WO2022028259A1

WO2022028259A1 - User subscription data obtaining method and apparatus

Info

Publication number: WO2022028259A1
Application number: PCT/CN2021/108022
Authority: WO
Inventors: 李飞; 何承东
Original assignee: 华为技术有限公司
Priority date: 2020-08-07
Filing date: 2021-07-23
Publication date: 2022-02-10
Also published as: CN114071452B; CN114071452A

Abstract

A user subscription data obtaining method and apparatus. A terminal device generates pk1 and sk1, and sends a registration request to a first network, the registration request comprising pk1; a first network element in the first network sends an authentication request for the terminal device to a second network element in a second network, the authentication request comprising pk1, and the second network element sends the identifier of a private network to the first network; the first network element obtains first user subscription data from a third network according to the identifier of the private network, the first user subscription data being obtained by encrypting second user subscription data by using pk1; the terminal device decrypts the first user subscription data by using sk1 to obtain the second user subscription data. By adopting the solution of the present application, obtaining of user subscription data can be protected, the user subscription data is prevented from being stolen, and the communication security is improved; moreover, by obtaining the identifier of a private network from a second network element, a first network element can obtain correct user subscription data from an appropriate PS.

Description

Method and device for acquiring user subscription data

This application claims the priority of the Chinese patent application with the application number 202010790909.7 and the invention titled "Method and Device for Obtaining User Signing Data", which was submitted to the State Intellectual Property Office of China on August 7, 2020, the entire contents of which are incorporated by reference in in this application.

technical field

The present application relates to the field of communication technologies, and in particular, to a method and device for acquiring user subscription data.

Background technique

The current fifth generation (5G) mobile communication technology proposes a new application scenario, namely enhanced non-public-network ( ^eNPN ). eNPN can achieve end-to-end resource isolation, provide dedicated access networks for vertical industries, and ensure exclusive access to customer resources in vertical industries. At the same time, eNPN can provide support for local area network (LAN) services, and can meet the needs of some enterprises, residences, schools, etc. for reliable and stable private networks. Among them, eNPN is divided into completely independently deployed networks, namely independent non-public network (standalone non-public-network, SNPN), and non-public network integrated into public network (public network integrated non-public-network, PNI- NPN), such as a non-public network carried by a public land mobile network (PLMN).

As shown in Figure 1, it is a schematic diagram of the architecture of the eNPN network. The eNPN network architecture includes a user equipment (UE), an onboarding-standalone non-public-network (O-SNPN), a default Certificate server (default credential server, DCS), provisioning server (provisioning server, PS) and SNPN. The eNPN includes an onboarding service, which means that the UE goes online to the eNPN, so that the eNPN can obtain the user subscription data of the UE in the SNPN network from the PS and deliver it to the UE, so that the UE can access the SNPN network. The SNPN buys the manufacturer's equipment (such as UE), and can configure the UE not in a one-by-one manner, but in a unified configuration manner. Specifically, as shown in the online process shown in FIG. 1 , the UE may first access the O-SNPN network, and then connect to the PS. The PS stores the user subscription data of the SNPN, or the PS obtains the user subscription data from the SNPN. The PS sends the user subscription data to the UE. Then the UE can access the SNPN network using the new identity according to the user subscription data.

However, as a private network, the SNPN network has high requirements on the security of the UE going online. Therefore, how to protect the acquisition of user subscription data and avoid the theft of user subscription data is a problem that needs to be solved.

SUMMARY OF THE INVENTION

The present application provides a method and device for acquiring user subscription data, so as to protect the acquisition of user subscription data.

A first aspect provides a method for acquiring user subscription data, comprising: generating a first public key and a first private key; sending a registration request to a first network, the registration request including the first public key; receiving a first public key User contract data, the first user contract data is obtained by encrypting the second user contract data with the first public key; and the first user contract data is decrypted using the first private key to obtain the second user contract data User subscription data. In this aspect, by receiving the encrypted first user contract data returned by the third network, and decrypting the first user contract data with the first private key generated by itself to obtain the second user contract data, the acquisition of the user contract data can be protected. , avoiding the theft of user subscription data and improving communication security; and by obtaining the private network identifier from the second network element, the first network element can obtain correct user subscription data from a suitable PS.

With reference to the first aspect, in a possible implementation, the registration request further includes an online indication, where the online indication is used to indicate that the type of the registration request is an online service. In this implementation, by carrying an online indication in the registration request, the second network element in the second network determines the first authentication server in the first network, so that the first authentication server requests the second network for the request The online terminal device is authenticated.

With reference to the first aspect, in another possible implementation, the registration request further includes a user hidden identifier, and the user hidden identifier includes the first public key. In this implementation, the user hidden identifier is calculated using the first public key, therefore, the first public key can be carried in the user hidden identifier to realize the transmission of the first public key.

In a second aspect, a method for acquiring user subscription data is provided, including: receiving an authentication request for a terminal device from a first network, where the authentication request includes a first public key; saving the first public key ; sending the identity of the private network to the first network; and sending the first public key to the third network. In this aspect, by authenticating the terminal device and sending the identifier of the private network accessible to the terminal device to the first network element in the first network, the first network element can access the private network from the identifier of the private network. The third network obtains the first user contract data, and the first user contract data is encrypted data, so that the acquisition of the user contract data can be protected, the user contract data can be prevented from being stolen, and the security of communication can be improved; The element acquires the identity of the private network, so that the first network element can acquire correct user subscription data from an appropriate PS.

With reference to the second aspect, in a possible implementation, the authentication request further includes a user hidden identifier, and the user hidden identifier includes the first public key.

With reference to the second aspect, in another possible implementation, the authentication request further includes an online indication, and the online indication is used to indicate that the type of the authentication request is an online service; The key includes: saving the first public key according to the online instruction. In this aspect, when it is determined that the type of the authentication request is an online service, the first public key is saved so that it can be sent to the PS later.

In a third aspect, a method for acquiring user subscription data is provided, including: a first network element in a first network receives an identifier of a private network from a second network; the first network element sends an identifier to the private network according to the identifier of the private network. The third network sends the user subscription data acquisition request of the terminal device; the first network element receives the user subscription data acquisition response returned by the third network, where the user subscription data acquisition response includes that the terminal device is in the private network and the first network element sends the first user subscription data to the terminal device. In this aspect, according to the identity of the private network received from the second network, an appropriate PS can be selected to obtain correct user subscription data; further, the second user subscription data can be encrypted by using the received first public key to obtain the first A user's subscription data is sent, and the first user's subscription data is sent, so that the acquisition of the user's subscription data can be protected, the user's subscription data can be prevented from being stolen, and the security of communication can be improved.

With reference to the third aspect, in a possible implementation, before the first network element receives the identifier of the private network from the second network, the method further includes: the first network element receives a registration request from the terminal device, and the The registration request carries at least one of the following: user hidden identifier, online indication, registration type, slice identifier; the first network element determines the first authentication server in the first network according to the registration request; the The first network element sends the authentication request of the terminal device to the second network through the first authentication server; wherein, determining the first authentication server according to the registration request includes: the user hides The identifier includes the identifier of the second network, and the first authentication server is determined according to the identifier of the second network; or the user hidden identifier includes a routing indication, and the first authentication server is determined according to the routing instruction. an authentication server; or determine the first authentication server according to the online instruction, the online instruction is used to indicate that the type of the registration request is an online service; or determine the first authentication server according to the registration type server, the registration type is online service; or the first authentication server is determined according to the slice identifier. In an existing registration process, the first network element receives a registration request from a terminal device, and generally sends the registration request to an authentication server of the network where the first network element is located for subsequent processing. However, in this implementation, the first network element determines that the online service is to be performed according to the received registration request, then determines the first authentication server of the network, and the first authentication server submits the authentication request to authenticate the online service. The second network for right management is used to authenticate the UE.

With reference to the third aspect, in yet another possible implementation, the registration request includes a first public key, and before the first network element receives the identifier of the private network from the second network, the method further includes: sending to the The second network sends the first public key, and the first user subscription data is obtained by encrypting the second user subscription data with the first public key.

With reference to the third aspect, in yet another possible implementation, the registration request includes a user hidden identifier, and the user hidden identifier includes the first public key.

In a fourth aspect, a method for acquiring user subscription data is provided, which is applied to a communication system, where the communication system includes a first network element in a first network and a second network element in a second network, including: the first network element A network element sends an authentication request for the terminal device to the second network element, where the authentication request includes the first public key; the second network element stores the first public key; the second network element Sending the identifier of the private network to the first network element; sending the first public key to the third network by the second network element; and sending the first network element to the third network according to the identifier of the private network Send a user subscription data acquisition request of the terminal device; the first network element receives a user subscription data acquisition response returned by the third network, where the user subscription data acquisition response includes the terminal device in the private network. user subscription data; and the first network element sends the first user subscription data to the terminal device.

For the specific interaction process of the terminal device, the first network element, the second network element, and the third network, reference may be made to any one of the foregoing implementation manners of the first to third aspects, and details are not described herein again.

In a fifth aspect, a device for acquiring user subscription data is provided for executing the above-mentioned first aspect or the method in any possible implementation of the first aspect. The device for acquiring the user subscription data may be a terminal device in the first aspect or any possible implementation of the first aspect, or a module applied in the terminal device, such as a chip or a chip system. Wherein, the device for acquiring user subscription data includes corresponding modules, units, or means for implementing the above method, and the modules, units, or means may be implemented by hardware, software, or by executing corresponding software in hardware. The hardware or software includes one or more modules or units corresponding to the above functions.

