WO2022087797A1

WO2022087797A1 - Information transmission method and apparatus

Info

Publication number: WO2022087797A1
Application number: PCT/CN2020/123784
Authority: WO
Inventors: 张博; 李飞; 邓娟; 何承东
Original assignee: 华为技术有限公司
Priority date: 2020-10-26
Filing date: 2020-10-26
Publication date: 2022-05-05
Also published as: CN116250263A

Abstract

Provided by the present application are an information transmission method and apparatus, relating to the technical field of communications, and solving the problem of security context synchronization when mobility management entity (MME) handover occurs in a terminal device. The method comprises: a first mobility management network element receiving a tracking area update (TAU) request message from a terminal device, said terminal device being handed over from a second network to a first network, said first mobile management network element belonging to said first network; according to the TAU request message, the mobility management network element setting a security context used between the first mobile management network element and the terminal device to be a native security context.

Description

An information transmission method and device

technical field

The present application relates to the field of communication technologies, and in particular, to an information transmission method and device.

Background technique

With the rapid development of wireless communication technology, the fifth generation (5G) mobile communication network (referred to as 5G network) came into being, and the 5G network can coexist with the existing fourth generation (4G) network. Interoperability can be achieved between the two. After the user equipment is switched from the 5G network to the 4G network, if the user equipment moves again, the handover between mobility management entities (MMEs) may be triggered. For example, the user equipment (UE1) switches from MME1 to MME2, then MME2 determines the security context type corresponding to the UE and MME2 according to the key set identifier (key set identifier in e-utran, eKSI) included in the tracking area update (TAU) request sent by the UE subsequently If the local storage is inconsistent, the MME2 will reject the TAU request of the UE, so that the UE cannot access the network again after a period of time, which affects the service continuity of the user equipment. The eKSI is used to identify the security context corresponding to the 4G network.

Security contexts include mapped types and native types. The native type refers to the security context generated in a communication system and used only in the communication system, for example, the local security context used in the 4G network, or the local security context negotiated after the 5G network authentication. The mapped type refers to the context generated in a communication system and used by other communication systems after deduction or processing.

For example, if the UE moves from a 5G network to a 4G network, the core access and mobility management function (AMF) in the 5G network will deduce the native security context used in the 5G network to get the mapping The security context is the mapped security context, and the mapped security context is sent to MME1. Therefore, the eKSI saved by the UE and MME1 is the mapped security context, and when the UE moves to trigger the switch from MME1 to MME2, MME2 determines the security context received from MME1 as the native security context, and MME2 according to the TAU request sent by the UE The eKSI carried in the message determines that the UE uses the mapped security context. MME2 cannot find the mapped security context locally. Therefore, MME2 fails to verify the UE's TAU message and sends a rejection message to the UE. The rejection message may also carry a rejection indication. , instructing the UE to access after a period of time, obviously this will seriously affect the continuity of UE services.

SUMMARY OF THE INVENTION

Embodiments of the present application provide an information transmission method and apparatus, so as to solve the problem of security context synchronization in a terminal device when an MME switch occurs.

In order to achieve the above purpose, the embodiment of the present application adopts the following technical solutions:

In a first aspect, an embodiment of the present application provides an information transmission method, which is applied to a first mobility management network element. The method includes: receiving a tracking area update TAU request message from a user equipment, and the user equipment switches from the second network to the first network element. network, the first mobility management network element belongs to the first network; according to the TAU request message, the security context used between the first mobility management network element and the user equipment is set as the native security context.

In the above technical solution, when the user equipment is switched from the second network to the first mobility management network element of the first network, the first mobility management network element can connect the first mobility management network element and the user equipment according to the TAU request message. The security context used between the two is unified as the native security context, and the native security context is the context used in the first network, so that the user equipment needs to be switched from the first mobility management network element to the first mobile management network element due to reasons such as movement. When other mobility management network elements in the network are used, the situation that the access of the user equipment is rejected by other mobility management network elements due to the asynchronous security context can be avoided, the service continuity of the user equipment is guaranteed, and the communication performance is improved.

In addition, the user equipment in each embodiment of the present application is just an example, and may be other types of terminal equipment.

In a possible implementation manner, setting the security context used between the first mobility management network element and the user equipment as the native security context includes: the first mobility management network element authenticates the user equipment.

In the above possible implementation manner, the first mobility management network element unifies the security context used with the user equipment into the native security context. Specifically, the first mobility management network element can trigger the authentication of the user, and after the authentication, the security context can be unified. It is the native type used in the first network, so that the security context between the first mobility management network element and other mobility management network elements in the first network and the user equipment can be synchronized, so that the user equipment can be When it is necessary to switch from the first mobility management network element to other mobility management network elements in the first network due to other reasons, the user equipment can be prevented from being rejected when accessing other mobility management network elements, and the service continuity of the user equipment can be guaranteed. sex.

In a possible implementation manner, the TAU request message includes status information of the user equipment, and the first mobility management network element authenticates the user equipment, specifically including: if the status information indicates that the user equipment switches from the second network to the first network, Or, the status information indicates the mobility management registration information of the second network of the user equipment, or the status information indicates that the user equipment has the network security capability of the second network, or the status information indicates that the user equipment has the capability of the N1 interface of the second network , the first mobility management network element authenticates the user equipment.

In the above possible implementation manner, the first mobility management network element may trigger the authentication of the user equipment according to the above state information confirming that the user equipment is switched from the second network to the first network, so as to unify the first mobility management network element with the user equipment. The security context used between user equipments is of the native type, so that when the user equipment needs to switch from the first mobility management network element to other mobility management network elements in the first network due to reasons such as movement, it can avoid security In the case that the access of the user equipment is rejected by other mobility management network elements due to the asynchronous context, the service continuity of the user equipment is improved. In addition, the judgment condition for triggering the authentication of the user equipment is highly flexible and easy to implement.

In a possible implementation manner, according to the TAU request message, the security context used between the first mobility management network element and the user equipment is set as the native security context, which specifically includes: the first mobility management network element determines according to the TAU request message The identifier of the user equipment; the first mobility management network element determines that the location of the user equipment changes according to the identifier of the user equipment; the first mobility management network element authenticates the user equipment.

In the above possible implementation manner, the first mobility management network element may determine that the user equipment will be switched between the mobility management network elements according to the position change of the user equipment, thereby triggering the authentication of the user equipment, so as to connect the first mobility management network element with the user equipment. The security context used between user equipments is of the native type, so that when the user equipment needs to switch from the first mobility management network element to other mobility management network elements in the first network due to reasons such as movement, it can avoid security In the case that the access of the user equipment is rejected by other mobility management network elements due to the context synchronization, the service continuity of the user equipment is improved.

In a possible implementation manner, the first mobility management network element determines that the location information of the user equipment changes according to the identifier of the user equipment, which specifically includes: the first mobility management network element determines, according to the identifier of the user equipment, that the user equipment needs to be switched to the first mobility management network element. 2. Mobile management network element.

In a possible implementation manner, according to the TAU request message, setting the security context used between the first mobility management network element and the user equipment as the native security context, including: determining the identity of the user equipment according to the TAU request message, and the TAU request The message includes an identification; first indication information corresponding to the identification is determined according to the identification, and the indication information comes from the AMF; and authentication of the user equipment is determined according to the first indication information.

In the above possible implementation manner, the first mobility management network element may trigger authentication of the user equipment according to the first indication information, thereby improving the flexibility of security context synchronization and improving the service continuity of the user equipment.

In a possible implementation manner, the first indication information is at least one of authentication indication information, or a 5G access type, or a tunnel identifier.

In the above possible implementation manner, the first mobility management network element may determine that the user equipment is switched from the 5G network to the first network according to at least one of the authentication indication information, or the 5G access type, or the tunnel identifier, so that the user equipment is switched from the 5G network to the first network. Triggering the authentication of the user equipment, when the user equipment needs to be switched from the first mobility management network element to other mobility management network elements in the first network due to reasons such as movement, it can avoid the security context being out of sync. When the access of the user equipment is rejected by other mobility management network elements, the flexibility of the security context synchronization is improved, and the service continuity of the user equipment is improved.

In a possible implementation manner, the first network is a 4G network, and the second network is a 5G network.

In a second aspect, an information transmission method is provided, which is applied to a first mobility management network element. The method includes: the first mobility management network element determines that a user equipment is switched from a second network to a first network, where the first network includes a first mobility management network. A management network element and a second mobility management network element; the first mobility management network element sends second indication information to the second mobility management network element, where the second indication information indicates the mapped security context of the user equipment, or indicates the second mobility management network The element authenticates the user equipment.

In the above possible implementation manner, in the scenario where the user equipment switches from the second network to the first network and then switches from the first mobility management network element to the second mobility management network element, the first mobility management network element can pass the switch to the second mobility management network element. The mobility management network element sends the second indication information, so that the second mobility management network element can synchronize the security context used between the second mobility management network element and the user equipment according to the instruction, thereby preventing the access of the user equipment from being rejected, Improve the business continuity of user equipment.

In a possible implementation manner, the second indication information includes at least one indication information among 5G security algorithms, or 5G wireless access types, 5G or next-generation wireless security capabilities, or tunnel identifiers.

In the above possible implementation manner, the first mobility management network element may send 5G network-related indication information to the second mobility management network element to indicate that the user equipment is switched from the 5G network to the first network, so that the second mobility management network element The mobility management network element can synchronize the security context with the user equipment through the above-mentioned indication information.

