WO2022078214A1 - 签约数据更新方法、装置、节点和存储介质 - Google Patents

签约数据更新方法、装置、节点和存储介质 Download PDF

Info

Publication number
WO2022078214A1
WO2022078214A1 PCT/CN2021/121564 CN2021121564W WO2022078214A1 WO 2022078214 A1 WO2022078214 A1 WO 2022078214A1 CN 2021121564 W CN2021121564 W CN 2021121564W WO 2022078214 A1 WO2022078214 A1 WO 2022078214A1
Authority
WO
WIPO (PCT)
Prior art keywords
network function
function node
subscription data
subscription
network
Prior art date
Application number
PCT/CN2021/121564
Other languages
English (en)
French (fr)
Inventor
游世林
蔡继燕
林兆骥
彭锦
刘宇泽
邢真
王继刚
刘敏
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to JP2022555641A priority Critical patent/JP2023544664A/ja
Priority to EP21879260.4A priority patent/EP4106372A4/en
Priority to KR1020227031756A priority patent/KR20230088627A/ko
Publication of WO2022078214A1 publication Critical patent/WO2022078214A1/zh
Priority to US17/988,431 priority patent/US20230232240A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/72—Subscriber identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/14—Backbone network devices

Definitions

  • the present application relates to the field of wireless communication technologies, for example, to a method, apparatus, node and storage medium for updating subscription data.
  • the 5th Generation Mobile Communication Technology (5G) system includes 5G Radio Access Network (5G Radio Access Network, 5G) RAN) subsystem, 5G core network (5G Core, 5GC) subsystem.
  • the architecture of the 5G system includes multiple network functions (Network Function, NF). Access Node, (R)AN).
  • the 5G core network subsystem includes Unified Data Management (UDM), Access Management (AMF), Session Management (SMF), and User Plane (UPF) functions. ), Policy Control Function (PCF), Security Anchor Function (SEAF), Authentication Server Function (AUSF), and Authentication Credential Repository and Processing Function, ARPF).
  • the 5G network includes Subscription Concealed Identifier (SUCI) and Subscription Permanent Identifier (SUPI), where SUPI may include International Mobile Subscriber Identification Number (IMSI) or network access Identifier (Network Access Identifier, NAI).
  • IMSI International Mobile Subscriber Identification Number
  • NAI Network Access Identifier
  • FIG. 2 is a schematic diagram of an application identity authentication and key management architecture (Architecture for Authentication and Key Management for Applications, AKMA) based on a service-oriented architecture.
  • AKMA Application Identity authentication and key management architecture
  • AAnF AKMA Anchor Function
  • AAnF is located in the home network
  • AAnF is mainly used to generate the session key between the user equipment (User Equipment, UE) and the application function (Application Function, AF), and maintain the security between it and the UE context.
  • UE User Equipment
  • AF Application Function
  • AAnF is similar to the Bootstrapping Server Function (BSF) in the General Bootstrapping Architecture (GBA), and the interface Ua* between the UE and the AF is also similar to the Ua interface in the GBA.
  • BPF Bootstrapping Server Function
  • GBA General Bootstrapping Architecture
  • Nnef, Nausf, Naanf, and Namf in Figure 2 are service-based interfaces of Network Exposure Function (NEF), AUSF, AAnF, and AMF, respectively.
  • FIG. 3 is a key derivation architecture diagram of the application identity authentication and key management system.
  • the UE accesses the 5G network and passes 5G-Authentication and Key Agreement (AKA), namely 5G-AKA, or Extensible Authentication Protocol (Extensible Authentication Protocol)-AKA', namely EAP-AKA', the authentication is successful
  • AKA 5G-Authentication and Key Agreement
  • EAP-AKA' Extensible Authentication Protocol
  • the AUSF and the UE generate the key K AUSF , and derive the AKMA anchor key K AKMA from the key K AUSF , and the mobile equipment (Mobile Equipment, ME) and AAnF derive the application key K from the key K AKMA AF , where both AUSF and AAnF are in the home network.
  • ME Mobile Equipment
  • the embodiments of the present application propose a method, device, node, and storage medium for updating subscription data.
  • the second network function node does not retain AKMA-related context, so as to avoid AKMA services being abused by attackers. Condition.
  • An embodiment of the present application provides a method for updating subscription data.
  • the method includes the following steps: when the first network function node determines that the AKMA subscription data is updated, the first network function node determines a second network function that stores the AKMA context of the user. node; the first network function node sends a subscription data management notification message to the second network function node; the first network function node receives the subscription data management notification response message sent by the second network function node; wherein, the subscription data management notification response message is all Sent by the second network function node after deleting the AKMA context of the user according to the subscription data management notification message.
  • An embodiment of the present application provides a method for updating subscription data.
  • the method includes the following steps: a third network function node receives a query message sent by the first network function node; the third network function node determines the second network function node according to the query message; The third network function node sends a query response message to the first network function node, where the query response message carries the identifier or address of the second network function node.
  • An embodiment of the present application provides a method for updating subscription data.
  • the method includes the following steps: a fourth network function node determines a second network function node; the fourth network function node sends a message to the first network function node; the message carries the first network function node. 2. The identification or address of the network function node.
  • An embodiment of the present application provides an apparatus for updating subscription data.
  • the apparatus includes: a determining module, configured to determine the second network function node sending module that stores the AKMA context of the user in the case of determining that the AKMA subscription data of the user is updated, using sending a subscription data management notification message to the second network function node; the receiving module is configured to receive a subscription data management notification response message sent by the second network function node; wherein the subscription data management notification response message is the second network function node according to the subscription The data management notification message is sent after the user's AKMA context is deleted.
  • An embodiment of the present application provides an apparatus for updating subscription data, the apparatus includes: a receiving module for receiving a query message sent by a first network function node; a determining module for determining a second network function node according to the query message; a sending module , which is used to send a query response message to the first network function node, where the query response message carries the identifier or address of the second network function node.
  • An embodiment of the present application provides an apparatus for updating subscription data.
  • the apparatus includes: a determining module, configured to determine a second network function node; a sending module, configured to send a message to the first network function node; the message carries the first network function node. 2. The identification or address of the network function node.
  • the embodiment of the present application provides a network function node, the node includes a processor, and when the program is executed by the processor, the subscription data update method provided by the embodiment of the present application is implemented.
  • the embodiments of the present application provide a readable and writable storage medium for computer storage, where the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the implementation of the present application
  • the contract data update method provided by the example.
  • Embodiments of the present application provide a method, device, node and storage medium for updating subscription data.
  • the method includes, when the first network function node determines that the user's AKMA subscription data is updated, the first network function node determines to store the user's AKMA the second network function node of the context; the first network function node sends a subscription data management notification message to the second network function node; the first network function node receives the subscription data management notification response message sent by the second network function node; wherein the subscription data
  • the management notification response message is sent by the second network function node after deleting the AKMA context of the user according to the subscription data management notification message.
  • FIG. 1 is a schematic diagram of a 5G system architecture in the related art
  • FIG. 2 is a schematic diagram of an application identity authentication and key management system architecture in the related art
  • FIG. 3 is a schematic diagram of a key derivation architecture of an application identity authentication and key management system in the related art
  • Fig. 4 is the schematic flow chart of the AKMA anchor key generation method in the related art
  • FIG. 5 is a flowchart of a method for updating subscription data provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of signaling interaction of a method for updating subscription data provided by an embodiment of the present application
  • FIG. 7 is a schematic diagram of signaling interaction of another subscription data update method provided by an embodiment of the present application.
  • FIG. 8 is a schematic diagram of signaling interaction of another subscription data update method provided by an embodiment of the present application.
  • FIG. 9 is a schematic diagram of signaling interaction of another subscription data update method provided by an embodiment of the present application.
  • FIG. 10 is a flowchart of another method for updating subscription data provided by an embodiment of the present application.
  • 11 is a flowchart of another method for updating subscription data provided by an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of an apparatus for updating subscription data provided by an embodiment of the present application.
  • FIG. 13 is a schematic structural diagram of another apparatus for updating subscription data provided by an embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of another apparatus for updating subscription data provided by an embodiment of the present application.
  • FIG. 15 is a schematic structural diagram of a network function node provided by an embodiment of the present application.
  • words such as “optionally” or “exemplarily” are used to represent examples, illustrations, or illustrations. Any embodiment or design described in the embodiments of the present application as “optionally” or “exemplarily” should not be construed as preferred or advantageous over other embodiments or designs.
  • the use of words such as “optionally” or “exemplarily” is intended to present the related concepts in a specific manner.
  • the key K AKMA is usually generated by reusing the 5G main authentication process (that is, the above-mentioned 5G-AKA or EAP-AKA'). After the authentication is successful, the UE and the AUSF derive the AKMA anchor from the key K AUSF . The key K AKMA is determined, and the AKMA key identifier (AKMA-Key Identifier, A-KID) related to the key K AKMA is also generated while the key K AKMA is generated, then the key K AKMA can only pass the 5G main authentication. The process is updated. AKMA technology provides end-to-end security protection from user to application for 5G network users. If user subscription data is updated, it will affect the use of AKMA services. If AAnF continues to retain AKMA-related security context, attackers can use AKMA service, resulting in the possibility of AKMA service being abused by attackers.
  • A-KID AKMA-Key Identifier
