentioned device provided by the embodiment of the present disclosure can realize all the method steps realized by the above-mentioned method embodiment, and can achieve the same technical effect, and the same as the method embodiment in this embodiment is not repeated here. The parts and beneficial effects will be described in detail.
  • Embodiments of the present disclosure also provide a method for managing security between a user and multiple terminals, which is applied to the network side, and the method includes:
  • the network side triggers the network side node to transmit the security key input parameter of the network side node corresponding to the target terminal;
  • the network side triggers the network side node to transmit the security key input parameter of the access node corresponding to the target terminal, including:
  • the first terminal that establishes a affiliation with the user, after the affiliation with the user is activated and accesses the network, performs initial authentication and key negotiation procedures to determine the first key of the first terminal Derivative collection;
  • the affiliation relationship between the set user and the terminal is derived according to the first key of the first terminal, and the network node is triggered to transmit the corresponding information of the target terminal.
  • the security key input parameter of the network side node is derived according to the first key of the first terminal.
  • triggering the network node to transmit the security key input parameters of the access node corresponding to the target terminal according to the first key derivation set of the first terminal including:
  • the core network After determining that the second terminal belongs to the user of the first terminal, the core network sends the non-access NAS layer security key input parameter set and the access network node root key input parameter to the second terminal, and the The core network notifies the access network node to access the first key derivation set of the first terminal of the security key input parameter set of the AS layer;
  • the core network triggers the access network node to input parameters for accessing the security key of the AS layer.
  • triggering the network node to transmit the security key input parameters of the access node corresponding to the target terminal according to the first key derivation set of the first terminal including:
  • the access network node determines that the first terminal and the second terminal belong to the same user, and reports to the core network, triggering an the transfer of the access NAS layer key and the access network node root key input parameter, and the access network node sends the access AS layer security key input parameter to the second terminal;
  • the core network sends the first key derivation set of the first terminal to the second terminal.
  • the network side triggers the network side node to transmit the security key input parameter of the access node network side node corresponding to the target terminal, including:
  • the first terminal that establishes the affiliation with the user after the affiliation with the user is activated and accesses the network, and the first terminal that is not the first target terminal that establishes the affiliation with the user accesses the network.
  • the relationship between the first terminal and the target terminal and the count value of the target terminal are reported to the core network, and the network side node performs initial authentication according to the security key input parameter triggered and transmitted by the count value of the target terminal and the key negotiation process, to determine the first key derivation set of the first terminal;
  • the network node After the non-first target terminal that establishes a affiliation with the user accesses the network, trigger the network node to transmit the target terminal's information according to the first key derivation set of the first terminal and terminal count value The security key input parameter of the corresponding access node.
  • the network side node triggers and transmits the security key input parameters according to the count value of the target terminal, including:
  • the core network After determining that the second terminal belongs to the user of the first terminal, the core network updates the root key according to the terminal count value of the second terminal, and sends to the second terminal the key input parameters and connection parameters of the non-access NAS layer of the core network.
  • the root key input parameter of the network access node the core network triggers the access network node to transmit the AS layer key input parameter.
  • the network side node triggers and transmits the security key input parameters according to the count value of the target terminal, including:
  • the network side receives the terminal count value corresponding to the second terminal reported by the second terminal, and the access network node receives the terminal count value of the second terminal according to the terminal count value of the second terminal Update the corresponding key input parameters;
  • the access network node sends the security key input parameter to the second terminal.
  • the method on the network side is a process corresponding to the method on the terminal side, and all implementations in the embodiments of the method on the terminal side are applicable to the implementation process of the method on the network side.
  • Embodiments of the present disclosure further provide a network-side device, including: a transceiver, a processor, and a memory, where a program executable by the processor is stored in the memory; when the processor executes the program, the processor implements: a slave When at least one target terminal among multiple terminals of the same user accesses the network, the network side triggers the network side node to transmit the security key input parameter of the network side node corresponding to the target terminal; according to the security key input parameter and terminal for data transmission.
  • a network-side device including: a transceiver, a processor, and a memory, where a program executable by the processor is stored in the memory; when the processor executes the program, the processor implements: a slave When at least one target terminal among multiple terminals of the same user accesses the network, the network side triggers the network side node to transmit the security key input parameter of the network side node corresponding to the target terminal; according to the security key input parameter and terminal for data transmission.
  • the network side triggers the network side node to transmit the security key input parameter of the access node corresponding to the target terminal, including:
  • the first terminal that establishes a affiliation with the user, after the affiliation with the user is activated and accesses the network, performs initial authentication and key negotiation procedures to determine the first key of the first terminal Derivative collection;
  • the affiliation relationship between the set user and the terminal is derived according to the first key of the first terminal, and the network node is triggered to transmit the corresponding information of the target terminal.
  • the security key input parameter of the network side node is derived according to the first key of the first terminal.
  • triggering the network node to transmit the security key input parameters of the access node corresponding to the target terminal according to the first key derivation set of the first terminal including:
  • the core network After the core network determines that the second terminal belongs to the user of the first terminal, it sends the non-access NAS layer security key input parameter set and the access network node root key input parameter to the second terminal, and the The core network notifies the access network node to access the first key derivation set of the first terminal of the security key input parameter set of the AS layer; and
  • the core network triggers the access network node to input parameters for accessing the security key of the AS layer.
  • triggering the network node to transmit the security key input parameters of the access node corresponding to the target terminal according to the first key derivation set of the first terminal including:
  • the access network node determines that the first terminal and the second terminal belong to the same user, and reports to the core network, triggering an the transfer of the access NAS layer key and the access network node root key input parameter, and the access network node sends the access AS layer security key input parameter to the second terminal;
  • the core network sends the first key derivation set of the first terminal to the second terminal.
  • the network side triggers the network side node to transmit the security key input parameter of the access node network side node corresponding to the target terminal, including:
  • the first terminal that establishes the affiliation with the user after the affiliation with the user is activated and accesses the network, and the first terminal that is not the first target terminal that establishes the affiliation with the user accesses the network.
  • the relationship between the first terminal and the target terminal and the count value of the target terminal are reported to the core network, and the network side node performs initial authentication according to the security key input parameter triggered and transmitted by the count value of the target terminal and the key negotiation process, to determine the first key derivation set of the first terminal;
  • the network node After the non-first target terminal that establishes a affiliation with the user accesses the network, trigger the network node to transmit the target terminal's information according to the first key derivation set of the first terminal and terminal count value The security key input parameter of the corresponding access node.
  • the network side node triggers and transmits the security key input parameters according to the count value of the target terminal, including:
  • the core network After determining that the second terminal belongs to the user of the first terminal, the core network updates the root key according to the terminal count value of the second terminal, and sends to the second terminal the key input parameters and connection parameters of the non-access NAS layer of the core network.
  • the root key input parameter of the network access node the core network triggers the access network node to transmit the AS layer key input parameter.
  • the network side node triggers and transmits the security key input parameters according to the count value of the target terminal, including:
  • the network side receives the terminal count value corresponding to the second terminal reported by the second terminal, and the access network node receives the terminal count value of the second terminal according to the terminal count value of the second terminal Update the corresponding key input parameters;
  • the access network node sends the security key input parameter to the second terminal.
  • the network device in this embodiment is a network device corresponding to the above method on the network side, and the implementation manners in each of the above embodiments are applicable to this embodiment, and the same technical effect can also be achieved.
  • the transceiver and the memory, as well as the transceiver and the processor can be connected through the bus interface communication, the function of the processor 82 can also be realized by the transceiver, and the function of the transceiver can also be realized by the processor.
  • the above-mentioned network device provided by the embodiments of the present disclosure can implement all the method steps implemented by the above-mentioned method embodiments, and can achieve the same technical effect. The same parts and beneficial effects will be described in detail.
  • the embodiments of the present disclosure also provide a security management apparatus between a user and multiple terminals, which is applied to a network side device, and the apparatus includes:
  • a processing module configured to trigger the network side node to transmit the security key input parameter of the access node corresponding to the target terminal when at least one target terminal in the multiple terminals belonging to the same user accesses the network;
  • the transceiver module is used for data transmission with the terminal according to the security key input parameter.
  • the network side triggers the network side node to transmit the security key input parameter of the access node corresponding to the target terminal, including:
  • the first terminal that establishes a affiliation with the user, after the affiliation with the user is activated and accesses the network, performs initial authentication and key negotiation procedures to determine the first key of the first terminal Derivative collection;
  • the affiliation relationship between the set user and the terminal is derived according to the first key of the first terminal, and the network node is triggered to transmit the corresponding information of the target terminal.
  • the security key input parameter of the network side node is derived according to the first key of the first terminal.
  • triggering the network node to transmit the security key input parameters of the access node corresponding to the target terminal according to the first key derivation set of the first terminal including:
  • the core network After determining that the second terminal belongs to the user of the first terminal, the core network sends the non-access NAS layer security key input parameter set and the access network node root key input parameter to the second terminal, and the The core network notifies the access network node to access the first key derivation set of the first terminal of the security key input parameter set of the AS layer;
  • the core network triggers the access network node to input parameters for accessing the security key of the AS layer.
  • triggering the network node to transmit the security key input parameters of the access node corresponding to the target terminal according to the first key derivation set of the first terminal including:
  • the access network node determines that the first terminal and the second terminal belong to the same user, and reports to the core network, triggering an the transfer of the access NAS layer key and the access network node root key input parameter, and the access network node sends the access AS layer security key input parameter to the second terminal;
  • the core network sends the first key derivation set of the first terminal to the second terminal.
  • the network side triggers the network side node to transmit the security key input parameter of the access node network side node corresponding to the target terminal, including:
  • the first terminal that establishes the affiliation with the user after the affiliation with the user is activated and accesses the network, and the first terminal that is not the first target terminal that establishes the affiliation with the user accesses the network.
  • the relationship between the first terminal and the target terminal and the count value of the target terminal are reported to the core network, and the network side node performs initial authentication according to the security key input parameter triggered and transmitted by the count value of the target terminal and the key negotiation process, to determine the first key derivation set of the first terminal;
  • the network node After the non-first target terminal that establishes a affiliation with the user accesses the network, trigger the network node to transmit the target terminal's information according to the first key derivation set of the first terminal and terminal count value The security key input parameter of the corresponding access node.
  • the network side node triggers and transmits the security key input parameters according to the count value of the target terminal, including:
  • the core network After determining that the second terminal belongs to the user of the first terminal, the core network updates the root key according to the terminal count value of the second terminal, and sends to the second terminal the key input parameters and connection parameters of the non-access NAS layer of the core network.
  • the root key input parameter of the network access node the core network triggers the access network node to transmit the AS layer key input parameter.
  • the network side node triggers and transmits the security key input parameters according to the count value of the target terminal, including:
  • the network side receives the terminal count value corresponding to the second terminal reported by the second terminal, and the access network node receives the terminal count value of the second terminal according to the terminal count value of the second terminal Update the corresponding key input parameters;
  • the access network node sends the security key input parameter to the second terminal.
  • the device in this embodiment is a device corresponding to the method on the network side, and the implementation manners in the above-mentioned embodiments are all applicable to the embodiments of the device, and the same technical effect can also be achieved. It should be noted here that the above-mentioned device provided by the embodiment of the present disclosure can realize all the method steps realized by the above-mentioned method embodiment, and can achieve the same technical effect, and the same as the method embodiment in this embodiment is not repeated here. The parts and beneficial effects will be described in detail.
  • Embodiments of the present disclosure also provide a processor-readable storage medium storing processor-executable instructions for causing the processor to execute the above-mentioned The method on the terminal side or the method on the network side. All implementation manners in the foregoing method embodiment are applicable to this embodiment, and the same technical effect can also be achieved.
  • the disclosed apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer-readable storage medium.
  • the computer software product is stored in a storage medium, including several
  • the instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present disclosure.
  • the aforementioned storage medium includes: a U disk, a removable hard disk, a ROM, a RAM, a magnetic disk, or an optical disk and other mediums that can store program codes.
  • each component or each step can be decomposed and/or recombined.
  • These disaggregations and/or recombinations should be considered equivalents of the present disclosure.
  • the steps of performing the above-mentioned series of processes can naturally be performed in chronological order in the order described, but need not necessarily be performed in chronological order, and some steps can be performed in parallel or independently of each other.
  • Those of ordinary skill in the art can understand all or any steps or components of the method and device of the present disclosure. , software, or a combination thereof, which can be implemented by those of ordinary skill in the art using their basic programming skills after reading the description of the present disclosure.
  • the objects of the present disclosure can also be achieved by running a program or set of programs on any computing device.
  • the computing device may be a known general purpose device. Therefore, the objects of the present disclosure can also be achieved merely by providing a program product containing program code for implementing the method or apparatus. That is, such a program product also constitutes the present disclosure, and a storage medium in which such a program product is stored also constitutes the present disclosure.
  • the storage medium can be any known storage medium or any storage medium developed in the future.
  • each component or each step can be decomposed and/or recombined. These disaggregations and/or recombinations should be considered equivalents of the present disclosure.
  • the steps of executing the above-described series of processes can naturally be executed in chronological order in the order described, but need not necessarily be executed in chronological order. Certain steps may be performed in parallel or independently of each other.
  • modules can all be implemented in the form of software calling through processing elements; they can also all be implemented in hardware; some modules can also be implemented in the form of calling software through processing elements, and some modules can be implemented in hardware.
  • the determination module may be a separately established processing element, or may be integrated into a certain chip of the above-mentioned device to be implemented, in addition, it may also be stored in the memory of the above-mentioned device in the form of program code, and a certain processing element of the above-mentioned device may Call and execute the function of the above determined module.
  • the implementation of other modules is similar. In addition, all or part of these modules can be integrated together, and can also be implemented independently.
  • the processing element described here may be an integrated circuit with signal processing capability. In the implementation process, each step of the above-mentioned method or each of the above-mentioned modules can be completed by an integrated logic circuit of hardware in the processor element or an instruction in the form of software.
  • each module, unit, sub-unit or sub-module may be one or more integrated circuits configured to implement the above methods, such as: one or more Application Specific Integrated Circuit (ASIC), or, one or Multiple microprocessors (digital signal processors, DSP), or, one or more field programmable gate arrays (Field Programmable Gate Array, FPGA), etc.
  • ASIC Application Specific Integrated Circuit
  • DSP digital signal processors
  • FPGA Field Programmable Gate Array
  • the processing element may be a general-purpose processor, such as a central processing unit (Central Processing Unit, CPU) or other processors that can call program codes.
  • CPU central processing unit
  • these modules can be integrated together and implemented in the form of a system-on-a-chip (SOC).
  • SOC system-on-a-chip