With reference to the fifth aspect, in a possible implementation, the device for acquiring user subscription data includes: a generating unit, a sending unit, a receiving unit, and a decrypting unit; wherein the generating unit is used to generate a first public key and a first private key a sending unit, configured to send a registration request to the first network, where the registration request includes the first public key; a receiving unit, configured to receive the first user contract data, the first user contract data from the second user The contract data is obtained by encrypting with the first public key; and a decryption unit is configured to use the first private key to decrypt the first user contract data to obtain the second user contract data.

With reference to the fifth aspect, in another possible implementation, the device for acquiring user subscription data includes: an input interface, an output interface, and a processing circuit; wherein, the processing circuit is used to generate a first public key and a first private key; an output interface, used to send a registration request to the first network, where the registration request includes the first public key; an input interface, used to receive first user contract data, the first user contract data is obtained from the second user contract data Obtained by encrypting with the first public key; and a processing circuit configured to decrypt the first user contract data by using the first private key to obtain the second user contract data.

Exemplarily, the device for acquiring user subscription data further includes a memory, which is coupled to the at least one processor, and the at least one processor is configured to execute program instructions stored in the memory, so that the device for acquiring user subscription data executes The first aspect or the method in any possible implementation of the first aspect.

In one possible implementation, the memory is used to store program instructions and data. The memory is coupled to the at least one processor, and the at least one processor can call and execute program instructions stored in the memory, so that the apparatus for acquiring user subscription data executes the first aspect or any possibility of the first aspect method in the implementation.

Exemplarily, the apparatus for acquiring user subscription data further includes a communication interface, where the communication interface is used for the apparatus for acquiring user subscription data to communicate with other devices. When the device for acquiring the user subscription data is a terminal device, the communication interface is a transceiver, an input/output interface, or a circuit or the like.

In a possible design, the device for acquiring user subscription data includes: at least one processor and a communication interface for executing the method in the first aspect or any possible implementation of the first aspect, specifically including: The at least one processor communicates with the outside using the communication interface; the at least one processor is configured to run a computer program, so that the apparatus for acquiring user subscription data executes the method in the first aspect or any possible implementation of the first aspect. It can be understood that the external part may be an object other than the processor, or an object other than the device for acquiring the user contract data.

In another possible design, the device for acquiring the user subscription data is a chip or a chip system. The communication interface may be an input/output interface, an interface circuit, an output circuit, an input circuit, a pin or a related circuit, etc. on the chip or the chip system. The processor may also be embodied as processing circuitry or logic circuitry.

Wherein, for the technical effects brought by any one of the design methods in the fifth aspect, reference may be made to the technical effects brought by different design methods in the above-mentioned first aspect, which will not be repeated here.

In a sixth aspect, a communication apparatus is provided for performing the second aspect or the method in any possible implementation of the second aspect. The communication apparatus may be the second network element in the second network in the second aspect or any possible implementation of the second aspect, or a module applied to the second network element, such as a chip or a chip system. Wherein, the communication device includes corresponding modules, units, or means for implementing the above method, and the modules, units, or means may be implemented by hardware, software, or by executing corresponding software in hardware. The hardware or software includes one or more modules or units corresponding to the above functions.

With reference to the sixth aspect, in a possible implementation, the communication device includes: a receiving unit, a processing unit, and a sending unit; wherein the receiving unit is configured to receive an authentication request for the terminal device from the first network, and the The authentication request includes a first public key; a processing unit, used to save the first public key; a sending unit, used to send the identity of the private network to the first network; and the sending unit, also used to send to the first network. The third network sends the first public key.

Optionally, the authentication request further includes an online instruction, where the online instruction is used to indicate that the type of the authentication request is an online service; the processing unit is configured to save the first online service according to the online instruction. public key.

With reference to the above sixth aspect, in yet another possible implementation, the communication device includes: an input interface, an output interface, and a processing circuit; wherein, the input interface is used to receive authentication for the terminal device from the first network request, the authentication request includes a first public key; a processing circuit, configured to save the first public key; an output interface, used to send the identifier of the private network to the first network; and the output interface, further for sending the first public key to the third network.

Optionally, the authentication request further includes an online indication, and the online indication is used to indicate that the type of the authentication request is an online service; the processing circuit is configured to save the first online service according to the online instruction. public key.

Exemplarily, the communication device further includes a memory coupled to the at least one processor for executing program instructions stored in the memory to cause the communication device to perform the above-mentioned second aspect or the second aspect method in any possible implementation of .

In one possible implementation, the memory is used to store program instructions and data. The memory is coupled to the at least one processor, and the at least one processor can invoke and execute program instructions stored in the memory to cause the communication device to perform the above-mentioned second aspect or any possible implementation of the second aspect. method.

Exemplarily, the communication apparatus further includes a communication interface for the communication apparatus to communicate with other devices. When the communication device is the second network element, the communication interface is a transceiver, an input/output interface, a circuit, or the like.

In a possible design, the communication device includes: at least one processor and a communication interface for executing the method in the second aspect or any possible implementation of the second aspect, specifically including: the at least one processor The communication device communicates with the outside using the communication interface; the at least one processor is used for running a computer program, so that the communication device executes the method in the second aspect or any possible implementation of the second aspect. It is understood that the external may be an object other than the processor, or an object other than the communication device.

In another possible design, the communication device is a chip or a system of chips. The communication interface may be an input/output interface, an interface circuit, an output circuit, an input circuit, a pin or a related circuit, etc. on the chip or the chip system. The processor may also be embodied as processing circuitry or logic circuitry.

Wherein, for the technical effect brought by any one of the design methods in the sixth aspect, reference may be made to the technical effects brought by the different design methods in the above-mentioned second aspect, which will not be repeated here.

In a seventh aspect, a communication apparatus is provided for performing the third aspect or the method in any possible implementation of the third aspect. The communication apparatus may be the first network element in the first network in the third aspect or any possible implementation of the third aspect, or a module applied to the first network element, such as a chip or a chip system. Wherein, the communication device includes corresponding modules, units, or means for implementing the above method, and the modules, units, or means may be implemented by hardware, software, or by executing corresponding software in hardware. The hardware or software includes one or more modules or units corresponding to the above functions.

With reference to the above seventh aspect, in a possible implementation, the communication device includes: a receiving unit, a processing unit, and a sending unit; wherein the receiving unit is used to receive the identifier of the private network from the second network; The identifier of the private network determines the user subscription data acquisition request of the terminal device; the sending unit is configured to send the user subscription data acquisition request to a third network; the receiving unit is further configured to receive a response from the third network The user subscription data acquisition response includes the first user subscription data of the terminal device in the private network; and the sending unit is further configured to send the first user subscription data to the terminal device User subscription data.

Optionally, the receiving unit is further configured to receive a registration request from the terminal device, where the registration request carries at least one of the following: a user hidden identifier, an online indication, a registration type, and a slice identifier; the processing unit , and is further configured to determine the first authentication server in the first network according to the registration request; the sending unit is further configured to send the terminal device to the second network through the first authentication server The authentication request; wherein, the processing unit is specifically configured to include the identifier of the second network in the user hidden identifier, and determine the first authentication server according to the identifier of the second network; or The processing unit is specifically configured to include a routing indication in the user hidden identifier, and determine the first authentication server according to the routing indication; or the processing unit is specifically configured to determine the first authentication server according to the online indication an authentication server, where the online indication is used to indicate that the type of the registration request is an online service; or the processing unit is specifically configured to determine the first authentication server according to the registration type, where the registration type is an online service; or the processing unit, specifically configured to determine the first authentication server according to the slice identifier.

With reference to the above seventh aspect, in yet another possible implementation, the communication device includes: an input interface, an output interface, and a processing circuit; wherein the input interface is used for receiving the identifier of the private network from the second network; the output interface is used for Send the user subscription data acquisition request of the terminal device to the third network according to the identity of the private network; the input interface is further configured to receive the user subscription data acquisition response returned by the third network, the user subscription data acquisition response It includes the first user subscription data of the terminal device in the private network; and the output interface is further configured to send the first user subscription data to the terminal device.

Optionally, the input interface is further configured to receive a registration request from the terminal device, where the registration request carries at least one of the following: a user hidden identifier, an online indication, a registration type, and a slice identifier; the processing circuit , used to determine the first authentication server in the first network according to the registration request; the sending unit is further configured to send the information of the terminal device to the second network through the first authentication server An authentication request; wherein the processing circuit is specifically configured to include the identifier of the second network in the user hidden identifier, and determine the first authentication server according to the identifier of the second network; or the a processing circuit, specifically configured to include a routing indication in the user hidden identifier, and determine the first authentication server according to the routing indication; or the processing circuit, specifically configured to determine the first authentication server according to the online indication an authentication server, where the online indication is used to indicate that the type of the registration request is an online service; or the processing circuit is specifically configured to determine the first authentication server according to the registration type, where the registration type is online or the processing circuit, specifically configured to determine the first authentication server according to the slice identifier.

Exemplarily, the communication device further includes a memory coupled to the at least one processor, the at least one processor is configured to execute program instructions stored in the memory, so that the communication device performs the above-mentioned third aspect or the third aspect method in any possible implementation of .

In one possible implementation, the memory is used to store program instructions and data. The memory is coupled to the at least one processor, and the at least one processor can invoke and execute program instructions stored in the memory to cause the communication device to perform the above third aspect or any possible implementation of the third aspect. method.

Exemplarily, the communication apparatus further includes a communication interface for the communication apparatus to communicate with other devices. When the communication device is the first network element, the communication interface is a transceiver, an input/output interface, or a circuit or the like.

In a possible design, the communication device includes: at least one processor and a communication interface for executing the method in the third aspect or any possible implementation of the third aspect, specifically including: the at least one processor The communication device communicates with the outside using the communication interface; the at least one processor is used for running a computer program, so that the communication device executes the method in the third aspect or any possible implementation of the third aspect. It is understood that the external may be an object other than the processor, or an object other than the communication device.