  • UDM is used to permanently store user subscription data and is located in the home network where the user is subscribed; ARPF stores long-term security credentials for authentication, and uses long-term security credentials as input to perform key operations. UDM and ARPF are located in the secure environment of the operator or third-party systems and are not exposed to unauthorized physical access. In addition, interaction between ARPF and AUSF is possible.
  • the AMF is used to manage the user's access requirements to the network, and is responsible for functions such as non-access stratum (Non-Access Stratum, NAS) signaling management and user mobility management from the terminal to the network.
  • AMF has SEAF, interacts with AUSF and UE, and receives intermediate keys established for UE authentication process. Based on the authentication method of Universal Subscriber Identity Module (USIM), AMF obtains security-related data from AUSF.
  • USIM Universal Subscriber Identity Module
  • AUSF has authentication functions that interact with ARPF and can terminate requests from SEAF.
  • AUSF is located in the secure environment of the operator or third-party systems and is not exposed to unauthorized physical access.
  • SMF is used to manage user's Packet Data Unit (PDU) session, quality of service (Quality of Service, QoS) flow, and formulate packet detection and forwarding rules for UPF.
  • PDU Packet Data Unit
  • QoS Quality of Service
  • UPF is responsible for Internet Protocol (IP) data and non-IP data routing and forwarding, usage reporting and other functions.
  • IP Internet Protocol
  • PCF is responsible for providing policy rules at all levels for AMF and SMF.
  • DN Data Network
  • networks such as operator services, network access, and third-party services.
  • AF is used to manage AF sessions.
  • SUCI consists of six parts, as follows:
  • SUPI Type the value is 0-7, where 0 is the International Mobile Subscriber Identification Number (IMSI), 1 is the Network Access Identifier (NAI), other stand-by.
  • IMSI International Mobile Subscriber Identification Number
  • NAI Network Access Identifier
  • the Home Network Identifier which identifies the user of the home network.
  • the home network identifier is composed of the Mobile Country Code (MCC) and the Mobile Network Code (MNC).
  • MCC Mobile Country Code
  • MNC Mobile Network Code
  • NAI NAI is defined by section 2.2 of the standard IETF RFC 7542.
  • Routing Indicator allocated by the operator of the home network, configured in the mobile phone card (USIM), and together with the home network identifier to indicate that the network signaling is routed to the AUSF and UDM of the serving user.
  • Protection system output when there is no protection, the protection system output is the mobile subscriber identification number (Mobile Subscriber Identification Number, MSIN) or NAI of IMSI; when there is protection, the protection system output is encrypted using elliptic curve The value of MSIN and NAI.
  • MSIN Mobile Subscriber Identification Number
  • NAI NAI of IMSI
  • the routing indication is 678
  • the home network key identifier is 27
  • the unprotected SUCI consists of 0, 234, 15, 678, 0, 0 and 0999999999
  • the protected SUCI consists of 0, 234, 15, 678, 1, 27,
  • EEC Elliptic Curve Cryptography
  • MAC Message Authentication Code
  • the 5G master authentication process is as follows.
  • the AUSF interacts with the UDM to obtain authentication information.
  • the authentication credential AKA Authentication Vector (AV)
  • the authentication method uses the Nudm_UEAuthentication_Get Request service operation.
  • the UDM may indicate to the AUSF whether an AKMA key needs to be generated for the UE.
  • the AUSF receives the AKMA indication from the UDM, the AUSF stores K AUSF , and generates AKMA anchor keys K AKMA and A-KID based on K AUSF after the primary authentication succeeds. Before the UE initiates communication with the AKMA application server, the UE generates AKMA anchor keys K AKMA and A-KID based on K AUSF .
  • the AUSF uses the Naanf_AKMA_KeyRegistration Request service operation to send the user's SUPI, the generated A-KID and KAKMA to the AAnF.
  • the AAnF stores the latest key material sent by the AUSF.
  • the AAnF uses the Naanf_AKMA_KeyRegistration Response service operation to send the response to the AUSF.
  • an embodiment of the present application provides a method for updating subscription data.
  • the flowchart of the method is shown in FIG. 5 , including but not limited to the following steps.
  • the first network function node determines a second network function node that stores the user's AKMA context.
  • the first network function node in this step may be understood as UDM, and the second network function node may be understood as AAnF.
  • the update of the user's AKMA subscription data may include but not limited to the following situations: 1. The user withdraws from the network, and the user's subscription message is deleted in the UDM; 2. The user does not use the AKMA service, and the AKMA subscription information is deleted; 3. Due to various reasons such as arrears, the user cannot use the service.
  • this step can be understood as the UDM needs to confirm the AAnF that stores the AKMA context of the user when the AKMA subscription data of the user is updated.
  • the first network function node sends a subscription data management notification message to the second network function node.
  • the user identifier SUPI may be carried in the subscription data management notification message.
  • the AKMA subscription indication of the user may also be carried in the subscription data management notification message.
  • the first network function node receives the subscription data management notification response message sent by the second network function node.
  • the second network function node After receiving the subscription data management notification message sent by the first network function node, the second network function node can delete the AKMA context of the user stored in the subscription data management notification message according to the user identifier SUPI, for example, SUPI, A -KID and KAKMA, and then send a subscription data management notification response message to the first network function node.
  • SUPI user identifier
  • SUPI user identifier
  • An embodiment of the present application provides a method for updating subscription data.
  • the method includes, when the first network function node determines that the user's AKMA subscription data is updated, the first network function node determines a second network function node that stores the user's AKMA context.
  • the first network function node sends a subscription data management notification message to the second network function node; the first network function node receives the subscription data management notification response message sent by the second network function node; wherein the subscription data management notification response message is the second Sent by the network function node after deleting the user's AKMA context according to the subscription data management notification message.
  • the implementation manner of the foregoing step S501 may include but is not limited to the following situations: in the first situation, the first network function node determines the second network function node according to the local configuration; in the second situation, the first network function node The network function node determines the second network function node through the third network function node; in the third case, the first network function node determines the second network function node through the fourth network function node.
  • an implementation manner of the above-mentioned first case may include that the first network function node determines the second network function node according to a partial field of the user identification.
  • the above-mentioned partial fields may include MCC or MNC, or the like.
  • the implementation of the second case may include the following process: the first network function node sends a query message to the third network function node; the first network function node receives the information sent by the third network function node according to the query message.
  • the query response message carries the identifier or address of the second network function node; the first network function node determines the second network function node according to the query response message.
  • the query message may carry a network function name (eg, AAnF) and/or a network type (eg, AAnF type), as well as the user identity SUPI and/or the location information of the first network function node.
  • the above-mentioned third network function node may be a network storage function (Network Repository Function, NRF), that is, the NRF queries and stores the user's AKMA context according to the SUPI and/or UDM location information in the query message, and the AAnF network function name and/or AAnF network type.
  • NRF Network Repository Function
  • the implementation manner of the above-mentioned third situation may include the following process: the first network function node sends a subscription change request message to the fourth network function node; the first network function node receives the first network function node 4.
  • the subscription change request response message sent by the network function node, the subscription change request response message carries the identifier or address of the second network function node; the first network function node determines the second network function node according to the subscription change request response message.
  • the above-mentioned fourth network function node may be an AUSF
  • the above-mentioned subscription change request may carry a network function name (for example, AAnF) and/or a network type (for example, AAnF type), and a user identifier SUPI and/or Location information of the first network function node. That is, the AUSF queries the AAnF that stores the user's AKMA context according to the SUPI and/or UDM location information, as well as the AAnF network function name and/or AAnF network type, and sends the query result to the UDM in the form of a subscription change request response message.
  • AAnF network function name
  • AAnF type for example, AAnF type
  • the implementation of the third situation may further include the following process: the first network function node receives the subscription data management subscription message sent by the fourth network function node, and the subscription data management subscription The message carries the identifier or address of the second network function node; the first network function node stores the identifier or address of the second network function node according to the subscription data management subscription message; the first network function node stores the identifier or address of the second network function node according to the stored identifier or The address determines the second network function node.
  • the first network function node may also send a subscription data management subscription response message to the fourth network function node.
  • the first network function node may also perform a main authentication process through the fourth network function node, and the main authentication process is:
  • the implementation provided in FIG. 4 of the present application It can be seen from Figure 4 that after the AUSF generates the AKMA key material, it sends the AKMA key material to the AAnF, and the AAnF stores the AKMA key material. In this way, when the user's AKMA subscription data is updated, the UDM can send a subscription data management notification message to the AAnF according to the stored AAnF identifier or address.
  • FIG. 10 is a flowchart of another method for updating subscription data provided by an embodiment of the present application. As shown in FIG. 10 , the method may include, but is not limited to, the following steps.
  • a third network function node receives a query message sent by a first network function node.
  • the third network function node in this embodiment of the present application may be an NRF
  • the first network function node may be a UDM
  • the query message sent by the first network function node may carry the network function name and/or network type, and the user ID and /or location information of the first network function node.
  • the third network function node determines the second network function node according to the query message.
  • the third network function node queries the second network function node according to the network function name and/or network type in the query message, and the user identity and/or the location information of the first network function node.
