WO2022078058A1 - 解密方法、服务器及存储介质 - Google Patents

解密方法、服务器及存储介质 Download PDF

Info

Publication number
WO2022078058A1
WO2022078058A1 PCT/CN2021/113293 CN2021113293W WO2022078058A1 WO 2022078058 A1 WO2022078058 A1 WO 2022078058A1 CN 2021113293 W CN2021113293 W CN 2021113293W WO 2022078058 A1 WO2022078058 A1 WO 2022078058A1
Authority
WO
WIPO (PCT)
Prior art keywords
signaling
key
decryption
network interface
authentication
Prior art date
Application number
PCT/CN2021/113293
Other languages
English (en)
French (fr)
Inventor
钟芸
张海涛
邵敏峰
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2022078058A1 publication Critical patent/WO2022078058A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity

Definitions

  • the embodiments of the present application relate to the field of communications, and in particular, to a decryption method, a server, and a storage medium.
  • the 5th generation mobile network is the latest generation of cellular mobile communication technology.
  • GSM Global System for Mobile Communications
  • the non-access stratum signaling carries a lot of important information, and undertakes the two-way authentication function between the terminal and the 5G network, so the security of the non-access stratum signaling is particularly important.
  • the network element usually encrypts the non-access stratum signaling during the transmission process, which causes the signaling analysis system to obtain the encrypted non-access stratum signaling After the command, the encrypted non-access stratum signaling cannot be used for subsequent work such as data analysis.
  • Embodiments of the present application provide a decryption method, a server, and a storage medium.
  • An embodiment of the present application provides a decryption method, including: collecting signaling in a network interface; associating signaling used for authentication by the same user equipment in the same session to obtain associated signaling; Obtain user permanent identification and decryption parameters from the signaling of the device; derive a key according to the user permanent identification and the decryption parameter; wherein, the key includes a decryption key; according to the target parameter in the decryption parameter and the decryption key to decrypt the collected encrypted signaling in the same session.
  • An embodiment of the present application further provides a server, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein, the memory stores instructions executable by the at least one processor , the instructions are executed by the at least one processor, so that the at least one processor can execute the decryption method described above.
  • Embodiments of the present application further provide a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the above-mentioned decryption method is implemented.
  • FIG. 1 is a flowchart of a decryption method according to a first embodiment of the present application
  • FIG. 2 is a flowchart according to a specific implementation manner of step 102 in the first embodiment of the present application
  • FIG. 3 is a flowchart according to a specific implementation manner of step 104 in the first embodiment of the present application
  • FIG. 4 is a flowchart according to a specific implementation manner of step 105 in the first embodiment of the present application.
  • FIG. 5 is a flowchart of a decryption method according to a second embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a server according to a third embodiment of the present application.
  • the first embodiment of the present application relates to a decryption method, which is applied to a signaling analysis system.
  • the specific flow chart is shown in Figure 1, including:
  • Step 101 Collect signaling in the network interface.
  • a network interface refers to a network interface between network elements located in the non-access stratum (Non-Access Stratum, NAS).
  • the network elements located in the non-access stratum include but are not limited to the following network elements: user equipment (User Equipment, UE), base station (generation NodeB, gNB), access and mobility management function network element (Access and Mobility Management Function, AMF), authentication service function network element (Authentication Server Function, ASUF), so the network
  • the interfaces include but are not limited to the following network interfaces: a first network interface N1 between the UE and the AMF, a second network interface N12 between the AMF and the ASUF, and a third network interface N2 between the gNB and the AMF.
  • the signaling analysis system can use the deployed probe to collect the signaling in each network interface, and obtain the signaling in all network interfaces.
  • collecting the signaling in the network interface includes: collecting the signaling in the first network interface and the second network interface; wherein the first network interface includes a user equipment, an access and mobility management function network element
  • the second network interface includes the network interface between the network elements of the access and mobility management functions and the network elements of the authentication service function.
  • the signaling analysis The system can use the deployed probe to collect only the signaling in the first network interface N1 and the signaling in the second network interface N12; wherein, when the signaling interaction between the UE and the AMF is performed, the UE needs to communicate with the AMF through the gNB. signaling interaction between them.
  • this method only the signaling in the first interface and the second interface needs to be collected, and the signaling in all network interfaces does not need to be collected, which reduces the workload of collection.
  • collecting the signaling in the network interface includes: collecting the signaling in the first network interface, the second network interface and the third network interface; wherein the third network interface includes the network interface between the gNB and the AMF .
  • the UE needs to perform signaling interaction with the AMF through the gNB or the AMF needs to perform signaling interaction with the UE through the gNB, so the signaling in the first network interface N1
  • the required parameters when the required parameters are missing from the signaling in the first network interface N1, the required parameters may be obtained from the signaling in the third network interface N2, which has double guarantees and reduces the collection work. On the premise of the load, the possibility that the collected signaling has the required parameters is improved.
  • step 102 the signaling used for authentication in the same session of the same user equipment is associated to obtain the associated signaling.
  • the whole process from establishing a connection with other network elements when a user equipment is turned on to disconnecting with other network elements when shutting down is called a session. Since multiple user equipments establish connections with other network elements and the same user equipment is restarted to establish connections with other network elements, that is, the collected signaling in the network interface includes different sessions of the same user equipment and different user equipments. different sessions, and due to differences in the encryption process of different sessions, the authentication signaling needed to decrypt different sessions is not the same, so the signaling analysis system needs to use the same user equipment in the same session for The authenticated signaling is associated to obtain the associated signaling.
  • the signaling used for authentication includes parameters required for decryption, and the signaling analysis system can identify the signaling used for authentication from the collected signaling of the network interface. In an example, if the signaling used for authentication by the same user equipment in the same session carries an identifier that is different from other sessions, the same user equipment is directly used for authentication in the same session according to the identifier. associated signaling to obtain the associated signaling.
  • the first identifier is used to use the different
  • the same user equipment of the network interface is associated with the signaling used for authentication in the same session, and the specific flowchart of associating the signaling used for authentication by the same user equipment in the same session is shown in Figure 2, including:
  • Step 1021 Based on the second identifier, associate the signaling used for authentication by the same user equipment in the same session in the first network interface to obtain the associated first signaling.
  • Step 1022 Based on the third identifier, associate the signaling used for authentication by the same user equipment in the same session in the second network interface to obtain the associated second signaling.
  • Step 1023 Based on the first identifier, associate the signaling used for authentication by the same user equipment in the same session in the first signaling and the second signaling to obtain the associated signaling.