Wherein, for the technical effect brought by any one of the design methods in the seventh aspect, reference may be made to the technical effects brought by different design methods in the above-mentioned third aspect, which will not be repeated here.

In an eighth aspect, a communication system is provided, the communication system includes a first network element in a first network and a second network element in a second network, wherein the first network element is configured to report to the first network element The second network element sends an authentication request for the terminal device, where the authentication request includes the first public key; the second network element is used to store the first public key; the second network element is also used to send the The first network element sends the identifier of the private network; the second network element is further configured to send the first public key to the third network; the first network element is further configured to send the private network identifier to the third network. The third network sends a user subscription data acquisition request of the terminal device; the first network element is further configured to receive a user subscription data acquisition response returned by the third network, where the user subscription data acquisition response includes the terminal device in the the first user subscription data of the private network; and the first network element is further configured to send the first user subscription data to the terminal device.

With reference to the eighth aspect, in a possible implementation, the authentication request further includes a user hidden identifier, and the user hidden identifier includes the first public key.

With reference to the eighth aspect, in another possible implementation, the authentication request further includes an online indication, and the online indication is used to indicate that the type of the authentication request is an online service, and the second network element also uses and storing the first public key according to the online instruction.

With reference to the eighth aspect, in another possible implementation, the first network element is further configured to receive a registration request from the terminal device, where the registration request carries at least one of the following: a user hidden identifier, an online indication , registration type, slice identifier; the first network element is further configured to determine the first authentication server in the first network according to the registration request; the first network element is further configured to pass the first authentication server The authorization server sends the authentication request of the terminal device to the second network; wherein, the first network element is specifically used for the user hidden identifier to include the identifier of the second network, according to the second network element. The identifier of the network determines the first authentication server; or the first network element is specifically configured to include a routing indication in the user hidden identifier, and the first authentication server is determined according to the routing indication; or the The first network element is specifically used to determine the first authentication server according to the online instruction, and the online instruction is used to indicate that the type of the registration request is an online service; or the first network element is specifically used to determine the first authentication server according to the online service. The registration type determines the first authentication server, and the registration type is an online service; or the first network element is specifically configured to determine the first authentication server according to the slice identifier.

With reference to the eighth aspect, in another possible implementation, the registration request includes a first public key, the first network element is further configured to send the first public key to the second network element, the The first user subscription data is obtained by encrypting the second user subscription data by using the first public key.

With reference to the eighth aspect, in another possible implementation, the registration request includes a user hidden identifier, and the user hidden identifier includes the first public key.

In a ninth aspect, a computer-readable storage medium is provided, which stores a computer program, and when it runs on a computer, the above-mentioned aspects or any one of the above-mentioned aspects to implement the described method is executed.

In a tenth aspect, there is provided a computer program product which, when run on a computer, causes the above-mentioned aspects or any of the above-mentioned aspects to be executed.

In an eleventh aspect, there is provided a computer program which, when run on a computer, causes the above-mentioned aspects or any one of the above-mentioned aspects to be executed.

Description of drawings

Figure 1 is a schematic diagram of the architecture of the eNPN network;

FIG. 2 is a schematic structural diagram of a communication system 100 provided by an embodiment of the present application;

3 is a schematic flowchart of a method for acquiring user subscription data according to an embodiment of the present application;

4 is a schematic flowchart of another method for acquiring user subscription data provided by an embodiment of the present application;

5 is a schematic flowchart of another method for acquiring user subscription data provided by an embodiment of the present application;

FIG. 6 is a schematic structural diagram of a communication apparatus 200 according to an embodiment of the present application;

FIG. 7 is a schematic structural diagram of an apparatus 300 for acquiring user subscription data according to an embodiment of the present application;

FIG. 8 is a schematic structural diagram of a communication apparatus 400 according to an embodiment of the present application;

FIG. 9 is a schematic structural diagram of a communication apparatus 500 according to an embodiment of the present application.

detailed description

The embodiments of the present application will be described below with reference to the accompanying drawings in the embodiments of the present application.

The technical solutions of the embodiments of the present application can be applied to various communication systems. For example: enhanced long term evolution (enhanced-long term evolution, eLTE) system, fifth generation (5th generation, 5G) system or new radio (new radio, NR), etc. The 5G mobile communication system involved in this application includes non-standalone A 5G mobile communication system of a non-standalone (NSA) network or a 5G mobile communication system of an independent network (standalone, SA). The technical solutions provided in this application can also be applied to future communication systems, such as the sixth generation mobile communication system. The communication system may also be a public land mobile network (PLMN) network, a device-to-device (D2D) communication system, a machine-to-machine (M2M) communication system, an object Internet of things (IoT) communication system or other communication system.

FIG. 2 is a schematic structural diagram of a communication system 100 according to an embodiment of the present application. As shown in FIG. 2, the communication system 100 includes a first network, a second network and a third network. Wherein, the first network may be an onboarding network, the second network may be the network where the DCS/unified data management (unified data management, UDM) is located, and the third network may be the network where the PS is located. In the embodiment of the present application, the PS is generally set independently from the private network, that is, the third network is generally a network different from the private network. The UE initiates a registration request on the first network, the first network requests the second network to authenticate the UE, and after the second network authenticates the UE, it returns the identity of the private network to the first network, and the first network uses the identity of the private network The user subscription data is requested from the third network, and the third network encrypts the user subscription data and sends it to the UE.

The first network includes the first network element 11, the second network includes the second network element 12, and the third network includes the PS13. The first network element 11 may be a mobility management network element, and the second network element 12 may be a unified data management network element or a DCS. The network element or entity corresponding to the mobility management network element may be an access and mobility management function (AMF) entity in the 5G mobile communication system, and the network element corresponding to the unified data management network element The element or entity may be a UDM functional entity in the 5G mobile communication system, which is not specifically limited in this embodiment of the present application. The foregoing network elements may communicate directly or communicate through forwarding by other network elements, which is not specifically limited in this embodiment of the present application. Although not shown, the communication system may further include other network elements, which are not specifically limited in this embodiment of the present application.

Embodiments of the present application provide a method and device for acquiring user subscription data. After receiving a registration request from a UE, a first network element in the first network requests to perform authentication on the UE; a second network element in the second network Perform authentication and authentication on the UE, and send the identifier of the private network that the UE can access to the first network element in the first network, and send pk1 to the third network; the first network element can use the identifier of the private network from The third network requests to obtain the subscription data of the first user, and the third network encrypts the subscription data of the second user using pk1 to obtain the subscription data of the first user; the third network sends the data to the UE through the control plane of the first network or through the user of the first network The first user subscription data. Thereby, the acquisition of user subscription data can be protected, the user subscription data can be prevented from being stolen, and the security of communication can be improved; and by acquiring the identity of the private network from the second network element, the first network element can obtain the correct user from the appropriate PS. contract data.

Specifically, the solution can be applied to the above-mentioned communication system. The solution includes: the first network element sends an authentication request for the terminal device to the second network element, where the authentication request includes the first public key pk1; the second network element saves the pk1; The second network element sends the identifier of the private network to the first network element; the second network element sends the pk1 to the third network; the first network element sends the identifier of the private network to the third network according to the identifier of the private network. The third network sends the user subscription data acquisition request of the terminal device; the first network element receives the user subscription data acquisition response returned by the third network, and the user subscription data acquisition response includes the terminal device in the private network. first user subscription data; and the first network element sends the first user subscription data to the terminal device.

In a possible implementation, the authentication request further includes a hidden user identifier, and the hidden user identifier includes the pk1.

In another possible implementation, the authentication request further includes an online indication, where the online indication is used to indicate that the type of the authentication request is an online service, and the second network element storing the pk1 includes: The second network element saves the pk1 according to the online instruction.

In another possible implementation, before the second network element sends the identity of the private network to the first network element, the method further includes: the first network element receives a registration request from the terminal device , the registration request carries at least one of the following: user hidden identifier, online indication, registration type, slice identifier; the first network element determines the first authentication server in the first network according to the registration request; The first network element sends the authentication request of the terminal device to the second network through the first authentication server; wherein determining the first authentication server according to the registration request includes: the The user hidden identifier includes the identifier of the second network, and the first authentication server is determined according to the identifier of the second network; or the user hidden identifier includes a routing instruction, and the routing instruction is determined according to the routing instruction. the first authentication server; or determine the first authentication server according to the online instruction, the online instruction is used to indicate that the type of the registration request is an online service; or determine the first authentication server according to the registration type An authentication server, where the registration type is an online service; or the first authentication server is determined according to the slice identifier.

In yet another possible implementation, the registration request includes the first public key pk1, and before the second network element sends the identifier of the private network to the first network element, the registration request further includes: the first network element to the first network element The second network element sends the pk1, and the first user subscription data is obtained by encrypting the second user subscription data by using the pk1.

In yet another possible implementation, the registration request includes a hidden user identifier, and the hidden user identifier includes the pk1.

Among them, the AMF entity: mainly responsible for the processing of signaling, such as: access control, mobility management, attachment and detachment, and gateway selection and other functions. When the AMF entity provides services for the session in the terminal, it provides storage resources of the control plane for the session to store the session identifier, the identifier of the session management function (SMF) entity associated with the session identifier, and the like.

UDM entity: mainly used to manage user subscription information.

The DCS includes information that can be used to verify terminal equipment. For example, if the terminal device includes only the manufacturer's credential, the DCS includes information (ie, the root certificate) that can verify the manufacturer's credential. The DCS can pass the authentication information to the authentication service function (AUSF) entity, or it can perform the authentication itself.