  • the second network function node may be an AAnF, where the AAnF is used to store the AKMA context of the user.
  • the third network function node sends a query response message to the first network function node.
  • the query response message sent by the third network function node carries the identifier or address of the second network function node.
  • An embodiment of the present application provides a method for updating subscription data.
  • the method includes the third network function node receiving a query message sent by the first network function node; the third network function node determining the second network function node according to the query message; the third network function node The function node sends a query response message to the first network function node, where the query response message carries the identifier or address of the second network function node.
  • the second network function node can be effectively determined, and further, when the user subscription data is updated, the first network function node can send a subscription data management notification message to the second network function node, so that the second network function node can The AKMA-related context is not preserved, thereby avoiding the situation that AKMA services are abused by attackers.
  • FIG. 11 is a flowchart of another method for updating subscription data provided by an embodiment of the present application. As shown in FIG. 11 , the method may include, but is not limited to, the following steps.
  • the fourth network function node determines the second network function node.
  • the fourth network function node in this embodiment of the present application may be an AUSF, and the second network function node may be an AAnF, where the AAnF is used to store the AKMA context of the user.
  • the implementation of this step may include: the fourth network function node receives a subscription change request message sent by the first network function node, and the subscription change request message carries the user identifier; the fourth network function node queries the first network function node according to the user identifier. Two network function nodes.
  • the above-mentioned first network function node may be a UDM, that is, after the AUSF receives the subscription change request message sent by the UDM, the AUSF queries the AAnF that stores the user's AKMA context according to the user identifier in the message.
  • the fourth network function node sends a message to the first network function node.
  • the message sent by the fourth network function node may carry the identifier or address of the second network function node.
  • An embodiment of the present application provides a method for updating subscription data.
  • the method includes a fourth network function node determining a second network function node, and the fourth network function node sending a message to the first network function node, where the message carries the second network function node.
  • the identity or address of the functional node the first network function node can determine the second network function node, and when the user subscription data is updated, the first network function node sends a subscription data management notification message to the second network function node, so that the first network function node can send a subscription data management notification message to the second network function node.
  • the second network function node does not retain the AKMA-related context, so as to avoid the situation that the AKMA service is abused by the attacker.
  • FIG. 12 is an apparatus for updating subscription data provided by an embodiment of the present application.
  • the apparatus may include: a determining module 1201, a sending module 1202, and a receiving module 1203; wherein, the determining module 1202 is used to determine the storage of the user's AKMA context in the case of determining that the user's AKMA subscription data is updated a second network function node; a sending module for sending a subscription data management notification message to the second network function node; a receiving module for receiving a subscription data management notification response message sent by the second network function node; wherein the subscription data management notification The response message is sent by the second network function node after deleting the AKMA context of the user according to the subscription data management notification message.
  • the above determining module is configured to determine the second network function node according to the local configuration; or, determine the second network function node through the third network function node; or determine the second network function node through the fourth network function node .
  • the determining module may determine the second network function node according to a partial field of the user identification.
  • the determination module may include a communication unit and a determination unit; the communication unit is configured to send a query message to the third network function node, and receive a query response message sent by the third network function node according to the query message, the query response The message carries the identifier or address of the second network function node; the determining unit is configured to determine the second network function node according to the query response message.
  • the determining module may include a communication unit and a determining unit; the communication unit is configured to send a subscription change request message to the fourth network function node, and receive a subscription change request response message sent by the fourth network function node, the subscription
  • the change request response message carries the identifier or address of the second network function node; the determining unit is configured to determine the second network function node according to the subscription change request response message.
  • the above query message may carry the network function name and/or network type, and, the user identity and/or the location information of the first network function node;
  • the above-mentioned subscription change request message may carry the network function name and/or network type, and, the user identity and/or the location information. or location information of the first network function node.
  • the above determination module may include a communication unit, a storage unit and a determination unit; the communication unit is configured to receive a subscription data management subscription message sent by the fourth network function node, where the subscription data management subscription message carries the second network function the identifier or address of the node; the storage unit is used to store the identifier or address of the second network function node according to the contract data management subscription message; the determination unit is used to determine the second network function according to the stored identifier or address of the second network function node node.
  • the above-mentioned apparatus may further include an authentication module configured to perform the main authentication process through the fourth network function node.
  • the subscription data updating apparatus provided in this embodiment is used to implement the subscription data updating methods of the embodiments shown in FIG. 5 , FIG. 6 , FIG. 7 , FIG. 8 , and FIG.
  • FIG. 13 is another apparatus for updating subscription data provided by an embodiment of the present application.
  • the apparatus may include: a receiving module 1301, a determining module 1302, and a sending module 1303; wherein the receiving module is used to receive the query message sent by the first network function node; the determining module is used to determine according to the query message a second network function node; a sending module configured to send a query response message to the first network function node, where the query response message carries the identifier or address of the second network function node.
  • the above query message carries the network function name and/or the network type, and the user identity and/or the location information of the first network function node.
  • the apparatus for updating subscription data provided in this embodiment is used to implement the method for updating subscription data in the embodiment shown in FIG. 10 , and its implementation principle and technical effect are similar, which will not be repeated here.
  • FIG. 14 is another apparatus for updating subscription data provided by an embodiment of the present application.
  • the apparatus may include: a determining module 1401 and a sending module 1402; wherein the determining module is used to determine the second network function node; the sending module is used to send a message to the first network function node, the message in the It carries the identifier or address of the second network function node.
  • the above determination module may include a communication unit, and a query unit; the communication unit is used to receive a subscription change request message sent by the first network function node, and the subscription change request message carries a user identifier; The user identity queries the second network function node.
  • the apparatus for updating subscription data provided in this embodiment is used to implement the method for updating subscription data in the embodiment shown in FIG. 11 , and its implementation principle and technical effect are similar, which will not be repeated here.
  • FIG. 15 is a schematic structural diagram of a network node according to an embodiment of the present application.
  • the network node includes a processor 1501 and a memory 1502; the number of processors 1501 in the network node may be one or more, and one processor 1501 is taken as an example in FIG. 15; the processor 1501 in the network node
  • the memory 1502 may be connected by a bus or other means, and the connection by a bus is taken as an example in FIG. 15 .
  • the memory 1502 can be used to store software programs, computer-executable programs, and modules, such as program instructions/modules corresponding to the methods in any of the embodiments of FIG. 5 to FIG. 11 of this application.
  • the processor 1501 implements the above-mentioned methods in the embodiments of FIG. 5 to FIG. 11 by running the software programs, instructions and modules stored in the memory 1502 .
  • the memory 1502 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required for at least one function; the storage data area may store data created according to the use of the set-top box, and the like. Additionally, memory 1502 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other non-volatile solid state storage device.
  • the processor in the above node may also implement the above method for updating subscription data through hardware circuits such as logic circuits, gate circuits and the like in the above node.
  • the embodiments of the present application also provide a readable and writable storage medium for computer storage, where the storage medium stores one or more programs, and when the one or more programs can be executed by one or more processors, the The method provided by any of the embodiments of FIGS. 5-11 .
  • the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of multiple Physical components execute cooperatively.
  • Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit .
  • Such software may be distributed on computer-readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media).
  • Computer storage media includes both volatile and nonvolatile implemented in any method or technology for storage of information, such as computer readable instructions, data structures, program modules or other data flexible, removable and non-removable media.
  • Computer storage media include but are not limited to random access memory (Random Access Memory, RAM), read-only memory (Read-Only Memory, ROM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM) , Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Video Disk (DVD) or other optical disk storage, magnetic cartridge, tape, magnetic disk storage or other magnetic A storage device, or any other medium that can be used to store desired information and that can be accessed by a computer.
  • communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and can include any information delivery media, as is well