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本公开公开了一种用户与多终端间的安全性管理方法、装置及设备。方法包括：用户与多个终端建立从属关系，多个终端存储安全性根密钥；在所述多个终端中，至少一个目标终端接入网络时，获取所述目标终端对应的网络侧节点的安全密钥输入参数；所述目标终端根据所述安全密钥输入参数进行安全密钥的推衍，与网络进行数据传输。

Description

用户与多终端间的安全性管理方法、装置及设备
相关申请的交叉引用
本申请主张在2020年7月22日在中国提交的中国专利申请号No.202010709512.0的优先权，其全部内容通过引用包含于此。
技术领域
本公开涉及通信技术领域，尤其涉及一种用户与多终端间的安全性管理方法、装置及设备。
背景技术
在无线通信蜂窝网中，为了保证网络安全，需要对信令和用户数据的传输进行加密和完整性保护。在单个用户终端与网络间节点派生相关密钥，共同进行通信过程的安全保障。
(1)密钥体系
用户终端与网络节点间的密钥如图1所示，包括由用户和网络侧签约的长期密钥推衍出终端与核心网节点的根密钥K AMF，以及由终端和核心网节点从K AMF推衍出的NAS信令密钥K NASint，K NASenc，用于NAS信令的加密与完整性保护；还包括接入网节点的相关密钥，如由K AMF推衍的终端与接入节点间的密钥K gNB，以及由终端和接入节点从K gNB推衍出的AS信令和数据密钥K RRCint，K RRCenc，K UPint，K UPenc，用于终端和接入节点间的信令和数据传输的加密和完整性保护。
(2)双连接的安全机制
无线通信蜂窝网的双连接中，终端可连接至一个MN(Master Node，主节点)以及一个SN(Secondary Node，辅节点)。MN为MN和UE之间共享的给定AS安全上下文首次在SN与UE之间建立安全上下文时，MN为SN生成K SN并通过Xn-C接口将其发送给SN。为了生成K SN，MN将称为SN计数器的计数器与当前的AS安全上下文相关联。当需要生成新的K SN时，MN通过RRC信令路径将SN计数器的值发送给UE。K SN用于获取在UE和SN 之间使用的进一步的RRC和UP密钥。
如图2所示，为由MN发起的SN添加/修改流程的安全过程，MN通过Xn-C向SN发送SN添加/修改请求过程中，将MN根据SN计数器参数计算的KSN以及UE安全能力发送给SN。SN进行相关配置，并根据K SN计算所需的RRC和UP密钥。MN在通过向UE发送RRC链接重配置请求，为其配置新的DRB和/或SRB，且包括SN计数器参数。UE将计算SN的KSN及相关DRB和/或SRB所需的RRC和UP密钥，UE将重配置完成发送给MN，并激活SN选择的加密和完整性保护密钥。在SN接收到MN发送的重配置完成后，激活UE所选择的加密和完整性保护。以上为UE与多个接入节点间的安全过程，仅针对单个终端的由MN到SN所需密钥的交互。
但在未来移动通信系统中，一个用户可在不同地点拥有多个终端设备，如公司、私家车、家里等地方可使用的多种类型终端设备，这些相互分离的终端设备在与用户建立从属关系后共同为一个用户提供服务。当用户移动时，可激活一个或多个终端设备以供使用。在这种单用户多终端的场景下，针对单个终端的安全性管理方法将不再适用于单用户多终端模式。
蜂窝网中的信息数据传输的安全性是以单个终端为目标的，未来通信系统中，一个用户可以有多个相互分离的从属终端，且多个终端相互关联，为一个用户提供服务，目前相关技术还不能支持单用户多终端场景下的数据传输安全性管理。
发明内容
本公开实施例提供了一种用户与多终端间的安全性管理方法、装置及设备。在用户终端的从属关系生效接入网络时，用户终端与网络侧安全密钥的输入参数通过网络节点进行传递，以保障用户终端与网络连接的安全性。
为解决上述技术问题，本公开的实施例提供如下技术方案：
一种用户与多终端间的安全性管理方法，应用于终端，所述方法包括：
用户与多个终端建立从属关系，多个终端存储安全性根密钥；
在所述多个终端中，至少一个目标终端接入网络时，获取所述目标终端对应的网络侧节点的安全密钥输入参数；
所述目标终端根据所述安全密钥输入参数进行安全密钥的推衍，与网络进行数据传输。
可选的，存储安全性根密钥，包括：
获取用户的预设参数，所述预设参数包括：用户与网络侧签约的标识和/或用户与网络侧签约的第一密钥；
根据所述预设参数，存储所述安全性根密钥。
可选的，根据所述预设参数，存储安全性根密钥，包括：
所述多个终端与用户建立从属关系的过程中，根据用户与网络侧签约的第一密钥生成安全性根密钥并存储；
或者，
所述多个终端直接从所述用户接收所述第一密钥，并将所述第一密钥作为安全性根密钥进行存储。
可选的，在所述多个终端中，至少一个目标终端接入网络时，获取所述目标终端对应的网络侧节点的安全密钥输入参数，包括：
在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，进行初始认证及密钥协商流程，确定第一终端的第一密钥推衍集合；
在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一终端的第一密钥推衍集合，通过网络节点触发网络节点传递所述目标终端的对应网络侧节点的安全密钥输入参数。
可选的，在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一终端的第一密钥推衍集合，通过网络节点触发网络节点传递所述目标终端的对应的网络侧节点的安全密钥输入参数，包括：
在非首个与所述用户建立从属关系的第二终端接入网络后，核心网确定所述第二终端从属于第一终端的用户后，所述第二终端接收核心网发送的非接入NAS层的安全密钥输入参数集合以及接入网节点根密钥的输入参数，以及由所述核心网通知接入网节点进行接入AS层的安全密钥输入参数集合。
可选的，若所述第一终端接入第一接入网节点，所述第二终端接入第二接入网节点，所述第一接入网节点和所述第二接入网节点是不同的网络节点， 所述核心网通知所述第一接入网节点向所述第二接入网节点发送安全密钥输入参数，所述第二终端接收所述第二接入网节点所发送的安全密钥输入参数；
若所述第一终端和所述第二终端接入相同的接入网节点，所述核心网触发所述接入网节点进行安全密钥输入参数的传递，所述第二终端接收所述接入网节点发送的所述接入网节点的安全密钥输入参数。
可选的，在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一个终端的第一密钥推衍集合，通过网络节点触发网络节点传递所述目标终端的对应的接入节点的安全密钥输入参数，包括：
在非首个与所述用户建立从属关系的第二终端接入网络后，若所述第一终端与所述第二终端接入同一接入网节点，则该接入网节点确定所述第一终端和所述第二终端从属于同一用户，并上报核心网，触发非接入NAS层密钥及接入网节点根密钥输入参数的传递，所述第二终端接收所述接入网节点发送的接入AS层安全密钥输入参数以及接收所述核心网发送的安全输入参数。
可选的，根据所述预设参数，存储安全性根密钥，包括：
在用户与多个终端建立从属关系的过程中，根据用户与网络侧签约的第一密钥以及终端与用户建立从属关系时的终端计数值，生成安全性根密钥并存储；
或者，
在用户与多个终端建立从属关系的过程中，用户根据终端计数值，更新用户与网络侧签约的第一密钥，各终端获取与其对应的更新后的第一密钥，作为该终端的安全性根密钥并存储。
可选的，在所述多个终端中的至少一个目标终端接入网络时，获取所述目标终端对应的接入节点的安全密钥输入参数，包括：
在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，以及在非首个与所述用户建立从属关系的目标终端接入网络后，将所述第一终端和所述目标终端的关系以及所述目标终端的计数值上报核心网，所述第二终端接收网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数。
可选的，所述第二终端接收网络侧节点根据所述目标终端的计数值触发 并传递的安全密钥输入参数，包括：
核心网在确定第二终端从属于第一终端的用户后，根据第二终端的终端计数值更新根密钥，并向第二终端发送核心网和接入网节点的根密钥推衍参数以及非接入NAS层的密钥输入参数，核心网触发接入网节点进行AS层密钥输入参数的传递。
可选的，若所述第一终端接入第一接入网节点，所述第二终端接入第二接入网节点，所述第一接入网节点和所述第二接入网节点是不同的网络节点，所述核心网根据所述第二终端的计数值更新根密钥，并向所述第二终端发送核心网和接入网节点的根密钥输入参数以及非接入NAS层的密钥输入参数，核心网通知第一接入网节点向所述第二接入网节点发送安全密钥输入参数，所述第二终端接收所述核心网发送的网络节点根密钥输入参数和非接入NAS层的安全密钥输入参数及接入网节点AS层的安全密钥输入参数；
若所述第一终端和所述第二终端接入相同的接入网节点，所述核心网根据所述第二终端的计数值更新根密钥，并向所述第二终端发送核心网和接入网节点的根密钥输入参数以及非接入NAS层的密钥输入参数，核心网触发所述接入网节点进行安全密钥输入参数的传递，所述第二终端接收所述核心网发送的网络节点根密钥输入参数和非接入NAS层的安全密钥输入参数及所述接入网节点的安全密钥输入参数。
可选的，所述第二终端接收网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
在非首个与所述用户建立从属关系的第二终端接入网络后，第二终端向网络侧上报第二终端所对应的终端计数值，接入网节点根据第二终端的终端计数值进行对应密钥输入参数的更新；接入网节点确定所述第一终端和所述第二终端从属于同一用户，并上报核心网，所述核心网通过所述第一终端与所述第二终端的关系，根据第二终端计数值及进行NAS或者AS根密钥参数的推算更新，第二终端接收所述核心网发送的网络节点根密钥输入参数和非接入NAS层的安全密钥输入参数及所述接入网节点的安全密钥输入参数。
可选的，所述目标终端根据所述安全密钥输入参数与网络进行数据传输，包括：
所述第二终端根据所述安全密钥输入参数，激活非接入NAS层以及接入AS层的安全性，与网络进行数据传输。
可选的，当用户与多个终端的从属关系结束时，多个终端删除所存储的第二密钥。
本公开的实施例还提供一种用户与多终端间的安全性管理方法，应用于网络侧，所述方法包括：
从属于同一用户的多个终端中的至少一个目标终端接入网络时，网络侧触发网络侧节点传递所述目标终端对应的网络侧节点的安全密钥输入参数；
根据所述安全密钥输入参数与终端进行数据传输。
可选的，网络侧触发网络侧节点传递所述目标终端对应的接入节点的安全密钥输入参数，包括：
在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，进行初始认证及密钥协商流程，确定第一终端的第一密钥推衍集合；
在非首个与所述用户建立从属关系的目标终端接入网络时，根据用户与终端的从属关系，触发网络节点传递所述目标终端的对应的网络侧节点的安全密钥输入参数。
可选的，根据所述第一终端的第一密钥推衍集合，触发网络节点传递所述目标终端的对应的接入节点的安全密钥输入参数，包括：
核心网确定所述第二终端从属于第一终端的用户后，向第二终端发送非接入NAS层的安全密钥输入参数集合以及接入网节点根密钥的推衍参数，再由所述核心网通知接入网节点进行接入AS层的安全密钥输入参数集合。
可选的，根据所述第一终端的第一密钥推衍集合，触发网络节点传递所述目标终端的对应的接入节点的安全密钥输入参数，包括：
若所述第一终端与所述第二终端接入同一接入网节点，则该接入网节点确定所述第一终端和所述第二终端从属于同一用户，并上报核心网，所述核心网触发非接入NAS层密钥及接入网节点根密钥输入参数的传递，接入网节点向所述第二终端发送接入AS层安全密钥输入参数。
可选的，网络侧触发网络侧节点传递所述目标终端对应的网络侧节点的 安全密钥输入参数，包括：
在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，以及在非首个与所述用户建立从属关系的目标终端接入网络后，将所述第一终端和所述目标终端的关系以及所述目标终端的计数值上报核心网，网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数。
可选的，网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
核心网在确定第二终端从属于第一终端的用户后，根据第二终端的终端计数值更新根密钥，并向第二终端发送核心网的非接入NAS层的密钥输入参数和接入网节点的根密钥输入参数，核心网触发接入网节点进行AS层密钥输入参数的传递。
可选的，网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
在非首个与所述用户建立从属关系的第二终端接入网络后，网络侧接收第二终端上报的第二终端所对应的终端计数值，接入网节点根据第二终端的终端计数值进行对应密钥输入参数的更新；
所述接入网节点向所述第二终端发送安全密钥输入参数。
本公开的实施例还提供一种终端，包括：收发机，处理器，存储器，所述存储器上存有所述处理器可执行的程序；所述处理器执行所述程序时实现：用户与多个终端建立从属关系，多个终端存储安全性根密钥；在所述多个终端中，至少一个目标终端接入网络时，获取所述目标终端对应的网络侧节点的安全密钥输入参数；所述目标终端根据所述安全密钥输入参数进行安全密钥的推衍，与网络进行数据传输。
可选的，存储安全性根密钥，包括：
获取用户的预设参数，所述预设参数包括：用户与网络侧签约的标识和/或用户与网络侧签约的第一密钥；
根据所述预设参数，存储所述安全性根密钥。