PS: an entity used to provide the SNPN identity, which can obtain the user subscription data of the SNPN from the SNPN, and send the SNPN identifier to the terminal device.

It should be noted that the above functional entity is only a name, and the name itself does not limit the entity. For example, the mobility management function entity may also be replaced by "mobility management function" or other names. Moreover, the mobility management function entity may also correspond to an entity including other functions besides the mobility management function. The unified data management function entity may also be replaced by "unified data management function" or other names, and the unified data management function entity may also correspond to an entity that includes other functions in addition to the unified data management function. A unified description is provided here, and details are not repeated below.

The terminal device accesses the network through a radio access network (RAN) device or an access network (AN) device. The RAN device is mainly the wireless network device in the 3GPP network, and the AN may be the access network device defined by non-3GPP.

Optionally, the terminal device in this embodiment of the present application may refer to an access terminal, a subscriber unit, a subscriber station, a mobile station, a mobile station, a relay station, a remote station, a remote terminal, a mobile device, a user terminal (user terminal), and user equipment. (user equipment, UE), terminal (terminal), wireless communication equipment, user agent, user equipment, cellular phone, cordless phone, session initiation protocol (session initiation protocol, SIP) phone, wireless local loop (wireless local loop, WLL) ) stations, personal digital assistants (PDAs), handheld devices with wireless communication capabilities, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, end devices in future 5G networks or future A terminal device in an evolved public land mobile network (Public Land Mobile Network, PLMN) or a terminal device in the future Internet of Vehicles, etc., are not limited in this embodiment of the present application.

As an example but not a limitation, in this embodiment of the present application, the terminal device may be a mobile phone, a tablet computer, a computer with wireless transceiver function, a virtual reality terminal device, an augmented reality terminal device, a wireless terminal in industrial control, a wireless terminal in an unmanned driving wireless terminal in remote surgery, wireless terminal in smart grid, wireless terminal in transportation safety, wireless terminal in smart city, wireless terminal in smart home, etc.

As an example and not a limitation, in the embodiments of this application, a wearable device may also be referred to as a wearable smart device, which is a general term for intelligently designing daily wearable devices and developing wearable devices using wearable technology, such as glasses, Gloves, watches, clothing and shoes, etc. A wearable device is a portable device that is worn directly on the body or integrated into the user's clothing or accessories. Wearable device is not only a hardware device, but also realizes powerful functions through software support, data interaction, and cloud interaction. In a broad sense, wearable smart devices include full-featured, large-scale, complete or partial functions without relying on smart phones, such as smart watches or smart glasses, and only focus on a certain type of application function, which needs to cooperate with other devices such as smart phones. Use, such as all kinds of smart bracelets, smart jewelry, etc. for physical sign monitoring.

In addition, in the embodiments of the present application, the terminal device may also be a terminal device in an Internet of Things (IoT) system. IoT is an important part of the future development of information technology, and its main technical feature is that items pass through communication technology Connect with the network, so as to realize the intelligent network of human-machine interconnection and interconnection of things. In the embodiments of the present application, the IoT technology can achieve massive connections, deep coverage, and power saving of terminals through, for example, a narrow band (narrow band, NB) technology.

In addition, in the embodiment of the present application, the terminal device may also include sensors such as smart printers, train detectors, and gas stations, and the main functions include collecting data (part of terminal devices), receiving control information and downlink data of access network devices, and Send electromagnetic waves to transmit uplink data to access network equipment.

Optionally, the access network device in this embodiment of the present application may be any communication device with a wireless transceiver function that is used to communicate with a terminal device. The access network equipment includes but is not limited to: evolved node B (evolved node B, eNB), baseband unit (baseband unit, BBU), access point (access point, wireless fidelity, WIFI) system AP), wireless relay node, wireless backhaul node, transmission point (TP) or TRP, etc. The access network device may also be a gNB or TRP or TP in the 5G system, or one or a group (including multiple antenna panels) antenna panels of a base station in the 5G system. In addition, the access network device may also be a network node that constitutes a gNB or a TP, such as a BBU, or a distributed unit (distributed unit, DU).

In some deployments, a gNB may include a centralized unit (CU) and a DU. In addition, the gNB may also include an active antenna unit (active antenna unit, AAU). The CU implements some functions of the gNB, and the DU implements some functions of the gNB. For example, the CU is responsible for processing non-real-time protocols and services, and implementing functions of radio resource control (RRC) and packet data convergence protocol (PDCP) layers. The DU is responsible for processing physical layer protocols and real-time services, and implementing the functions of the radio link control (RLC) layer, the media access control (MAC) layer, and the physical (PHY) layer. AAU implements some physical layer processing functions, radio frequency processing and related functions of active antennas. Since the information of the RRC layer will eventually become the information of the PHY layer, or be transformed from the information of the PHY layer, therefore, in this architecture, the higher-layer signaling, such as the RRC layer signaling, can also be considered to be sent by the DU. , or, sent by DU and AAU. It can be understood that the access network device may be a device including one or more of a CU node, a DU node, and an AAU node.

Optionally, the access network device and the terminal device in the embodiment of the present application may communicate through licensed spectrum, may also communicate through unlicensed spectrum, or may communicate through licensed spectrum and unlicensed spectrum at the same time. The access network equipment and the terminal equipment can communicate through the frequency spectrum below 6 GHz (gigahertz, GHz), and can also communicate through the frequency spectrum above 6 GHz, and can also use the frequency spectrum below 6 GHz and the frequency spectrum above 6 GHz for communication at the same time. . The embodiments of the present application do not limit the spectrum resources used between the access network device and the terminal device 101 .

Optionally, the terminal equipment and network equipment in the embodiments of the present application can be deployed on land, including indoor or outdoor, handheld or vehicle mounted; can also be deployed on water; and can also be deployed on aircraft, balloons, and artificial satellites in the air. . The embodiments of the present application do not limit the application scenarios of the terminal device and the network device.

Optionally, in this embodiment of the present application, the terminal device or the network device includes a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer. This hardware layer includes hardware such as central processing unit (CPU), memory management unit (MMU), and memory (also called main memory). The operating system may be any one or more computer operating systems that implement business processing through processes, such as a Linux operating system, a Unix operating system, an Android operating system, an iOS operating system, or a Windows operating system. The application layer includes applications such as browsers, address books, word processing software, and instant messaging software. In addition, the embodiments of the present application do not specifically limit the specific structure of the execution body of the methods provided by the embodiments of the present application, as long as the program that records the codes of the methods provided by the embodiments of the present application can be executed to provide the methods provided by the embodiments of the present application. For example, the execution subject of the method provided by the embodiment of the present application may be a terminal device or a network device, or a functional module in the terminal device or network device that can call and execute a program.

In other words, the related functions of the terminal device, the first network element, and the second network element in the embodiments of the present application may be implemented by one device, or jointly implemented by multiple devices, or may be implemented by one or more devices in one device. The functional module is implemented, which is not specifically limited in this embodiment of the present application. It is to be understood that the above-mentioned functions can be either network elements in hardware devices, or software functions running on dedicated hardware, or a combination of hardware and software, or instantiated on a platform (eg, a cloud platform). Virtualization capabilities.

The method for acquiring user subscription data provided by the embodiments of the present application will be described below with reference to FIG. 1 to FIG. 5 .

It should be noted that the name of the message between each network element or the name of each parameter in the message in the following embodiments of the present application is just an example, and other names may also be used in the specific implementation, which is not done in this embodiment of the present application. Specific restrictions.

As shown in FIG. 3 , it is a schematic flowchart of a method for acquiring user subscription data according to an embodiment of the present application. The method may include the following steps:

S100. The UE generates a first public key (public key, pk) 1 and a first private key (secret key, sk) 1.

The UE generates a public-private key pair pk1 and sk1, and can use sk1 to decrypt the data encrypted by pk1.

Specifically, the UE can generate the public and private key pairs pk1 and sk1 in the following ways:

In one implementation, the UE may generate a public-private key pair pk1 and sk1 for calculating a subscriber concealed identifier (SUCI). The UE uses sk1 to encrypt the user temporary identifier (subscription permanent identifier, SUPI) to obtain SUCI.

In another implementation, the UE may also generate the public-private key pairs pk1 and sk1 automatically and independently, instead of generating the public-private key pairs pk1 and sk1 when calculating the SUCI.

S101. The UE sends a registration request to a first network element in the first network, where the registration request includes pk1. Correspondingly, the first network element receives the registration request.

In this embodiment, the first network is the online network, the second network is the network where the DCS/UDM is located, and the third network is the network where the PS is located. The registration request is used to request registration to the online network. What the UE performs through the first network is an online service, that is, through the first network request, the user subscription data of the UE is delivered to the UE, so that the UE can go online on the private network.

Specifically, the UE sends a registration request to the first network element in the first network. The first network element may be, for example, an AMF. The registration request includes pk1.

S102. The first network element sends an authentication request for the UE to a second network element in the second network, where the authentication request includes pk1. Correspondingly, the second network element receives the authentication request for the UE from the first network.

After receiving the registration request, the first network element learns that the registration request is a request to register on the online network to access the private network, and the second network performs authentication for the UE accessing the private network. Therefore, the first network element sends an authentication request for the UE to the second network element in the second network. The authentication request is used to request to perform authentication and authentication on the UE. The authentication request includes pk1 so that the pk1 is passed to the second network element.

S103. The second network element stores pk1.

The second network element receives the registration request sent by the first network element, and thus recognizes that the registration request is an online service, so that the second network element stores the pk1 carried in the authentication request.

S104. The second network element sends the identifier of the private network to the first network element. Correspondingly, the first network element receives the identifier of the private network.