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开一种签约数据更新方法、装置、节点和存储介质，该方法包括在第一网络功能节点确定用户的AKMA签约数据更新的情况下，第一网络功能节点确定存储用户的AKMA上下文的第二网络功能节点；第一网络功能节点向第二网络功能节点发送签约数据管理通知消息；第一网络功能节点接收第二网络功能节点发送的签约数据管理通知响应消息；其中，签约数据管理通知响应消息是第二网络功能节点根据签约数据管理通知消息删除用户的AKMA上下文后发送的。

Description

签约数据更新方法、装置、节点和存储介质 技术领域
本申请涉及无线通信技术领域，例如涉及一种签约数据更新方法、装置、节点和存储介质。
背景技术
根据第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)标准工作组的定义，第五代移动通信技术(5th Generation Mobile Communication Technology，5G)系统包括5G无线接入网(5G Radio Access Network，5G RAN)子系统、5G核心网(5G Core，5GC)子系统。如图1所示，5G系统的架构包括多个网络功能(Network Function，NF)，其中，5G无线接入网子系统包括新一代无线基站(New Radio，NR)，即无线接入点(Radio Access Node，(R)AN)。5G核心网子系统包括统一数据管理功能(Unified Data Management，UDM)、接入管理功能(Access Management Function，AMF)、会话管理功能(Session Management Function，SMF)、用户面功能(User Plane Function，UPF)、策略控制功能(Policy Control Function，PCF)、安全锚点功能(Security Anchor Function，SEAF)、认证服务器功能(Authentication Server Function，AUSF)和身份验证凭据存储库和处理功能(Authentication Credential Repository and Processing Function，ARPF)。5G网络中包括有用户隐藏标识(Subscription Concealed Identifier，SUCI)和用户永久标识(Subscription Permanent Identifier，SUPI)，其中，SUPI可以包括国际移动用户识别码(International Mobile Subscriber Identification Number，IMSI)或网络接入标识(Network Access Identifier，NAI)。
图2是基于服务化架构的应用身份认证和密钥管理架构(Architecture for Authentication and Key Management for Applications，AKMA)的示意图，AKMA相对于5G系统引入了新的网络功能—AKMA密钥锚定功能(AKMA Anchor Function，AAnF)，AAnF位于归属网络，AAnF主要用于生成用户设备(User Equipment，UE)与应用功能(Application Function，AF)之间的会话秘钥，以及维护其与UE之间的安全上下文。AAnF与通用引导认证机制(General Bootstrapping Architecture，GBA)中的自举服务功能(Bootstrapping Server Function，BSF)类似，UE与AF之间的接口Ua*也与GBA中的Ua接口近似。图2中的Nnef、Nausf、Naanf和Namf分别为网络开放功能(Network Exposure Function，NEF)、AUSF、AAnF和AMF的基于服务化接口。
图3是应用身份认证和密钥管理系统的密钥推衍架构图。UE接入5G网络，通过5G-认证和密钥协商(Authentication and Key Agreement，AKA)，即5G-AKA，或者可扩展认证协议(Extensible Authentication Protocol)-AKA’，即EAP-AKA’，认证成功后，AUSF和UE产生密钥K AUSF，并由密钥K AUSF推衍出AKMA锚定密钥K AKMA，移动设备(Mobile Equipment，ME)和AAnF由密钥K AKMA推衍出应用密钥K AF，其中AUSF和AAnF均在归属网络中。
发明内容
本申请实施例提出一种签约数据更新方法、装置、节点和存储介质，在用户签约数据发生更新的情况下，第二网络功能节点不保留AKMA相关的上下文，从而避免AKMA业务被攻击者滥用的情况。
本申请实施例提供了一种签约数据更新方法，该方法包括以下步骤：在第一网络功能节点确定AKMA签约数据更新的情况下，第一网络功能节点确定存储用户的AKMA上下文的第二网络功能节点；第一网络功能节点向第二网络功能节点发送签约数据管理通知消息；第一网络功能节点接收第二网络功能节点发送的签约数据管理通知响应消息；其中，签约数据管理通知响应消息是所述第二网络功能节点根据签约数据管理通知消息删除用户的AKMA上下文后发送的。
本申请实施例提供了一种签约数据更新方法，该方法包括以下步骤：第三网络功能节点接收第一网络功能节点发送的查询消息；第三网络功能节点根据查询消息确定第二网络功能节点；第三网络功能节点向第一网络功能节点发送查询响应消息，查询响应消息中携带有第二网络功能节点的标识或地址。
本申请实施例提供了一种签约数据更新方法，该方法包括以下步骤：第四网络功能节点确定第二网络功能节点；第四网络功能节点向第一网络功能节点发送消息；消息中携带有第二网络功能节点的标识或地址。
本申请实施例提供了一种签约数据更新装置，该装置包括：确定模块，用于在确定用户的AKMA签约数据更新的情况下，确定存储用户的AKMA上下文的第二网络功能节点发送模块，用于向第二网络功能节点发送签约数据管理通知消息；接收模块，用于接收第二网络功能节点发送的签约数据管理通知响应消息；其中，签约数据管理通知响应消息是第二网络功能节点根据签约数据管理通知消息删除用户的AKMA上下文后发送的。
本申请实施例提供了一种签约数据更新装置，该装置包括：接收模块，用于接收第一网络功能节点发送的查询消息；确定模块，用于根据查询消息确定第二网络功能节点；发送模块，用于向第一网络功能节点发送查询响应消息， 查询响应消息中携带有第二网络功能节点的标识或地址。
本申请实施例提供了一种签约数据更新装置，该装置包括：确定模块，用于确定第二网络功能节点；发送模块，用于向第一网络功能节点发送消息；消息中携带有所述第二网络功能节点的标识或地址。
本申请实施例提供了一种网络功能节点，该节点包括处理器，当程序被处理器执行时实现本申请实施例提供的签约数据更新方法。
本申请实施例提供了一种可读写存储介质，用于计算机存储，存储介质存储有一个或者多个程序，该一个或者多个程序可被一个或者多个处理器执行，以实现本申请实施例提供的签约数据更新方法。
本申请实施例提供了一种签约数据更新方法、装置、节点和存储介质，该方法包括在第一网络功能节点确定用户的AKMA签约数据更新的情况下，第一网络功能节点确定存储用户的AKMA上下文的第二网络功能节点；第一网络功能节点向第二网络功能节点发送签约数据管理通知消息；第一网络功能节点接收第二网络功能节点发送的签约数据管理通知响应消息；其中，签约数据管理通知响应消息是第二网络功能节点根据签约数据管理通知消息删除用户的AKMA上下文后发送的。通过这样的设计方式，在用户签约数据发生更新的情况下，第二网络功能节点不保留AKMA相关的上下文，从而避免AKMA业务被攻击者滥用的情况。
附图说明
图1是相关技术中的5G系统架构的示意图；
图2是相关技术中的应用身份认证和密钥管理系统架构的示意图；
图3是相关技术中的应用身份认证和密钥管理系统的密钥推衍架构示意图；
图4是相关技术中的AKMA锚定密钥产生方法的流程示意图；
图5是本申请实施例提供的一种签约数据更新方法的流程图；
图6是本申请实施例提供的一种签约数据更新方法的信令交互示意图；
图7是本申请实施例提供的另一种签约数据更新方法的信令交互示意图；
图8是本申请实施例提供的另一种签约数据更新方法的信令交互示意图；
图9是本申请实施例提供的另一种签约数据更新方法的信令交互示意图；
图10是本申请实施例提供的另一种签约数据更新方法的流程图；
图11是本申请实施例提供的另一种签约数据更新方法的流程图；
图12是本申请实施例提供的一种签约数据更新装置的结构示意图；
图13是本申请实施例提供的另一种签约数据更新装置的结构示意图；
图14是本申请实施例提供的另一种签约数据更新装置的结构示意图；
图15是本申请实施例提供的一种网络功能节点的结构示意图。
具体实施方式
下文中将结合附图对本申请的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
另外，在本申请实施例中，“可选地”或者“示例性地”等词用于表示作例子、例证或说明。本申请实施例中被描述为“可选地”或者“示例性地”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。使用“可选地”或者“示例性地”等词旨在以具体方式呈现相关概念。
在相关技术中，通常以重用5G主认证流程(即上述5G-AKA或EAP-AKA’)的方式产生密钥K AKMA，当认证成功后，UE和AUSF由密钥K AUSF推衍产生AKMA锚定密钥K AKMA，在产生密钥K AKMA的同时也产生与密钥K AKMA相关的AKMA密钥标识(AKMA-Key Identifier，A-KID)，那么密钥K AKMA也只能通过5G主认证流程进行更新。而AKMA技术为5G网络用户提供了用户到应用的端到端的安全保护，若用户签约数据发生更新，则将会影响AKMA业务的使用，若AAnF继续保留AKMA相关的安全上下文，那么攻击者可以使用AKMA业务，导致AKMA业务存在被攻击者滥用的可能性。