In a third aspect, an information transmission method is provided, which is applied to a second mobility management network element, the second mobility management network element belongs to a first network, the first network further includes a first mobility management network element, and a user equipment is a slave from the second network. Switching to the user equipment of the first network, the method includes: determining that the user equipment is switched from the first mobility management network element to the second mobility management network element; receiving second indication information from the first mobility management network element, the second indication information Indicating the security context of the user equipment is a mapped security context, or instructing the second mobility management network element to authenticate the user equipment; and determining the security context used between the second mobility management network element and the user equipment according to the second indication information.

In the above possible implementation manner, in the scenario where the user equipment switches from the second network to the first network and the first mobility management network element is switched to the second mobility management network element, the second mobility management network element The second indication information of a mobility management network element determines the synchronization of the security context with the user equipment, thereby preventing the second mobility management network element from rejecting the access of the user equipment, improving the service continuity of the user equipment and improving the communication performance.

In a possible implementation manner, the second indication information indicates that the security context of the user equipment is a mapped security context, and determining the security context used between the second mobility management network element and the user equipment according to the second indication information includes: determining the first security context. 2. The security context used between the mobility management network element and the user equipment is the mapped security context.

In the above possible implementation manner, the second mobility management network element may directly determine the security context used with the user equipment according to the security context of the user equipment indicated by the second indication information as the mapped security context, ignoring the locally saved security context type. The security context is mapped, thereby preventing the second mobility management network element from rejecting the access of the user equipment, and improving the service continuity of the user equipment.

In a possible implementation manner, the second indication information includes at least one type of indication information among 5G security algorithms, or 5G wireless access types, 5G or next-generation network security capabilities, or tunnel identifiers, and is determined according to the second indication information. The security context used between the second mobility management network element and the user equipment includes: determining the security context used between the second mobility management network element and the user equipment as a mapped security context.

In the above possible implementation manner, the second mobility management network element can determine that the user equipment is switched from the 5G network to the first network according to the above indication information, thereby improving the flexibility of the configuration of the second indication information and the synchronization of the security context. It is easier to implement and improves the business continuity of the user equipment.

In a possible implementation manner, the second indication information instructs the second mobility management network element to authenticate the user equipment, and the security context used between the second mobility management network element and the user equipment is determined according to the second indication information, including: The second mobility management network element authenticates the user equipment, and sets the security context used between the second mobility management network element and the user equipment as the local native security context.

In the above possible implementation manner, the second mobility management network element may also authenticate the user equipment according to the second indication information, and after the authentication, the security context used between the second mobility management network element and the user equipment can be unified as the local native. The security context avoids the rejection of user equipment access requests and ensures the service continuity of users.

In a fourth aspect, an information transmission apparatus is provided, the apparatus includes a receiving module configured to receive a tracking area update TAU request message from a user equipment, the user equipment switches from a second network to a first network, and the apparatus belongs to the first network; processing; The module is configured to set the security context used between the device and the user equipment as the native security context according to the TAU request message.

In a possible implementation manner, the processing module is specifically configured to: authenticate the user equipment.

In a possible implementation manner, the TAU request message includes status information of the user equipment, and the processing module is specifically configured to: if the status information indicates that the user equipment switches from the second network to the first network, or the status information indicates that the first network of the user equipment The mobility management registration information of the second network, or the status information indicates that the user equipment has the network security capability of the second network, or the status information indicates that the user equipment has the capability of the N1 interface of the second network, and the user equipment is authenticated.

In a possible implementation manner, according to the TAU request message, the processing module is specifically configured to: determine the identity of the user equipment according to the TAU request message; determine that the location of the user equipment changes according to the identity of the user equipment; and authenticate the user equipment.

In a possible implementation manner, the processing module is specifically configured to: determine, according to the identifier of the user equipment, that the user equipment needs to be handed over to the second mobility management network element.

In a possible implementation manner, the processing module is specifically configured to: determine the identifier of the user equipment according to the TAU request message, and the TAU request message includes the identifier; determine first indication information corresponding to the identifier according to the identifier, and the first indication information comes from the core Access and mobility management function AMF network element; determine to authenticate the user equipment according to the first indication information.

In a fifth aspect, an information transmission apparatus is provided, the apparatus comprising: a processing module configured to determine that the user equipment is switched from the second network to the first network, and determine that the user equipment is switched from the first mobility management network element to the second mobility management network element, the first network includes a device and a second mobility management network element; a sending module is configured to send second indication information to the second mobility management network element, where the second indication information indicates the mapped security context of the user equipment, or indicates the first 2. The mobile management network element authenticates the user equipment.

In a sixth aspect, an information transmission apparatus is provided, the apparatus belongs to a first network, the first network further includes a first mobility management network element, and the user equipment is a user equipment that is switched from the second network to the first network, characterized in that the apparatus It includes: a processing module for determining that the user equipment is switched from the first mobility management network element to the device; a receiving module for receiving second indication information from the first mobility management network element, the second indication information The security context instructing the user equipment is a mapped security context, or instructing the apparatus to authenticate the user equipment; the processing module is further configured to determine the security context used between the apparatus and the user equipment according to the second indication information.

In a possible implementation manner, the processing module is specifically configured to: when the second indication information indicates that the security context of the user equipment is the mapped security context, determine that the security context used between the apparatus and the user equipment is the mapped security context.

In a possible implementation manner, the processing module is specifically configured to: when the second indication information includes 5G security algorithm, or 5G wireless access type, 5G or next-generation network security capability, or at least one indication of tunnel identifier , and the security context used between the device and the user equipment is determined to be the mapped security context.

In a possible implementation manner, the processing module is specifically configured to: when the second indication information instructs the apparatus to authenticate the user equipment, authenticate the user equipment, and set the security context used between the apparatus and the user equipment to local native security context.

In a seventh aspect, a communication device is provided, the communication device comprising a processor and a transmission interface; wherein the processor is configured to execute instructions stored in a memory, so that the device performs any one of the above-mentioned first aspects. one of the methods described.

In an eighth aspect, a computer-readable storage medium is provided, comprising a program or an instruction, when the program or instruction is executed by a processor, the method according to any one of the above-mentioned first aspect is performed.

In a ninth aspect, there is provided a computer program product which, when the computer program product is run on a computer or a processor, causes the computer or the processor to perform the method according to any one of the above first aspects.

A tenth aspect provides a communication device, characterized in that the communication device includes a processor and a transmission interface; wherein the processor is configured to execute instructions stored in a memory, so that the device executes the above-mentioned The method of any one of the second aspects.

In an eleventh aspect, a computer-readable storage medium is provided, which is characterized in that it includes a program or an instruction, and when the program or instruction is executed by a processor, the method according to any one of the above-mentioned second aspect is executed. .

A twelfth aspect provides a computer program product that, when the computer program product is run on a computer or a processor, causes the computer or the processor to execute the method according to any one of the second aspects above .

A thirteenth aspect provides a communication device, characterized in that the communication device includes a processor and a transmission interface; wherein the processor is configured to execute instructions stored in a memory, so that the device executes the The method of any one of the third aspects above.

A fourteenth aspect provides a computer-readable storage medium, characterized in that it includes a program or an instruction, and when the program or instruction is executed by a processor, the method according to any one of the third aspect above is executed .

A fifteenth aspect provides a computer program product that, when the computer program product is run on a computer or a processor, causes the computer or the processor to execute the method according to any one of the third aspects above .

A sixteenth aspect provides a communication system, characterized by comprising the device according to any one of the foregoing second aspect and the device according to any one of the foregoing third aspect.

It can be understood that any information transmission method, communication device, communication system, computer-readable storage medium or computer program product provided above can be implemented by the corresponding method provided above. Therefore, it can achieve For the beneficial effects, reference may be made to the beneficial effects in the corresponding methods provided above, which will not be repeated here.

Description of drawings

1 is a schematic diagram of a communication system provided by an embodiment of the present application;

FIG. 2 is a schematic flowchart of an information transmission method provided by an embodiment of the present application;

FIG. 3 is an implementation flow chart 1 of an information transmission method provided by an embodiment of the present application;

4 is a schematic flowchart of another information transmission method provided by an embodiment of the present application;

FIG. 5 is a second implementation flow chart of an information transmission method provided by an embodiment of the present application;

FIG. 6 is a third implementation flowchart of an information transmission method provided by an embodiment of the present application;

FIG. 7 is a schematic diagram of an information transmission apparatus provided by an embodiment of the present application;

FIG. 8 is a schematic diagram of another information transmission apparatus provided by an embodiment of the present application;

FIG. 9 is a schematic diagram of another information transmission apparatus provided by an embodiment of the present application;

FIG. 10 is a schematic diagram of a communication apparatus according to an embodiment of the present application.

Detailed ways

The terms "first", "second" and "third" in the description and claims of the present application and the drawings are used to distinguish different objects, rather than to limit a specific order. In the embodiments of the present application, words such as "exemplary" or "for example" are used to represent examples, illustrations or illustrations. Any embodiments or designs described in the embodiments of the present application as "exemplary" or "such as" should not be construed as preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "such as" is intended to present the related concepts in a specific manner.

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

First, in order to facilitate the understanding of the present application, the related technologies involved in the embodiments of the present application are now described.