The second network element performs authentication on the UE, and after the authentication is passed, the identifier of the private network is sent to the first network element. The identifier of the private network is used to uniquely identify the private network.

The online network can serve multiple private networks, and can also be connected to PSs corresponding to multiple private networks. Therefore, by acquiring the identifier of the private network, the first network element can make the first network element select an appropriate PS to obtain user subscriptions data.

S105. The second network element sends pk1 to the PS in the third network. Accordingly, the PS receives the pk1.

After receiving the pk1, the second network element finally delivers the pk1 to the PS in the third network.

It can be understood that there is no order of execution between steps S104 and S105, that is, S104 may be executed first, and then S105 may be executed; S105 may be executed first, and then S104 may be executed; or S104 and S105 may be executed simultaneously.

Alternatively, the first network element may also send pk1 to the PS in the third network in the following step S106, or after step S106, the PS actively requests the AMF for a key, that is, pk1.

S106: The first network element sends a request for obtaining user subscription data of the UE to the PS in the third network according to the identifier of the private network. Accordingly, the PS receives the user subscription data acquisition request.

After acquiring the identity of the private network, the first network element may request the PS in the third network for user subscription data of the UE according to the identity of the private network. The first network element requests to acquire user subscription data of the UE, so that the UE can access the private network.

S107: The PS returns a user subscription data acquisition response to the first network element, where the user subscription data acquisition response includes the first user subscription data of the UE in the private network. Correspondingly, the first network element receives the user subscription data acquisition response, and parses and acquires the first user subscription data carried in the response.

Only after the second network element performs authentication on the UE, the PS can receive the user subscription data acquisition request. The PS acquires the second user subscription data of the UE. And the PS obtains the public key pk1 of the UE, and can use pk1 to encrypt the second user contract data to obtain the first user contract data, so as to protect the second user contract data, prevent the user contract data from being stolen, and improve the security of communication. .

S108: The first network element sends the first user subscription data to the UE. Correspondingly, the UE receives the first user subscription data.

The first network element sends the first user subscription data to the UE, where the first user subscription data is encrypted data, so that the first user subscription data can be protected.

S109, the UE decrypts the first user subscription data using sk1 to obtain the second user subscription data.

After receiving the first user subscription data, the UE decrypts the first user subscription data using sk1 corresponding to pk1, and obtains the second user subscription data. Therefore, the UE can access the above-mentioned private network based on the second user subscription data, and complete the process of the UE going online.

According to a method for acquiring user subscription data provided by an embodiment of the present application, the second network element in the second network authenticates the UE and sends the identifier of the private network that the UE can access to the user in the first network. The first network element, so that the first network element can obtain the first user subscription data from the third network according to the identity of the private network, and the first user subscription data is encrypted subscription data, so that the acquisition of the user subscription data can be protected and avoid The user subscription data is stolen, which improves communication security; and by acquiring the private network identifier from the second network element, the first network element can acquire correct user subscription data from a suitable PS.

As shown in FIG. 4 , it is a schematic flowchart of another method for acquiring user subscription data provided by an embodiment of the present application. The method may include the following steps:

S200a, the UE presets the PS public key pk2.

When the UE leaves the factory, the public key pk2 for encrypted communication with the PS can be preset. Alternatively, the UE may also preset a PS certificate, where the PS certificate includes the PS public key pk2.

S200b, the PS preset public key pk2 and private key sk2 of the third network.

PS can also preset public and private key pairs pk2, sk2.

S201, the UE generates a public-private key pair pk1 and sk1.

In one implementation, the UE may generate a public-private key pair pk1 and sk1 for calculating SUCI. The UE uses sk1 to encrypt SUPI to obtain SUCI.

S202. The UE sends a registration request to the AMF in the onboarding network. Accordingly, the AMF receives the registration request.

The registration request is used to request registration to the online network. The registration request includes SUCI, and may further include at least one of the following: an onboarding indication, a registration type, and a slice identifier.

Wherein, the online indication is used to indicate that the type of the registration request is an online service.

The SUCI includes the above pk1.

The registration type is online business.

The slice identifier is used to indicate the identifier of the network slice where the private network that the UE requests to register is located.

S203. The AMF determines the first authentication server (AUSF1/AUSF1*) in the first network according to the registration request.

In the existing registration process, the AMF receives the registration request of the UE, and generally sends the registration request to the AUSF of the network where the AMF is located for subsequent processing. However, in this embodiment, the AMF determines that the online service is to be performed according to the received registration request, and then determines the first authentication server of the network, and the first authentication server submits the authentication request to the authentication management of the online service. The second network is used to authenticate the UE.

Specifically, the AMF determines the first authentication server in the first network according to the registration request, which can be implemented in the following ways:

In one implementation, the SUCI includes an identifier of the second network, and the first authentication server is determined according to the identifier of the second network. The identifier of the second network may be a DCS ID, or an ID of a network where the DCS is located, or an ID of a DCS administrator (for example, a vendor ID). That is, according to the identifier of the second network, the AMF determines that the second network needs to authenticate the UE, and then determines the first authentication server (AUSF1) of the network, or selects an AUSF (AUSF1*) dedicated to the online service.

In another implementation, the SUCI includes a routing indicator (RI), and the first authentication server is determined according to the routing indicator. The routing indication is used to indicate routing to the SNPN. Then, according to the routing instruction, the AMF determines that it is an online service, and determines that the second network needs to authenticate the UE, then determines the first authentication server (AUSF1) of the network, or selects an AUSF (AUSF1*) dedicated to the online service. ).

In yet another implementation, the first authentication server is determined according to an online indication, where the online indication is used to indicate that the type of the registration request is an online service. According to the online instruction, the AMF determines that it is an online service, and determines that the second network needs to authenticate the UE, then determines the first authentication server (AUSF1) of the network, or selects an AUSF dedicated to the online service (AUSF1*) .

In yet another implementation, the first authentication server is determined according to a registration type, where the registration type is an online service. The existing UE registration types include: initial registration, mobility registration, and periodic registration. This embodiment proposes a new registration type: online service. Then, according to the registration type, the AMF determines that the online service is to be performed, and determines that the second network needs to authenticate the UE, then determines the first authentication server (AUSF1) of the network, or selects an AUSF (AUSF1*) dedicated to the online service. ).

In yet another implementation, the first authentication server is determined according to the slice identifier. According to the slice identifier carried in the registration request, the AMF is used to indicate the identifier of the network slice where the private network that the UE requests to register is located, so that the AMF determines that the UE is performing an online service, and determines that the second network is required to authenticate the UE, Then determine the first authentication server (AUSF1) of the network, or select an AUSF (AUSF1*) dedicated to the online service.

S204: After determining the first authentication server, the AMF sends an authentication request for the UE to the first authentication server. The authentication request is used to request to perform authentication and authentication on the UE. The authentication request includes SUCI, and may also include an on-line indication. Correspondingly, the first authentication server receives the authentication request. The SUCI includes the above pk1.

S205. The first authentication server determines, according to the authentication request, to forward the authentication request to the second network.

The first authentication server determines, according to the authentication request, that the online service is to be performed, and then determines to forward the authentication request to the second network.

S206. The first authentication server forwards the authentication request to the AUSF2 of the second network. The authentication request is used to request to perform authentication and authentication on the UE. The authentication request includes SUCI, and may also include an on-line indication. Correspondingly, after receiving the authentication request, AUSF2 forwards the authentication request to the UDM/DCS of the second network. The UDM/DCS of the second network receives the authentication request.

S207, the UDM/DCS of the second network decrypts the SUPI from the SUCI, and extracts the pk1 in the SUCI and saves it.

The UDM/DCS of the second network obtains the SUCI carried in the authentication request, and can decrypt the SUPI.

And the UDM/DCS of the second network receives the authentication request, because the authentication request also includes an on-line instruction, and the on-line instruction is used to indicate that the type of the authentication request is an on-line service, then the UDM/DCS saves the on-line instruction according to the pk1.

So far, the above authentication and authentication are completed, and the AMF obtains the SUPI of the UE. The subsequent signal transmission between the first network and the second network may be performed on the UE based on the SUPI.

S208. The UDM/DCS of the second network sends pk1 to the PS of the third network. Accordingly, the PS receives the pk1.

After the UE is authenticated by the UDM/DCS of the second network, it can send pk1 to the PS in the third network, so that the subsequent PS can use the pk1 to encrypt data. When the UDM/DCS pushes the key, it can also carry the generic public subscription identifier (GPSI) and pk1. Further, it can also carry a serving network name (serving network name). This GPSI corresponds to SUPI.

The above is that the UDM/DCS of the second network actively pushes pk1 to the PS in the third network. Optionally, the pk1 may also be carried when the AMF in the first network requests the PS in the third network to acquire user subscription data in the following step S212. Optionally, after step S212, when the PS in the third network receives the user subscription data acquisition request, it requests the UDM/DCS of the second network to acquire the key, and then the UDM/DCS of the second network sends the request to the UDM/DCS of the second network. The PS in the third network sends this pk1.

S209. The AMF in the first network sends a first acquisition request to the UDM/DCS of the second network, where the first acquisition request includes SUPI and may also include an online indication. Correspondingly, the UDM/DCS of the second network receives the first acquisition request.

The online network can serve multiple private networks, and can also be connected to PSs corresponding to multiple private networks. Therefore, the AMF in the first network sends a first acquisition request to the UDM/DCS of the second network to acquire the private network. The identifier can make the first network element select an appropriate PS to obtain user subscription data. After the UDM/DCS of the second network authenticates the UE, the identifier of the private network that the UE can access may be sent to the AMF.

S210. The UDM/DCS of the second network acquires the identifier of the private network according to the online instruction or the local configuration.