为了便于理解本申请实施例提供的方法，对本申请实施例以及说明书附图中所涉及的网络功能节点功能等相关概念作进一步解释，具体如下。
UDM用于永久存放用户签约数据，位于用户签约的归属网；ARPF存储用于认证的长期安全凭证，并使用长期安全凭证作为输入执行密钥运算。UDM和ARPF位于运营商或者第三方系统的安全环境中，不会暴露给非授权的物理访问。另外，ARPF和AUSF之间可以进行交互。
AMF用于对用户接入到网络的需求进行管理，负责终端到网络的非接入层(Non-Access Stratum，NAS)信令管理、用户移动性管理等功能。AMF具有SEAF，与AUSF以及UE交互，并接收为UE认证过程而建立的中间密钥。基于全球用户识别卡(Universal Subscriber Identity Module，USIM)的认证方式，AMF从AUSF获取安全相关数据。
AUSF具有与ARPF交互的认证功能，并可以终止来自SEAF的请求。AUSF位于运营商或第三方系统的安全环境中，不会暴露给未授权的物理接入。
SMF用于管理用户的分组数据单元(Packet Data Unit，PDU)会话、服务质量(Quality of Service，QoS)流，为UPF制定包检测和转发规则等。
UPF负责网际协议(Internet Protocol，IP)数据、及非IP数据的路由和转发、用量上报等功能。
PCF负责为AMF、SMF提供各级别的策略规则。
数据网络(Data Network，DN)，包括例如运营商服务，网络接入，第三方服务等网络。
AF用于对AF会话进行管理。
SUCI包括六部分，具体如下：
(1)SUPI类型(SUPI Type)，取值为0-7，其中0为国际移动用户识别码(International Mobile Subscriber Identification Number，IMSI)，1为网络接入标识(Network Access Identifier，NAI)，其他待用。
(2)归属网络标识(Home Network Identifier)，标识归属网络的用户，当SUPI为IMSI时，归属网络标识由移动国家码(Mobile Country Code，MCC)和移动网络码(Mobile Network Code，MNC)组成；当SUPI为NAI时，NAI由标准IETF RFC 7542中的2.2章节定义。
(3)路由指示(Routing Indicator，RID)，由归属网络的运营商分配，配置在手机卡(USIM)中，和归属网络标识共同指示网络信令路由到服务用户的AUSF和UDM。
(4)保护体系标识(Protection Scheme Identifier)，表示无保护(null-scheme)或者有保护(non-null-scheme)两种之一。
(5)归属网络密钥标识(Home Network Public Key Identifier)，表示一个归属网络提供的为保护SUPI的公钥的标识，当无保护情况下，归属网络密钥标识值为0。
(6)保护体系输出(Scheme Output)，当无保护时，保护体系输出为IMSI的移动用户识别号码(Mobile Subscriber Identification Number，MSIN)或者NAI；当有保护时，保护体系输出为使用椭圆曲线加密MSIN和NAI的值。
例如，当IMSI为234150999999999，即MCC＝234，MNC＝15和MSIN＝0999999999，路由指示为678，归属网络密钥标识为27时，无保护的SUCI由0、234、15、678、0、0和0999999999组成，有保护的SUCI由0、234、15、678、1、27、<椭圆曲线密码学的椭圆曲线公钥值(Elliptic Curve Cryptography(EEC)ephemeral public key value)>、<加密0999999999>和<消息认证码 (Message Authentication Code，MAC)值(MAC tag value)>组成。
如图4所示，5G主认证过程如下。
S401、AUSF与UDM交互，获取认证信息。例如，认证凭证(AKA认证向量(Authentication Vector，AV))，认证方法使用Nudm_UEAuthentication_Get Request服务操作。
S402、在响应消息中，UDM可以向AUSF指示是否需要为UE生成AKMA密钥。
S403、如果AUSF收到UDM的AKMA指示，则AUSF存储K AUSF，并在主认证成功后基于K AUSF生成AKMA锚定密钥K AKMA和A-KID。在UE启动与AKMA应用服务器的通信之前，UE基于K AUSF生成AKMA锚定密钥K AKMA和A-KID。
S404、AUSF生成AKMA密钥材料后，使用Naanf_AKMA_KeyRegistration Request服务操作将用户的SUPI、生成的A-KID和KAKMA发送到AAnF。AAnF存储AUSF发送的最新密钥材料。
S405、AAnF使用Naanf_AKMA_KeyRegistration Response服务操作，将响应发送给AUSF。
基于上述概念，本申请实施例提供了一种签约数据更新方法，该方法流程图如图5所示，包括但不限于以下步骤。
S501、在第一网络功能节点确定用户的AKMA签约数据更新的情况下，第一网络功能节点确定存储用户的AKMA上下文的第二网络功能节点。
在本申请实施例中，可以将本步骤中的第一网络功能节点理解为UDM，将第二网络功能节点理解为AAnF。
本步骤中用户的AKMA签约数据更新的情况可以包括但不限于以下几种情况：一、用户退网，在UDM中删除用户签约消息；二、用户不使用AKMA业务，删除AKMA签约信息；三、由于欠费等各种原因，用户不能使用服务。
也即本步骤可以理解为在用户的AKMA签约数据发生更新的情况下，UDM需要确认存储用户的AKMA上下文的AAnF。
S502、第一网络功能节点向第二网络功能节点发送签约数据管理通知消息。
第一网络功能节点确定第二网络功能节点后，向第二网络功能节点发送签约数据管理通知消息时，可以在签约数据管理通知消息中携带用户标识SUPI。可选地，也可以在该签约数据管理通知消息中携带用户的AKMA签约指示。
S503、第一网络功能节点接收第二网络功能节点发送的签约数据管理通知 响应消息。
第二网络功能节点接收到第一网络功能节点发送的签约数据管理通知消息后，可以根据签约数据管理通知消息中携带的用户标识SUPI，删除其存储的该用户的AKMA上下文，例如，SUPI、A-KID和KAKMA，进而向第一网络功能节点发送签约数据管理通知响应消息。
本申请实施例提供了一种签约数据更新方法，该方法包括在第一网络功能节点确定用户的AKMA签约数据更新的情况下，第一网络功能节点确定存储用户的AKMA上下文的第二网络功能节点；第一网络功能节点向第二网络功能节点发送签约数据管理通知消息；第一网络功能节点接收第二网络功能节点发送的签约数据管理通知响应消息；其中，签约数据管理通知响应消息是第二网络功能节点根据签约数据管理通知消息删除用户的AKMA上下文后发送的。通过这样的设计方式，在用户签约数据发生更新的情况下，第二网络功能节点不保留AKMA相关的上下文，从而避免AKMA业务被攻击者滥用的情况。
在一种实施例中，上述步骤S501的实现方式可以包括但不限于以下几种情况：第一种情况，第一网络功能节点根据本地配置确定第二网络功能节点；第二种情况，第一网络功能节点通过第三网络功能节点确定第二网络功能节点；第三种情况，第一网络功能节点通过第四网络功能节点确定第二网络功能节点。
如图6所示，上述第一种情况的实现方式可以包括，第一网络功能节点根据用户标识的部分字段确定第二网络功能节点。
示例性地，上述部分字段可以包括MCC或者MNC等。
如图7所示，上述第二种情况的实现方式可以包括以下过程：第一网络功能节点向第三网络功能节点发送查询消息；第一网络功能节点接收第三网络功能节点根据查询消息发送的查询响应消息，该查询响应消息中携带有第二网络功能节点的标识或地址；第一网络功能节点根据查询响应消息确定第二网络功能节点。
示例性地，上述查询消息中可以携带有网络功能名(例如，AAnF)和/或网络类型(例如，AAnF类型)，以及，用户标识SUPI和/或第一网络功能节点的位置信息。上述第三网络功能节点可以为网络存储功能(Network Repository Function，NRF)，即NRF根据查询消息中的SUPI和/或UDM位置信息，以及AAnF网络功能名和/或AAnF网络类型查询存储用户AKMA上下文的AAnF，进而向UDM发送查询响应消息。
如图8所示，在一种实施例中，上述第三种情况的实现方式可以包括以下过程：第一网络功能节点向第四网络功能节点发送签约改变请求消息；第一网 络功能节点接收第四网络功能节点发送的签约改变请求响应消息，签约改变请求响应消息携带有第二网络功能节点的标识或地址；第一网络功能节点根据签约改变请求响应消息确定第二网络功能节点。
示例性地，上述第四网络功能节点可以为AUSF，上述签约改变请求中可以携带有网络功能名(例如，AAnF)和/或网络类型(例如，AAnF类型)，以及，用户标识SUPI和/或第一网络功能节点的位置信息。即AUSF根据SUPI和/或UDM位置信息，以及AAnF网络功能名和/或AAnF网络类型查询存储用户AKMA上下文的AAnF，并将查询结果以签约改变请求响应消息的方式发送至UDM。
如图9所示，在一种实施例中，上述第三种情况的实现方式还可以包括以下过程：第一网络功能节点接收第四网络功能节点发送的签约数据管理签约消息，签约数据管理签约消息携带第二网络功能节点的标识或地址；第一网络功能节点根据签约数据管理签约消息存储第二网络功能节点的标识或地址；第一网络功能节点根据存储的第二网络功能节点的标识或地址确定第二网络功能节点。