  • the first identifier is used to associate the signaling used for authentication of the same user equipment with different network interfaces in the same session, but the signaling in the first network interface N1 includes information that does not carry the first identifier.
  • the signaling in the second network interface N12 include signaling that does not carry the first identifier, that is, it is impossible to directly use the first identifier to connect the same user equipment in the first network interface N1 and the second network interface N12 in the same session. All signaling used for authentication is associated, but the signaling used for authentication in the same session of the same user equipment in the first network interface carries the same second identifier, and the same user equipment in the second network interface carries the same second identifier.
  • the signaling used for authentication in the same session carries the same third identifier, so based on the second identifier, the signaling used for authentication by the same user equipment in the same session in the first network interface can be associated , obtain the associated first signaling, and based on the third identifier, associate the signaling used for authentication by the same user equipment in the same session in the second network interface to obtain the associated second signaling;
  • the identifier, the second identifier and the third identifier are different, that is, they are not the same identifier, otherwise, the information used for authentication in the same session of the same user equipment in the first network interface and the second network interface can be directly based on the same identifier.
  • first signaling and the second signaling have signaling carrying the first identifier, so that the same user equipment in the first signaling and the second signaling can be used to associate the same user equipment in the same session by using the first identifier.
  • the signaling used for authentication is associated to obtain the associated signaling. Through this method, the signaling used for authentication in the same session of the same user equipment can be successfully associated.
  • the signaling in the first network interface and the second network interface is collected, and the signaling used for authentication by the same user equipment in the same session is associated to obtain the associated signaling, and the associated signaling is obtained from the associated signaling.
  • the third An identifier is used to associate the signaling used for authentication of the same user equipment on different network interfaces in the same session, and based on the second identifier, the same user equipment on the first network interface is used for authentication in the same session associated with the signaling of the user equipment to obtain the associated first signaling, and based on the third identifier, associate the signaling used for authentication of the same user equipment in the same session in the second network interface to obtain the associated second signaling , based on the first identifier, associate the signaling used for authentication by the same user equipment in the same session in the second network interface to obtain the associated second signaling , based on the first identifier, associate the signaling used for authentication by the same user equipment in the same session
  • the first identifier includes an authentication parameter corresponding to the user equipment
  • the second identifier includes an interface application protocol identifier of the first network interface
  • the third identifier includes an authentication context identifier.
  • the authentication parameters corresponding to the user equipment are obtained after the user equipment is successfully registered on the operator side, and the authentication parameters corresponding to the user equipment remain unchanged.
  • the authentication parameters include but are not limited to the following parameters: AUthentication Token (AUTN, AUTN) ) and a random number;
  • the interface application protocol identifier Access and Mobility Management Function User Equipment NG Application Protocol Identity Document, AMF UE NGAP ID
  • AMF UE NGAP ID Access and Mobility Management Function User Equipment NG Application Protocol Identity Document
  • the authentication context identifier is carried in the authCtxId field of the signaling of the second network interface, for example, the field may be located in the header of the signaling of the second network interface.
  • Step 103 Obtain user permanent identification and decryption parameters from associated signaling.
  • the associated signaling is the signaling used for authentication by the same user equipment in the same session
  • the associated signaling includes at least the first signaling and the second signaling
  • the parameter type of the decryption parameter can be based on the actual The required parameter types need to be pre-set or updated in real time.
  • the signaling analysis system can obtain the Subscription Permanent Identifier (SUPI) and decryption parameters from the associated signaling according to the parameter types of the decryption parameters, and use this session.
  • SUPI Subscription Permanent Identifier
  • a corresponding relationship is established between the SUPI in and the decryption parameter; wherein, the SUPI is obtained from the second signaling.
  • Step 104 derive a key according to the user's permanent identification and decryption parameters; wherein the key includes a decryption key.
  • the signaling analysis system uses a preset algorithm to derive a decryption key according to SUPI and decryption parameters, and the preset algorithm can be set according to actual needs, which is not specifically limited in this embodiment.
  • the decryption parameters include: symmetric cipher, anchor key, authentication type, and encryption algorithm type; according to the user permanent identification and decryption parameters, the specific process of deriving the key is shown in Figure 3, including:
  • Step 1041 derive the session key according to the user's permanent ID, symmetric password and anchor key.
  • Step 1042 derive a key according to the authentication type, encryption algorithm type and session key; wherein the key includes a decryption key.
  • the symmetric key ABBA and the encryption algorithm type are obtained from the first signaling, and the anchor key Kseaf and the authentication type are obtained from the second signaling; wherein, the encryption algorithm type is obtained from the first signaling Security mode command message Selected EPS NAS security algorithm information element is obtained, encryption algorithm types include but are not limited to the following types: 5G-EA0, 128-5G-EA1, 128-5G-EA2, 128-5G-EA3.
  • the signaling analysis system spells SUPI and ABBA into a string S, uses Kseaf as the key, and derives the session key Kamf, and then spells the authentication type and encryption algorithm type into a string S', uses Kamf as the key, and derives A key is generated, wherein the key includes the decryption key KNASenc.
  • the decryption key can be successfully derived.
  • Step 105 Decrypt the collected encrypted signaling in the same session according to the target parameter and the decryption key in the decryption parameters.
  • the target parameter includes an encryption algorithm type
  • the specific flow chart of decrypting the collected encrypted signaling in the same session according to the target parameter and the decryption key in the decryption parameter is shown in Figure 4, including:
  • Step 1051 Obtain the byte length of the encrypted signaling, the direction of the encrypted signaling, and a count value corresponding to the direction according to the collected encrypted signaling in the same session.
  • Step 1052 Decrypt the encrypted signaling according to the decryption key, the encryption algorithm type, the byte length of the encrypted signaling, the direction of the encrypted signaling, and the count value corresponding to the direction.
  • the direction of encrypted signaling includes an uplink direction and a downlink direction
  • the count value corresponding to the direction includes an uplink count value and a downlink count value.
  • the signaling analysis system can use the deployed probe to collect encrypted signaling in the same session. Obtain the byte length of the encrypted signaling, the direction of the encrypted signaling, and the count value corresponding to the direction from the encrypted signaling; wherein, the count value corresponding to the direction is obtained by the following methods: because the uplink counter and the downlink counter are both a
  • the 24-byte counter with the same algorithm is controlled by the UE and AMF respectively.
  • the signaling analysis system can obtain the Sequence Number from the encrypted signaling, so as to obtain the upstream count value or the downstream count value, that is, the count value corresponding to the direction.
