WO2022142446A1 - 一种鉴权方法及通信装置 - Google Patents

一种鉴权方法及通信装置 Download PDF

Info

Publication number
WO2022142446A1
WO2022142446A1 PCT/CN2021/116801 CN2021116801W WO2022142446A1 WO 2022142446 A1 WO2022142446 A1 WO 2022142446A1 CN 2021116801 W CN2021116801 W CN 2021116801W WO 2022142446 A1 WO2022142446 A1 WO 2022142446A1
Authority
WO
WIPO (PCT)
Prior art keywords
tag
label
access
message
communication
Prior art date
Application number
PCT/CN2021/116801
Other languages
English (en)
French (fr)
Inventor
朱浩仁
徐艺珊
诸华林
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21913193.5A priority Critical patent/EP4258718A1/en
Priority to CN202180086463.2A priority patent/CN116686314A/zh
Priority to KR1020237025838A priority patent/KR20230125301A/ko
Publication of WO2022142446A1 publication Critical patent/WO2022142446A1/zh
Priority to US18/344,158 priority patent/US20230345243A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/40—Security arrangements using identity modules
    • H04W12/47—Security arrangements using identity modules using near field communication [NFC] or radio frequency identification [RFID] modules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/71—Hardware identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/72—Subscriber identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/70—Services for machine-to-machine communication [M2M] or machine type communication [MTC]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/80—Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/26—Network addressing or numbering for mobility support
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/618—Details of network addresses
    • H04L2101/622—Layer-2 addresses, e.g. medium access control [MAC] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/10—Mapping addresses of different types
    • H04L61/103—Mapping addresses of different types across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/75—Temporary identity