The UDM/DCS searches for the identity of the private network that the UE can access according to the SUPI, and obtains the identity of the private network (ie, the SNPN ID) according to the online instruction or local configuration. The SNPN network is identified by a PLMN ID and a network identifier (NID), and the SNPN ID includes a public land mobile network (Public land mobile network, PLMN) ID and NID. Among them, the PLMN ID can be an inherent value reserved by a third-party operator, or can be a specific value of the PLMN operator that deploys this SNPN.

Specifically, the UDM/DCS searches for the identifiers of multiple private networks that the UE can access according to the SUPI, determines the private network that the UE requests to perform the online service according to the online instruction, and obtains the identifiers of the private network. The identifier of the private network is one or more of the identifiers of the above-mentioned multiple private networks.

Alternatively, the UDM/DCS searches the identities of multiple private networks that the UE can access according to the SUPI, and determines the identities of the private networks that the UE is allowed to access according to the local configuration, so as to obtain the identities of the private networks that the UE is allowed to access.

S211. The UDM/DCS of the second network sends a first acquisition response to the AMF, where the first acquisition response includes the SUPI, the identifier of the private network, and may also include pk1. Accordingly, the AMF receives the first acquisition response.

S212: The AMF in the first network sends a request for obtaining user subscription data of the UE to the PS in the third network according to the identifier of the private network. Correspondingly, the PS in the third network receives the user subscription data acquisition request.

After acquiring the identity of the private network, the AMF can request the user subscription data of the UE from the PS in the third network according to the identity of the private network.

Wherein, the user subscription data acquisition request includes GPSI. Further, it may also include pk1, online indication, service network name.

S213. The PS in the third network encrypts the second user subscription data with pk1 to obtain the first user subscription data, and uses sk2 to sign the first user subscription data.

After receiving the user subscription data acquisition request, the PS searches for the UE's second user subscription data according to the GPSI. and encrypting the second user subscription data according to the acquired pk1 corresponding to the UE to obtain the first user subscription data, which can protect the second user subscription data from being stolen. Further, the sk2 preset by the PS in step S200b can also be used to sign the first user subscription data, which can protect the first user subscription data from being tampered with.

S214. The PS in the third network sends a user subscription data acquisition response to the AMF in the first network. The user subscription data acquisition response includes the signed first user subscription data. Correspondingly, the AMF in the first network receives the user subscription data acquisition response.

In this embodiment, the PS delivers the signed first user subscription data through the control plane. Specifically, the PS sends a user subscription data acquisition response to the UE through the AMF in the first network. The user subscription data acquisition response includes the signed first user subscription data.

S215. The AMF in the first network issues the signed first user subscription data through a terminal configuration update (UE configruated updated, UCU) process. Correspondingly, the UE receives the signed first user subscription data.

S216 , the UE uses pk2 to verify the signature, and after the signature verification is passed, it then uses sk1 to decrypt the first user subscription data to obtain the second user subscription data.

After receiving the user subscription data acquisition response, the UE extracts the signed first user subscription data carried therein, and uses the pk2 preset by the UE in step S200a to verify the signature, and after the signature verification is passed, then uses sk1 to decrypt the first user subscription The data obtains the second user subscription data.

S217. The UE sends a UCU response to the AMF in the first network. Accordingly, the AMF receives the UCU response.

The UCU response is used to indicate that the UE has successfully received the user subscription data acquisition response.

According to a method for acquiring user subscription data provided by an embodiment of the present application, the second network element in the second network authenticates the UE and sends the identifier of the private network that the UE can access to the user in the first network. The first network element, so that the first network element can obtain the first user subscription data from the third network according to the identity of the private network, and deliver the first user subscription data to the UE through the control plane, and the first user subscription data is encrypted Therefore, the acquisition of the user's subscription data can be protected, the stealing and tampering of the user's subscription data can be avoided, and the security of communication can be improved; and by obtaining the private network identifier from the second network element, the first network element can obtain the private network identity from the appropriate network element. The PS obtains the correct user subscription data.

As shown in FIG. 5 , it is a schematic flowchart of another method for acquiring user subscription data provided by an embodiment of the present application. The method may include the following steps:

S300a, the UE presets the PS public key pk2.

For the specific implementation of this step, reference may be made to step S200a of the embodiment shown in FIG. 4 .

S300b, the PS preset public key pk2 and private key sk2 of the third network.

For the specific implementation of this step, reference may be made to step S200b of the embodiment shown in FIG. 4 .

S301, the UE generates a public-private key pair pk1 and sk1.

For the specific implementation of this step, reference may be made to step S201 of the embodiment shown in FIG. 4 .

S302. The UE sends a registration request to the AMF in the onboarding network, where the registration request includes the SUCI and may also include an onboarding indication. Accordingly, the AMF receives the registration request.

For the specific implementation of this step, reference may be made to step S202 in the embodiment shown in FIG. 4 .

S303. The AMF determines the first authentication server (AUSF1/AUSF1*) in the first network according to the registration request.

For the specific implementation of this step, reference may be made to step S203 in the embodiment shown in FIG. 4 .

S304: The AMF sends an authentication request for the UE to the first authentication server. The authentication request includes SUCI, and may also include an on-line indication. Correspondingly, the first authentication server receives the authentication request.

For the specific implementation of this step, reference may be made to step S204 in the embodiment shown in FIG. 4 .

S305. The first authentication server determines, according to the authentication request, to forward the authentication request to the second network.

For the specific implementation of this step, reference may be made to step S205 in the embodiment shown in FIG. 4 .

S306. The first authentication server forwards the authentication request to the AUSF2 of the second network. The authentication request includes SUCI, and may also include an on-line indication. Correspondingly, after receiving the authentication request, AUSF2 forwards the authentication request to the UDM/DCS of the second network. The UDM/DCS of the second network receives the authentication request.

For the specific implementation of this step, reference may be made to step S206 in the embodiment shown in FIG. 4 .

S307, the UDM/DCS of the second network decrypts the SUPI from the SUCI, and extracts the pk1 in the SUCI and saves it.

For the specific implementation of this step, reference may be made to step S207 in the embodiment shown in FIG. 4 .

So far, the above authentication and authentication are completed, and the AMF obtains the SUPI of the UE.

S308: The AMF sends a second acquisition request to the UDM/DCS of the second network, where the second acquisition request includes SUPI and may also include an online indication. Correspondingly, the UDM/DCS of the second network receives the second acquisition request. The second acquisition request is used to acquire the identifier of the private network that the UE can access.

For the specific implementation of this step, reference may be made to step S209 in the embodiment shown in FIG. 4 .

S309 , the UDM/DCS of the second network obtains the identifier of the private network according to the online instruction or according to the local configuration.

For the specific implementation of this step, reference may be made to step S210 in the embodiment shown in FIG. 4 .

Among them, steps S308 and S309 are optional steps, which are represented by dotted lines in the figure. In this embodiment, the user subscription data is delivered through the user plane. Therefore, the SMF also obtains the identity of the private network from the UDM/DCS of the second network, which is specifically described in steps S314 and S315.

S310. The UDM/DCS of the second network sends a second acquisition response to the AMF, where the second acquisition response includes SUPI, the identity of the private network, and may also include pk1. Accordingly, the AMF receives the second acquisition response.

For the specific implementation of this step, reference may be made to step S211 of the embodiment shown in FIG. 4 .

S311. The AMF of the first network sends a registration response to the UE. Accordingly, the UE receives the registration response.

The registration response is used to indicate registration success or failure.

After the UE completes the registration with the third network, it may establish a protocol data unit (protocol data unit, PDU) session with the third network.

S312: The UE sends a PDU session establishment request to the AMF of the first network. Accordingly, the AMF of the first network receives the PDU session establishment request.

S313. The AMF of the first network sends a PDU session establishment request to the SMF of the second network. The PDU session establishment request includes SUPI/GPSI, and may also include the identity of the private network, pk1. Accordingly, the SMF of the second network receives the PDU session establishment request, and establishes the PDU session.

S314. The SMF of the second network sends a third acquisition request to the UDM/DCS of the second network, where the third acquisition request includes SUPI and may also include an online indication. Correspondingly, the UDM/DCS of the second network receives the third acquisition request. The third acquisition request is used to request to acquire the identifier of the private network accessible to the UE.

The UDM/DCS of the second network searches for the identifier and pk1 of the private network accessible to the UE according to the SUPI, and sends the identifier and pk1 of the private network to the SMF with the identifier and pk1 of the private network in the third acquisition request.

S315 . The UDM/DCS of the second network sends a third acquisition response to the SMF of the second network, where the third acquisition response includes SUPI, the identity of the private network, and may also include pk1.

So far, the establishment of the PDU session is completed.

S316. The SMF of the second network sends pk1 to the PS of the third network. Accordingly, the PS of the third network receives the pk1.

Different from the embodiment shown in FIG. 4 , pk1 can be pushed to the PS of the third network through the SMF of the second network when the session is established.

Specifically, if the SMF of the second network obtains pk1 in the above-mentioned first user subscription data acquisition response, the SMF of the second network may push pk1 to the PS of the third network. The key push carries GPSI, pk1, and may also include the service network name.

Alternatively, after the following session establishment is completed, the SMF of the second network may send a key acquisition response to the PS of the third network after receiving the key acquisition request of the PS of the third network. Wherein, the key acquisition request includes GPSI, and may also include service network name, online indication, and the like. The key acquisition response includes GPSI, pk1.

S317: The PS encrypts the second user subscription data with pk1 to obtain the first user subscription data, and uses sk2 to sign the first user subscription data.

For the specific implementation of this step, reference may be made to step S213 in the embodiment shown in FIG. 4 .