  • the signaling analysis system can obtain the Sequence Number from the encrypted signaling, so as to obtain the upstream count value or the downstream count value, that is, the count value corresponding to the direction.
  • the decryption key After obtaining the byte length of encrypted signaling, the direction of encrypted signaling, and the count value corresponding to the direction, according to the decryption key, encryption algorithm type, byte length of encrypted signaling, direction and direction of encrypted signaling
  • the encrypted signaling is decrypted by using a preset algorithm, and the plaintext signaling is obtained. Through such a method, the encrypted signaling can be successfully decrypted.
  • the decryption parameters include: symmetric cipher, anchor key, authentication type, and encryption algorithm type, and the session key is derived according to the user's permanent identity, symmetric cipher and anchor key; according to the authentication type, encryption Algorithm type and session key, derive the key; when the key includes the decryption key, the target parameter includes the encryption algorithm type, and obtain the byte length of the encrypted signaling according to the collected encrypted signaling in the same session , the direction of the encrypted signaling, and the count value corresponding to the direction; the encrypted signaling is decrypted according to the decryption key, the encryption algorithm type, the byte length of the encrypted signaling, the direction of the encrypted signaling and the count value corresponding to the direction.
  • the signaling analysis system may associate the plaintext signaling of the same user equipment in the same session, and store it locally for subsequent use.
  • the signaling analysis system collects the signaling in the network interface, and associates the signaling used for authentication by the same user equipment in the same session; since the associated signaling is the same user equipment in the same session
  • the original signaling used for authentication so the user permanent identification and decryption parameters can be directly obtained from the associated signaling, and then the key including the decryption key can be derived according to the user permanent identification and decryption parameters.
  • the target parameter and decryption key in the parameters decrypt the collected encrypted signaling in the same session, so that the encrypted signaling can be successfully decrypted to obtain plaintext signaling, so that subsequent related work can be performed according to the plaintext signaling.
  • the second embodiment of the present application relates to a decryption method.
  • the second embodiment is substantially the same as the first embodiment, and the main difference is that the encrypted signaling also needs to be integrity checked according to the integrity check key.
  • the specific flowchart is shown in Figure 5, including:
  • Step 201 collecting signaling in the network interface.
  • Step 202 Associate the signaling used for authentication in the same session of the same user equipment to obtain the associated signaling.
  • Step 203 Obtain user permanent identification and decryption parameters from associated signaling.
  • Steps 201-203 are similar to steps 101-103 in the first embodiment, and are not repeated here.
  • Step 204 derive a key according to the user's permanent identification and decryption parameters, wherein the key includes a decryption key and an integrity check key.
  • the signaling analysis system uses a preset algorithm to derive a decryption key according to SUPI and decryption parameters, and the preset algorithm can be set according to actual needs, which is not specifically limited in this embodiment.
  • the decryption parameters include: symmetric cipher, anchor key, authentication type, and encryption algorithm type; the key is derived according to the user's permanent identification and decryption parameters; wherein the key includes a decryption key and an integrity checksum. verification key.
  • the signaling analysis system spells SUPI and ABBA into a string S, uses Kseaf as the key, and derives the session key Kamf, and then spells the authentication type and encryption algorithm type into a string S', and uses Kamf as the key , derive the key, wherein the key includes KNASenc and the integrity check key KnasInt.
  • Step 205 Perform integrity check on the encrypted signaling according to the integrity check key.
  • Step 206 it is judged whether the encrypted signaling passes the integrity check, if the encrypted signaling passes the integrity check, the process goes to step 207, and if the encrypted signaling fails the integrity check, the process ends.
  • performing integrity verification on the encrypted signaling according to the integrity verification key includes: calculating the message authentication code according to the integrity verification key and the encrypted signaling; if the calculated message authentication code is the same as the The message authentication code carried in the encrypted signaling matches, indicating that the encrypted signaling passes the integrity check.
  • the signaling analysis system obtains a message authentication code (Message Authentication Code, MAC) according to KnasInt and encrypted signaling, where KnasInt is used as a key, and uses a preset algorithm to calculate, wherein the preset algorithm can be 128-NIA1, 128 -NIA2, 128-NIA3, etc.
  • MAC Message Authentication Code
  • the MAC carried in the encrypted signaling can be stored in the field where the security information is stored in the header of the encrypted signaling.
  • Step 207 Decrypt the collected encrypted signaling in the same session according to the target parameter and the decryption key in the decryption parameters.
  • Step 207 is similar to step 205 in the first embodiment, and is not repeated here.
  • the signaling analysis system can verify whether the encrypted signaling is complete, and decrypt the encrypted signaling only after passing the integrity check, which reduces the workload of decryption and increases the correct rate of decryption.
  • the third embodiment of the present application relates to a server, as shown in FIG. 6 , comprising at least one processor 302 ; and a memory 301 communicatively connected to the at least one processor; wherein, the memory 301 stores data that can be accessed by the at least one processor 302 Executed instructions, the instructions are executed by the at least one processor 302 to enable the at least one processor 302 to perform the embodiments of the decryption method described above.
  • the memory 301 and the processor 302 are connected by a bus, and the bus may include any number of interconnected buses and bridges, and the bus connects one or more processors 302 and various circuits of the memory 301 together.
  • the bus may also connect together various other circuits, such as peripherals, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein.
  • the bus interface provides the interface between the bus and the transceiver.
  • a transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing a means for communicating with various other devices over a transmission medium.
  • the data processed by the processor 302 is transmitted on the wireless medium through the antenna, and further, the antenna also receives the data and transmits the data to the processor 302 .
  • the processor 302 is responsible for managing the bus and general processing, and may also provide various functions including timing, peripheral interface, voltage regulation, power management, and other control functions.
  • the memory 301 may be used to store data used by the processor 302 when performing operations.
  • the fourth embodiment of the present application relates to a computer-readable storage medium storing a computer program.
  • the above method embodiments are implemented when the computer program is executed by the processor.
  • the aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .
  • the decryption method, server and storage medium proposed in this application collect signaling in the network interface, and associate the signaling used for authentication by the same user equipment in the same session; because the associated signaling is the same user equipment
  • the original signaling used for authentication in the same session so the user permanent identification and decryption parameters can be directly obtained from the associated signaling, and then the key including the decryption key can be derived according to the user permanent identification and decryption parameters. Therefore, according to the target parameter and the decryption key in the decryption parameters, the collected encrypted signaling in the same session can be decrypted, so that the encrypted signaling can be successfully decrypted to obtain the plaintext signaling, so that the follow-up can be performed according to the plaintext signaling. related work.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种解密方法、服务器及存储介质。本申请中，采集网络接口中的信令(101)；将同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的信令(102)；从所述关联的信令中获取用户永久标识、解密参数(103)；根据所述用户永久标识和所述解密参数，推衍出密钥；其中，所述密钥包括解密密钥(104)；根据所述解密参数中的目标参数和所述解密密钥对采集到的所述同一会话中的加密信令进行解密(105)。