4G network and 5G network interworking architecture:

As shown in Figure 1, it is a schematic diagram of the existing 4G network and 5G network interworking architecture. Among them, 4G network and 5G network share user plane function (UPF) network element + PDN gateway user plane function (PDN gateway user plane function, PGW-U) network element, session management function (session management function, SMF) Network element + PDN gateway control plane function (PDN gateway control plane function, PGW-C) network element, policy control function (policy control function, PCF) network element + policy and charging rules function (policy and charging rules function, PCRF) Network element, home subscriber server (HSS) + unified data management (unified data management, UDM) network element. Here "+" means co-location, UPF is the user plane function of 5G network, PGW-U is the gateway user plane function of 4G network corresponding to UPF, SMF is the session management function of 5G network, PGW-C is corresponding to SMF The gateway control plane function in the 4G network, the PCF is the policy control function of the 5G network, and the PCRF is the policy charging rule function of the 4G network corresponding to the PCF. In the embodiments of this application, for the convenience of description, the HSS+UDM network element is referred to as the user data management network element, and the PGW-C network element+SMF network element is referred to as the control plane function network element. The following description will not be repeated. Of course, other names may also be used for the above-mentioned combined network device, which is not specifically limited in this embodiment of the present application.

In addition, as shown in FIG. 1 , the above-mentioned 4G network and 5G network interworking architecture may further include an MME and a Serving Gateway (SGW) in the 4G network, and an AMF network element in the 5G network. Optionally, the 4G network and 5G network interworking architecture may further include a network slice selection function (network slice selection function, NSSF) network element. Wherein, when the AMF network element cannot select a network slice for the terminal, the AMF network element may request the NSSF network element to select a network slice for the terminal, which is not specifically limited in this embodiment of the present application.

Among them, the terminal is connected to the 4G network through the evolved universal terrestrial radio access network (E-UTRAN) equipment, and the terminal is connected to the 4G network through the next generation radio access network (NG-RAN) equipment Access to 5G network. The E-UTRAN device communicates with the MME through the S1-MME interface, the E-UTRAN device communicates with the SGW through the S1-U interface, the MME communicates with the SGW through the S11 interface, the MME communicates with the user data management network element through the S6a interface, and the MME communicates with the user data management network element through the N26 interface. Communicate with AMF network element, SGW communicates with PGW-U network element+UPF network element through S5-U interface, SGW communicates with PGW-C network element+SMF network element through S5-C interface, PGW-U network element+UPF network element Element communicates with NG-RAN equipment through N3 interface, PGW-U network element+UPF network element communicates with PGW-C network element+SMF network element through N4 interface, PGW-C network element+SMF network element communicates with PCRF network element through N7 interface NE+PCF NE communicates, HSS+UDM NE communicates with PGW-C NE+SMF NE through N10 interface, HSS+UDM NE communicates with AMF NE through N8 interface, PCRF NE+PCF NE communicates with N15 The interface communicates with the AMF network element, the PGW-C network element + SMF network element communicates with the AMF network element through the N11 interface, the AMF network element communicates with the NG-RAN equipment through the N2 interface, and the AMF network element communicates with the terminal through the N1 interface.

It should be noted that the name of the interface between each network element in FIG. 1 is just an example, and the name of the interface may be other names in a specific implementation, which is not specifically limited in this embodiment of the present application.

It should be noted that the NG-RAN device in the 5G network can also be called an access device, and the access device refers to a device that accesses the core network, such as a base station, a broadband network gateway, BNG), aggregation switches, non-3GPP access devices, etc. The base station may include various forms of base stations, for example, a macro base station, a micro base station (also referred to as a small cell), a relay station, an access point, etc., which are not specifically limited in this embodiment of the present application.

Of course, 4G network and 5G network may also have other network elements. For example, 4G network may also include general packet radio system (GPRS) service support node (serving GPRS support node, SGSN), etc. 5G The network may also include an authentication server function (authentication server function, AUSF) network element, etc., which is not specifically limited in this embodiment of the present application.

The network architecture and service scenarios described in the embodiments of the present application are for the purpose of illustrating the technical solutions of the embodiments of the present application more clearly, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. The evolution of the architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

Combined with the communication system architecture shown in Figure 1 above, this application is mainly applied to the scenario of intercommunication between 5G network and 4G network. After the user equipment switches from 5G network to 4G network, if the user equipment switches between MMEs again, because User equipment access is denied due to the security context being out of sync. Among them, handover means that when the user equipment moves from the coverage area of one base station to the coverage area of another base station during the communication process, or when the communication quality is degraded due to external interference, it needs to switch to a new channel to continue to maintain the service. process.

Wherein, the re-occurrence of handover between MMEs of the user equipment mainly includes the following scenarios 1 and 2. Scenario 1 refers to that after the user equipment moves from the AMF of the 5G network to the MME1 of the 4G network, when the MME1 determines that the movement of the user equipment causes If it is necessary to switch from MME1 to MME2 again, the security context carried in the relocation request message sent by MME1 to MME2 is the mapped security context. In the specific implementation of the prior art, MME2 does not obtain the type of the security context. According to the fact that the relocation request message is sent from the MME1 of the 4G network, the security context is considered to be the native security context, that is, it is stored as the native security context. context. Therefore, after MME2 receives the TAU request sent from the user equipment, according to the inconsistency between the mapped security context carried in the TAU request and the native security context stored locally corresponding to the user equipment, MME2 will reject the TAU request of the user equipment and send The rejection indication, for example, the rejection indication TAU#9 may be sent, so that the user equipment can only access again after a period of time, thus seriously affecting the continuity of the UE service.

The second scenario is that after the user equipment moves from the AMF of the 5G network to the MME1 of the 4G network, the user equipment establishes a non-access stratum (NAS) connection with MME1, and then the user equipment enters the idle state and moves in the idle state. , when the user equipment moves out of the coverage of MME1, the user equipment sends a TAU request message to MME2, and MME2 determines that the user equipment is from MME1 according to the user identity carried in the TAU request message. Therefore, MME2 actively requests a security context from MME1. MME1 replies with a security context response message to MME2. Similarly, in the specific implementation of the prior art, MME2 does not acquire the security context type, and MME2 does not know whether the received security context is native type or mapped type. According to the security context response message, MME2 comes from the 4G network MME1, so it will determine the security context as the native context, that is, save it as the native security context. Therefore, according to the inconsistency between the mapped security context carried in the TAU request and the native security context corresponding to the user equipment stored locally, MME2 will reject the TAU request of the user equipment and send a rejection indication, for example, may send a rejection indication TAU#9, As a result, the user equipment can only access again after a period of time, which seriously affects the continuity of UE services.

Combined with the communication network structure of FIG. 1 and the above-mentioned implementation scenario, the present application provides an information transmission method to solve the problem of synchronization of security contexts when user equipment is switched over to MME, and to avoid the access of user equipment due to unsynchronized security contexts. the case of rejection. As shown in Figure 2, the method may include:

201: The first mobility management network element receives a tracking area update TAU request message from the user equipment.

The user equipment is switched from the second network to the first network, and the first mobility management network element belongs to the first network.

In one embodiment, the first network may be a 4G network, the second network may be a 5G network, and the first mobility management network element may be MME1, that is, the user equipment is connected by switching from the 5G network to the 4G network MME1. Alternatively, in an embodiment, the first network may be a 5G network, and the second network may be a next-generation or previous-generation mobile communication network, such as a sixth generation (6G) network or a 4G network. This application does not specifically limit this.

In an implementation manner, the mobility management network element may specifically be the MME shown in FIG. 1 above, or may be other network elements with similar functions. This application does not specifically limit this.

202: The first mobility management network element sets the security context used between the first mobility management network element and the user equipment as the native security context according to the TAU request message.

Specifically, in the above step 202, setting the security context used between the first mobility management network element and the user equipment as the native security context may include:

The first mobility management network element triggers authentication of the user equipment, so that the security contexts between the first MME and the user equipment are unified into a native security context.

In an implementation manner, the TAU request message may include state information of the user equipment, and the first mobility management network element determines to trigger the authentication of the user equipment, which may specifically include at least one of the following:

1. If the state information of the user equipment indicates that the user equipment is switched from the second network to the first network, the first mobility management network element authenticates the user equipment.

Exemplarily, the TAU request message may include indication information, and the indication information may be used to indicate that the user equipment is switched from the 5G network to the 4G network, or the indication information may be used to indicate that the TAU request message is that the user equipment is TAU request after switching from 5G network to 4G network. Then MME1 triggers authentication for the UE.

Specifically, the authentication can be performed through the authentication and key agreement (authentication and key agreement, AKA). Exemplarily, if the MME1 does not have the international mobile subscriber identity (IMSI) of the UE, the MME1 sends an identity request message to the UE, and after obtaining the IMSI from the UE, sends the IMSI to the home subscriber server (home subscriber server). , HSS), and obtain the authentication vector, and then perform authentication. Or if the MME1 stores the IMSI or requests the IMSI from other MMEs, it sends the IMSI to the HSS, and after obtaining the authentication vector, performs authentication.

For the specific process of performing authentication, reference may be made to the description of the related art, which is not specifically limited in this application.

2. If the state information of the user equipment indicates the mobility management registration information of the second network of the user equipment, the first mobility management network element authenticates the user equipment.

Exemplarily, the status information available in the TAU request message may be mobility management registration information. For example, it includes UE status, which is used to indicate whether the UE has been registered in 5G mobility management (Mobility Management, MM). If the UE has been registered in 5GMM, MME1 determines the security context corresponding to the UE as mapped.