可选地，第一网络功能节点接收第四网络功能节点发送的签约数据管理签约消息后，还可以向第四网络功能节点发送签约数据管理签约响应消息。
需要说明的是，在第一网络功能节点接收第四网络功能节点发送的签约数据管理签约消息之前，第一网络功能节点还可以通过第四网络功能节点执行主认证过程，该主认证过程即为本申请图4所提供的实现方式。结合图4可以看出，AUSF生成AKMA密钥材料后，将AKMA密钥材料发送至AAnF，由AAnF进行存储。这样，在用户的AKMA签约数据更新的情况下，UDM可以根据存储的AAnF的标识或地址向AAnF发送签约数据管理通知消息。
图10是本申请实施例提供的另一种签约数据更新方法的流程图。如图10所示，该方法可以包括但不限于以下步骤。
S1001、第三网络功能节点接收第一网络功能节点发送的查询消息。
本申请实施例中的第三网络功能节点可以为NRF，第一网络功能节点可以为UDM，第一网络功能节点发送的查询消息中可以携带有网络功能名和/或网络类型，以及，用户标识和/或第一网络功能节点的位置信息。
S1002、第三网络功能节点根据查询消息确定第二网络功能节点。
第三网络功能节点根据查询消息中的网络功能名和/或网络类型，以及，用户标识和/或第一网络功能节点的位置信息查询第二网络功能节点。
该第二网络功能节点可以为AAnF，AAnF用于存储用户的AKMA上下文。
S1003、第三网络功能节点向第一网络功能节点发送查询响应消息。
第三网络功能节点发送的查询响应消息中携带有第二网络功能节点的标识或地址。
本申请实施例提供了一种签约数据更新方法，该方法包括第三网络功能节点接收第一网络功能节点发送的查询消息；第三网络功能节点根据查询消息确定第二网络功能节点；第三网络功能节点向第一网络功能节点发送查询响应消息，查询响应消息中携带有第二网络功能节点的标识或地址。通过上述方案可以有效确定第二网络功能节点，进而可以在用户签约数据发生更新的情况下，实现第一网络功能节点向第二网络功能节点发送签约数据管理通知消息，以使得第二网络功能节点不保留AKMA相关的上下文，从而避免AKMA业务被攻击者滥用的情况。
图11是本申请实施例提供的另一种签约数据更新方法的流程图。如图11所示，该方法可以包括但不限于以下步骤。
S1101、第四网络功能节点确定第二网络功能节点。
本申请实施例中的第四网络功能节点可以为AUSF，第二网络功能节点可以为AAnF，AAnF用于存储用户的AKMA上下文。
示例性地，本步骤的实现方式可以包括：第四网络功能节点接收第一网络功能节点发送的签约改变请求消息，该签约改变请求消息中携带用户标识；第四网络功能节点根据用户标识查询第二网络功能节点。
上述第一网络功能节点可以为UDM，即AUSF接收UDM发送的签约改变请求消息后，AUSF根据该消息中的用户标识查询存储用户的AKMA上下文的AAnF。
S1102、第四网络功能节点向第一网络功能节点发送消息。
第四网络功能节点发送的消息中可以携带有第二网络功能节点的标识或地址。
本申请实施例提供了一种签约数据更新方法，该方法包括第四网络功能节点确定第二网络功能节点，第四网络功能节点向第一网络功能节点发送消息，该消息中携带有第二网络功能节点的标识或地址。通过上述方案可以实现第一网络功能节点确定第二网络功能节点，进而在用户签约数据发生更新的情况下，由第一网络功能节点向第二网络功能节点发送签约数据管理通知消息，以使得第二网络功能节点不保留AKMA相关的上下文，从而避免AKMA业务被攻击者滥用的情况。
图12是本申请实施例提供的一种签约数据更新装置。如图12所示，该装置可以包括：确定模块1201、发送模块1202、接收模块1203；其中，确定模块1202，用于在确定用户的AKMA签约数据更新的情况下，确定存储用户的AKMA上下文的第二网络功能节点；发送模块，用于向第二网络功能节点发送签约数据管理通知消息；接收模块，用于接收第二网络功能节点发送的签约数据管理通知响应消息；其中，签约数据管理通知响应消息是第二网络功能节点根据签约数据管理通知消息删除用户的AKMA上下文后发送的。
在一种示例中，上述确定模块用于根据本地配置确定第二网络功能节点；或者，通过第三网络功能节点确定第二网络功能节点；或者，通过第四网络功能节点确定第二网络功能节点。
在一种示例中，确定模块，可以根据用户标识的部分字段确定第二网络功能节点。
在一种示例中，确定模块可以包括通信单元和确定单元；通信单元，用于向第三网络功能节点发送查询消息，以及接收第三网络功能节点根据查询消息发送的查询响应消息，该查询响应消息中携带有第二网络功能节点的标识或地址；确定单元，用于根据查询响应消息确定第二网络功能节点。
在一种示例中，确定模块，可以包括通信单元和确定单元；通信单元，用于向第四网络功能节点发送签约改变请求消息，以及接收第四网络功能节点发送签约改变请求响应消息，该签约改变请求响应消息携带有第二网络功能节点的标识或地址；确定单元，用于根据签约改变请求响应消息确定第二网络功能节点。
上述查询消息可以携带网络功能名和/或网络类型，以及，用户标识和/或第一网络功能节点的位置信息；上述签约改变请求消息可以携带网络功能名和/或网络类型，以及，用户标识和/或第一网络功能节点的位置信息。
在一种示例中，上述确定模块，可以包括通信单元、存储单元和确定单元；通信单元，用于接收第四网络功能节点发送的签约数据管理签约消息，签约数据管理签约消息携带第二网络功能节点的标识或地址；存储单元，用于根据签约数据管理签约消息存储第二网络功能节点的标识或地址；确定单元，用于根据存储的第二网络功能节点的标识或地址确定第二网络功能节点。
在一种示例中，上述装置还可以包括认证模块，用于通过第四网络功能节点执行主认证过程。
本实施例提供的签约数据更新装置用于实现图5、图6、图7、图8、图9所示实施例的签约数据更新方法，其实现原理和技术效果类似，此处不再赘述。
图13是本申请实施例提供的另一种签约数据更新装置。如图13所示，该装置可以包括：接收模块1301、确定模块1302、发送模块1303；其中，接收模块，用于接收第一网络功能节点发送的查询消息；确定模块，用于根据查询消息确定第二网络功能节点；发送模块，用于向第一网络功能节点发送查询响应消息，查询响应消息中携带有第二网络功能节点的标识或地址。
，上述查询消息携带有网络功能名和/或网络类型，以及，用户标识和/或第一网络功能节点的位置信息。
本实施例提供的签约数据更新装置用于实现图10所示实施例的签约数据更新方法，其实现原理和技术效果类似，此处不再赘述。
图14是本申请实施例提供的另一种签约数据更新装置。如图14所示，该装置可以包括：确定模块1401、发送模块1402；其中，确定模块，用于确定第二网络功能节点；发送模块，用于向第一网络功能节点发送消息，该消息中携带有第二网络功能节点的标识或地址。
可选地，上述确定模块可以包括通信单元，以及查询单元；通信单元，用于接收第一网络功能节点发送的签约改变请求消息，签约改变请求消息中携带有用户标识；查询单元，用于根据用户标识查询第二网络功能节点。
本实施例提供的签约数据更新装置用于实现图11所示实施例的签约数据更新方法，其实现原理和技术效果类似，此处不再赘述。
图15为本申请实施例提供的一种网络节点的结构示意图。如图15所示，该网络节点包括处理器1501和存储器1502；网络节点中处理器1501的数量可以是一个或多个，图15中以一个处理器1501为例；网络节点中的处理器1501和存储器1502可以通过总线或其他方式连接，图15中以通过总线连接为例。
存储器1502作为一种计算机可读存储介质，可用于存储软件程序、计算机可执行程序以及模块，如本申请图5-图11任一实施例中的方法对应的程序指令/模块。处理器1501通过运行存储在存储器1502中的软件程序、指令以及模块实现上述的图5-图11实施例中的方法。
存储器1502可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序；存储数据区可存储根据机顶盒的使用所创建的数据等。此外，存储器1502可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他非易失性固态存储器件。
在一种示例中，在可能的情况下，上述节点中的处理器也可以通过其内部的逻辑电路、门电路等硬件电路实现上述的签约数据更新方法。
本申请实施例还提供了一种可读写存储介质，用于计算机存储，存储介质存储有一个或者多个程序，在一个或者多个程序可被一个或者多个处理器执行时，可以实现如图5-图11任一实施例所提供的方法。
本领域普通技术人员可以理解，上文中所公开方法中的全部或某些步骤、设备中的功能模块/单元可以被实施为软件、固件、硬件及其适当的组合。
在硬件实施方式中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由多个物理组件合作执行。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在计算机可读介质上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于随机存取存储器(Random Access Memory，RAM)、只读存储器(Read-Only Memory，ROM)、电可擦可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、闪存或其他存储器技术、光盘只读存储器(Compact Disc Read-Only Memory，CD-ROM)、数字多功能盘(Digital Video Disk，DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。
以上参照附图仅说明了本申请的示例性实施例而已，并非因此局限本申请的权利范围。本领域技术人员不脱离本申请的范围和实质内所作的任何修改、等同替换和改进，均应在本申请的权利范围之内。