Description

解密方法、服务器及存储介质
相关申请的交叉引用
本申请基于申请号为202011091254.0、申请日为2020年10月13日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本申请实施例涉及通信领域，特别涉及一种解密方法、服务器及存储介质。
背景技术
第五代移动通信技术(5th generation mobile networks，5G)是最新一代蜂窝移动通信技术，也是继长期演进技术(Long Term Evolution，LTE)、通用移动通信系统(Universal Mobile Telecommunications System，UMTS)和全球移动通信系统(Global System for Mobile Communications，GSM)之后的延伸。在5G网络中，非接入层信令携带着许多重要信息，且承担着终端和5G网络之间的双向认证功能，所以非接入层信令的安全性显得尤为重要。而为了保证非接入层信令的安全性，网元在传输过程中通常会对非接入层信令进行加密处理，这就导致信令分析系统在获取到被加密的非接入层信令后，无法利用被加密的非接入层信令进行数据分析等后续的工作。
发明内容
本申请实施例提供了一种解密方法、服务器及存储介质。
本申请实施例提供了一种解密方法，包括：采集网络接口中的信令；将同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的信令；从所述关联的信令中获取用户永久标识、解密参数；根据所述用户永久标识和所述解密参数，推衍出密钥；其中，所述密钥包括解密密钥；根据所述解密参数中的目标参数和所述解密密钥对采集到的所述同一会话中的加密信令进行解密。
本申请实施例还提供了一种服务器，包括：至少一个处理器；以及，与所述至少一个处理器通信连接的存储器；其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行上述所述的解密方法。
本申请实施例还提供了一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时实现上述所述的解密方法。
附图说明
图1是根据本申请第一实施例中的解密方法的流程图；
图2是根据本申请第一实施例中的步骤102的一种具体实现方式的流程图；
图3是根据本申请第一实施例中的步骤104的一种具体实现方式的流程图；
图4是根据本申请第一实施例中的步骤105的一种具体实现方式的流程图；
图5是根据本申请第二实施例中的解密方法的流程图；
图6是根据本申请第三实施例中的服务器的结构示意图。
具体实施方式
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请的各实施例进行详细的阐述。然而，本领域的普通技术人员可以理解，在本申请各实施例中，为了使读者更好地理解本申请而提出了许多技术细节。但是，即使没有这些技术细节和基于以下各实施例的种种变化和修改，也可以实现本申请所要求保护的技术方案。以下各个实施例的划分是为了描述方便，不应对本申请的具体实现方式构成任何限定，各个实施例在不矛盾的前提下可以相互结合相互引用。
本申请的第一实施例涉及一种解密方法，应用于信令分析系统。具体流程图如图1所示，包括：
步骤101，采集网络接口中的信令。
具体地说，网络接口指的是位于非接入层(Non-Access Stratum，NAS)的各网元之间的网络接口，位于非接入层的网元包括但不限于以下网元：用户设备(User Equipment，UE)、基站(generation NodeB，gNB)、接入和移动性管理功能网元(Access and Mobility Management Function，AMF)、鉴权服务功能网元(Authentication Server Function，ASUF)，所以网络接口包括但不限于以下网络接口：UE与AMF之间的第一网络接口N1、AMF与ASUF之间的第二网络接口N12、gNB与AMF之间的第三网络接口N2。信令分析系统可以利用部署的探针采集每个网络接口中的信令，得到所有网络接口中的信令。
在一个例子中，采集网络接口中的信令，包括：采集第一网络接口和第二网络接口中的信令；其中，第一网络接口包括用户设备、接入和移动性管理功能网元之间的网络接口，第二网络接口包括接入和移动性管理功能网元、鉴权服务功能网元之间的网络接口。具体地，由于用户永久标识和解密参数是从UE与AMF之间的第一网络接口N1中的信令、AMF与ASUF之间的第二网络接口N12中的信令获取的，所以信令分析系统可以利用部署的探针仅仅只采集第一网络接口N1中的信令、第二网络接口N12中的信令；其中，在UE与AMF之间进行信令交互时，UE需要通过gNB与AMF之间进行信令交互。通过这样的方法，只需要采集第一接口和第二接口中的信令，并不需要采集所有网络接口中的信令，这样减轻了采集的工作负担。
在一个例子中，采集网络接口中的信令，包括：采集第一网络接口、第二网络接口和第三网络接口中的信令；其中，第三网络接口包括gNB与AMF之间的网络接口。具体地，由于在UE与AMF之间进行信令交互时，UE需要通过gNB与AMF进行信令交互或AMF需要通过gNB与UE进行信令交互，所以会将第一网络接口N1中的信令带入gNB与AMF之间的第三网络接口N2，即第三网络接口N3中包括第一网络接口N1中的信令。通过这样的方法，当第一网络接口N1中的信令中缺失所需的参数时，可能可以从第三网络接口N2中的信令获取所需的参数，具有双重保证，在减轻采集的工作负担的前提下提高了采集 的信令中具有所需参数的可能性。
步骤102，将同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的信令。
具体地说，一个用户设备从开机时与其他的网元建立连接到关机时与其他的网元断开连接的整个过程称为一次会话。由于存在多个用户设备与其他的网元建立连接以及同一个用户设备重新开机与其他的网元建立连接的情况，即采集的网络接口中的信令包括同一用户设备的不同会话和不同用户设备的不同会话，且由于不同会话的加密过程存在差异，对不同会话进行解密时需要用到的鉴权的信令并不相同，所以信令分析系统需要将同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的信令。其中，用于鉴权的信令中包括解密所需的参数，且信令分析系统可以从采集的网络接口的信令中识别出用于鉴权的信令。在一个例子中，若同一个用户设备在同一会话中用于鉴权的信令均携带一种区别于其他会话的标识，则根据该标识直接将同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的信令。
在一个例子中，若第一网络接口中的信令包括未携带第一标识的信令且第二网络接口中的信令中包括未携带第一标识的信令，第一标识用于将不同网络接口的同一个用户设备在同一会话中用于鉴权的信令进行关联，将同一个用户设备在同一会话中用于鉴权的信令进行关联具体流程图如图2所示，包括：