3. If the state information of the user equipment indicates that the user equipment has the network security capability of the second network, the first mobility management network element authenticates the user equipment.

For example, the TAU request message may include the network security capabilities of the user equipment, for example, UE 5G security capabilities, or next-generation wireless security capabilities.

4. If the state information of the user equipment indicates that the user equipment has the capability of the N1 interface of the second network, the first mobility management network element authenticates the user equipment.

For example, the N1 interface is the interface between the UE and the AMF.

In another embodiment, in the above step 202, the first mobility management network sets the security context used between the first mobility management network element and the user equipment as the native security context according to the TAU request message, which may further include:

Step1: The first mobility management network element determines the identifier of the user equipment according to the TAU request message.

Wherein, the TAU request message can carry the identity of the user equipment, for example, a globally unique temporary UE identity (globally unique temporary UE identity, GUTI), or an international mobile subscriber identity (international mobile subscriber identity, IMSI).

Step 2: The first mobility management network element determines, according to the identifier, first indication information corresponding to the identifier.

The first indication information may specifically be authentication indication information, or a tunnel identifier, or an access type.

Wherein, the authentication indication information; or the tunnel identifier, or the access type is used to instruct the user equipment to be authenticated, and the first indication information comes from the AMF network element.

The MME1 may determine to trigger authentication for the user according to the authentication indication information, the tunnel identifier, or the access type. For example, if it is determined by the tunnel identifier that the peer end is a 5G network, or it is determined by the access type that it is an access mode of the 5G network, the authentication of the user is triggered.

It should be noted that the authentication indication information may be carried in the forward relocation request message from the AMF before the first mobility management network receives the TAU request from the user equipment. The authentication indication information can be used to indicate that the user equipment is from a 5G network, and authentication can be triggered for the device to synchronize the security context. The specific implementation process will be introduced in the following detailed embodiments, and will not be repeated here.

Alternatively, the authentication indication information may also be sent to the AMF after the first mobility management network receives the TAU request from the user equipment, and is carried in the context response message sent by the AMF. The authentication indication information can be used to indicate that the user equipment is from a 5G network, and authentication can be triggered for the device to synchronize the security context. The specific implementation process will be introduced in the following detailed embodiments, and will not be repeated here.

In an implementation manner, the first indication information may also be a tunnel identifier, where the tunnel identifier includes a tunnel identifier used to indicate that the AMF is an AMF in a 5G network; it may be a tunnel identifier of GTP-C.

In addition, the first indication information may also be an access type, which is used to indicate that the current network is an access type of a 5G network or an access type of a 5G wireless network; or may be a RAT type.

Step 3: The first mobility management network element determines to authenticate the user equipment according to the first indication information.

MME1 determines the first indication information corresponding to the UE according to the UE's identity, triggers authentication with the UE, establishes a unified native security context between MME1 and the UE, and then executes the handover process from MME1 to MME2.

Through the above-mentioned embodiments of the present application, when the user equipment switches from the second network to the first network, and the user equipment moves in position, so that the user equipment needs to perform handover between the mobility management network elements MMEs, the MME can trigger the user equipment The device is authenticated. For example, when the user equipment is handed over from MME1 to MME2, MME1 may trigger authentication of the user equipment. In the prior art, the authentication process is not necessary, but it is determined in the embodiments of the present application that in this scenario, the MME triggers the authentication of the user equipment to synchronize the type of security context.

After the authentication is performed, the native security context is saved between the user equipment and MME1, and when the switching process from MME1 to MME2 is executed, the security context type inconsistency will not occur, and the user equipment will not be blocked due to the inconsistency of security contexts. MME2 denies access, thereby improving the service continuity of the user equipment.

In the following, the communication process corresponding to the above-mentioned embodiment of the present application will be described by taking the first network as a 4G network, the second network as a 5G network, and the first mobility management network element as the MME1 as an example in combination with the above scenarios. As shown in FIG. 3 , the base station of the 4G network may be an eNB, and the base station of the 5G network may be a gNB or an ng-eNB.

301: The gNB/ng-eNB sends a handover request message to the AMF.

When the base station of the 5G network recognizes that the user equipment needs to be handed over, it sends a handover required message to the AMF.

302: The AMF sends a forward relocation request message, including the eKSI, to MME1.

When the AMF determines that the user equipment needs to switch to the 4G network, it obtains the eKSI according to the local 5G KSI (referred to as ngKSI) of the AMF, which is used to indicate that the security context corresponding to the user equipment is the mapped security context.

The AMF sends a forward relocation request message forward relocation request to MME1, where the forward relocation request message includes the eKSI, and the type of the security context indicated by the forward relocation request message is the mapped security context. Here, the eKSI is used to identify the corresponding security context, for example, it may include the Kasme key; it may also include the protection key and protection algorithm of the NAS. It should be noted that the eKSI information may include a counter for identifying the security context and a type of security context flag (type of security context flag, TSC). Among them, TSC is used to identify the type of security context, which can be native or mapped.

According to the specific implementation of the standard, only the counter identifying the security context is sent in the forward relocation request message, but the TSC part is not included. Therefore, MME1 does not know whether the received security context is of native type or mapped type.

In addition, as shown in Step 2 in the foregoing embodiment, the forward relocation request message sent by the AMF to the MME1 may further include first indication information, which is used to instruct the MME1 to authenticate the user equipment.

Specifically, the first indication information may be authentication indication information. According to Step 2 in the foregoing embodiment, the first indication information may also be a tunnel identifier, that is, the forward relocation request message sent by the AMF to MME1 may also be Including a tunnel identifier, where the tunnel identifier includes a tunnel identifier used to indicate that the AMF is an AMF in the 5G network; it can be a GTP-C tunnel identifier.

In addition, according to what is shown in Step 2 in the foregoing embodiment, the first indication information may also be the access type, that is, the forward relocation request message sent by the AMF to the MME1 may also include the access type, which is used to indicate the current network is the access type of the 5G network or the access type of the 5G wireless network; or the first indication information may also be the access type, such as RAT type.

303: MME1 sends an S1 handover request to the eNB.

304: The eNB sends an S1 handover response to the MME1.

The configuration of the eNB will be included here, and the specific content may refer to the relevant description of the prior art, which is not limited in this application.

305: MME1 sends a forward relocation response message to the AMF.

MME1 sends a forward relocation response message to AMF.

306: The AMF sends a handover response message to the gNB/ng-eNB.

307: The gNB/ng-eNB sends a handover response message to the user equipment.

308: The user equipment generates eKSI information, and the security context corresponding to the eKSI is the mapped security context.

Specifically, the UE generates an indication that the eKSI is the mapped security context according to the indication that the local ngKSI (used to identify the security context of the 5G network) is the native security context. Here, the location where the UE side generates the eKSI is not limited, and it may be regenerated when sending the TAU request message to the MME1.

309: The user equipment sends a handover complete message to the eNB.

310: The eNB sends a handover request message to MME1.

311: The user equipment sends a TAU request message to MME1.

The TAU request message may carry the GUTI identifier of the user equipment and the corresponding eKSI. eKSI indicates a mapped context. Here, the GUTI may be generated for the above steps of MME1 (for example, generated in step 305), and sent to the UE through the AMF.

According to a possible implementation of step 202 in the above embodiment, the TAU request message may include the status information of the user equipment. For example, the status information of the user equipment indicates that the user equipment is switched from a 5G network to a 4G network. Or, the status information of the user equipment is UE status to indicate whether the UE has been registered in 5GMM. Or, the status information of the user equipment indicates the 5G wireless security capability of the user equipment, or the indication information such as the wireless security capability of the next generation network. Or, the state information of the user equipment is used to indicate that the TAU request message is a TAU message after switching from 5G to 4G.

In addition, according to Step 1 to Step 3 in the above embodiment, MME1 may also obtain authentication indication information corresponding to the user equipment according to the GUTI identifier of the user equipment carried in the TAU request message, so that MME1 can obtain authentication indication information corresponding to the user equipment according to the authentication indication information. , or the tunnel ID, or the access type is determined to trigger authentication for the user. For example, if the peer end is determined to be a 5G network through the tunnel identifier, or the access mode of the previous 5G network is determined through the access type, then the authentication of the user is triggered.

312: The MME1 triggers the authentication of the user equipment according to the TAU request message, and generates a new security context, thereby determining the security context used between the MME1 and the user equipment as the native security context.

After the authentication between the user equipment and the MME1 and the security mode control (security mode control, SMC) of the NAS are completed, the user equipment and the MME1 share the native security context. According to the description of the prior art, after the authentication and the security mode control of the NAS are currently performed, the security context determined by both parties is the native security context.

In another implementation manner, after the user equipment is switched from the second network to the first network, the user equipment establishes a NAS connection with the first mobility management network element, which belongs to the connected state, that is, the aforementioned embodiments of the present application can be applied Scene two. Then in the above-mentioned step 202, the first mobility management network element, according to the TAU request message, sets the security context used between the first mobility management network element and the user equipment as the native security context, and specifically can also include:

The first mobility management network element may trigger the authentication of the user equipment according to the position change of the user equipment, so that the security context used between the first mobility management network element and the user equipment is set as the native security context.