可选的，根据所述预设参数，存储安全性根密钥，包括：
所述多个终端与用户建立从属关系的过程中，根据用户与网络侧签约的第一密钥生成安全性根密钥并存储；
或者，
所述多个终端直接从所述用户接收所述第一密钥，并将所述第一密钥作为安全性根密钥进行存储。
可选的，在所述多个终端中，至少一个目标终端接入网络时，获取所述目标终端对应的网络侧节点的安全密钥输入参数，包括：
在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，进行初始认证及密钥协商流程，确定第一终端的第一密钥推衍集合；
在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一终端的第一密钥推衍集合，通过网络节点触发网络节点传递所述目标终端的对应网络侧节点的安全密钥输入参数。
可选的，根据所述预设参数，存储安全性根密钥，包括：
在用户与多个终端建立从属关系的过程中，根据用户与网络侧签约的第一密钥以及终端与用户建立从属关系时的终端计数值，生成安全性根密钥并存储；
或者，
在用户与多个终端建立从属关系的过程中，用户根据终端计数值，更新用户与网络侧签约的第一密钥，各终端获取与其对应的更新后的第一密钥，作为该终端的安全性根密钥并存储。
可选的，在所述多个终端中的至少一个目标终端接入网络时，获取所述目标终端对应的接入节点的安全密钥输入参数，包括：
在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，以及在非首个与所述用户建立从属关系的目标终端接入网络后，将所述第一终端和所述目标终端的关系以及所述目标终端的计数值上报核心网，所述第二终端接收网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数。
本公开的实施例还提供一种用户与多终端间的安全性管理装置，应用于 终端，所述装置包括：
存储模块，用于用户与多个终端建立从属关系，多个终端存储安全性根密钥；
获取模块，用于在所述多个终端中，至少一个目标终端接入网络时，获取所述目标终端对应的网络侧节点的安全密钥输入参数；
处理模块，用于根据所述安全密钥输入参数进行安全密钥的推衍与网络进行数据传输。
本公开的实施例还提供一种网络侧设备，包括：收发机，处理器，存储器，所述存储器上存有所述处理器可执行的程序；所述处理器执行所述程序时实现：从属于同一用户的多个终端中的至少一个目标终端接入网络时，网络侧触发网络侧节点传递所述目标终端对应的网络侧节点的安全密钥输入参数；根据所述安全密钥输入参数与终端进行数据传输。
本公开的实施例还提供一种用户与多终端间的安全性管理装置，应用于网络侧设备，所述装置包括：
处理模块，用于从属于同一用户的多个终端中的至少一个目标终端接入网络时，网络侧触发网络侧节点传递所述目标终端对应的网络侧节点的安全密钥输入参数；
收发模块，用于根据所述安全密钥输入参数与终端进行数据传输。
本公开的实施例还提供一种处理器可读存储介质，所述处理器可读存储介质存储有处理器可执行指令，所述处理器可执行指令用于使所述处理器执行如上所述的方法。
本公开实施例的有益效果是：
本公开的上述实施例，通过用户与多个终端建立从属关系，多个终端存储安全性根密钥；在所述多个终端中，至少一个目标终端接入网络时，获取所述目标终端对应的网络侧节点的安全密钥输入参数；所述目标终端根据所述安全密钥输入参数进行安全密钥的推衍，与网络进行数据传输。在用户终端的从属关系生效接入网络时，用户终端与网络侧安全密钥的输入参数通过网络节点进行传递，以保障用户终端与网络连接的安全性。
附图说明
图1是密钥体系的示意图；
图2是双连接的安全机制示意图；
图3是本公开的用户与多终端间的安全性管理方法流程示意图；
图4是本公开的实施例中核心网节点触发的多终端安全性管理流程示意图；
图5是本公开的实施例中接入网节点触发的多终端安全性管理流程示意图；
图6是本公开的实施例中核心网节点触发的多终端安全性管理流程示意图；
图7是本公开的实施例中接入网节点触发的多终端安全性管理流程示意图；
图8是本公开的实施例终端的架构示意图；
图9是本公开的实施例用户与多终端分离架构下的安全性管理装置的模块示意图。
具体实施方式
下面将参照附图更详细地描述本公开的示例性实施例。虽然附图中显示了本公开的示例性实施例，然而应当理解，可以以各种形式实现本公开而不应被这里阐述的实施例所限制。相反，提供这些实施例是为了能够更透彻地理解本公开，并且能够将本公开的范围完整的传达给本领域的技术人员。
如图3所示，本公开的实施例提供一种用户与多终端间的安全性管理方法，应用于终端，所述方法包括：
步骤31，用户与多个终端建立从属关系，多个终端存储安全性根密钥；
步骤32，在所述多个终端中，至少一个目标终端接入网络时，获取所述目标终端对应的网络侧节点的安全密钥输入参数；
步骤33，所述目标终端根据所述安全密钥输入参数进行安全密钥的推衍，与网络进行数据传输。
本公开的该实施例，用户可与多个终端建立从属关系，并于终端侧存储 用户安全性根密钥。在用户终端的从属关系生效接入网络时，用户终端与网络侧安全密钥的输入参数通过网络节点进行传递，以保障用户终端与网络连接的安全性。
本公开的一可选的实施例中，存储安全性根密钥，包括：
步骤311，获取用户的预设参数，所述预设参数包括：用户与网络侧签约的标识和/或用户与核心网侧签约的第一密钥；
步骤312，根据所述预设参数，存储所述安全性根密钥。
可选的，步骤312可以包括：
方式一：所述多个终端与用户建立从属关系的过程中，根据用户与网络侧签约的第一密钥生成安全性根密钥并存储；或者，所述多个终端直接从所述用户接收所述第一密钥，并将所述第一密钥作为安全性根密钥进行存储。
方式二：在用户与多个终端建立从属关系的过程中，根据用户与网络侧签约的第一密钥以及终端与用户建立从属关系时的终端计数值，生成安全性根密钥并存储；或者，在用户与多个终端建立从属关系的过程中，用户根据终端计数值，更新用户与网络侧签约的第一密钥，各终端获取与其对应的更新后的第一密钥，作为该终端的安全性根密钥并存储。
这里，用户可与多个终端建立从属关系，即用户在与终端建立从属关系时将特有参数信息传递给终端，如用户签约标识以及用户与核心网侧签约的长期安全性根密钥，并于终端侧进行存储，以确定该终端从属于用户，为其提供服务。
用户与多个终端建立从属关系后，终端侧存储的安全性根密钥形式，采用以下方式之一：
用户具有与核心网侧签约的长期安全性根密钥，在与终端建立从属关系后，将由长期密钥自生成安全性密钥，如加密与完整性根密钥，所有从属于用户的终端具有相同根密钥，并存储于终端内部。或，用户直接将相同的用户长期根密钥传递并存储于从属终端内部。
用户具有的长期安全性根密钥根据UE COUNT值进行从属终端安全性密钥的自生成，如加密与完整性根密钥，根据终端建立从属关系的先后顺序于终端侧存储不同的安全性根密钥。或，用户根据UE COUNT值更新用户与 网络侧签约的长期安全性根密钥，不同的终端存储与UE COUNT值相对应的安全性长期根密钥。
在首个终端与用户的从属关系激活并接入网络后，进行初始认证及密钥协商流程，根据根密钥等参数进行接入网与核心网的安全密钥参数推衍，保证用户面与控制面的安全性传输。
本公开的一可选的实施例中，基于上述方式一，步骤32可以包括：
步骤321，在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，进行初始认证及密钥协商流程，确定第一终端的第一密钥推衍集合；
步骤322，在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一终端的第一密钥推衍集合，通过网络节点触发网络节点传递所述目标终端的对应网络侧节点的安全密钥输入参数。
可选的，由核心网节点触发参数传递：步骤322可以包括：
在非首个与所述用户建立从属关系的第二终端接入网络后，核心网确定所述第二终端从属于第一终端的用户后，所述第二终端接收核心网发送的非接入NAS层的安全密钥输入参数集合以及接入网节点根密钥的输入参数，以及由核心网通知接入网节点进行接入AS层的安全密钥输入参数集合。
基于核心网节点触发参数传递的方式，可选的，若所述第一终端接入第一接入网节点，所述第二终端接入第二接入网节点，所述第一接入网节点和所述第二接入网节点是不同的网络节点，所述核心网通知所述第一接入网节点向所述第二接入网节点发送安全密钥输入参数，所述第二终端接收所述第二接入网节点所发送的安全密钥输入参数；
若所述第一终端和所述第二终端接入相同的接入网节点，所述核心网触发所述接入网节点进行安全密钥输入参数的传递，所述第二终端接收所述接入网节点发送的所述接入网节点的安全密钥输入参数。
也就是说，由核心网节点触发方式中，核心网节点：当第二终端2(与用户建立从属关系的非首个终端)接入网络后，核心网确定其从属于第一终端(与用户建立从属关系的首个终端)的用户后，将第一终端的核心网及接入网根密钥计算参数、NAS层的密钥推衍集合(如算法类型、算法标识符)发 送给该用户的第二终端，以进行NAS层安全参数的推衍。并通知接入网节点将AS层的密钥推衍集合发送给第二终端，以进行AS层参数的推衍。
接入网节点：若第一终端(与用户建立从属关系的首个终端)和第二终端(与用户建立从属关系的非首个终端)接入同一接入网节点，则直接由该接入节点进行AS密钥参数推衍集合的传递；若第一终端和第二终端接入不同接入网节点，则由第一终端的第一接入节点将推衍的接入节点密钥参数(如推衍密钥、计数器参数等)通过接口发送给第二终端的第二接入节点，并将计数器参数发送给核心网侧，再由核心网侧转发给第二终端，进行其接入网节点密钥推算，确保第二终端与其接入节点的数据传输安全。
用户从属第二终端：在接收到NAS和AS层密钥参数推衍集合后，进行相关密钥参数的推算，并激活NAS层和AS层的安全过程，以保障信令及用户数据传输的安全性。
本公开的一可选的实施例中，基于上述方式一，接入网节点触发参数传递的情况：步骤322可以包括：
在非首个与所述用户建立从属关系的第二终端接入网络后，若所述第一终端与所述第二终端接入同一接入网节点，则该接入网节点确定所述第一终端和所述第二终端从属于同一用户，并上报核心网，触发非接入NAS层密钥及接入网节点根密钥输入参数的传递，所述第二终端接收所述接入网节点发送的接入AS层安全密钥输入参数以及接收所述核心网发送的安全输入参数。
也就是说，由接入网节点触发的情况下：
接入网节点：第二终端(与用户建立从属关系的非首个终端)接入网络后，若第一终端(与用户建立从属关系的首个终端)与第二终端接入同一接入网节点，则该接入网节点确定两终端从属于同一用户，向第二终端发送AS层的密钥推衍集合，并上报核心网两终端关系，触发密钥参数的传递。
核心网节点：由核心网向第二终端(与用户建立从属关系的非首个终端)发送第一终端(与用户建立从属关系的首个终端)的核心网及接入网根密钥计算参数及NAS层的密钥推衍集合。
用户从属第二终端：第二终端进行相关密钥参数的推衍以及安全过程的激活，以确保第二终端与网络的数据传输安全性。
若两终端接入不同的接入节点，则由接入网节点将终端信息发送给核心网节点，由核心网侧触发不同接入节点下的安全密钥参数传递过程。
本公开的一可选的实施例中，基于上述方式二，步骤32可以包括：
在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，以及在非首个与所述用户建立从属关系的目标终端接入网络后，将所述第一终端和所述目标终端的关系以及所述目标终端的计数值上报核心网，所述第二终端接收网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数。
基于上述方式二，由核心网节点触发参数传递的方式，所述第二终端接收网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
核心网在确定第二终端从属于第一终端的用户后，根据第二终端的终端计数值更新根密钥，并向第二终端发送核心网和接入网节点的根密钥输入参数以及非接入NAS层的密钥输入参数，核心网触发接入网节点进行AS层密钥输入参数的传递。
可选的，若所述第一终端接入第一接入网节点，所述第二终端接入第二接入网节点，所述第一接入网节点和所述第二接入网节点是不同的网络节点，所述核心网根据所述第二终端的计数值更新根密钥，并向所述第二终端发送核心网和接入网节点的根密钥输入参数以及非接入NAS层的密钥输入参数，核心网通知第一接入网节点向所述第二接入网节点发送安全密钥输入参数，所述第二终端接收所述核心网发送的网络节点根密钥输入参数和非接入NAS层的安全密钥输入参数及接入网节点AS层的安全密钥输入参数；
若所述第一终端和所述第二终端接入相同的接入网节点，所述核心网根据所述第二终端的计数值更新根密钥，并向所述第二终端发送核心网和接入网节点的根密钥输入参数以及非接入NAS层的密钥输入参数，核心网触发所述接入网节点进行安全密钥输入参数的传递，所述第二终端接收所述核心网发送的网络节点根密钥输入参数和非接入NAS层的安全密钥输入参数及所述接入网节点的安全密钥输入参数。
也就是说，由核心网触发的情况下，在第二当终端(与用户建立从属关 系的非首个终端)接入网络后，向核心网侧上报其对应的UE COUNT值，核心网在确定其从属于第一终端(与用户建立从属关系的首个终端)的用户后，根据所存储的第一终端的核心网密钥根据UE COUNT值进行第二终端的密钥更新，并将第一终端的核心网及接入网根密钥计算参数、NAS层的密钥推衍集合发送给第二终端，以进行NAS层安全参数的推衍。并通知接入网节点根据UE COUNT值将AS层的密钥进行更新，将推衍集合发送给第二终端，以进行AS层参数的推衍。针对相同或不同的终端节点，采用同方式一相同方法。