步骤1021，基于第二标识，将第一网络接口中同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的第一信令。
步骤1022，基于第三标识，将第二网络接口中同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的第二信令。
步骤1023，基于第一标识，将第一信令和第二信令中同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的信令。
具体地说，第一标识用于将不同网络接口的同一个用户设备在同一会话中用于鉴权的信令进行关联，但是第一网络接口N1中的信令包括未携带第一标识的信令且第二网络接口N12中的信令中包括未携带第一标识的信令，即无法直接利用第一标识将第一网络接口N1和第二网络接口N12中同一个用户设备在同一会话中用于鉴权的所有的信令均进行关联，但是第一网络接口中同一用户设备在同一会话中用于鉴权的信令中均携带相同的第二标识，第二网络接口中同一用户设备在同一会话中用于鉴权的信令中均携带相同的第三标识，所以可以基于第二标识，将第一网络接口中同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的第一信令，基于第三标识，将第二网络接口中同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的第二信令；其中，第一标识、第二标识和第三标识不同，即不是同一个标识，否则就可以直接根据相同的标识将第一网络接口和第二网络接口中同一个用户设备在同一会话中用于鉴权的信令进行关联；而且第一信令和第二信令中存在携带第一标识的信令，这样就可以利用第一标识将第一信令和第二信令中同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的信令。通过这样的方法，可以成功的将同一个用户设备在同一会话中用于鉴权的信令进行关联。
在一个例子中，在采集第一网络接口和第二网络接口中的信令，将同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的信令，从关联的信令中获取用户永久标 识、解密参数时，若第一网络接口中的信令包括未携带第一标识的信令且第二网络接口中的信令中包括未携带第一标识的信令，第一标识用于将不同网络接口的同一个用户设备在同一会话中用于鉴权的信令进行关联，基于第二标识，将第一网络接口中同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的第一信令，基于第三标识，将第二网络接口中同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的第二信令，基于第一标识，将第一信令和第二信令中同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的信令，其中，第一标识、第二标识和第三标识不同。
在一个例子中，第一标识包括用户设备对应的认证参数，第二标识包括第一网络接口的接口应用协议标识，第三标识包括鉴权上下文标识。具体地，用户设备对应的认证参数为用户设备在运营商侧注册成功后获取的，用户设备对应的认证参数始终保持不变，认证参数包括但不限于以下参数：认证令牌(AUthentication TokeN，AUTN)以及随机数；第一网络接口的接口应用协议标识(Access and Mobility Management Function User Equipment NG Application Protocol Identity Document，AMF UE NGAP ID)即为AMF和UE之间的网络接口的接口应用协议标识，携带于第一网络接口的信令中；鉴权上下文标识携带于第二网络接口的信令的authCtxId字段中，例如：该字段可以位于第二网络接口的信令的头部位置。通过这样的方法，给出了第一标识、第二标识和第三标识的具体内容，根据给出的第一标识、第二标识和第三标识可以较方便的得到关联的信令。
步骤103，从关联的信令中获取用户永久标识、解密参数。
具体地说，关联的信令为同一个用户设备在同一会话中用于鉴权的信令，关联的信令中至少包括第一信令和第二信令，解密参数的参数类型可以根据实际需要进行预先设定或者实时更新需要的参数类型，信令分析系统可以根据解密参数的参数类型从关联的信令中获取用户永久标识(Subscription Permanent Identifier，SUPI)和解密参数，并将本次会话中的SUPI和解密参数之间建立对应关系；其中，SUPI从第二信令中获取得到。
步骤104，根据用户永久标识和解密参数，推衍出密钥；其中，密钥包括解密密钥。
具体地说，信令分析系统根据SUPI和解密参数，利用预设算法推衍出解密密钥，预设算法可以根据实际需要进行设定，本实施例不做具体限定。在一个例子中，解密参数包括：对称密码、锚密钥、鉴权类型、加密算法类型；根据用户永久标识和解密参数，推衍出密钥的具体流程如图3所示，包括：
步骤1041，根据用户永久标识、对称密码和锚密钥，推衍出会话密钥。
步骤1042，根据鉴权类型、加密算法类型和会话密钥，推衍出密钥；其中，密钥包括解密密钥。
具体地说，对称密钥ABBA、加密算法类型从第一信令中获取得到，锚密钥Kseaf、鉴权类型从第二信令中获取得到；其中，加密算法类型从第一信令中的Security mode command消息Selected EPS NAS security algorithms信元获取得到，加密算法类型包括但不限于以下类型：5G-EA0、128-5G-EA1、128-5G-EA2、128-5G-EA3。信令分析系统将SUPI和ABBA拼成字符串S，以Kseaf作为key，推衍出会话密钥Kamf，再将鉴权类型和加密算法类型拼成字符串S’，以Kamf作为key，推衍出密钥，其中，密钥包括解密密钥KNASenc。通过这样的方法，可以实现成功推衍出解密密钥。
步骤105，根据解密参数中的目标参数和解密密钥对采集到的同一会话中的加密信令 进行解密。
在一个例子中，目标参数包括加密算法类型，根据解密参数中的目标参数和解密密钥对采集到的同一会话中的加密信令进行解密的具体流程图如图4所示，包括：
步骤1051，根据采集到的同一会话中的加密信令，获取加密信令的字节长度、加密信令的方向、与方向对应的计数值。
步骤1052，根据解密密钥、加密算法类型、加密信令的字节长度、加密信令的方向和与方向对应的计数值对加密信令进行解密。