3, after step 311 in the above embodiment, the user equipment can establish a NAS connection with the first mobility management network element (MME1), and the user equipment enters the connection state at this time. At this time, the MME1 in step 312 may trigger the authentication of the user equipment according to the TAU request message, which may further include:

The first mobility management network element may trigger authentication of the user equipment according to the location change of the user.

Wherein, the first mobility management network element triggers authentication of the user equipment according to the location change of the user, which may specifically include:

Step 1: The first mobility management network element determines the identifier of the user equipment according to the TAU request message.

Exemplarily, taking the first mobility management network element as MME1 as an example, after the UE switches from the 5G network to the 4G network, the UE establishes a NAS connection with the MME1, which belongs to the connected state. The MME1 may acquire the identity of the user equipment according to the GUTI identity carried in the TAU request message. Optionally, the identifier of the user equipment here may be a permanent identifier or a GUTI identifier.

Step 2: The first mobility management network element determines that the location of the user equipment changes according to the identifier of the user equipment.

The determination by the first mobility management network element that the location information of the user equipment has changed according to the identifier of the user equipment mainly refers to: the first mobility management network element determines, according to the identifier of the user equipment, that the user equipment needs to be switched to the second mobility management network element. .

Exemplarily, the location change of the user equipment may specifically mean that the location of the user equipment moves out of the range of MME1, and the user equipment needs to perform handover between MMEs, for example, handover from MME1 to MME2.

Wherein, the location information of the user equipment may come from the information reported by the network equipment received by the first mobility management network element. Specifically, the location information of the user equipment may be obtained from the base station, for example, the base station regularly reports the change of the location information of the user equipment. For example, here the base station reports the tunnel identifier and measurement information between the base station bound to the user equipment and the MME. Here, the tunnel identifier between the base station and the MME is related to the user equipment. It can be distributed for MME or base station without limitation. The MME determines the identifier of the UE according to the tunnel identifier between the base station and the MME, and then determines whether the handover of the MME needs to be performed according to measurement information and the like. The content of the information uploaded by the specific base station and the operation manner in which the MME 1 determines that the MME handover needs to be performed may refer to the prior art without limitation.

Alternatively, the location information of the user equipment may come from a location management network element, and the location management network element is used to monitor the location information of the user equipment. Exemplarily, the GUTI or IMSI of the UE may be sent to the location management network element for MME1, and when the location management network element detects that the location of the UE changes, the location information of the UE is sent to the MME1.

In addition, MME1 may also determine whether to perform MME handover, such as handover from MME1 to MME2, according to the UE location related message carried in the handover request (handover required) sent by the network device eNB. Here, the manner of judging whether the MME handover needs to be performed may refer to the prior art, which is not limited in this application.

Step 3: The first mobility management network element authenticates the user equipment.

When the MME1 determines that the handover of the MME needs to be performed, the MME1 triggers the authentication of the user equipment.

Optionally, if MME1 determines that MME handover needs to be performed, and MME1 has performed two-way authentication with the user equipment before, the authentication for the user equipment does not need to be triggered again.

Optionally, if MME1 determines that MME handover needs to be performed, and MME1 and the user equipment have been unified into a native security context before, the authentication for the user equipment does not need to be triggered again.

Among them, when MME1 determines that the location of the UE will exceed the range of the tracking area (TA), or exceeds the range covered by MME1, MME1 triggers authentication with the UE, and the MME1 and the UE are unified as the native security context. , and then execute the handover process from MME1 to MME2.

Through the above-mentioned embodiments provided in the present application, when the user equipment switches from the second network to the first network, the user equipment moves in position, and when it is determined that the user equipment is about to switch between mobility management network elements, the user equipment is triggered again. In the scenario where the user equipment needs to perform handover between mobility management network elements due to authentication, the mobility management network element can trigger the authentication of the user equipment, so that the security context between the user equipment and the mobility management network element is synchronized. When the handover process between mobility management network elements is performed, the problem of inconsistent security context types will not occur, and the problem of rejection of the TAU request of the user equipment will be avoided, thereby improving the service continuity of the user equipment.

Optionally, to determine whether authentication is required here, it is also possible to combine the status information of the user equipment carried in the previous TAU message and the indication information 1 received by the MME1 from the AMF. The indication information 1 here may be authentication indication information; or a tunnel identifier, or an access type. For example, authentication is performed only when inter-MME handover is required, and the TAU carries the state information of the user equipment, or after receiving indication information 1 from the AMF.

In another embodiment, when the user equipment switches from the second network to the first network, the user equipment moves in position and when it is determined that the user equipment is about to switch between mobility management network elements, for example, the user equipment switches to the MME2 In the scenario of requesting to switch from MME1 to MME2, through specific indication information, MME2 can still synchronize the security context with the user equipment, thereby improving the service continuity of the user equipment.

This embodiment of the present application provides another method for information transmission. As shown in FIG. 4 , the method may include:

401: The first mobility management network element determines that the user equipment is switched from the second network to the first network.

The first network includes a first mobility management network element and a second mobility management network element.

Exemplarily, the first network may be a 4G network, and the second network may be a 5G network. The first mobility management network element may be MME1, and the second mobility management network element may be MME2. The UE switches from the 5G network to the 4G network.

In addition, the first mobility management network element determines that the user equipment needs to be handed over from the first mobility management network element to the second mobility management network element. That is to say, the first mobility management network element determines that the user equipment moves, and it is necessary to perform handover between the mobility management network elements.

402: The first mobility management network element sends second indication information to the second mobility management network element.

Wherein, in an implementation manner, the second indication information may indicate that the security context corresponding to the user equipment is a mapped security context. Or the second indication information may be to instruct the second mobility management network element to authenticate the user equipment.

In one embodiment, if the second network is a 5G network, the second indication information may include at least one indication information among a 5G security algorithm, or a 5G wireless access type, or a 5G wireless security capability, or a tunnel identifier.

403: The second mobility management network element receives the second indication information from the first mobility management network element.

404: The second mobility management network element determines, according to the second indication information, a security context used between the second mobility management network element and the user equipment.

The second mobility management network element determines the security context used between the second mobility management network element and the user equipment according to the second indication information, which may specifically include the following three ways.

Manner 1: The second indication information indicates that the security context of the user equipment is the mapped security context, and the second mobility management network element determines that the security context used with the user equipment is the mapped security context.

Mode 2. The second indication information may be obtained according to some parameters of the user equipment sent by the first mobility management network element. For example, the second indication information includes 5G security algorithm, or 5G wireless access type, 5G or next-generation network security capability, or at least one type of indication information in the tunnel identifier, determine that the security context used between the second mobility management network element and the user equipment is the mapped security context.

Mode 3: If the second indication information instructs the second mobility management network element to authenticate the user equipment, the second mobility management network element authenticates the user equipment according to the second indication information, and the second mobility management network element and the user equipment are authenticated. The security context used between them is set or unified to the local native security context.

Through the above-mentioned embodiments provided in this application, when the user equipment switches from the second network to the first network, the user equipment moves in position, and when it is determined that the user equipment is about to switch from the first mobility management network element to the second mobility management network element , the second mobility management network element may determine to synchronize the security context with the user equipment through the second indication information carried by the first mobility management network element, or the second mobility management network element may use the second mobility management network element to carry the second The instruction information authenticates the user equipment, so that the security context between the second mobility management network element and the user equipment is synchronized as the native security context, then the second mobility management network element will not reject the user equipment due to the inconsistency of the security context types. TAU request, thereby improving the service continuity of the user equipment.

In the following, in combination with the above scenarios, taking the first network as a 4G network, the second network as a 5G network, the first mobility management network element as MME1, and the second mobility management network element as MME2 as an example, the implementation scenario is that the user equipment switches from 5G to After the network is switched to the 4G network, the user equipment moves and needs to be switched from MME1 to MME2 as an example to describe the communication flow corresponding to the above-mentioned embodiment of the present application. As shown in FIG. 5 , the base station of the 4G network may be an eNB, and the base station of the 5G network may be a gNB or an ng-eNB.

For steps 301 to 310, reference may be made to the relevant descriptions in the foregoing embodiments.

501: The eNB sends a handover request message to MME1.

It is used to indicate that the user equipment needs to perform handover.

502: MME1 determines that the user equipment needs to be handed over to MME2.

This step may correspond to the description in step 401 in the foregoing embodiment: the first mobility management network element determines that the user equipment needs to be handed over from the first mobility management network element to the second mobility management network element.

Specifically, MME1 may determine that the user equipment needs to be switched to MME2 according to the position movement of the user equipment. For a specific implementation manner, reference may be made to the related description of the prior art, which is not specifically limited in this embodiment of the present application.

503: MME1 sends a forward relocation request message to MME2, where the forward relocation request message carries the second indication information.

This step may correspond to step 402 in the foregoing embodiment. The second indication information may specifically include:

1. The second indication information indicates that the security context of the user equipment is the mapped security context.

2. The second indication information includes at least one indication information among 5G security algorithms, or 5G wireless access types, 5G or next-generation network security capabilities, or tunnel identifiers. It is used to instruct the MME2 to determine the security context according to the first indication information.

3. The second indication information may specifically be authentication indication information, which is used to instruct the MME2 to authenticate the user equipment corresponding to the forward relocation request message.

504: MME2 replies with a forward relocation response message to MME1.

505: The MME2 determines the security context used with the user.

This step may correspond to step 404 in the foregoing embodiment, that is, MME2 may determine the security context used between MME2 and the user equipment according to the second indication information from MME1.