Claims (18)

  1. 一种签约数据更新方法，包括：
    在第一网络功能节点确定用户的用户身份认证和密钥管理架构AKMA签约数据更新的情况下，所述第一网络功能节点确定存储所述用户的AKMA上下文的第二网络功能节点；
    所述第一网络功能节点向所述第二网络功能节点发送签约数据管理通知消息；
    所述第一网络功能节点接收所述第二网络功能节点发送的签约数据管理通知响应消息；
    其中，所述签约数据管理通知响应消息是所述第二网络功能节点根据所述签约数据管理通知消息删除所述用户的AKMA上下文后发送的。
  2. 根据权利要求1所述的方法，其中，所述第一网络功能节点确定存储所述用户的AKMA上下文的第二网络功能节点，包括：
    所述第一网络功能节点根据本地配置确定所述第二网络功能节点；
    或者，所述第一网络功能节点通过第三网络功能节点确定所述第二网络功能节点；
    或者，所述第一网络功能节点通过第四网络功能节点确定所述第二网络功能节点。
  3. 根据权利要求2所述的方法，其中，所述第一网络功能节点根据本地配置确定所述第二网络功能节点，包括：
    所述第一网络功能节点根据用户标识的部分字段确定所述第二网络功能节点。
  4. 根据权利要求2所述的方法，其中，所述第一网络功能节点通过第三网络功能节点确定所述第二网络功能节点，包括：
    所述第一网络功能节点向所述第三网络功能节点发送查询消息；
    所述第一网络功能节点接收所述第三网络功能节点根据所述查询消息发送的查询响应消息，其中，所述查询响应消息中携带有所述第二网络功能节点的标识或地址；
    所述第一网络功能节点根据所述查询响应消息确定所述第二网络功能节点。
  5. 根据权利要求2所述的方法，其中，所述第一网络功能节点通过第四网络功能节点确定所述第二网络功能节点，包括：
    所述第一网络功能节点向所述第四网络功能节点发送签约改变请求消息；
    所述第一网络功能节点接收所述第四网络功能节点发送的签约改变请求响应消息，其中，所述签约改变请求响应消息携带有所述第二网络功能节点的标识或地址；
    所述第一网络功能节点根据所述签约改变请求响应消息确定所述第二网络功能节点。
  6. 根据权利要求4所述的方法，其中，所述查询消息携带所述第二网络功能节点的网络功能名和所述第二网络功能节点的网络类型中的至少之一，以及，用户标识和所述第一网络功能节点的位置信息中的至少之一。
  7. 根据权利要求5所述的方法，其中，所述签约改变请求消息携带所述第二网络功能节点的网络功能名和所述第二网络功能节点的网络类型中的至少之一，以及，用户标识和所述第一网络功能节点的位置信息中的至少之一。
  8. 根据权利要求2所述的方法，其中，所述第一网络功能节点通过第四网络功能节点确定所述第二网络功能节点，包括：
    所述第一网络功能节点接收所述第四网络功能节点发送的签约数据管理签约消息，所述签约数据管理签约消息携带所述第二网络功能节点的标识或地址；
    所述第一网络功能节点根据所述签约数据管理签约消息存储所述第二网络功能节点的标识或地址；
    所述第一网络功能节点根据所述第一网络功能节点存储的所述第二网络功能节点的标识或地址确定所述第二网络功能节点。
  9. 根据权利要求8所述的方法，在所述第一网络功能节点接收所述第四网络功能节点发送的签约数据管理签约消息之前，还包括：
    所述第一网络功能节点通过所述第四网络功能节点执行主认证过程。
  10. 一种签约数据更新方法，包括：
    第三网络功能节点接收第一网络功能节点发送的查询消息；
    所述第三网络功能节点根据所述查询消息确定第二网络功能节点；
    所述第三网络功能节点向所述第一网络功能节点发送查询响应消息，所述查询响应消息中携带有所述第二网络功能节点的标识或地址。
  11. 根据权利要求10所述的方法，其中，所述查询消息携带所述第二网络功能节点的网络功能名和所述第二网络功能节点的网络类型中的至少之一，以及，用户标识和所述第一网络功能节点的位置信息中的至少之一。
  12. 一种签约数据更新方法，包括：
    第四网络功能节点确定第二网络功能节点；
    所述第四网络功能节点向第一网络功能节点发送消息；
    其中，所述消息中携带有所述第二网络功能节点的标识或地址。
  13. 根据权利要求12所述的方法，其中，所述第四网络功能节点确定第二网络功能节点，包括：
    所述第四网络功能节点接收所述第一网络功能节点发送的签约改变请求消息，所述签约改变请求消息中携带用户标识；
    所述第四网络功能节点根据所述用户标识查询所述第二网络功能节点。
  14. 一种签约数据更新装置，包括：
    确定模块，设置为在确定用户的用户身份认证和密钥管理架构AKMA签约数据更新的情况下，确定存储所述用户的AKMA上下文的第二网络功能节点；
    发送模块，设置为向所述第二网络功能节点发送签约数据管理通知消息；
    接收模块，设置为接收所述第二网络功能节点发送的签约数据管理通知响应消息；
    其中，所述签约数据管理通知响应消息是所述第二网络功能节点根据所述签约数据管理通知消息删除所述用户的AKMA上下文后发送的。
  15. 一种签约数据更新装置，包括：
    接收模块，设置为接收第一网络功能节点发送的查询消息；
    确定模块，设置为根据所述查询消息确定第二网络功能节点；
    发送模块，设置为向所述第一网络功能节点发送查询响应消息，所述查询响应消息中携带有所述第二网络功能节点的标识或地址。
  16. 一种签约数据更新装置，包括：
    确定模块，设置为确定第二网络功能节点；
    发送模块，设置为向第一网络功能节点发送消息；
    其中，所述消息中携带有所述第二网络功能节点的标识或地址。
  17. 一种网络功能节点，包括：处理器，所述处理器执行计算机程序时，实现如权利要求1-9任一项所述的签约数据更新方法，或者，如权利要求10-11任一项所述的签约数据更新方法，或者，如权利要求12-13任一项所述的签约数据更新方法。
  18. 一种可读写存储介质，所述可读写存储介质存储有计算机程序，所述 计算机程序被处理器执行时实现如权利要求1-9任一项所述的签约数据更新方法，或者，如权利要求10-11任一项所述的签约数据更新方法，或者，如权利要求12-13任一项所述的签约数据更新方法。
PCT/CN2021/121564 2020-10-16 2021-09-29 签约数据更新方法、装置、节点和存储介质 WO2022078214A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
JP2022555641A JP2023544664A (ja) 2020-10-16 2021-09-29 サブスクリプションデータ更新方法ならびに装置、ノードおよび記憶媒体
EP21879260.4A EP4106372A4 (en) 2020-10-16 2021-09-29 METHOD AND APPARATUS FOR UPDATING SUBSCRIPTION DATA, NODES AND STORAGE MEDIUM
KR1020227031756A KR20230088627A (ko) 2020-10-16 2021-09-29 가입 데이터 업데이트 방법과 장치, 노드, 및 저장 매체
US17/988,431 US20230232240A1 (en) 2020-10-16 2022-11-16 Subscription data update method and apparatus, node, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011111639.9 2020-10-16
CN202011111639.9A CN112512044A (zh) 2020-10-16 2020-10-16 签约数据更新方法、装置、节点和存储介质