本公开的一可选的实施例中，基于上述方式二，由接入网节点触发：所述第二终端接收网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
在非首个与所述用户建立从属关系的第二终端接入网络后，第二终端向网络侧上报第二终端所对应的终端计数值，接入网节点根据第二终端的终端计数值进行对应密钥输入参数的更新；接入网节点确定所述第一终端和所述第二终端从属于同一用户，并上报核心网，所述核心网通过所述第一终端与所述第二终端的关系，根据第二终端计数值进行NAS或者AS根密钥参数的推算更新，第二终端接收所述核心网发送的网络节点根密钥输入参数和非接入NAS层的安全密钥输入参数及所述接入网节点的安全密钥输入参数。
也就是说，由接入网节点触发的情况下：第二终端接入网络后，与方式一不同的是，首先第二终端向网络侧上报第二终端所对应的UE COUNT参数，网络侧节点根据UE COUNT值进行对应密钥参数的更新，再进行第二终端密钥推衍集合的传递。
本公开的一可选的实施例中，步骤33可以包括：
所述第二终端根据所述安全密钥输入参数，激活非接入NAS层以及接入层的安全性，与网络进行数据传输。
可选的，当用户与多个终端的从属关系结束时，多个终端删除所存储的第二密钥。当用户与终端的从属关系结束时，终端侧删除所存储的用户相关参数信息。
下面结合具体的实例，说明上述方法的具体实现过程：
实施例一：基于上述方式一的情况下，核心网节点触发的多终端安全性管理，与用户建立从属关系的两个终端分别接入不同的接入节点：
如图4所示，该流程包括：
步骤0：终端1(与用户建立从属关系的首个终端)与终端2(与用户建立从属关系的非首个终端)建立与用户的从属关系，获取相同的用户特有参数信息，如用户签约标识等用户特有标识及与网络侧相对应的安全性密钥等。
所获取的安全性密钥参数如下：
用户直接将其长期安全性根密钥存储于从属终端内部；
或，由用户长期安全性根密钥自生成加密与完整性保护根密钥，存储于终端内部，且各终端的安全性密钥相同。
步骤1：首个与用户建立从属关系的终端1接入网络(接入节点1和核心网)，完成用户的注册及认证流程，并建立与网络侧的密钥体系。
步骤2：当用户激活从属终端2(例如，与用户第二个建立从属关系的终端)后，通过接入节点2接入网络，核心网侧根据终端2所携带的用户特有标识确定其所从属的用户，并识别用户的所有从属终端。
步骤3：核心网将终端1所对应的核心网及接入网根密钥计算参数、NAS层密钥推衍集合(如算法类型、算法标识符等)发送给终端2，使终端进行NAS层密钥参数的推衍。
步骤4：激活终端2与核心网侧的安全性，包括信令及用户数据的加密与完整性保护的安全过程。
步骤5：由核心网侧触发接入节点1进行接入网密钥集合的传递，触发消息中包括终端2的接入节点信息及相关参数信息。
步骤6：接入节点1根据终端1的接入节点根密钥进行接入节点2的密钥推衍，将推衍密钥发送给接入节点2，并于向核心网反馈的消息中，将终端2的接入节点的密钥推衍集合发送给核心网侧。
步骤7：核心网将终端2的接入节点密钥推衍集合(如算法类型、算法标识等)转发给终端2。
步骤8：终端2利用密钥推衍集合参数信息推衍接入节点的相关密钥参数信息，并激活与接入节点2的安全性，包括信令及用户数据的加密与完整 性保护的安全过程。
步骤9：在完成用户从属终端2的接入网与核心网的安全激活流程后，终端可与网络侧安全地进行数据信息传递。
实施例2：核心网节点触发的多终端安全性管理(方式1)，与用户建立从属关系的两个终端分别接入相同的接入节点的实现方式中，与上述实施例1的区别在于，将接入节点1和接入节点2合并为一个接入接点，步骤6中：接入节点根据终端1的接入节点根密钥进行接入节点的密钥推衍，将推衍密钥向核心网反馈。
实施例3：基于上述方式一的情况下，接入网节点触发的多终端安全性管理(两终端同一接入节点)：
如图5所示，该流程包括：
步骤0：终端1与终端2建立与用户的从属关系，获取相同的用户特有参数信息，如用户签约标识等用户特有标识及与网络侧相对应的安全性密钥等。所获取的安全性密钥参数如下：
用户直接将其长期安全性根密钥存储于从属终端内部；
或，由用户长期密钥自生成的加密与完整性保护根密钥，存储于终端内部，且各终端的安全性密钥相同。
步骤1：用户的首个从属终端1接入网络(接入节点和核心网)，完成用户的注册及认证流程，并建立与网络侧的密钥体系。
步骤2：当用户激活从属终端2后，通过接入节点接入网络，接入网节点根据终端2所携带的用户标识确定其所从属的用户，并识别用户的所有从属终端。
步骤3：接入节点向核心网侧上报用户从属终端1与终端2的关系，并指示进行终端2的NAS/AS密钥参数的传递。
步骤4：核心网将终端1的核心网及接入网根密钥计算参数、NAS层密钥推衍集合(如算法类型、算法标识等)转发给终端2。
步骤5：终端2利用核心网及接入网根密钥计算参数推衍其核心网和接入网的根密钥参数，再利用密钥推衍集合参数信息推衍与核心网节点的相关密钥参数，并激活核心网侧的安全性，包括信令及用户数据的加密与完整性 保护的安全过程。
步骤6：终端1与终端2从属于同一接入节点，则直接由接入节点将终端1相关联的AS密钥推衍集合(如算法类型、算法标识等)发送给终端2。
步骤7：终端2利用密钥推衍集合参数信息推衍与接入网节点的相关密钥参数信息，并激活终端2与接入网侧的安全性，包括信令及用户数据的加密与完整性保护的安全过程。
步骤8：在完成用户从属终端2的接入网与核心网的安全激活流程后，终端可与网络侧安全地进行数据信息传递。
实施例4：接入网节点触发的多终端安全性管理(方式1，若两终端接入不同的接入节点)，由接入网节点将终端信息发送给核心网节点，由核心网侧触发不同接入节点下的安全密钥参数传递过程，可参考实施例1中相对应过程。
实施例5：基于上述方式二的情况下，核心网节点触发的多终端安全性管理(两终端接入不同的接入节点)：
如图6所示，该流程包括：
步骤0：终端1与终端2建立与用户的从属关系，获取用户特有参数信息，如用户签约标识等用户特定标识及与网络侧相对应的安全性密钥等。所获取的安全性密钥参数如下：
用户根据其长期密钥利用UE COUNT值进行从属终端安全性根密钥的更新，并存储于终端内部。其中用户第一个从属终端所对应的UE COUNT＝0，具有与用户相同的长期密钥，之后与用户建立从属关系的终端的UE COUNT值递增；
或，由用户长期密钥利用UE COUNT值自生成加密与完整性根密钥，存储于终端内部，且各终端的安全性密钥参数不同。
步骤1：用户的首个从属终端1接入网络(接入节点1和核心网)，完成用户的注册及认证流程，并建立与网络侧的密钥体系。
步骤2：当用户激活从属终端2后，通过接入节点接入网络，核心网节点根据终端2所携带的用户标识确定其所从属的用户，并识别用户的所有从属终端。
步骤3：核心网侧通过用户从属终端1与终端2的关系，根据UE COUNT值及网络侧的用户长期密钥进行终端2的NAS根密钥参数的更新。
步骤4：核心网将终端2所对应的核心网及接入网根密钥计算参数、NAS层密钥推衍集合(如算法类型、算法标识符等)发送给终端2，使终端进行NAS层密钥参数的推衍。
步骤5：激活终端2与核心网侧的安全性，包括信令及用户数据的加密与完整性保护的安全过程。
步骤6：由核心网侧触发接入节点1进行接入网密钥集合的传递，触发消息中包括终端2的接入节点信息及相关参数信息。
步骤7：接入节点1根据终端1的接入节点根密钥及UE COUNT值进行接入节点2的密钥推衍，将推衍密钥发送给接入节点2，并于向核心网反馈的消息中将终端2接入节点的密钥推衍集合发送给核心网侧。
步骤8：核心网将终端2的接入节点密钥推衍集合(如算法类型、算法标识等)转发给终端2。
步骤9：终端2利用密钥推衍集合参数信息推衍接入节点的相关密钥参数信息，并激活与接入节点2的安全性，包括信令及用户数据的加密与完整性保护的安全过程。
步骤10：在完成用户从属终端2的接入网与核心网的安全激活流程后，终端可与网络侧安全地进行数据信息传递。
实施例6：核心网节点触发的多终端安全性管理(方式2，两终端接入相同的接入节点)，与上述实施例5的区别在于，将接入节点1和接入节点2合并为一个接入接点，步骤7中：接入节点根据终端1的接入节点根密钥进行接入节点的密钥推衍，将推衍密钥向核心网反馈。步骤8中，核心网将接入节点密钥推衍集合(如算法类型、算法标识等)转发给终端2。
实施例7：基于上述方式二的情况下，接入网节点触发的多终端安全性管理(两终端同一接入节点)
如图7所示，该流程包括：
步骤0：终端1与终端2建立与用户的从属关系，获取用户特有参数信息，如用户签约标识等用户特定标识及与网络侧相对应的安全性密钥等。所 获取的安全性密钥参数如下：
用户根据其长期密钥利用UE COUNT值进行从属终端安全性根密钥的更新，并存储于终端内部。其中用户第一个从属终端所对应的UE COUNT＝0，具有与用户相同的长期密钥，之后与用户建立从属关系的终端的UE COUNT值递增；
或，由用户长期密钥利用UE COUNT值自生成加密与完整性保护的根密钥，存储于终端内部，且各终端的安全性密钥参数不同。
步骤1：用户的首个从属终端1接入网络(接入节点和核心网)，完成用户的注册及认证流程，并建立与网络侧的密钥体系。
步骤2：当用户激活从属终端2后，通过接入节点接入网络，接入网节点根据终端2所携带的用户标识确定其所从属的用户，并识别用户的所有从属终端。
步骤3：接入节点根据终端2的UE COUNT值进行接入节点密钥参数的更新。
步骤4：接入节点向核心网侧上报用户从属终端1与终端2的关系，并指示进行终端2的NAS密钥参数的更新与传递。
步骤5：核心网侧通过用户从属终端1与终端2的关系，根据UE COUNT值及终端1的长期密钥进行终端2的NAS/AS根密钥参数的推算更新。
步骤6：核心网将终端1的核心网及接入网根密钥计算参数、NAS层密钥推衍集合(如算法类型、算法标识等)发送给终端2。
步骤7：终端2利用核心网及接入网根密钥计算参数更新接入网与核心网的根密钥，再根据密钥推衍集合参数信息推衍与核心网节点的相关密钥参数信息，并激活核心网侧的安全性，包括信令及用户数据的加密与完整性保护的安全过程。
步骤8：终端1与终端2从属于同一接入节点，则直接由接入节点将根据UE COUNT值更新后AS密钥推衍集合(如算法类型、算法标识等)发送给终端2。
步骤9：终端2利用密钥推衍集合参数信息推衍与接入网节点的相关密钥参数信息，并激活接入网侧的安全性，包括信令及用户数据的加密与完整 性保护的安全过程。
步骤10：在完成用户从属终端2的接入网与核心网的安全激活流程后，终端可与网络侧安全地进行数据信息传递。
实施例8：若两终端接入不同的接入节点，则由接入网节点将终端信息发送给核心网节点，由核心网侧触发不同接入节点下的安全密钥参数更新与传递过程，可参考实施例5中相对应过程。
通过本公开的上述实施例，可以实现用户多终端场景下，用户在移动过程中激活并使用不同终端时，仍可以保证用户信令及业务数据传输的安全性。
如图8所示，本公开的实施例还提供一种终端80，包括：收发机81，处理器82，存储器83，所述存储器83上存有所述处理器82可执行的程序；所述处理器82执行所述程序时实现：用户与多个终端建立从属关系，多个终端存储安全性根密钥；在所述多个终端中，至少一个目标终端接入网络时，获取所述目标终端对应的网络侧节点的安全密钥输入参数；所述目标终端根据所述安全密钥输入参数进行安全密钥的推衍，与网络进行数据传输。
可选的，存储安全性根密钥，包括：
获取用户的预设参数，所述预设参数包括：用户与网络侧签约的标识和/或用户与核心网侧相对应网络侧签约的第一安全性根密钥；
根据所述预设参数，存储所述安全性根密钥。
可选的，根据所述预设参数，存储安全性根密钥，包括：
所述多个终端与用户建立从属关系的过程中，根据用户与网络侧签约的第一密钥生成安全性根密钥并存储；
或者，
所述多个终端直接从所述用户接收所述第一密钥，并将所述第一密钥作为安全性根密钥进行存储。
可选的，在所述多个终端中，至少一个目标终端接入网络时，获取所述目标终端对应的网络侧节点的安全密钥输入参数，包括：
在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，进行初始认证及密钥协商流程，确定第一终端的第一密钥推衍集合；
在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一终端的第一密钥推衍集合，通过网络节点触发网络节点传递所述目标终端的对应网络侧节点的安全密钥输入参数。
可选的，在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一终端的第一密钥推衍集合，通过网络节点触发网络节点传递所述目标终端的对应的网络侧节点的安全密钥输入参数，包括：
在非首个与所述用户建立从属关系的第二终端接入网络后，核心网确定所述第二终端从属于第一终端的用户后，所述第二终端接收核心网发送的非接入NAS层的安全密钥输入参数集合以及接入网节点根密钥的输入参数，以及由所述核心网通知接入网节点进行接入AS层的安全密钥输入参数集合。
可选的，若所述第一终端接入第一接入网节点，所述第二终端接入第二接入网节点，所述第一接入网节点和所述第二接入网节点是不同的网络节点，所述核心网通知所述第一接入网节点向所述第二接入网节点发送安全密钥输入参数，所述第二终端接收所述第二接入网节点所发送的安全密钥输入参数；
若所述第一终端和所述第二终端接入相同的接入网节点，所述核心网触发所述接入网节点进行安全密钥输入参数的传递，所述第二终端接收所述接入网节点发送的所述接入网节点的安全密钥输入参数。
可选的，在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一个终端的第一密钥推衍集合，通过网络节点触发网络节点传递所述目标终端的对应的接入节点的安全密钥输入参数，包括：