Specifically, the MME2 determines whether the security context used with the user equipment is the mapped type or the native type, which may include:

1. When the second indication information indicates that the security context corresponding to the user equipment is the mapped security context, the MME2 determines that the security context used with the user equipment is the mapped security context.

2. When the second indication information includes 5G security algorithm, or 5G wireless access type, 5G or next-generation network security capability, or at least one kind of indication information of tunnel identification, MME2 determines the security used between the user equipment and the user equipment. The context is the mapped security context.

3. When the second indication information is authentication indication information, the MME2 saves the authentication indication information corresponding to the user equipment.

After receiving the TAU request message sent by the user equipment, the MME2 can obtain the corresponding authentication indication information according to the identifier of the user equipment, so as to authenticate the user equipment.

Or, after receiving the TAU request message sent by the user equipment, the MME2 first determines whether the eKSI of the user equipment has a corresponding security context according to the identity of the user equipment, such as GUTI (for example, the eKSI indicates the mapped type security context, and the local storage is native type security context, the security context corresponding to eKSI is not saved), if there is no corresponding security context, and the authentication indication information corresponding to the user equipment is saved at the same time, then the user equipment is directly triggered according to the authentication indication to be authenticated, so that The security context used between the MME2 and the user equipment is set to the local native security context.

Or, in the forward relocation request message, the forward relocation request message does not carry the second indication information, and MME2 regards the security context received from MME1 as the native type security context by default. After the MME2 receives the TAU request message sent by the user equipment, the following possible manners are performed.

Manner 1: MME2 updates the local native security context corresponding to the user equipment to the mapped security context, ignoring the locally saved security context, so as to maintain synchronization with the security context of the user equipment.

Manner 2: MME2 can ignore the security context type indicated by eKSI in the TAU request message. By default, the eKSI and the locally saved context type are consistent, that is, it is determined that the security context synchronization used between MME2 and the user equipment is of the native type.

Manner 3: When the received type is mapped and the locally stored one is native, the MME2 triggers authentication of the user equipment, so that the security context used between the MME2 and the user equipment is synchronized to the native security context.

Manner 4: The MME2 triggers authentication of the user equipment according to the authentication indication information carried in the TAU request message sent by the user equipment, so that the security context used between the MME2 and the user equipment is synchronized to the native security context.

Any of the above manners can realize synchronization of security contexts, and the communication system can preselect at least one of the strategies to configure the network elements designed in the foregoing embodiments, so as to realize synchronization of security contexts of user equipments in the foregoing scenarios. The specific configuration manner is not limited in this application.

Through the above-mentioned embodiments provided in this application, the second indication information is configured in the slave location request message sent by the MME, so that when the user equipment switches from the 5G network to the 4G network, the user equipment moves in position, and when it is determined that the user equipment is about to occur MME1 When switching to MME2, MME2 may determine to synchronize the security context with the user equipment through the second indication information carried by MME1, or MME2 may authenticate the user equipment through the second indication information carried by MME1, so that there is a connection between MME2 and the user equipment. The security context is synchronized to the native security context, then the MME2 will not reject the TAU request of the user equipment due to the inconsistency of the security context types, thereby improving the service continuity of the user equipment.

In addition, the embodiment of the present application also provides another information transmission method, which is applicable to the above-mentioned second scenario, that is, after the user equipment moves from the AMF of the 5G network to the MME1 of the 4G network, the user equipment establishes a non-access stratum (non-access layer) with MME1. stratum, NAS) connection, after that, the user equipment enters an idle state, and moves in the idle state. When the user equipment moves out of the coverage of MME1, the user equipment sends a TAU request message to MME2. This application provides another information transmission method, so that MME2 can determine the synchronization of the security context used between MME2 and the user equipment according to the message obtained from MME1, thereby avoiding the rejection of the TAU request of the user equipment and affecting the user's services continuity.

As shown in Figure 6, the specific communication process may include:

For steps 301 to 311, reference may be made to the relevant descriptions in the foregoing embodiments.

601: The user equipment establishes a NAS connection with the MME1.

At this time, the MME1 receives the TAU request message from the user equipment according to step 311, wherein the TAU request message includes the GUTI representation of the user equipment and the eKSI. MME1 determines that the security context used between MME1 and the user is the mapped security context, and then establishes a NAS connection with the user equipment.

After that, after the user equipment enters the idle state, the location moves to the range covered by the MME2.

602: The user equipment sends a TAU request message to MME2.

The TAU request message may include the GUTI and eKSI of the user equipment.

603: MME2 sends a context request message to MME1.

MME2 requests the security context corresponding to the user equipment to MME1 according to the GUTI, that is, sends a context request context request message to MME1.

The context request message includes the GUTI of the user equipment.

603: MME1 sends a context response message to MME2.

MME1 responds to the security context corresponding to the user equipment to MME2 according to the GUTI, that is, sends a context response message to MME1. The context response message includes eKSI; here eKSI does not include TSC information. The MME2 determines that it is the security context received from the 4G MME1, and determines that the security context is of the native type.

604: The MME2 determines the security context used between the MME2 and the user equipment.

MME2 first determines whether the security context corresponding to the user equipment is stored according to the GUTI and eKSI. If the security context corresponding to the user equipment is stored, but the eKSI in the TAU request message sent by the user equipment indicates that the corresponding security context is of the mapped type, and The security context corresponding to the user equipment saved by the MME2 is of the native type, then the MME2 determines the security context used with the user equipment, which may include the following methods:

In another implementation manner, when the user equipment switches from the 5G network to the 4G network and switches from MME1 to MME2, the TAU request message sent by the user equipment to MME2 may include authentication indication information, so that MME2 can Indicates that the authentication for the user equipment is directly triggered to realize the synchronization of the security context.

Through the above-mentioned embodiments provided in this application, when the user equipment switches from the 5G network to the 4G network and switches between MMEs, when the user equipment sends a TAU request to the MME2, the MME2 can determine that the default is to save locally through a pre-configured method. The native security context type, or the mapped security context indicated by eKSI, is updated to the mapped security context, or the user equipment is triggered for authentication and updated to the native security context, so as to avoid MME2 rejecting the TAU of the user equipment due to inconsistent security context types. request to improve the business continuity of the user equipment.

In addition, in another implementation manner, the eKSI in the TAU request message sent by the user equipment received by the MME2 indicates that the corresponding security context is of the mapped type, and the security context corresponding to the user equipment saved by the MME2 is of the native type, then the MME2 Sending a TAU rejection message to the user equipment, wherein the TAU rejection message may carry third indication information, for example, an indication of a TAU failure type, indicating that the security context corresponding to the user equipment does not match; or, instructing the user equipment to perform initial access; Alternatively, the user equipment is instructed to send the IMSI identifier; or, other non-TAU#9 failure type indications. Then, after receiving the third indication information included in the TAU rejection message, the user equipment can send the IMSI to MME2 to perform initial registration, thereby establishing a native security context with MME2. Here, it mainly refers to not sending a rejection indication that requires the UE to wait for a period of time before accessing, so that the user equipment can immediately perform access at this time, so as to ensure the continuity of the service to the greatest extent.

In another embodiment, when the user equipment is switched from the second network to the first network, the fourth indication information can be carried in the handover complete message, so that the first mobility management network element can save the fourth indication information , when switching between mobility management network elements occurs in the user equipment, the first mobility management network element may trigger authentication of the user equipment according to the fourth indication information, so as to realize synchronization of the security context.

Specifically, with reference to the above-mentioned FIG. 3, that is, in the above-mentioned step 309, the user equipment sends a handover complete message to the eNB, and the message includes fourth indication information. Then, the handover response message sent by the eNB to the MME1 may include the fourth indication information, and then the MME1 may store the fourth indication information corresponding to the user equipment.

Subsequently, when the user equipment makes a request for switching from MME1 to MME2, after MME1 receives the TAU request message (including GUTI, eKSI) sent by the user equipment, MME1 determines the fourth indication information stored locally according to the GUTI, and triggers the user equipment to perform Certification. After the authentication is completed, the native security context will be shared between the user equipment and MME1. At this time, even if the handover of the MME occurs again, the problem of inconsistency of the security context between the user equipment and the MME2 will not occur.

It should be noted that, the idle state mentioned in the present invention may save context information between the UE and the AMF, and the context includes a security context. However, the current NAS is in an inactive state, and the security activation of the NAS connection can be completed through NAS messages in the future. After activation, it is in the connected state.

Based on the implementations described in FIG. 2 and FIG. 3 , an embodiment of the present application further provides an information transmission apparatus. As shown in FIG. 7 , the apparatus 700 includes a receiving module 701 and a processing module 702 .

The receiving module 701 is configured to receive a tracking area update TAU request message from a user equipment, where the user equipment switches from the second network to the first network, and the apparatus belongs to the first network.

The processing module 702 is configured to set the security context used between the apparatus 700 and the user equipment as the native security context according to the TAU request message.

The processing module 702 may perform the processing performed by the first mobility management network element in the foregoing method embodiments, except for sending and receiving, and correspondingly, the receiving module 701 may perform the message receiving processing performed by the first mobility management network element in the foregoing method embodiments. .

In an implementation manner, the processing module 702 is specifically configured to: authenticate the user equipment.