S318. The PS receives the pk1 sent by the SMF, and triggers the PS to send a user subscription data acquisition response to the UE. The user subscription data acquisition response includes the signed first user subscription data. Correspondingly, the UE receives the user subscription data acquisition response.

In this embodiment, the PS sends the user subscription data acquisition response to the UE through the established session channel, that is, through the user.

S319 , the UE uses pk2 to verify the signature, and after the signature verification is passed, uses sk1 to decrypt the first user subscription data to obtain the second user subscription data.

For the specific implementation of this step, reference may be made to step S216 in the embodiment shown in FIG. 4 .

According to a method for acquiring user subscription data provided by an embodiment of the present application, the second network element in the second network authenticates the UE and sends the identifier of the private network that the UE can access to the user in the first network. The first network element, so that the first network element can obtain the first user subscription data from the third network according to the identity of the private network, and deliver the first user subscription data to the UE through the user plane, and the first user subscription data is encrypted Therefore, the acquisition of the user's subscription data can be protected, the stealing and tampering of the user's subscription data can be avoided, and the security of communication can be improved; and by obtaining the private network identifier from the second network element, the first network element can obtain the private network identity from the appropriate network element. The PS obtains the correct user subscription data.

It can be understood that, in the above embodiments, the methods and/or steps implemented by the terminal device may also be implemented by components (such as chips or circuits) that can be used in the terminal device; the methods and/or steps implemented by the first network element The steps can also be implemented by components (such as chips or circuits) that can be used in the first network element; the methods and/or steps implemented by the second network element can also be implemented by components (such as chips or circuits) that can be used in the second network element. )accomplish.

The foregoing mainly introduces the solutions provided by the embodiments of the present application from the perspective of interaction between various network elements. Correspondingly, an embodiment of the present application further provides an apparatus, and the apparatus is used to implement the above-mentioned various methods. The apparatus may be a terminal device, a first network element, and a second network element in the foregoing method embodiments. It can be understood that, in order to realize the above-mentioned functions, the apparatus includes corresponding hardware structures and/or software modules for executing each function. Those skilled in the art should easily realize that the present application can be implemented in hardware or a combination of hardware and computer software with the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.

In this embodiment of the present application, the device may be divided into functional modules according to the above method embodiments. For example, each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module. The above-mentioned integrated modules can be implemented in the form of hardware, and can also be implemented in the form of software function modules. It should be noted that, the division of modules in the embodiments of the present application is schematic, and is only a logical function division, and there may be other division manners in actual implementation.

The related functions of the communication apparatus in the embodiment of the present application may be implemented by the communication apparatus 200 in FIG. 6 . FIG. 6 is a schematic structural diagram of a communication apparatus 200 according to an embodiment of the present application. The communication device 200 includes one or more processors 21, a communication line 22, and at least one communication interface (in FIG. 6, it is only exemplary to include the communication interface 24 and one processor 21 for illustration), optional The memory 23 may also be included.

The processor 21 may be a CPU, a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the programs of the present application.

The communication line 22 may include a path for connecting between the various components.

The communication interface 24 can be a transceiver module for communicating with other devices or communication networks, such as Ethernet, RAN, wireless local area networks (wireless local area networks, WLAN) and the like. For example, the transceiver module may be a device such as a transceiver or a transceiver. Optionally, the communication interface 24 may also be a transceiver circuit located in the processor 21 to implement signal input and signal output of the processor.

The memory 23 may be a device having a storage function. For example, it may be read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM) or other types of storage devices that can store information and instructions The dynamic storage device can also be electrically erasable programmable read-only memory (electrically erasable programmable read-only memory, EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, optical disk storage ( including compact discs, laser discs, compact discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of being stored by a computer any other medium taken, but not limited to this. The memory may exist independently and be connected to the processor through the communication line 22 . The memory can also be integrated with the processor.

The memory 23 is used for storing computer-executed instructions for executing the solution of the present application, and the execution is controlled by the processor 21 . The processor 21 is configured to execute the computer-executable instructions stored in the memory 23, thereby implementing the method for acquiring user subscription data provided in the embodiments of the present application.

Alternatively, in this embodiment of the present application, the processor 21 may also execute the processing-related functions in the method for obtaining user subscription data provided by the following embodiments of the present application, and the communication interface 24 is responsible for communicating with other devices or communication networks. The embodiment does not specifically limit this.

The computer-executed instructions in the embodiments of the present application may also be referred to as application program codes, which are not specifically limited in the embodiments of the present application.

In a specific implementation, as an embodiment, the processor 21 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 6 .

In a specific implementation, as an embodiment, the communication apparatus 200 may include multiple processors, such as the processor 21 and the processor 27 in FIG. 6 . Each of these processors can be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. A processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).

In a specific implementation, as an embodiment, the communication apparatus 200 may further include an output device 25 and an input device 26 . The output device 25 is in communication with the processor 21 and can display information in a variety of ways.

The above-mentioned communication device 200 may be a general-purpose device or a dedicated device. For example, the communication device 200 may be a desktop computer, a portable computer, a web server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless user equipment, an embedded device, or a device with a similar structure in FIG. 6 . This embodiment of the present application does not limit the type of the communication apparatus 200 .

FIG. 7 is another schematic structural diagram of an apparatus for acquiring user subscription data provided by an embodiment of the present application. The apparatus for acquiring user subscription data may be the terminal device in the above-mentioned embodiment. The device 300 for acquiring user subscription data includes: a processing unit 31, a sending unit 32 and a receiving unit 33; wherein:

a processing unit 31 for generating a first public key pk1 and a first private key sk1;

a sending unit 32, configured to send a registration request to the first network, where the registration request includes the pk1;

a receiving unit 33, configured to receive the first user contract data, the first user contract data is obtained by encrypting the second user contract data by using the pk1;

The processing unit 31 is further configured to decrypt the first user subscription data by using the sk1 to obtain the second user subscription data.

For the specific implementation of the above-mentioned processing unit 31 , sending unit 32 and receiving unit 33 , reference may be made to the relevant description of the UE in the embodiments shown in FIG. 3 to FIG. 5 .

According to an apparatus for obtaining user contract data provided by an embodiment of the present application, the device receives the encrypted first user contract data returned by a third network, and decrypts the first user contract data by using the first private key generated by itself to obtain the first user contract data. The second user subscription data can protect the acquisition of the user subscription data, prevent the user subscription data from being stolen, and improve the security of communication; and by acquiring the private network identifier from the second network element, the first network element can obtain the private network from the appropriate PS. Get the correct user subscription data.

FIG. 8 is another schematic structural diagram of a communication apparatus provided by an embodiment of the present application, where the communication apparatus may be a second network element in the second network in the foregoing embodiment. The communication device 400 includes: a receiving unit 41, a processing unit 42 and a sending unit 43; wherein:

a receiving unit 41, configured to receive an authentication request for the terminal device from the first network, where the authentication request includes the first public key pk1;

a processing unit 42, configured to save the pk1;

a sending unit 43, configured to send the identifier of the private network to the first network;

The sending unit 43 is further configured to send the pk1 to the third network.

In a possible implementation, the authentication request further includes an online indication, and the online indication is used to indicate that the type of the authentication request is an online service; the processing unit 42 is configured to, according to the online instruction, Save the pk1.

For the relevant description of the above receiving unit 41, the processing unit 42 and the sending unit 43, reference may be made to the relevant description of the second network element in the embodiments shown in FIG. 3 to FIG. 5 .

According to a communication device provided by an embodiment of the present application, the device authenticates a terminal device and sends an identifier of a private network accessible to the terminal device to a first network element in a first network, so that the first network The element can obtain the first user contract data from the third network according to the identity of the private network, and the first user contract data is encrypted data, so that the acquisition of the user contract data can be protected, the user contract data can be prevented from being stolen, and the communication efficiency can be improved. security; and by acquiring the identity of the private network from the second network element, the first network element can acquire correct user subscription data from an appropriate PS.

FIG. 9 is another schematic structural diagram of a communication apparatus provided by an embodiment of the present application, where the communication apparatus may be a first network element in the first network in the foregoing embodiment. The communication device 500 includes: a receiving unit 51, a processing unit 52 and a sending unit 53; wherein:

a receiving unit 51, configured to receive the identifier of the private network from the second network;

a processing unit 52, configured to determine the user subscription data acquisition request of the terminal device according to the identifier of the private network;

a sending unit 53, configured to send the user subscription data acquisition request to a third network;

The receiving unit 51 is further configured to receive a user subscription data acquisition response returned by the third network, where the user subscription data acquisition response includes the first user subscription data of the terminal device in the private network;

The sending unit 53 is further configured to send the first user subscription data to the terminal device.

In a possible implementation, the receiving unit 51 is further configured to receive a registration request from the terminal device, where the registration request carries at least one of the following: user hidden identifier, online indication, registration type, slice identifier ;

The processing unit 52 is further configured to determine a first authentication server in the first network according to the registration request;

The sending unit 53 is further configured to send the authentication request of the terminal device to the second network through the first authentication server;

Wherein, the processing unit 52 is specifically configured to include the identifier of the second network in the user hidden identifier, and determine the first authentication server according to the identifier of the second network; or

The processing unit 52 is specifically configured to include a routing indication in the user hidden identifier, and determine the first authentication server according to the routing indication; or

The processing unit 52 is specifically configured to determine the first authentication server according to the online instruction, and the online instruction is used to indicate that the type of the registration request is an online service; or

The processing unit 52 is specifically configured to determine the first authentication server according to the registration type, where the registration type is an online service; or

The processing unit 52 is specifically configured to determine the first authentication server according to the slice identifier.