在非首个与所述用户建立从属关系的第二终端接入网络后，若所述第一终端与所述第二终端接入同一接入网节点，则该接入网节点确定所述第一终端和所述第二终端从属于同一用户，并上报核心网，触发非接入NAS层密钥及接入网节点根密钥输入参数的传递，所述第二终端接收所述接入网节点发送的接入AS层安全密钥输入参数以及接收所述核心网发送的安全输入参数。
可选的，根据所述预设参数，存储安全性根密钥，包括：
在用户与多个终端建立从属关系的过程中，根据用户与网络侧签约的第一密钥以及终端与用户建立从属关系时的终端计数值，生成安全性根密钥并存储；
或者，
在用户与多个终端建立从属关系的过程中，用户根据终端计数值，更新用户与网络侧签约的第一密钥，各终端获取与其对应的更新后的第一密钥，作为该终端的安全性根密钥并存储。
可选的，在所述多个终端中的至少一个目标终端接入网络时，获取所述目标终端对应的接入节点的安全密钥输入参数，包括：
在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，以及在非首个与所述用户建立从属关系的目标终端接入网络后，将所述第一终端和所述目标终端的关系以及所述目标终端的计数值上报核心网，所述第二终端接收网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数。
可选的，所述第二终端接收网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
核心网在确定第二终端从属于第一终端的用户后，根据第二终端的终端计数值更新根密钥，并向第二终端发送核心网和接入网节点的根密钥输入参数以及非接入NAS层的密钥输入参数，核心网触发接入网节点进行AS层密钥输入参数的传递。
可选的，若所述第一终端接入第一接入网节点，所述第二终端接入第二接入网节点，所述第一接入网节点和所述第二接入网节点是不同的网络节点，所述核心网根据所述第二终端的计数值更新根密钥，并向所述第二终端发送核心网和接入网节点的根密钥输入参数以及非接入NAS层的密钥输入参数，核心网通知第一接入网节点向所述第二接入网节点发送安全密钥输入参数，所述第二终端接收所述核心网发送的网络节点根密钥输入参数和非接入NAS层的安全密钥输入参数及接入网节点AS层的安全密钥输入参数；
若所述第一终端和所述第二终端接入相同的接入网节点，所述核心网根据所述第二终端的计数值更新根密钥，并向所述第二终端发送核心网和接入网节点的根密钥输入参数以及非接入NAS层的密钥输入参数，核心网触发所述接入网节点进行安全密钥输入参数的传递，所述第二终端接收所述核心网发送的网络节点根密钥输入参数和非接入NAS层的安全密钥输入参数及所 述接入网节点的安全密钥输入参数。
可选的，所述第二终端接收网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
在非首个与所述用户建立从属关系的第二终端接入网络后，第二终端向网络侧上报第二终端所对应的终端计数值，接入网节点根据第二终端的终端计数值进行对应密钥输入参数的更新；接入网节点确定所述第一终端和所述第二终端从属于同一用户，并上报核心网，所述核心网通过所述第一终端与所述第二终端的关系，根据第二终端计数值及进行NAS或者AS根密钥参数的推算更新，第二终端接收所述核心网发送的网络节点根密钥输入参数和非接入NAS层的安全密钥输入参数及所述接入网节点的安全密钥输入参数。
可选的，所述目标终端根据所述安全密钥输入参数与网络进行数据传输，包括：
所述第二终端根据所述安全密钥输入参数，激活非接入NAS层以及接入AS层的安全性，与网络进行数据传输。
可选的，当用户与多个终端的从属关系结束时，多个终端删除所存储的第二密钥。
需要说明的是，该实施例中的终端是与上述图3所示的方法对应的终端，上述各实施例中的实现方式均适用于该实施例中，也能达到相同的技术效果。该终端中，收发机81与存储器83，以及收发机81与处理器82均可以通过总线接口通讯连接，处理器82的功能也可以由收发机81实现，收发机81的功能也可以由处理器82实现。在此需要说明的是，本公开实施例提供的上述通信设备，能够实现上述方法实施例所实现的所有方法步骤，且能够达到相同的技术效果，在此不再对本实施例中与方法实施例相同的部分及有益效果进行具体赘述。
如图9所示，本公开的实施例还提供一种用户与多终端间的安全性管理装置90，应用于终端，所述装置90包括：
存储模块91，用于用户与多个终端建立从属关系，多个终端存储安全性根密钥；
获取模块92，用于在所述多个终端中，至少一个目标终端接入网络时， 获取所述目标终端对应的网络侧节点的安全密钥输入参数；
处理模块93，用于根据所述安全密钥输入参数进行安全密钥的推衍，与网络进行数据传输。
获取用户的预设参数，所述预设参数包括：用户与网络侧签约的标识和/或用户与核心网侧相对应网络侧签约的第一安全性根密钥；
根据所述预设参数，存储所述安全性根密钥。
可选的，根据所述预设参数，存储安全性根密钥，包括：
所述多个终端与用户建立从属关系的过程中，根据用户与网络侧签约的第一密钥生成安全性根密钥并存储；
或者，
所述多个终端直接从所述用户接收所述第一密钥，并将所述第一密钥作为安全性根密钥进行存储。
可选的，在所述多个终端中，至少一个目标终端接入网络时，获取所述目标终端对应的网络侧节点的安全密钥输入参数，包括：
在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，进行初始认证及密钥协商流程，确定第一终端的第一密钥推衍集合；
在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一终端的第一密钥推衍集合，通过网络节点触发网络节点传递所述目标终端的对应网络侧节点的安全密钥输入参数。
可选的，在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一终端的第一密钥推衍集合，通过网络节点触发网络节点传递所述目标终端的对应的网络侧节点的安全密钥输入参数，包括：
在非首个与所述用户建立从属关系的第二终端接入网络后，核心网确定所述第二终端从属于第一终端的用户后，所述第二终端接收核心网发送的非接入NAS层的安全密钥输入参数集合以及接入网节点根密钥的输入参数，以及由所述核心网通知接入网节点进行接入AS层的安全密钥输入参数集合。
可选的，若所述第一终端接入第一接入网节点，所述第二终端接入第二接入网节点，所述第一接入网节点和所述第二接入网节点是不同的网络节点， 所述核心网通知所述第一接入网节点向所述第二接入网节点发送安全密钥输入参数，所述第二终端接收所述第二接入网节点所发送的安全密钥输入参数；
若所述第一终端和所述第二终端接入相同的接入网节点，所述核心网触发所述接入网节点进行安全密钥输入参数的传递，所述第二终端接收所述接入网节点发送的所述接入网节点的安全密钥输入参数。
可选的，在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一个终端的第一密钥推衍集合，通过网络节点触发网络节点传递所述目标终端的对应的接入节点的安全密钥输入参数，包括：
在非首个与所述用户建立从属关系的第二终端接入网络后，若所述第一终端与所述第二终端接入同一接入网节点，则该接入网节点确定所述第一终端和所述第二终端从属于同一用户，并上报核心网，触发非接入NAS层密钥及接入网节点根密钥输入参数的传递，所述第二终端接收所述接入网节点发送的接入AS层安全密钥输入参数以及接收所述核心网发送的安全输入参数。
可选的，根据所述预设参数，存储安全性根密钥，包括：
在用户与多个终端建立从属关系的过程中，根据用户与网络侧签约的第一密钥以及终端与用户建立从属关系时的终端计数值，生成安全性根密钥并存储；
或者，
在用户与多个终端建立从属关系的过程中，用户根据终端计数值，更新用户与网络侧签约的第一密钥，各终端获取与其对应的更新后的第一密钥，作为该终端的安全性根密钥并存储。
可选的，在所述多个终端中的至少一个目标终端接入网络时，获取所述目标终端对应的接入节点的安全密钥输入参数，包括：
在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，以及在非首个与所述用户建立从属关系的目标终端接入网络后，将所述第一终端和所述目标终端的关系以及所述目标终端的计数值上报核心网，所述第二终端接收网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数。
可选的，所述第二终端接收网络侧节点根据所述目标终端的计数值触发 并传递的安全密钥输入参数，包括：
核心网在确定第二终端从属于第一终端的用户后，根据第二终端的终端计数值更新根密钥，并向第二终端发送核心网和接入网节点的根密钥输入参数以及非接入NAS层的密钥输入参数，核心网触发接入网节点进行AS层密钥输入参数的传递。
可选的，若所述第一终端接入第一接入网节点，所述第二终端接入第二接入网节点，所述第一接入网节点和所述第二接入网节点是不同的网络节点，所述核心网根据所述第二终端的计数值更新根密钥，并向所述第二终端发送核心网和接入网节点的根密钥输入参数以及非接入NAS层的密钥输入参数，核心网通知第一接入网节点向所述第二接入网节点发送安全密钥输入参数，所述第二终端接收所述核心网发送的网络节点根密钥输入参数和非接入NAS层的安全密钥输入参数及接入网节点AS层的安全密钥输入参数；
若所述第一终端和所述第二终端接入相同的接入网节点，所述核心网根据所述第二终端的计数值更新根密钥，并向所述第二终端发送核心网和接入网节点的根密钥输入参数以及非接入NAS层的密钥输入参数，核心网触发所述接入网节点进行安全密钥输入参数的传递，所述第二终端接收所述核心网发送的网络节点根密钥输入参数和非接入NAS层的安全密钥输入参数及所述接入网节点的安全密钥输入参数。
可选的，所述第二终端接收网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
在非首个与所述用户建立从属关系的第二终端接入网络后，第二终端向网络侧上报第二终端所对应的终端计数值，接入网节点根据第二终端的终端计数值进行对应密钥输入参数的更新；接入网节点确定所述第一终端和所述第二终端从属于同一用户，并上报核心网，所述核心网通过所述第一终端与所述第二终端的关系，根据第二终端计数值及进行NAS或者AS根密钥参数的推算更新，第二终端接收所述核心网发送的网络节点根密钥输入参数和非接入NAS层的安全密钥输入参数及所述接入网节点的安全密钥输入参数。
可选的，所述目标终端根据所述安全密钥输入参数与网络进行数据传输，包括：
所述第二终端根据所述安全密钥输入参数，激活非接入NAS层以及接入AS层的安全性，与网络进行数据传输。
可选的，当用户与多个终端的从属关系结束时，多个终端删除所存储的第二密钥。
需要说明的是，该实施例中的装置是与终端侧的方法对应的装置，上述各实施例中的实现方式均适用于该装置的实施例中，也能达到相同的技术效果。在此需要说明的是，本公开实施例提供的上述装置，能够实现上述方法实施例所实现的所有方法步骤，且能够达到相同的技术效果，在此不再对本实施例中与方法实施例相同的部分及有益效果进行具体赘述。
本公开的实施例还提供一种用户与多终端间的安全性管理方法，应用于网络侧，所述方法包括：
从属于同一用户的多个终端中的至少一个目标终端接入网络时，网络侧触发网络侧节点传递所述目标终端对应的网络侧节点的安全密钥输入参数；
根据所述安全密钥输入参数与终端进行数据传输。
可选的，网络侧触发网络侧节点传递所述目标终端对应的接入节点的安全密钥输入参数，包括：
在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，进行初始认证及密钥协商流程，确定第一终端的第一密钥推衍集合；
在非首个与所述用户建立从属关系的目标终端接入网络时，根据所述第一终端的第一密钥推衍集合用户与终端的从属关系，触发网络节点传递所述目标终端的对应的网络侧节点的安全密钥输入参数。
可选的，根据所述第一终端的第一密钥推衍集合，触发网络节点传递所述目标终端的对应的接入节点的安全密钥输入参数，包括：
核心网确定所述第二终端从属于第一终端的用户后，向第二终端发送非接入NAS层的安全密钥输入参数集合以及接入网节点根密钥的输入参数，再由所述核心网通知接入网节点进行接入AS层的安全密钥输入参数集合的第一终端的第一密钥推衍集合；以及
所述核心网触发接入网节点，进行接入AS层的安全密钥输入参数。
可选的，根据所述第一终端的第一密钥推衍集合，触发网络节点传递所述目标终端的对应的接入节点的安全密钥输入参数，包括：
若所述第一终端与所述第二终端接入同一接入网节点，则该接入网节点确定所述第一终端和所述第二终端从属于同一用户，并上报核心网，触发非接入NAS层密钥及接入网节点根密钥输入参数的传递，接入网节点向所述第二终端发送接入AS层安全密钥输入参数；以及
所述核心网向所述第二终端发送所述第一终端的第一密钥推衍集合。
可选的，网络侧触发网络侧节点传递所述目标终端对应的接入节点网络侧节点的安全密钥输入参数，包括：
在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，以及在非首个与所述用户建立从属关系的目标终端接入网络后，将所述第一终端和所述目标终端的关系以及所述目标终端的计数值上报核心网，网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数进行初始认证及密钥协商流程，确定第一终端的第一密钥推衍集合；
在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一终端的第一密钥推衍集合以及终端计数值，通过网络节点触发网络节点传递所述目标终端的对应的接入节点的安全密钥输入参数。
可选的，网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