In an implementation manner, the TAU request message includes status information of the user equipment, and the processing module 702 may be specifically configured to: if the status information indicates that the user equipment switches from the second network to the first network, or if the status information indicates the first network of the user equipment The mobility management registration information of the second network, or the status information indicates that the user equipment has the network security capability of the second network, or the status information indicates that the user equipment has the capability of the N1 interface of the second network, and the user equipment is authenticated.

In one embodiment, according to the TAU request message, the processing module 702 may be specifically configured to determine the identity of the user equipment according to the TAU request message; determine that the location of the user equipment has changed according to the identity of the user equipment; and authenticate the user equipment.

In an implementation manner, the processing module 702 may be specifically configured to determine, according to the identifier of the user equipment, that the user equipment needs to be handed over to the second mobility management network element.

In one embodiment, the processing module 702 may be specifically configured to determine the identifier of the user equipment according to the TAU request message, where the TAU request message includes the identifier of the user equipment; and determine the first indication information corresponding to the identifier according to the identifier, the first indication information From the AMF; determine to authenticate the user equipment according to the first indication information.

In an embodiment, the first indication information is at least one of authentication indication information, or a 5G access type, or a tunnel identifier.

In one embodiment, the first network is a 4G network, and the second network is a 5G network.

In addition, based on the first mobility management network element in the embodiments shown in FIG. 4 and FIG. 5 , the present application further provides an information transmission apparatus. As shown in FIG. 8 , the apparatus 800 includes a sending module 801 and a processing module 802 .

The processing module 801 is configured to determine that the user equipment is switched from the second network to the first network, and determine that the user equipment is switched from the first mobility management network element to the second mobility management network element. The first network includes the apparatus 800 and the second mobility management network element. Manage network elements.

The sending module 801 is further configured to send second indication information to the second mobility management network element, where the second indication information indicates the mapped security context of the user equipment, or instructs the second mobility management network element to authenticate the user equipment.

The processing module 801 may perform the processing performed by the first mobility management network element in the foregoing method embodiments, except for sending and receiving, and correspondingly, the sending module 801 may perform the message sending processing performed by the first mobility management network element in the foregoing method embodiments. .

In an embodiment, the second indication information includes at least one indication information among 5G security algorithms, or 5G wireless access types, 5G or next-generation wireless security capabilities, or tunnel identifiers.

Correspondingly, based on the second mobility management network element in the embodiments shown in FIG. 4 and FIG. 5 , the present application further provides an information transmission apparatus. As shown in FIG. 9 , the apparatus 900 includes a receiving module 901 and a processing module 902.

The receiving module 901 is configured to receive second indication information from the first mobility management network element, where the second indication information indicates that the security context of the user equipment is a mapped security context, or instructs the apparatus 900 to authenticate the user equipment.

The processing module 902 is configured to determine the security context used between the apparatus 900 and the user equipment according to the second indication information.

The processing module 902 may perform the processing performed by the second mobility management network element in the foregoing method embodiments, except for sending and receiving, and correspondingly, the receiving module 901 may perform the message receiving processing performed by the second mobility management network element in the foregoing method embodiments. .

In one embodiment, the processing module 902 is specifically configured to: when the second indication information indicates that the security context of the user equipment is a mapped security context, determine that the security context used between the apparatus 900 and the user equipment is a mapped security context .

In one embodiment, the processing module 902 is specifically configured to: when the second indication information includes at least one indication information among 5G security algorithms, or 5G wireless access types, 5G or next-generation network security capabilities, or tunnel identifiers, It is determined that the security context used between the apparatus 900 and the user equipment is the mapped security context.

In one embodiment, the processing module 902 is specifically configured to: when the second indication information instructs the apparatus 900 to authenticate the user equipment, authenticate the user equipment, and set the security context used between the apparatus 900 and the user equipment to be Local native security context.

It should be noted that the sending or receiving performed by the sending module or the receiving module described in the above embodiments of the present application may be performed under the control of a processing module (for example, a processor). Therefore, in the embodiments of the present application, Describing the actions of sending or receiving as executed by a processing module (processor) does not affect the understanding of the solution by those skilled in the art.

FIG. 10 is another schematic structural diagram of a communication apparatus (any network element in the foregoing embodiment) provided by an embodiment of the present application. As shown in FIG. 10 , the communication apparatus 1000 includes a processor 1001 and a transceiver 1002 . Optionally, the communication apparatus 1000 further includes a memory 1003 . Among them, the processor 1001, the transceiver 1002 and the memory 1003 can communicate with each other through an internal connection path to transmit control and/or data signals. The computer program is invoked and executed to control the transceiver 1002 to send and receive signals. The communication apparatus 1000 may further include an antenna for transmitting the signaling output by the transceiver 1002 through wireless signals.

The above-mentioned processor 1001 and the memory 1003 may be combined into a processing device, and the processor 1001 is configured to execute the program codes stored in the memory 1003 to realize the above-mentioned functions. During specific implementation, the memory 1003 may also be integrated in the processor 1001 or independent of the processor 1001 .

Specifically, the communication apparatus 1000 may correspond to various embodiments of the methods according to the embodiments of the present application. In addition, each unit in the communication apparatus 1000 and the other operations and/or functions mentioned above are respectively for realizing the corresponding flow in each embodiment of the method.

The foregoing processor 1001 may be configured to perform one or more execution actions implemented by the first mobility management network element or the second mobility management network element described in the foregoing method embodiments, and the transceiver 1002 may be configured to execute the foregoing method embodiments. One or more actions of sending or receiving one or more actions of the first mobility management network element or the second mobility management network element described in . For details, please refer to the descriptions in the foregoing method embodiments, which will not be repeated here.

Optionally, the above-mentioned communication apparatus 1000 may further include a power supply for providing power to various devices or circuits in the communication apparatus.

The information transmission device in each of the above device embodiments may completely correspond to the first mobility management network element or the second mobility management network element in the method embodiments, and corresponding steps are performed by corresponding modules or units. When implemented in the form of a chip, the above-mentioned receiving module may be an interface circuit used by the chip to receive signals from other chips or devices. The above unit for sending is an interface circuit of the device, which is used to send signals to other devices. For example, when the device is implemented in the form of a chip, the above-mentioned sending module is used by the chip to send signals to other chips or devices. signal interface circuit.

It should be understood that the processor in the embodiment of the present application may be a CPU, and the processor may also be other general-purpose processors, digital signal processing (digital signal processing, DSP), application specific integrated circuit (ASIC), field Field Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

It should also be understood that the memory in the embodiments of the present application may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically programmable Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory. Volatile memory may be random access memory (RAM), which acts as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (DRAM) Access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory Fetch memory (synchlink DRAM, SLDRAM) and direct memory bus random access memory (direct rambus RAM, DR RAM).

An embodiment of the present application further provides a communication system, and the communication system includes: any one of the first mobility management network elements or the second mobility management network elements provided in the above embodiments of the present application.

Embodiments of the present application further provide a computer-readable medium for storing computer program codes, where the computer program includes a method for executing the first mobility management network element in the above method or the method executed in the second mobility management network element. instruction. The readable medium may be a ROM or a RAM, which is not limited in this embodiment of the present application.

The present application also provides a computer program product, the computer program product includes an instruction, when the instruction is executed, so that the first mobility management network element or the second mobility management network element respectively executes the first mobility corresponding to the above method. The operation of the management network element or the second mobility management network element.

Embodiments of the present application further provide a system chip, which includes: a processing unit and a communication unit, where the processing unit may be, for example, a processor, and the communication unit may be, for example, an input/output interface, a pin, or a circuit. The processing unit can execute computer instructions, so that the communication device to which the chip is applied executes the operations of the first mobility management network element or the second mobility management network element in the methods provided in the foregoing embodiments of the present application.

Optionally, any of the communication apparatuses provided in the foregoing embodiments of the present application may include the system chip.

Optionally, the computer instructions are stored in a storage unit.

Optionally, the storage unit is a storage unit in the chip, such as a register, a cache, etc., the storage unit can also be a storage unit located outside the chip in the communication device, such as a ROM or a storage unit that can store static information and instructions. Other types of static storage devices, RAM, etc. Wherein, the processor mentioned in any one of the above may be a CPU, a microprocessor, an ASIC, or one or more integrated circuits used to control the program execution of the above-mentioned method for transmitting feedback information. The processing unit and the storage unit can be decoupled, respectively disposed on different physical devices, and connected in a wired or wireless manner to implement the respective functions of the processing unit and the storage unit, so as to support the system chip to implement the above embodiments various functions in . Alternatively, the processing unit and the memory may also be coupled on the same device. It should be understood that the processor in the embodiments of the present application may be a CPU, and the processor may also be other general-purpose processors, DSP, ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. . A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described systems, devices and units may refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

It should be understood that, in various embodiments of the present application, the size of the sequence numbers of the above-mentioned processes does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, and should not be dealt with in the embodiments of the present application. implementation constitutes any limitation.

Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.

In the several embodiments provided in this application, it should be understood that the disclosed system, communication apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.

The functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.