Definitions

  • the embodiments of the present application relate to the field of communication, and in particular, to an authentication method and a communication device.
  • tag devices are used by more and more enterprises and individuals, and short-range, non-contact communication between devices can be realized by using the tag devices.
  • Label devices include radio frequency identification (RFID) tags, passive internet of things (passive IoT) devices, low-power devices, ultrawideband (UWB) tags, passive terminal devices, semi-free Source terminal devices, active terminal devices, reduced capability (Redcap) terminals, other IoT devices, and Bluetooth devices, etc.
  • Passive terminal equipment is the terminal equipment that obtains energy from radio frequency signals
  • semi-passive terminal equipment is the terminal equipment that obtains energy from radio frequency signals or solar or wind energy
  • active terminal equipment is the equipment that relies on its own battery to provide energy.
  • the safety certification process of label equipment varies greatly among manufacturers. When enterprises use a variety of label equipment, the complexity of label management is greatly increased.
  • the embodiments of the present application provide an authentication method and a communication device, which not only support unified network management of multiple labels, but also provide a unified authentication process for security authentication of label devices, thereby reducing the complexity of fusion management.
  • an authentication method including: an access network device obtains an identifier of a tag device, and determines a third generation partnership project 3GPP network user identifier according to the identifier of the tag device; The management network element sends a first message, where the first message includes a 3GPP network user identity, and the 3GPP network user identity is used to authenticate the label device.
  • the access network device may also receive the authentication result of the tag device through the access mobility management network element.
  • the identification of the label device may be the same identification as the 3GPP network user identification or a different identification.
  • An access network device can obtain an identifier of a tag device, determine a third generation partnership project 3GPP network user identifier according to the identifier of the tag device, and send a first message to an access mobility management network element.
  • the first message includes a 3GPP network user identity, which is used to authenticate the label device.
  • the authentication method provided by the embodiment of the present application can realize the authentication and authentication of different label devices, while supporting the unified network management of various labels, and at the same time, a unified authentication process is provided for the security authentication of label devices, which reduces the complexity of fusion management. sex.
  • the first message further includes type information, where the type information is used to indicate the type of the label device.
  • the access network device may also notify the authentication device of the type of the label device through the first message, so that the authentication device selects an authentication method and authentication parameters that match the label device.
  • the first message is a non-access stratum NAS registration request
  • the NAS registration request includes the 3GPP network User ID.
  • the access network device may send the 3GPP network user identity to the access mobility management network element through the NAS registration request.
  • the access network device obtains the identifier of the label device through the inventory process or the label access process, and the inventory The process is the process of obtaining the tag identification, and the tag access process is the process of reading or writing the tag device.
  • the access network device can acquire the identifier of the tag device through the inventory process or the tag access process, which provides various feasible solutions for the access network device to acquire the identifier of the tag device.
  • the method further includes: receiving a second message from an access mobility management network element,
  • the second message includes at least one of the following: a protocol parameter, a communication parameter or an access parameter; wherein the protocol parameter is used to indicate the communication protocol between the access network device and the label device and/or the access network device and the label aggregation network element
  • the communication protocol between the two; the communication parameters are used to support the data transmission rate and/or decoding method used for communication between the access network device configuration and the tag device; the access parameters are used for the access network device to configure the tag device access event.
  • a rule; a rule for a tag device access event includes at least one of the following: trigger time of the tag device access event, period of the tag device access event, or number of tag devices corresponding to the tag device access event.
  • the tag device access event is to perform a read operation, or a write operation, or an invalidation operation on the tag, or an inventory operation for the tag.
  • the read operation can read the information stored by the label device, such as sensor information, etc.
  • the inventory operation refers to the operation of obtaining the label identifier, and the access of the label device can also be called the access of the label device.
  • configuration parameters related to the tag device may also be sent to the access network device to support communication between the access network device, the tag device and the core network, for example, signaling interaction in the authentication process.
  • the method further includes: determining the access network device and the tag according to the second message The communication protocol between the devices and/or the communication protocol between the access network device and the tag aggregation network element; and/or, configure the data transmission rate and/or decoding method used for communication with the tag device; and/or , configure the rules for tag device access events.
  • the access network device may complete local configuration according to the configuration parameters delivered by the core network, so as to communicate with the label device and the core network, for example, signaling interaction in the authentication process.
  • the method further includes: receiving an operation instruction from a label aggregation network element; It is used to instruct the access network device to perform a communication operation with the tag device. Execute the communication operation with the label device according to the operation instruction.
  • the reader of the label device is integrated into the core network, that is, the label aggregation network element described in the embodiment of the present application.
  • This embodiment of the present application also supports communication between the label aggregation network element and the label device through the 3GPP network, for example, sending an operation instruction to the label device to instruct the label device to perform a specific access operation, such as a read operation or a write operation.
  • the label aggregation network element can be an independent core network element, or it can be deployed together with the user plane function network element UPF, the access mobility management network element AMF, the session management network element SMF, the network open network element NEF, the server or the IoT platform. network element.