具体地说，加密信令的方向包括上行方向和下行方向，与方向对应的计数值包括上行计数值和下行计数值，信令分析系统可以利用部署的探针采集同一会话中的加密信令，从加密信令中获取加密信令的字节长度、加密信令的方向和与方向对应的计数值；其中，与方向对应的计数值通过以下方式获取得到：由于上行计数器和下行计数器均是一个24字节的计数器且算法相同，分别由UE和AMF控制，当发送的为加密信令时，发送端会将计数值加一，得到新的顺序号Sequence Number，并将Sequence Number携带于加密信令中，所以信令分析系统可以从加密信令中获取Sequence Number，从而得到上行计数值或下行计数值，即与方向对应的计数值。在获取到加密信令的字节长度、加密信令的方向、与方向对应的计数值之后，根据解密密钥、加密算法类型、加密信令的字节长度、加密信令的方向和与方向对应的计数值，利用预设算法对加密信令进行解密，得到明文信令。通过这样的方法，可以实现对加密信令进行成功的解密。
在一个例子中，在解密参数包括：对称密码、锚密钥、鉴权类型、加密算法类型，根据用户永久标识、对称密码和锚密钥，推衍出会话密钥；根据鉴权类型、加密算法类型和会话密钥，推衍出密钥；其中，密钥包括解密密钥时，目标参数包括加密算法类型，根据采集到的同一会话中的加密信令，获取加密信令的字节长度、加密信令的方向、与方向对应的计数值；根据解密密钥、加密算法类型、加密信令的字节长度、加密信令的方向和与方向对应的计数值对加密信令进行解密。
在一个例子中，在得到明文信令之后，信令分析系统可以将同一个用户设备在同一会话中的明文信令进行关联，并存储于本地，以便后续使用。
本实施例中，信令分析系统采集网络接口中的信令，并将同一个用户设备在同一会话中用于鉴权的信令进行关联；由于关联的信令为同一个用户设备在同一会话中用于鉴权的原始信令，所以可以直接从关联的信令中获取用户永久标识、解密参数，再根据用户永久标识和解密参数，推衍出包括解密密钥的密钥，从而根据解密参数中的目标参数和解密密钥对采集到的同一会话中的加密信令进行解密，这样就可以将加密信令成功解密出来得到明文信令，从而可以根据明文信令进行后续的相关工作。
本申请的第二实施例涉及一种解密方法，第二实施例与第一实施例大致相同，主要区别之处在于：还需要根据完整性校验密钥对加密信令进行完整性校验。具体流程图如图5所示，包括：
步骤201，采集网络接口中的信令。
步骤202，将同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的信令。
步骤203，从关联的信令中获取用户永久标识、解密参数。
步骤201-203与第一实施例中的步骤101-103类似，在此不再赘述。
步骤204，根据用户永久标识和解密参数，推衍出密钥；其中，密钥包括解密密钥和完整性校验密钥。
具体地说，信令分析系统根据SUPI和解密参数，利用预设算法推衍出解密密钥，预设算法可以根据实际需要进行设定，本实施例不做具体限定。在一个例子中，解密参数包括：对称密码、锚密钥、鉴权类型、加密算法类型；根据用户永久标识和解密参数，推衍出密钥；其中，密钥包括解密密钥和完整性校验密钥。具体地，信令分析系统将SUPI和ABBA拼成字符串S，以Kseaf作为key，推衍出会话密钥Kamf，再将鉴权类型和加密算法类型拼成字符串S’，以Kamf作为key，推衍出密钥，其中，密钥包括KNASenc和完整性校验密钥KnasInt。
步骤205，根据完整性校验密钥对加密信令进行完整性校验。
步骤206，判断加密信令是否通过完整性校验，若加密信令通过完整校验，进入步骤207，若加密信令未通过完整性校验，进入结束。
在一个例子中，根据完整性校验密钥对加密信令进行完整性校验，包括：根据完整性校验密钥和加密信令，计算得到消息认证码；若计算得到的消息认证码与加密信令中携带的消息认证码匹配，表明加密信令通过完整性校验。具体地，信令分析系统根据KnasInt和加密信令，其中，KnasInt作为key，并利用预设算法计算得到消息认证码(Message Authentication Code，MAC)，其中，预设算法可以为128-NIA1、128-NIA2、128-NIA3等，若计算得到的MAC和加密信令中携带的MAC一致，则两者匹配，加密信令通过完整性校验；若计算得到的MAC和加密信令中携带的MAC不一致，则两者不匹配，加密信令未通过完整性校验；其中，加密信令携带的MAC可以在加密信息存在加密信令的头部存放安全信息的字段中。
步骤207，根据解密参数中的目标参数和解密密钥对采集到的同一会话中的加密信令进行解密。
步骤207与第一实施例中的步骤205类似，在此不再赘述。
本实施例中，信令分析系统可以验证加密信令是否完整，且只有加密信令通过完整性校验才进行解密，减轻了进行解密的工作负担且增加了解密的正确率。
上面各种方法的步骤划分，只是为了描述清楚，实现时可以合并为一个步骤或者对某些步骤进行拆分，分解为多个步骤，只要包括相同的逻辑关系，都在本专利的保护范围内；对算法中或者流程中添加无关紧要的修改或者引入无关紧要的设计，但不改变其算法和流程的核心设计都在该专利的保护范围内。
本申请第三实施例涉及一种服务器，如图6所示，包括至少一个处理器302；以及，与至少一个处理器通信连接的存储器301；其中，存储器301存储有可被至少一个处理器302执行的指令，指令被至少一个处理器302执行，以使至少一个处理器302能够执行上述解密方法的实施例。
其中，存储器301和处理器302采用总线方式连接，总线可以包括任意数量的互联的总线和桥，总线将一个或多个处理器302和存储器301的各种电路连接在一起。总线还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路连接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口在总线和收发机之间提 供接口。收发机可以是一个元件，也可以是多个元件，比如多个接收器和发送器，提供用于在传输介质上与各种其他装置通信的单元。经处理器302处理的数据通过天线在无线介质上进行传输，进一步，天线还接收数据并将数据传送给处理器302。
处理器302负责管理总线和通常的处理，还可以提供各种功能，包括定时，外围接口，电压调节、电源管理以及其他控制功能。而存储器301可以被用于存储处理器302在执行操作时所使用的数据。
本申请第四实施例涉及一种计算机可读存储介质，存储有计算机程序。计算机程序被处理器执行时实现上述方法实施例。
即，本领域技术人员可以理解，实现上述实施例方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
本申请提出的解密方法、服务器及存储介质，采集网络接口中的信令，并将同一个用户设备在同一会话中用于鉴权的信令进行关联；由于关联的信令为同一个用户设备在同一会话中用于鉴权的原始信令，所以可以直接从关联的信令中获取用户永久标识、解密参数，再根据用户永久标识和解密参数，推衍出包括解密密钥的密钥，从而根据解密参数中的目标参数和解密密钥对采集到的同一会话中的加密信令进行解密，这样就可以将加密信令成功解密出来得到明文信令，从而可以根据明文信令进行后续的相关工作。
本领域的普通技术人员可以理解，上述各实施例是实现本申请的具体实施例，而在实际应用中，可以在形式上和细节上对其作各种改变，而不偏离本申请的精神和范围。