核心网在确定第二终端从属于第一终端的用户后，根据第二终端的终端计数值更新根密钥，并向第二终端发送核心网的非接入NAS层的密钥输入参数和接入网节点的根密钥输入参数，核心网触发接入网节点进行AS层密钥输入参数的传递。
可选的，网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
在非首个与所述用户建立从属关系的第二终端接入网络后，网络侧接收第二终端上报的第二终端所对应的终端计数值，接入网节点根据第二终端的终端计数值进行对应密钥输入参数的更新；
所述接入网节点向所述第二终端发送安全密钥输入参数。
需要说明的是，该网络侧的方法是与上述终端侧的方法对应的流程，上述终端侧的方法的各实施例中的所有实现方式均适用于该网络侧的方法的实现流程中。
本公开的实施例还提供一种网络侧设备，包括：收发机，处理器，存储器，所述存储器上存有所述处理器可执行的程序；所述处理器执行所述程序时实现：从属于同一用户的多个终端中的至少一个目标终端接入网络时，网络侧触发网络侧节点传递所述目标终端对应的网络侧节点的安全密钥输入参数；根据所述安全密钥输入参数与终端进行数据传输。
可选的，网络侧触发网络侧节点传递所述目标终端对应的接入节点的安全密钥输入参数，包括：
在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，进行初始认证及密钥协商流程，确定第一终端的第一密钥推衍集合；
在非首个与所述用户建立从属关系的目标终端接入网络时，根据所述第一终端的第一密钥推衍集合用户与终端的从属关系，触发网络节点传递所述目标终端的对应的网络侧节点的安全密钥输入参数。
可选的，根据所述第一终端的第一密钥推衍集合，触发网络节点传递所述目标终端的对应的接入节点的安全密钥输入参数，包括：
核心网确定所述第二终端从属于第一终端的用户后，向第二终端发送非接入NAS层的安全密钥输入参数集合以及接入网节点根密钥的输入参数，以及由所述核心网通知接入网节点进行接入AS层的安全密钥输入参数集合的第一终端的第一密钥推衍集合；以及
所述核心网触发接入网节点，进行接入AS层的安全密钥输入参数。
可选的，根据所述第一终端的第一密钥推衍集合，触发网络节点传递所述目标终端的对应的接入节点的安全密钥输入参数，包括：
若所述第一终端与所述第二终端接入同一接入网节点，则该接入网节点确定所述第一终端和所述第二终端从属于同一用户，并上报核心网，触发非接入NAS层密钥及接入网节点根密钥输入参数的传递，接入网节点向所述第 二终端发送接入AS层安全密钥输入参数；以及
所述核心网向所述第二终端发送所述第一终端的第一密钥推衍集合。
可选的，网络侧触发网络侧节点传递所述目标终端对应的接入节点网络侧节点的安全密钥输入参数，包括：
在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，以及在非首个与所述用户建立从属关系的目标终端接入网络后，将所述第一终端和所述目标终端的关系以及所述目标终端的计数值上报核心网，网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数进行初始认证及密钥协商流程，确定第一终端的第一密钥推衍集合；
在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一终端的第一密钥推衍集合以及终端计数值，通过网络节点触发网络节点传递所述目标终端的对应的接入节点的安全密钥输入参数。
可选的，网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
核心网在确定第二终端从属于第一终端的用户后，根据第二终端的终端计数值更新根密钥，并向第二终端发送核心网的非接入NAS层的密钥输入参数和接入网节点的根密钥输入参数，核心网触发接入网节点进行AS层密钥输入参数的传递。
可选的，网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
在非首个与所述用户建立从属关系的第二终端接入网络后，网络侧接收第二终端上报的第二终端所对应的终端计数值，接入网节点根据第二终端的终端计数值进行对应密钥输入参数的更新；
所述接入网节点向所述第二终端发送安全密钥输入参数。
需要说明的是，该实施例中的网络设备是与上述网络侧的方法对应的网络设备，上述各实施例中的实现方式均适用于该实施例中，也能达到相同的技术效果。该网络设备中，收发机与存储器，以及收发机与处理器均可以通过总线接口通讯连接，处理器82的功能也可以由收发机实现，收发机的功能 也可以由处理器实现。在此需要说明的是，本公开实施例提供的上述网络设备，能够实现上述方法实施例所实现的所有方法步骤，且能够达到相同的技术效果，在此不再对本实施例中与方法实施例相同的部分及有益效果进行具体赘述。
本公开的实施例还提供一种用户与多终端间的安全性管理装置，应用于网络侧设备，所述装置包括：
处理模块，用于从属于同一用户的多个终端中的至少一个目标终端接入网络时，网络侧触发网络侧节点传递所述目标终端对应的接入节点的安全密钥输入参数；
收发模块，用于根据所述安全密钥输入参数与终端进行数据传输。
可选的，网络侧触发网络侧节点传递所述目标终端对应的接入节点的安全密钥输入参数，包括：
在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，进行初始认证及密钥协商流程，确定第一终端的第一密钥推衍集合；
在非首个与所述用户建立从属关系的目标终端接入网络时，根据所述第一终端的第一密钥推衍集合用户与终端的从属关系，触发网络节点传递所述目标终端的对应的网络侧节点的安全密钥输入参数。
可选的，根据所述第一终端的第一密钥推衍集合，触发网络节点传递所述目标终端的对应的接入节点的安全密钥输入参数，包括：
核心网确定所述第二终端从属于第一终端的用户后，向第二终端发送非接入NAS层的安全密钥输入参数集合以及接入网节点根密钥的输入参数，再由所述核心网通知接入网节点进行接入AS层的安全密钥输入参数集合的第一终端的第一密钥推衍集合；以及
所述核心网触发接入网节点，进行接入AS层的安全密钥输入参数。
可选的，根据所述第一终端的第一密钥推衍集合，触发网络节点传递所述目标终端的对应的接入节点的安全密钥输入参数，包括：
若所述第一终端与所述第二终端接入同一接入网节点，则该接入网节点确定所述第一终端和所述第二终端从属于同一用户，并上报核心网，触发非 接入NAS层密钥及接入网节点根密钥输入参数的传递，接入网节点向所述第二终端发送接入AS层安全密钥输入参数；以及
所述核心网向所述第二终端发送所述第一终端的第一密钥推衍集合。
可选的，网络侧触发网络侧节点传递所述目标终端对应的接入节点网络侧节点的安全密钥输入参数，包括：
在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，以及在非首个与所述用户建立从属关系的目标终端接入网络后，将所述第一终端和所述目标终端的关系以及所述目标终端的计数值上报核心网，网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数进行初始认证及密钥协商流程，确定第一终端的第一密钥推衍集合；
在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一终端的第一密钥推衍集合以及终端计数值，通过网络节点触发网络节点传递所述目标终端的对应的接入节点的安全密钥输入参数。
可选的，网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
核心网在确定第二终端从属于第一终端的用户后，根据第二终端的终端计数值更新根密钥，并向第二终端发送核心网的非接入NAS层的密钥输入参数和接入网节点的根密钥输入参数，核心网触发接入网节点进行AS层密钥输入参数的传递。
可选的，网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
在非首个与所述用户建立从属关系的第二终端接入网络后，网络侧接收第二终端上报的第二终端所对应的终端计数值，接入网节点根据第二终端的终端计数值进行对应密钥输入参数的更新；
所述接入网节点向所述第二终端发送安全密钥输入参数。
需要说明的是，该实施例中的装置是与网络侧的方法对应的装置，上述各实施例中的实现方式均适用于该装置的实施例中，也能达到相同的技术效果。在此需要说明的是，本公开实施例提供的上述装置，能够实现上述方法 实施例所实现的所有方法步骤，且能够达到相同的技术效果，在此不再对本实施例中与方法实施例相同的部分及有益效果进行具体赘述。
本公开的实施例还提供一种处理器可读存储介质，所述处理器可读存储介质存储有处理器可执行指令，所述处理器可执行指令用于使所述处理器执行如上所述的终端侧的方法或者网络侧的方法。上述方法实施例中的所有实现方式均适用于该实施例中，也能达到相同的技术效果。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本公开的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本公开所提供的实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本公开各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用 时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本公开的技术方案本质上或者说对相关技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本公开各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
此外，需要指出的是，在本公开的装置和方法中，显然，各部件或各步骤是可以分解和/或重新组合的。这些分解和/或重新组合应视为本公开的等效方案。并且，执行上述系列处理的步骤可以自然地按照说明的顺序按时间顺序执行，但是并不需要一定按照时间顺序执行，某些步骤可以并行或彼此独立地执行。对本领域的普通技术人员而言，能够理解本公开的方法和装置的全部或者任何步骤或者部件，可以在任何计算装置(包括处理器、存储介质等)或者计算装置的网络中，以硬件、固件、软件或者它们的组合加以实现，这是本领域普通技术人员在阅读了本公开的说明的情况下运用他们的基本编程技能就能实现的。
因此，本公开的目的还可以通过在任何计算装置上运行一个程序或者一组程序来实现。所述计算装置可以是公知的通用装置。因此，本公开的目的也可以仅仅通过提供包含实现所述方法或者装置的程序代码的程序产品来实现。也就是说，这样的程序产品也构成本公开，并且存储有这样的程序产品的存储介质也构成本公开。显然，所述存储介质可以是任何公知的存储介质或者将来所开发出来的任何存储介质。还需要指出的是，在本公开的装置和方法中，显然，各部件或各步骤是可以分解和/或重新组合的。这些分解和/或重新组合应视为本公开的等效方案。并且，执行上述系列处理的步骤可以自然地按照说明的顺序按时间顺序执行，但是并不需要一定按照时间顺序执行。某些步骤可以并行或彼此独立地执行。
需要说明的是，应理解以上各个模块的划分仅仅是一种逻辑功能的划分，实际实现时可以全部或部分集成到一个物理实体上，也可以物理上分开。且这些模块可以全部以软件通过处理元件调用的形式实现；也可以全部以硬件 的形式实现；还可以部分模块通过处理元件调用软件的形式实现，部分模块通过硬件的形式实现。例如，确定模块可以为单独设立的处理元件，也可以集成在上述装置的某一个芯片中实现，此外，也可以以程序代码的形式存储于上述装置的存储器中，由上述装置的某一个处理元件调用并执行以上确定模块的功能。其它模块的实现与之类似。此外这些模块全部或部分可以集成在一起，也可以独立实现。这里所述的处理元件可以是一种集成电路，具有信号的处理能力。在实现过程中，上述方法的各步骤或以上各个模块可以通过处理器元件中的硬件的集成逻辑电路或者软件形式的指令完成。
例如，各个模块、单元、子单元或子模块可以是被配置成实施以上方法的一个或多个集成电路，例如：一个或多个特定集成电路(Application Specific Integrated Circuit，ASIC)，或，一个或多个微处理器(digital signal processor，DSP)，或，一个或者多个现场可编程门阵列(Field Programmable Gate Array，FPGA)等。再如，当以上某个模块通过处理元件调度程序代码的形式实现时，该处理元件可以是通用处理器，例如中央处理器(Central Processing Unit，CPU)或其它可以调用程序代码的处理器。再如，这些模块可以集成在一起，以片上系统(system-on-a-chip，SOC)的形式实现。
本公开的说明书和权利要求书中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本公开的实施例，例如除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。此外，说明书以及权利要求中使用“和/或”表示所连接对象的至少其中之一，例如A和/或B和/或C，表示包含单独A，单独B，单独C，以及A和B都存在，B和C都存在，A和C都存在，以及A、B和C都存在的7种情况。类似地，本说明书以及权利要求中使用“A和B中的至少一个”应理解为“单独A，单独B，或A和B都存在”。
以上所述的是本公开的可选实施方式，应当指出对于本技术领域的普通 人员来说，在不脱离本公开所述的原理前提下还可以作出若干改进和润饰，这些改进和润饰也在本公开的保护范围内。