Finally, it should be noted that: the above are only specific embodiments of the present application, but the protection scope of the present application is not limited to this, and any changes or replacements within the technical scope disclosed in the present application should be covered by the present application. within the scope of protection of the application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

An information transmission method, applied to a first mobility management network element, characterized in that the method comprises:

receiving a tracking area update TAU request message from a terminal device, the terminal device is switched from a second network to a first network, and the first mobility management network element belongs to the first network;

According to the TAU request message, the security context used between the first mobility management network element and the terminal device is set as the native security context.
The method according to claim 1, wherein setting the security context used between the first mobility management network element and the terminal device as a native security context, comprising:

The first mobility management network element authenticates the terminal device.
The method according to claim 1, wherein the setting the security context used between the first mobility management network element and the terminal device as the native security context according to the TAU request message specifically includes: :

The first mobility management network element determines the identifier of the terminal device according to the TAU request message;

determining, by the first mobility management network element, that the location of the terminal device has changed according to the identifier of the terminal device;

The first mobility management network element authenticates the terminal device.
The method according to claim 3, wherein the first mobility management network element determines that the location information of the terminal device changes according to the identifier of the terminal device, which specifically includes:

The first mobility management network element determines, according to the identifier of the terminal device, that the terminal device needs to be switched to the second mobility management network element.
The method according to claim 2, 3 or 4, wherein the TAU request message includes the state information of the terminal device, and the first mobility management network element authenticates the terminal device, which specifically includes:

If the status information indicates that the terminal device switches from the second network to the first network, or the status information indicates the mobility management registration information of the second network of the terminal device, or the The status information indicates that the terminal device has the network security capability of the second network, or, the status information indicates that the terminal device has the capability of the N1 interface of the second network, then the first mobility management network element is responsible for the The terminal device is authenticated.
The method according to claim 1, wherein, according to the TAU request message, setting the security context used between the first mobility management network element and the terminal device as a native security context, comprising:

Determine the identifier of the terminal device according to the TAU request message, where the TAU request message includes the identifier;

determining first indication information corresponding to the identity according to the identity, where the first indication information comes from a core access and mobility management function network element;

The terminal device is determined to be authenticated according to the first indication information.
The method according to claim 6, wherein the first indication information is at least one of authentication indication information, or a 5G access type, or a tunnel identifier.
The method according to any one of claims 1-7, wherein the first network is a 4G network, and the second network is a 5G network.
An information transmission method, applied to a first mobility management network element, characterized in that the method comprises:

The first mobility management network element determines that the terminal device is switched from the second network to the first network, and determines that the terminal device is switched from the first mobility management network element to the second mobility management network element, and the first network including the first mobility management network element and the second mobility management network element;

The first mobility management network element sends second indication information to the second mobility management network element, where the second indication information indicates the mapped security context of the terminal device, or indicates the second mobility management network element The terminal device is authenticated.
The method according to claim 9, wherein the second indication information comprises at least one indication information of a 5G security algorithm, or a 5G wireless access type, a 5G or next-generation wireless security capability, or a tunnel identifier.
The method according to claim 9 or 10, wherein the first network is a 4G network, and the second network is a 5G network.
An information transmission method, applied to a second mobility management network element, characterized in that the second mobility management network element belongs to a first network, the first network further includes a first mobility management network element, and a terminal device is a slave The second network switches to the terminal equipment of the first network, and the method includes:

determining that the terminal device is switched from the first mobility management network element to the second mobility management network element;

Receive second indication information from the first mobility management network element, where the second indication information indicates that the security context of the terminal device is a mapped security context, or instructs the second mobility management network element to equipment for certification;

The security context used between the second mobility management network element and the terminal device is determined according to the second indication information.
The method according to claim 12, wherein the second indication information indicates that the security context of the terminal device is a mapped security context, and the second mobility management network element is determined according to the second indication information and the The security context used between the end devices, including:

It is determined that the security context used between the second mobility management network element and the terminal device is a mapped security context.
The method according to claim 12, wherein the second indication information comprises at least one indication information of a 5G security algorithm, or a 5G wireless access type, a 5G or next-generation network security capability, or a tunnel identifier, Determining the security context used between the second mobility management network element and the terminal device according to the second indication information includes:

It is determined that the security context used between the second mobility management network element and the terminal device is a mapped security context.
The method according to claim 12, wherein the second indication information instructs the second mobility management network element to authenticate the terminal device, and the second mobility management network element is determined according to the second indication information The security context used between the network element and the terminal device, including:

The second mobility management network element authenticates the terminal device, and sets the security context used between the second mobility management network element and the terminal device as a local native security context.
The method according to any one of claims 12-15, wherein the first network is a 4G network, and the second network is a 5G network.
An information transmission device, characterized in that the device comprises:

a receiving module, configured to receive a tracking area update TAU request message from a terminal device, the terminal device is switched from the second network to the first network, and the device belongs to the first network;

A processing module, configured to set the security context used between the apparatus and the terminal device as a native security context according to the TAU request message.
The device according to claim 17, wherein the processing module is specifically configured to:

The terminal device is authenticated.
The device according to claim 17, wherein the processing module is specifically configured to:

Determine the identity of the terminal device according to the TAU request message;

Determine that the location of the terminal device changes according to the identifier of the terminal device;

The terminal device is authenticated.
The device according to claim 19, wherein the processing module is specifically configured to:

It is determined according to the identification of the terminal device that the terminal device needs to be switched to the second mobility management network element.
The apparatus according to claim 17, 18 or 19, wherein the TAU request message includes status information of the terminal device, and the processing module is specifically configured to: if the status information indicates that the terminal device has The second network switches to the first network, or the status information indicates the mobility management registration information of the second network of the terminal device, or the status information indicates that the terminal device has the first network. The network security capability of the second network, or the status information indicates that the terminal device has the capability of the N1 interface of the second network, and the terminal device is authenticated.
The device according to claim 17, wherein the processing module is specifically configured to:

Determine the identifier of the terminal device according to the TAU request message, where the TAU request message includes the identifier;

determining first indication information corresponding to the identity according to the identity, where the first indication information comes from the core access and mobility management function AMF network element;

The terminal device is determined to be authenticated according to the first indication information.
The apparatus according to claim 22, wherein the first indication information is at least one of authentication indication information, or a 5G access type, or a tunnel identifier.
The apparatus according to any one of claims 17-23, wherein the first network is a 4G network, and the second network is a 5G network.
An information transmission device, characterized in that the device comprises:

a processing module, configured to determine that a terminal device is switched from a second network to a first network, and determine that the terminal device is switched from the device to a second mobility management network element, where the first network includes the device and the first network 2. Mobile management network element;

A sending module, configured to send second indication information to the second mobility management network element, where the second indication information indicates the mapped security context of the terminal device, or instructs the second mobility management network element to The terminal device is authenticated.
The apparatus according to claim 25, wherein the second indication information comprises at least one indication information of a 5G security algorithm, a 5G wireless access type, a 5G or next-generation wireless security capability, or a tunnel identifier.
The apparatus according to claim 25 or 26, wherein the first network is a 4G network, and the second network is a 5G network.
An information transmission device, the device belongs to a first network, the first network further includes a first mobility management network element, and a terminal device is a terminal device switched from a second network to the first network, characterized in that: The device includes:

a processing module, configured to determine that the terminal equipment is switched from the first mobility management network element to the apparatus;

a receiving module, configured to receive second indication information from the first mobility management network element, where the second indication information indicates that the security context of the terminal device is a mapped security context, or instructs the apparatus to equipment for certification;

The processing module is further configured to determine a security context used between the apparatus and the terminal device according to the second indication information.
The device according to claim 28, wherein the processing module is specifically configured to: when the second indication information indicates that the security context of the terminal device is a mapped security context, determine whether the device is connected to the terminal device. The security context used between is the mapped security context.
The apparatus according to claim 28, wherein the processing module is specifically configured to: the second indication information includes a 5G security algorithm, or a 5G wireless access type, a 5G or next-generation network security capability, or a tunnel identifier When at least one of the indication information is included, it is determined that the security context used between the apparatus and the terminal device is the mapped security context.
The apparatus according to claim 28, wherein the processing module is specifically configured to: when the second indication information instructs the apparatus to authenticate the terminal device, authenticate the terminal device, and The security context used between the apparatus and the terminal device is set as the local native security context.
The apparatus according to any one of claims 28-31, wherein the first network is a 4G network, and the second network is a 5G network.
A communication device, characterized in that the communication device comprises a processor and a transmission interface;

wherein the processor is configured to execute instructions stored in the memory to cause the apparatus to perform the method of any one of claims 1 to 8.
A computer-readable storage medium, characterized by comprising a program or an instruction, when the program or the instruction is executed by a processor, the method according to any one of claims 1 to 8 is performed.
A computer program product which, when run on a computer or processor, causes the computer or the processor to perform the method of any one of claims 1 to 8.
A communication device, characterized in that the communication device comprises a processor and a transmission interface;

wherein the processor is configured to execute instructions stored in the memory to cause the apparatus to perform the method of any one of claims 9 to 11.
A computer-readable storage medium, characterized by comprising a program or an instruction, when the program or the instruction is executed by a processor, the method according to any one of claims 9 to 11 is performed.
A computer program product which, when run on a computer or processor, causes the computer or the processor to perform the method of any one of claims 9 to 11.
A communication device, characterized in that the communication device comprises a processor and a transmission interface;

wherein the processor is configured to execute instructions stored in the memory to cause the apparatus to perform the method of any of claims 12 to 16.
A computer-readable storage medium, characterized by comprising a program or an instruction, when the program or the instruction is executed by a processor, the method according to any one of claims 12 to 16 is performed.
A computer program product which, when run on a computer or processor, causes the computer or the processor to perform the method of any one of claims 12 to 16.
A communication system, characterized by comprising the device according to any one of claims 25-27 and the device according to any one of claims 28-32.