Claims (10)

  1. 一种解密方法，包括：
    采集网络接口中的信令；
    将同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的信令；
    从所述关联的信令中获取用户永久标识、解密参数；
    根据所述用户永久标识和所述解密参数，推衍出密钥；其中，所述密钥包括解密密钥；
    根据所述解密参数中的目标参数和所述解密密钥对采集到的所述同一会话中的加密信令进行解密。
  2. 根据权利要求1所述的解密方法，其中，所述密钥还包括完整性校验密钥；
    在所述根据所述解密参数中的目标参数和所述解密密钥对采集到的所述同一会话中的加密信令进行解密之前，还包括：
    根据所述完整性校验密钥对所述加密信令进行完整性校验，且所述加密信令通过完整性校验。
  3. 根据权利要求1或2所述的解密方法，其中，所述采集网络接口中的信令，包括：
    采集第一网络接口和第二网络接口中的信令；其中，所述第一网络接口包括所述用户设备、接入和移动性管理功能网元之间的网络接口，所述第二网络接口包括所述接入和移动性管理功能网元、鉴权服务功能网元之间的网络接口。
  4. 根据权利要求3所述的解密方法，其中，若所述第一网络接口中的信令包括未携带第一标识的信令且所述第二网络接口中的信令中包括未携带所述第一标识的信令，所述第一标识用于将不同网络接口的同一个用户设备在同一会话中用于鉴权的信令进行关联；
    所述将同一个用户设备在同一会话中用于鉴权的信令进行关联，包括：
    基于第二标识，将所述第一网络接口中同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的第一信令；
    基于第三标识，将所述第二网络接口中同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的第二信令；
    基于所述第一标识，将所述第一信令和所述第二信令中同一个用户设备在同一会话中用于鉴权的信令进行关联，得到关联的信令；
    其中，所述第一标识、所述第二标识和所述第三标识不同。
  5. 根据权利要求4所述的解密方法，其中，所述第一标识包括所述用户设备对应的认证参数，所述第二标识包括所述第一网络接口的接口应用协议标识，所述第三标识包括鉴权上下文标识。
  6. 根据权利要求1或2所述的解密方法，其中，所述解密参数包括：对称密码、锚密钥、鉴权类型、加密算法类型；
    所述根据所述用户永久标识和所述解密参数，推衍出密钥，包括：
    根据所述用户永久标识、所述对称密码和所述锚密钥，推衍出会话密钥；
    根据所述鉴权类型、所述加密算法类型和所述会话密钥，推衍出密钥。
  7. 根据权利要求6所述的解密方法，其中，所述目标参数包括所述加密算法类型；
    所述根据所述解密参数中的目标参数和所述解密密钥对采集到的所述同一会话中的 加密信令进行解密，包括：
    根据采集到的所述同一会话中的加密信令，获取加密信令的字节长度、加密信令的方向、与所述方向对应的计数值；
    根据所述解密密钥、所述加密算法类型、所述加密信令的字节长度、所述加密信令的方向和所述与所述方向对应的计数值对所述加密信令进行解密。
  8. 根据权利要求2所述的解密方法，其中，所述根据所述完整性校验密钥对所述加密信令进行完整性校验，包括：
    根据所述完整性校验密钥和所述加密信令，计算得到消息认证码；
    若计算得到的所述消息认证码与所述加密信令中携带的消息认证码匹配，表明所述加密信令通过完整性校验。
  9. 一种服务器，包括：
    至少一个处理器；以及，
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行如权利要求1至8所述的解密方法。
  10. 一种计算机可读存储介质，存储有计算机程序，其中所述计算机程序被处理器执行时实现权利要求1至8所述的解密方法。
PCT/CN2021/113293 2020-10-13 2021-08-18 解密方法、服务器及存储介质 WO2022078058A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011091254.0 2020-10-13
CN202011091254.0A CN114423001A (zh) 2020-10-13 2020-10-13 解密方法、服务器及存储介质