Claims (31)

  1. 一种用户与多终端间的安全性管理方法，应用于终端，所述方法包括：
    用户与多个终端建立从属关系，多个终端存储安全性根密钥；
    在所述多个终端中，至少一个目标终端接入网络时，获取所述目标终端对应的网络侧节点的安全密钥输入参数；
    所述目标终端根据所述安全密钥输入参数进行安全密钥的推衍，与网络进行数据传输。
  2. 根据权利要求1所述的用户与多终端间的安全性管理方法，其中，存储安全性根密钥，包括：
    获取用户的预设参数，所述预设参数包括：用户与网络侧签约的标识和/或用户与网络侧签约的第一密钥；
    根据所述预设参数，存储所述安全性根密钥。
  3. 根据权利要求2所述的用户与多终端间的安全性管理方法，其中，根据所述预设参数，存储安全性根密钥，包括：
    所述多个终端与用户建立从属关系的过程中，根据用户与网络侧签约的第一密钥生成安全性根密钥并存储；
    或者，
    所述多个终端直接从所述用户接收所述第一密钥，并将所述第一密钥作为安全性根密钥进行存储。
  4. 根据权利要求3所述的用户与多终端间的安全性管理方法，其中，在所述多个终端中，至少一个目标终端接入网络时，获取所述目标终端对应的网络侧节点的安全密钥输入参数，包括：
    在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，进行初始认证及密钥协商流程，确定第一终端的第一密钥推衍集合；
    在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一终端的第一密钥推衍集合，通过网络节点触发网络节点传递所述目标终端的对应网络侧节点的安全密钥输入参数。
  5. 根据权利要求4所述的用户与多终端间的安全性管理方法，其中，在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一终端的第一密钥推衍集合，通过网络节点触发网络节点传递所述目标终端的对应的网络侧节点的安全密钥输入参数，包括：
    在非首个与所述用户建立从属关系的第二终端接入网络后，核心网确定所述第二终端从属于第一终端的用户后，所述第二终端接收核心网发送的非接入NAS层的安全密钥输入参数集合以及接入网节点根密钥的输入参数，以及由所述核心网通知接入网节点进行接入AS层的安全密钥输入参数集合。
  6. 根据权利要求5所述的用户与多终端间的安全性管理方法，其中，
    若所述第一终端接入第一接入网节点，所述第二终端接入第二接入网节点，所述第一接入网节点和所述第二接入网节点是不同的网络节点，所述核心网通知所述第一接入网节点向所述第二接入网节点发送安全密钥输入参数，所述第二终端接收所述第二接入网节点所发送的安全密钥输入参数；
    若所述第一终端和所述第二终端接入相同的接入网节点，所述核心网触发所述接入网节点进行安全密钥输入参数的传递，所述第二终端接收所述接入网节点发送的所述接入网节点的安全密钥输入参数。
  7. 根据权利要求4所述的用户与多终端间的安全性管理方法，其中，在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一个终端的第一密钥推衍集合，通过网络节点触发网络节点传递所述目标终端的对应的接入节点的安全密钥输入参数，包括：
    在非首个与所述用户建立从属关系的第二终端接入网络后，若所述第一终端与所述第二终端接入同一接入网节点，则该接入网节点确定所述第一终端和所述第二终端从属于同一用户，并上报核心网，触发非接入NAS层密钥及接入网节点根密钥输入参数的传递，所述第二终端接收所述接入网节点发送的接入AS层安全密钥输入参数以及接收所述核心网发送的安全输入参数。
  8. 根据权利要求2所述的用户与多终端间的安全性管理方法，其中，根据所述预设参数，存储安全性根密钥，包括：
    在用户与多个终端建立从属关系的过程中，根据用户与网络侧签约的第一密钥以及终端与用户建立从属关系时的终端计数值，生成安全性根密钥并 存储；
    或者，
    在用户与多个终端建立从属关系的过程中，用户根据终端计数值，更新用户与网络侧签约的第一密钥，各终端获取与其对应的更新后的第一密钥，作为该终端的安全性根密钥并存储。
  9. 根据权利要求8所述的用户与多终端间的安全性管理方法，其中，在所述多个终端中的至少一个目标终端接入网络时，获取所述目标终端对应的接入节点的安全密钥输入参数，包括：
    在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，以及在非首个与所述用户建立从属关系的目标终端接入网络后，将所述第一终端和所述目标终端的关系以及所述目标终端的计数值上报核心网，所述第二终端接收网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数。
  10. 根据权利要求9所述的用户与多终端间的安全性管理方法，其中，所述第二终端接收网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
    核心网在确定第二终端从属于第一终端的用户后，根据第二终端的终端计数值更新根密钥，并向第二终端发送核心网和接入网节点的根密钥推衍参数以及非接入NAS层的密钥输入参数，核心网触发接入网节点进行AS层密钥输入参数的传递。
  11. 根据权利要求10所述的用户与多终端间的安全性管理方法，其中，
    若所述第一终端接入第一接入网节点，所述第二终端接入第二接入网节点，所述第一接入网节点和所述第二接入网节点是不同的网络节点，所述核心网根据所述第二终端的计数值更新根密钥，并向所述第二终端发送核心网和接入网节点的根密钥输入参数以及非接入NAS层的密钥输入参数，核心网通知第一接入网节点向所述第二接入网节点发送安全密钥输入参数，所述第二终端接收所述核心网发送的网络节点根密钥输入参数和非接入NAS层的安全密钥输入参数及接入网节点AS层的安全密钥输入参数；
    若所述第一终端和所述第二终端接入相同的接入网节点，所述核心网根 据所述第二终端的计数值更新根密钥，并向所述第二终端发送核心网和接入网节点的根密钥输入参数以及非接入NAS层的密钥输入参数，核心网触发所述接入网节点进行安全密钥输入参数的传递，所述第二终端接收所述核心网发送的网络节点根密钥输入参数和非接入NAS层的安全密钥输入参数及所述接入网节点的安全密钥输入参数。
  12. 根据权利要求9所述的用户与多终端间的安全性管理方法，其中，所述第二终端接收网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
    在非首个与所述用户建立从属关系的第二终端接入网络后，第二终端向网络侧上报第二终端所对应的终端计数值，接入网节点根据第二终端的终端计数值进行对应密钥输入参数的更新；接入网节点确定所述第一终端和所述第二终端从属于同一用户，并上报核心网，所述核心网通过所述第一终端与所述第二终端的关系，根据第二终端计数值进行NAS或者AS根密钥参数的推算更新，第二终端接收所述核心网发送的网络节点根密钥输入参数和非接入NAS层的安全密钥输入参数及所述接入网节点的安全密钥输入参数。
  13. 根据权利要求4至12任一项所述的用户与多终端间的安全性管理方法，其中，所述目标终端根据所述安全密钥输入参数与网络进行数据传输，包括：
    所述第二终端根据所述安全密钥输入参数，激活非接入NAS层以及接入AS层的安全性，与网络进行数据传输。
  14. 根据权利要求4至12任一项所述的用户与多终端间的安全性管理方法，其中，
    当用户与多个终端的从属关系结束时，多个终端删除所存储的第二密钥。
  15. 一种用户与多终端间的安全性管理方法，应用于网络侧，所述方法包括：
    从属于同一用户的多个终端中的至少一个目标终端接入网络时，网络侧触发网络侧节点传递所述目标终端对应的网络侧节点的安全密钥输入参数；
    根据所述安全密钥输入参数与终端进行数据传输。
  16. 根据权利要求15所述的用户与多终端间的安全性管理方法，其中， 网络侧触发网络侧节点传递所述目标终端对应的接入节点的安全密钥输入参数，包括：
    在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，进行初始认证及密钥协商流程，确定第一终端的第一密钥推衍集合；
    在非首个与所述用户建立从属关系的目标终端接入网络时，根据用户与终端的从属关系，触发网络节点传递所述目标终端的对应的网络侧节点的安全密钥输入参数。
  17. 根据权利要求16所述的用户与多终端间的安全性管理方法，其中，根据所述第一终端的第一密钥推衍集合，触发网络节点传递所述目标终端的对应的接入节点的安全密钥输入参数，包括：
    核心网确定所述第二终端从属于第一终端的用户后，向第二终端发送非接入NAS层的安全密钥输入参数集合以及接入网节点根密钥的推衍参数，再由所述核心网通知接入网节点进行接入AS层的安全密钥输入参数集合。
  18. 根据权利要求16所述的用户与多终端间的安全性管理方法，其中，根据所述第一终端的第一密钥推衍集合，触发网络节点传递所述目标终端的对应的接入节点的安全密钥输入参数，包括：
    若所述第一终端与所述第二终端接入同一接入网节点，则该接入网节点确定所述第一终端和所述第二终端从属于同一用户，并上报核心网，所述核心网触发非接入NAS层密钥及接入网节点根密钥输入参数的传递，接入网节点向所述第二终端发送接入AS层安全密钥输入参数。
  19. 根据权利要求15所述的用户与多终端间的安全性管理方法，其中，网络侧触发网络侧节点传递所述目标终端对应的网络侧节点的安全密钥输入参数，包括：
    在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，以及在非首个与所述用户建立从属关系的目标终端接入网络后，将所述第一终端和所述目标终端的关系以及所述目标终端的计数值上报核心网，网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数。
  20. 根据权利要求19所述的用户与多终端间的安全性管理方法，其中，网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
    核心网在确定第二终端从属于第一终端的用户后，根据第二终端的终端计数值更新根密钥，并向第二终端发送核心网的非接入NAS层的密钥输入参数和接入网节点的根密钥输入参数，核心网触发接入网节点进行AS层密钥输入参数的传递。
  21. 根据权利要求19所述的用户与多终端间的安全性管理方法，其中，网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数，包括：
    在非首个与所述用户建立从属关系的第二终端接入网络后，网络侧接收第二终端上报的第二终端所对应的终端计数值，接入网节点根据第二终端的终端计数值进行对应密钥输入参数的更新；
    所述接入网节点向所述第二终端发送安全密钥输入参数。
  22. 一种终端，包括：收发机，处理器，存储器，所述存储器上存有所述处理器可执行的程序；所述处理器执行所述程序时实现：用户与多个终端建立从属关系，多个终端存储安全性根密钥；在所述多个终端中，至少一个目标终端接入网络时，获取所述目标终端对应的网络侧节点的安全密钥输入参数；所述目标终端根据所述安全密钥输入参数进行安全密钥的推衍，与网络进行数据传输。
  23. 根据权利要求22所述的终端，其中，存储安全性根密钥，包括：
    获取用户的预设参数，所述预设参数包括：用户与网络侧签约的标识和/或用户与网络侧签约的第一密钥；
    根据所述预设参数，存储所述安全性根密钥。
  24. 根据权利要求23所述的终端，其中，根据所述预设参数，存储安全性根密钥，包括：
    所述多个终端与用户建立从属关系的过程中，根据用户与网络侧签约的第一密钥生成安全性根密钥并存储；
    或者，
    所述多个终端直接从所述用户接收所述第一密钥，并将所述第一密钥作为安全性根密钥进行存储。
  25. 根据权利要求24所述的终端，其中，在所述多个终端中，至少一个目标终端接入网络时，获取所述目标终端对应的网络侧节点的安全密钥输入参数，包括：
    在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，进行初始认证及密钥协商流程，确定第一终端的第一密钥推衍集合；
    在非首个与所述用户建立从属关系的目标终端接入网络后，根据所述第一终端的第一密钥推衍集合，通过网络节点触发网络节点传递所述目标终端的对应网络侧节点的安全密钥输入参数。
  26. 根据权利要求23所述的终端，其中，根据所述预设参数，存储安全性根密钥，包括：
    在用户与多个终端建立从属关系的过程中，根据用户与网络侧签约的第一密钥以及终端与用户建立从属关系时的终端计数值，生成安全性根密钥并存储；
    或者，
    在用户与多个终端建立从属关系的过程中，用户根据终端计数值，更新用户与网络侧签约的第一密钥，各终端获取与其对应的更新后的第一密钥，作为该终端的安全性根密钥并存储。
  27. 根据权利要求26所述的终端，其中，在所述多个终端中的至少一个目标终端接入网络时，获取所述目标终端对应的接入节点的安全密钥输入参数，包括：
    在所述多个终端中，首个与用户建立从属关系的第一终端，与用户的从属关系激活并接入网络后，以及在非首个与所述用户建立从属关系的目标终端接入网络后，将所述第一终端和所述目标终端的关系以及所述目标终端的计数值上报核心网，所述第二终端接收网络侧节点根据所述目标终端的计数值触发并传递的安全密钥输入参数。
  28. 一种用户与多终端间的安全性管理装置，应用于终端，所述装置包 括：
    存储模块，用于用户与多个终端建立从属关系，多个终端存储安全性根密钥；
    获取模块，用于在所述多个终端中，至少一个目标终端接入网络时，获取所述目标终端对应的网络侧节点的安全密钥输入参数；
    处理模块，用于根据所述安全密钥输入参数进行安全密钥的推衍与网络进行数据传输。
  29. 一种网络侧设备，包括：收发机，处理器，存储器，所述存储器上存有所述处理器可执行的程序；所述处理器执行所述程序时实现：从属于同一用户的多个终端中的至少一个目标终端接入网络时，网络侧触发网络侧节点传递所述目标终端对应的网络侧节点的安全密钥输入参数；根据所述安全密钥输入参数与终端进行数据传输。
  30. 一种用户与多终端间的安全性管理装置，应用于网络侧设备，所述装置包括：
    处理模块，用于从属于同一用户的多个终端中的至少一个目标终端接入网络时，网络侧触发网络侧节点传递所述目标终端对应的网络侧节点的安全密钥输入参数；
    收发模块，用于根据所述安全密钥输入参数与终端进行数据传输。
  31. 一种处理器可读存储介质，所述处理器可读存储介质存储有处理器可执行指令，所述处理器可执行指令用于使所述处理器执行权利要求1至14任一项所述的方法或者执行权利要求15至21任一项所述的方法。
PCT/CN2021/104236 2020-07-22 2021-07-02 用户与多终端间的安全性管理方法、装置及设备 WO2022017158A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010709512.0A CN114051242B (zh) 2020-07-22 2020-07-22 用户与多终端间的安全性管理方法、装置及设备
CN202010709512.0 2020-07-22