For the specific implementation of the above receiving unit 51 , processing unit 52 and sending unit 53 , reference may be made to the description of the first network element in the embodiments shown in FIG. 3 to FIG. 5 .

According to a communication device provided by an embodiment of the present application, the device can select an appropriate PS to obtain correct user subscription data according to the identifier of the private network received from the second network; further, the device can use the received first A public key encrypts the second user contract data to obtain the first user contract data, and sends the first user contract data, thereby protecting the acquisition of the user contract data, preventing the user contract data from being stolen, and improving communication security.

Optionally, an embodiment of the present application further provides a chip system, including: at least one processor and an interface, the at least one processor is coupled to the memory through the interface, and when the at least one processor executes the computer program or instruction in the memory , the method in any of the above method embodiments is executed. Optionally, the chip system may be composed of chips, or may include chips and other discrete devices, which are not specifically limited in this embodiment of the present application.

It should be understood that in the description of this application, unless otherwise specified, "/" indicates that the objects associated before and after are an "or" relationship, for example, A/B can indicate A or B; wherein A and B can be singular. or plural. Also, in the description of the present application, unless stated otherwise, "plurality" means two or more than two. "At least one item(s) below" or similar expressions thereof refer to any combination of these items, including any combination of single item(s) or plural items(s). For example, at least one item (a) of a, b, or c may represent: a, b, c, ab, ac, bc, or abc, where a, b, and c may be single or multiple . In addition, in order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish the same or similar items with basically the same function and effect. Those skilled in the art can understand that the words "first", "second" and the like do not limit the quantity and execution order, and the words "first", "second" and the like are not necessarily different. Meanwhile, in the embodiments of the present application, words such as "exemplary" or "for example" are used to represent examples, illustrations or illustrations. Any embodiments or designs described in the embodiments of the present application as "exemplary" or "such as" should not be construed as preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "such as" is intended to present the related concepts in a specific manner to facilitate understanding.

In the above-mentioned embodiments, it may be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer may be a general purpose computer, special purpose computer, computer network, or other programmable device. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server, or data center by wire (eg, coaxial cable, optical fiber, digital subscriber line, DSL) or wireless (eg, infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or data storage devices including one or more servers, data centers, etc. that can be integrated with the medium. The available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, digital versatile disc (DVD)), or semiconductor media (eg, solid state disk (SSD)) Wait.

Although the application is described herein in conjunction with the various embodiments, those skilled in the art will understand and understand from a review of the drawings, the disclosure, and the appended claims in practicing the claimed application. Other variations of the disclosed embodiments are implemented. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality. A single processor or other unit may fulfill the functions of several items recited in the claims. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that these measures cannot be combined to advantage.

Although the application has been described in conjunction with specific features and embodiments thereof, it will be apparent that various modifications and combinations can be made therein without departing from the spirit and scope of the application. Accordingly, this specification and drawings are merely exemplary illustrations of the application as defined by the appended claims, and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of this application. Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

A method for obtaining user subscription data, comprising:

generating a first public key and a first private key;

sending a registration request to the first network, the registration request including the first public key;

receiving first user contract data, the first user contract data is obtained by encrypting the second user contract data with the first public key;

Decrypt the first user subscription data by using the first private key to obtain the second user subscription data.
The method according to claim 1, wherein the registration request further comprises an online indication, and the online indication is used to indicate that the type of the registration request is an online service.
The method according to claim 1 or 2, wherein the registration request further includes a user hidden identifier, and the user hidden identifier includes the first public key.
A method for obtaining user subscription data, comprising:

receiving an authentication request for the terminal device from the first network, where the authentication request includes the first public key;

save the first public key;

sending the identity of the private network to the first network;

The first public key is sent to the third network.
The method according to claim 4, wherein the authentication request further includes a user hidden identifier, and the user hidden identifier includes the first public key.
The method according to claim 4 or 5, wherein the authentication request further comprises an online instruction, and the online instruction is used to indicate that the type of the authentication request is an online service;

The storing of the first public key includes:

According to the online instruction, the first public key is saved.
A method for obtaining user subscription data, comprising:

The first network element in the first network receives the identifier of the private network from the second network;

sending, by the first network element, a request for obtaining user subscription data of the terminal device to a third network according to the identifier of the private network;

receiving, by the first network element, a user subscription data acquisition response returned by the third network, where the user subscription data acquisition response includes the first user subscription data of the terminal device in the private network;

The first network element sends the first user subscription data to the terminal device.
The method according to claim 7, wherein before the first network element receives the identifier of the private network from the second network, the method further comprises:

The first network element receives a registration request from the terminal device, and the registration request carries at least one of the following: a user hidden identifier, an online indication, a registration type, and a slice identifier;

determining, by the first network element, a first authentication server in the first network according to the registration request;

sending, by the first network element, an authentication request of the terminal device to the second network through the first authentication server;

Wherein, determining the first authentication server according to the registration request includes:

The user hidden identifier includes an identifier of the second network, and the first authentication server is determined according to the identifier of the second network; or

The user hidden identifier includes a routing indication, and the first authentication server is determined according to the routing indication; or

The first authentication server is determined according to the online indication, which is used to indicate that the type of the registration request is an online service; or

The first authentication server is determined according to the registration type, and the registration type is an online service; or

The first authentication server is determined according to the slice identifier.
The method according to claim 8, wherein the registration request includes a first public key, and before the first network element receives the identifier of the private network from the second network, further comprising:

The first public key is sent to the second network, and the first user subscription data is obtained by encrypting the second user subscription data with the first public key.
The method according to claim 8 or 9, wherein the registration request includes a user hidden identifier, and the user hidden identifier includes the first public key.
A device for acquiring user subscription data, comprising:

a processing unit for generating a first public key and a first private key;

a sending unit, configured to send a registration request to the first network, where the registration request includes the first public key;

a receiving unit, configured to receive first user contract data, the first user contract data is obtained by encrypting the second user contract data with the first public key;

The processing unit is further configured to decrypt the first user contract data by using the first private key to obtain the second user contract data.
The apparatus according to claim 11, wherein the registration request further comprises an online indication, and the online indication is used to indicate that the type of the registration request is an online service.
The apparatus according to claim 11 or 12, wherein the registration request further includes a user hidden identifier, and the user hidden identifier includes the first public key.
A communication device, comprising:

a receiving unit, configured to receive an authentication request for the terminal device from the first network, where the authentication request includes the first public key;

a processing unit, configured to save the first public key;

a sending unit, configured to send the identifier of the private network to the first network;

The sending unit is further configured to send the first public key to a third network.
The apparatus according to claim 14, wherein the authentication request further includes a user hidden identifier, and the user hidden identifier includes the first public key.
The device according to claim 14 or 15, wherein the authentication request further comprises an online indication, and the online indication is used to indicate that the type of the authentication request is an online service;

The processing unit is configured to save the first public key according to the online instruction.
A communication device, comprising:

a receiving unit, configured to receive the identifier of the private network from the second network;

a processing unit, configured to determine a user subscription data acquisition request of the terminal device according to the identifier of the private network;

a sending unit, configured to send the user subscription data acquisition request to a third network;

The receiving unit is further configured to receive a user subscription data acquisition response returned by the third network, where the user subscription data acquisition response includes the first user subscription data of the terminal device in the private network;

The sending unit is further configured to send the first user subscription data to the terminal device.
The device of claim 17, wherein:

The receiving unit is further configured to receive a registration request from the terminal device, where the registration request carries at least one of the following: a user hidden identifier, an online indication, a registration type, and a slice identifier;

The processing unit is further configured to determine a first authentication server in the first network according to the registration request;

The sending unit is further configured to send the authentication request of the terminal device to the second network through the first authentication server;

The processing unit is specifically configured to include the identifier of the second network in the user hidden identifier, and determine the first authentication server according to the identifier of the second network; or

The processing unit is specifically configured to include a routing indication in the user hidden identifier, and determine the first authentication server according to the routing indication; or

The processing unit is specifically configured to determine the first authentication server according to the online instruction, and the online instruction is used to indicate that the type of the registration request is an online service; or

The processing unit is specifically configured to determine the first authentication server according to the registration type, where the registration type is an online service; or

The processing unit is specifically configured to determine the first authentication server according to the slice identifier.
The apparatus according to claim 18, wherein the registration request includes a first public key, and the sending unit is further configured to send the first public key to the second network, and the first user signs a contract The data is obtained by encrypting the second user subscription data using the first public key.
The apparatus according to claim 18 or 19, wherein the registration request includes a user hidden identifier, and the user hidden identifier includes the first public key.
A communication device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, when the processor executes the computer program, any one of claims 1 to 3 is implemented the method described.
A communication device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, when the processor executes the computer program, any one of claims 4 to 6 is implemented the method described.
A communication device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, when the processor executes the computer program, any one of claims 7 to 10 is implemented the method described.
A communication device, characterized by comprising a processor, which is configured to be coupled to a memory, read instructions in the memory, and implement the method according to any one of claims 1 to 3 according to the instructions.
A communication device, characterized by comprising a processor, which is configured to be coupled with a memory, and read instructions in the memory, and implement the method according to any one of claims 4 to 6 according to the instructions.
A communication device is characterized by comprising a processor, which is configured to be coupled with a memory, read instructions in the memory, and implement the method according to any one of claims 7 to 10 according to the instructions.
A computer-readable storage medium on which a computer program is stored, characterized in that, when the program is executed by a processor, the method according to any one of claims 1 to 3 or any one of claims 4 to 6 is implemented. One of the methods, or implementing the method according to any one of claims 7 to 10.
A computer program product for implementing, when executed on a computing device, the method of any one of claims 1 to 3, or the method of any one of claims 4 to 6, or the The method of any one of claims 7-10.