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/988,431 Continuation US20230232240A1 (en) 2020-10-16 2022-11-16 Subscription data update method and apparatus, node, and storage medium

Publications (1)

Publication Number Publication Date
WO2022078214A1 true WO2022078214A1 (zh) 2022-04-21

Family

ID=74954136

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/121564 WO2022078214A1 (zh) 2020-10-16 2021-09-29 签约数据更新方法、装置、节点和存储介质

Country Status (7)

Country Link
US (1) US20230232240A1 (zh)
EP (1) EP4106372A4 (zh)
JP (1) JP2023544664A (zh)
KR (1) KR20230088627A (zh)
CN (2) CN117041955A (zh)
TW (1) TW202142010A (zh)
WO (1) WO2022078214A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117041955A (zh) * 2020-10-16 2023-11-10 中兴通讯股份有限公司 签约数据更新方法、装置、节点和存储介质
CN113316138B (zh) * 2021-04-27 2023-04-07 中盈优创资讯科技有限公司 一种应用层加密实现方法及其实现装置
CN117750349A (zh) * 2022-09-20 2024-03-22 维沃移动通信有限公司 参数获取方法、装置、第一网络功能及第二网络功能

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020031157A1 (en) * 2018-08-10 2020-02-13 Nokia Technologies Oy Method and apparatus for network function selection scheme in service based architecture of communication network
WO2020173863A1 (en) * 2019-02-27 2020-09-03 Telefonaktiebolaget Lm Ericsson (Publ) Non-public network authentication in 5g
CN112512044A (zh) * 2020-10-16 2021-03-16 中兴通讯股份有限公司 签约数据更新方法、装置、节点和存储介质

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020031157A1 (en) * 2018-08-10 2020-02-13 Nokia Technologies Oy Method and apparatus for network function selection scheme in service based architecture of communication network
WO2020173863A1 (en) * 2019-02-27 2020-09-03 Telefonaktiebolaget Lm Ericsson (Publ) Non-public network authentication in 5g
CN112512044A (zh) * 2020-10-16 2021-03-16 中兴通讯股份有限公司 签约数据更新方法、装置、节点和存储介质

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
SAMSUNG: "Support for AKMA context Deregistration option in AKMA", 3GPP DRAFT; S3-201968, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. e-meeting; 20200817 - 20200828, 7 August 2020 (2020-08-07), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051916491 *
See also references of EP4106372A4 *

Also Published As

Publication number Publication date
CN112512044A (zh) 2021-03-16
JP2023544664A (ja) 2023-10-25
KR20230088627A (ko) 2023-06-20
CN117041955A (zh) 2023-11-10
US20230232240A1 (en) 2023-07-20
EP4106372A1 (en) 2022-12-21
EP4106372A4 (en) 2024-02-07
TW202142010A (zh) 2021-11-01

Similar Documents

Publication Publication Date Title
US11431695B2 (en) Authorization method and network element
WO2022078214A1 (zh) 签约数据更新方法、装置、节点和存储介质
US20190182654A1 (en) Preventing covert channel between user equipment and home network in communication system
WO2021093164A1 (en) Method, device, and system for updating anchor key in a communication network for encrypted communication with service applications
WO2020088026A1 (zh) 一种基于通用引导架构gba的认证方法及相关设备
EP3284276B1 (en) Security improvements in a cellular network
US20230422032A1 (en) Session request method and apparatus, terminal, and storage medium
WO2021093162A1 (en) Method, device, and system for anchor key generation and management in a communication network for encrypted communication with service applications
EP4262257A1 (en) Secure communication method and device
US20220337408A1 (en) Method, Device, and System for Application Key Generation and Management in a Communication Network for Encrypted Communication with Service Applications
TWI837450B (zh) 密鑰再生方法及終端裝置
WO2023082161A1 (en) Secure information pushing by service applications in communication networks
WO2023216274A1 (zh) 密钥管理方法、装置、设备和存储介质
WO2022151464A1 (en) Method, device, and system for authentication and authorization with edge data network
US11432158B2 (en) Systems and methods for using a unique routing indicator to connect to a network
RU2801267C1 (ru) Способ, устройство и система для обновления привязочного ключа в сети связи для зашифрованной связи с приложениями предоставления услуг
US20240114057A1 (en) Secure user equipment policy data in a communication network environment
WO2023142102A1 (en) Security configuration update in communication networks
CN116546493A (zh) 一种基于云辅助的车联网认证密钥协商方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21879260

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2022555641

Country of ref document: JP

ENP Entry into the national phase

Ref document number: 2021879260

Country of ref document: EP

Effective date: 20220916

NENP Non-entry into the national phase

Ref country code: DE