Publications (1)

Publication Number Publication Date
WO2022017158A1 true WO2022017158A1 (zh) 2022-01-27

Family

ID=79729874

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/104236 WO2022017158A1 (zh) 2020-07-22 2021-07-02 用户与多终端间的安全性管理方法、装置及设备

Country Status (2)

Country Link
CN (1) CN114051242B (zh)
WO (1) WO2022017158A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114584328B (zh) * 2022-05-09 2022-08-02 武汉四通信息服务有限公司 Api接口的访问方法、计算机设备及计算机存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1602611A (zh) * 2001-12-07 2005-03-30 艾利森电话股份有限公司 端到端加密数据电信的合法侦听
CN109644339A (zh) * 2017-01-30 2019-04-16 瑞典爱立信有限公司 连接模式期间5g中的安全性上下文处理
US20190253888A1 (en) * 2016-09-20 2019-08-15 Nokia Solutions And Networks Oy Next generation key set identifier
CN111386720A (zh) * 2017-09-27 2020-07-07 日本电气株式会社 通信终端、核心网络装置、核心网络节点、网络节点和密钥导出方法

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101719825A (zh) * 2009-04-30 2010-06-02 中兴通讯股份有限公司 Ip多媒体子系统中实现安全分叉呼叫会话的方法及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1602611A (zh) * 2001-12-07 2005-03-30 艾利森电话股份有限公司 端到端加密数据电信的合法侦听
US20190253888A1 (en) * 2016-09-20 2019-08-15 Nokia Solutions And Networks Oy Next generation key set identifier
CN109644339A (zh) * 2017-01-30 2019-04-16 瑞典爱立信有限公司 连接模式期间5g中的安全性上下文处理
CN111386720A (zh) * 2017-09-27 2020-07-07 日本电气株式会社 通信终端、核心网络装置、核心网络节点、网络节点和密钥导出方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
APPLE: "pCR: KAF refreshment", 3GPP DRAFT; S3-200607, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. E-meeting; 20200414 - 20200417, 3 April 2020 (2020-04-03), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051868537 *

Also Published As

Publication number Publication date
CN114051242A (zh) 2022-02-15
CN114051242B (zh) 2023-06-23

Similar Documents

Publication Publication Date Title
CN108966220B (zh) 一种密钥推演的方法及网络设备
CN109964453B (zh) 统一安全性架构
CN110419205A (zh) 针对用户平面数据的完整性保护的方法
AU2018340618B2 (en) Parameter protection method and device, and system
WO2017147772A1 (zh) 一种消息传输方法及核心网接口设备
US20190335369A1 (en) Method for network entity handover, terminal and network entity device
US12015707B2 (en) Communication method and related product
US10797934B1 (en) Open control plane function for wireless networks
US20220272607A1 (en) Network Access Method and Communication Apparatus
US20220303763A1 (en) Communication method, apparatus, and system
US20200252897A1 (en) Service Activation and Deactivation Method, Device and Computer Storage Medium
CN105814924A (zh) 用于控制异构或同构无线网络内的技术特定按钮配置会话的运行的方法和网络节点设备及异构或同构无线网络
US20200137567A1 (en) Method and Devices for Hardware Identifier-Based Subscription Management
WO2022017158A1 (zh) 用户与多终端间的安全性管理方法、装置及设备
WO2023016451A1 (zh) 更新方法、网络侧设备、终端和计算机可读存储介质
US20230179400A1 (en) Key management method and communication apparatus
WO2018076298A1 (zh) 一种安全能力协商方法及相关设备
CN110881020B (zh) 一种用户签约数据的鉴权方法及数据管理网元
US11457492B2 (en) Technique for providing reliable wireless communication
WO2023205978A1 (zh) 邻近通信业务的密钥生成方法、装置、设备及存储介质
WO2024001889A1 (zh) V2x策略请求方法及装置
CN109792449A (zh) 建立移动终端至移动无线电通信网络的连接的方法和通信网络装置
US20230308864A1 (en) Wireless communication method, apparatus, and system
KR20240128970A (ko) 릴레이 사용자 장비를 통한 원격 사용자 장비 인증에 대한 지원
WO2014169568A1 (zh) 安全上下文处理方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21845682

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21845682

Country of ref document: EP

Kind code of ref document: A1