Publications (1)

Publication Number Publication Date
WO2022078058A1 true WO2022078058A1 (zh) 2022-04-21

Family

ID=81208906

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/113293 WO2022078058A1 (zh) 2020-10-13 2021-08-18 解密方法、服务器及存储介质

Country Status (2)

Country Link
CN (1) CN114423001A (zh)
WO (1) WO2022078058A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116684864A (zh) * 2023-08-03 2023-09-01 武汉博易讯信息科技有限公司 4g到5g切换场景nas解密方法、系统、设备及可读介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102769848A (zh) * 2010-12-21 2012-11-07 特克特朗尼克公司 使用实时lte监视的演进分组系统非接入层解密
CN109586899A (zh) * 2017-09-29 2019-04-05 电信科学技术研究院 信令操作及其指示方法、装置及计算机存储介质
CN110167013A (zh) * 2018-02-13 2019-08-23 华为技术有限公司 一种通信方法及装置
CN110431859A (zh) * 2017-03-20 2019-11-08 Lg电子株式会社 用于无线通信系统中层之间交互的方法及其设备
US10743176B1 (en) * 2019-04-05 2020-08-11 Verizon Patent And Licensing, Inc. Secure onboarding of a device having an embedded universal integrated circuit card without a preloaded provisioning profile

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102769848A (zh) * 2010-12-21 2012-11-07 特克特朗尼克公司 使用实时lte监视的演进分组系统非接入层解密
CN110431859A (zh) * 2017-03-20 2019-11-08 Lg电子株式会社 用于无线通信系统中层之间交互的方法及其设备
CN109586899A (zh) * 2017-09-29 2019-04-05 电信科学技术研究院 信令操作及其指示方法、装置及计算机存储介质
CN110167013A (zh) * 2018-02-13 2019-08-23 华为技术有限公司 一种通信方法及装置
US10743176B1 (en) * 2019-04-05 2020-08-11 Verizon Patent And Licensing, Inc. Secure onboarding of a device having an embedded universal integrated circuit card without a preloaded provisioning profile

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116684864A (zh) * 2023-08-03 2023-09-01 武汉博易讯信息科技有限公司 4g到5g切换场景nas解密方法、系统、设备及可读介质
CN116684864B (zh) * 2023-08-03 2023-11-03 武汉博易讯信息科技有限公司 4g到5g切换场景nas解密方法、系统、设备及可读介质

Also Published As

Publication number Publication date
CN114423001A (zh) 2022-04-29

Similar Documents

Publication Publication Date Title
CN110493774B (zh) 密钥配置方法、装置以及系统
CN107800539B (zh) 认证方法、认证装置和认证系统
US11075752B2 (en) Network authentication method, and related device and system
EP3605942B1 (en) Key agreement for wireless communication
US20200162913A1 (en) Terminal authenticating method, apparatus, and system
WO2020221252A1 (zh) 发送终端序列号的方法和装置以及认证方法和装置
WO2018137713A1 (zh) 网络切片内鉴权方法、切片鉴权代理实体及会话管理实体
CN108353279B (zh) 一种认证方法和认证系统
EP2680531A1 (en) Key agreement using a key derivation key
CN111148094B (zh) 5g用户终端的注册方法、用户终端设备及介质
EP3952241A1 (en) Parameter sending method and apparatus
CN112788594B (zh) 数据传输方法、装置和系统、电子设备、存储介质
JPWO2018079690A1 (ja) システム、ネットワーク装置、端末、及び方法
CN112492590A (zh) 一种通信方法及装置
WO2022078058A1 (zh) 解密方法、服务器及存储介质
CN111132149B (zh) 5g用户终端的注册方法、用户终端设备及介质
WO2020215958A1 (zh) 一种认证信息处理方法、终端和网络设备
CN111148213B (zh) 5g用户终端的注册方法、用户终端设备及介质
CN111836260B (zh) 一种认证信息处理方法、终端和网络设备
CN110830421B (zh) 数据传输方法和设备
CN111770488B (zh) Ehplmn更新方法、相关设备及存储介质
US20230336998A1 (en) Safe mode configuration method, device and system, and computer-readable storage medium
CN111212424B (zh) 一种从eps到5gs互操作时鉴权ue的方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21879105

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205N DATED 07/06/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 21879105

Country of ref document: EP

Kind code of ref document: A1