  • the identifier of the tag device includes the wireless access control MAC address of the tag device or the secret of the tag device Electronic Product Code EPC that identifies the SID or tag device.
  • the embodiment of the present application provides a specific implementation of the identification of the labeling device, so as to determine the 3GPP network user identification of the labeling device according to the label of the labeling device.
  • the access network device includes: a label access function module and a label proxy function module;
  • the network access device determines the 3GPP network user identity according to the identity of the label device, including: the label access function module obtains the identity of the label device, the label access function module sends the identity of the label device to the label proxy function module; the label proxy function module is based on the label device.
  • the identity of the 3GPP network user identity is determined.
  • the embodiment of the present application provides a possible convergence scenario, in which a label access function module and a label proxy function module are added to the access network device, and the label aggregation network element is the network element on the core network side that supports communication with the label device.
  • the label access function module supports the RAN to communicate with the label device
  • the label proxy function module supports the label device to communicate with the core network element or the high-level label aggregation network element.
  • the method further includes: the label proxy function module generates first information, the first The information is used to indicate the correspondence between the identification of the label device, the identification of the label access function module and the 3GPP network user identification; the label proxy function module addresses the label access function module according to the first information.
  • the label proxy function module can maintain and manage multiple label access function modules, and based on the first information, the label proxy function module can address the corresponding label access function module when receiving downlink signaling, so as to The downlink signaling is transmitted to the corresponding label device.
  • the 3GPP network user identifier includes the user hidden identifier SUCI or the user permanent identifier SUPI of the tag device. .
  • This embodiment of the present application provides a possible implementation of a 3GPP network user identity.
  • the authentication method provided in the first aspect can also be applied to a reader device, that is, the reader device performs the functions set and executed by the access network device.
  • the reader device can be deployed in access network devices or terminal devices. When the reader device is deployed in the access network device, the reader device can also be described as an access network device. When the reader device is deployed When in terminal equipment, the reader device can also be described as terminal equipment.
  • the access network device can also be directly used as a reader device, or the terminal device can also be directly used as a reader device.
  • an authentication method comprising: an access mobility management network element receiving a first message from an access network device, where the first message includes a third generation partnership project 3GPP network user identity of the tag device; The mobility management network element sends the 3GPP network user identifier to the authentication device, and the 3GPP network user identifier is used to authenticate the label device.
  • the access mobility management network element may also receive the authentication result of the label device from the authentication device, and send the authentication result to the access network device.
  • the identification of the label device may be the same identification as the 3GPP network user identification or a different identification.
  • An access network device can obtain an identifier of a tag device, determine a third generation partnership project 3GPP network user identifier according to the identifier of the tag device, and send a first message to an access mobility management network element.
  • the first message includes a 3GPP network user identity, which is used to authenticate the label device.
  • the authentication method provided by the embodiment of the present application can realize the authentication and authentication of different label devices, while supporting the unified network management of various labels, and at the same time, a unified authentication process is provided for the security authentication of label devices, which reduces the complexity of fusion management. sex.
  • the first message further includes type information, and the type information is used to indicate the type of the tag device.
  • the access network device may also notify the authentication device of the type of the label device through the first message, so that the authentication device selects an authentication method and authentication parameters that match the label device.
  • the first message is a non-access stratum NAS registration request
  • the NAS registration request includes the 3GPP network User ID.
  • the access network device may send the 3GPP network user identity to the access mobility management network element through the NAS registration request.
  • the method further includes: receiving at least one of the following from the label aggregation network element: a protocol parameters, communication parameters and access parameters; wherein, the protocol parameters are used to indicate the communication protocol between the access network device and the label device and/or the communication protocol between the access network device and the label aggregation network element; the communication parameters are used for Support the data transmission rate and/or decoding method used for communication between the access network device configuration and the label device; the access parameters are used for the access network device to configure the rules for the label device access event; the rules for the label device access event include: At least one of the following: the trigger time of the tag device access event, the period of the tag device access event, or the number of tag devices corresponding to the tag device access event; send a second message to the access network device, where the second message includes communication protocol parameters , at least one of device operating parameters and access parameters.
  • the tag device access event is to perform a read operation, or a write operation, or an invalidation operation on the tag, or an inventory operation for the tag.
  • the inventory operation refers to the operation of obtaining the tag ID.
  • the read operation can read the information stored in the tag, such as sensor information, etc., and tag device access can also be called tag device access.
  • configuration parameters related to the tag device may also be sent to the access network device through the access mobility management network element to support communication between the access network device, the tag device, and the core network. signaling interaction.
  • the method further includes: receiving a third message from the label aggregation network element, and the third The message is used by the label aggregation network element to subscribe the message related to the label device to the access mobility management network element.
  • the label aggregation network element may also subscribe the message related to the label device to the access mobility management network element, so that the access mobility management network element can accurately route the message related to the label device to the label aggregation network element for processing. deal with.
  • the label aggregation network element can be an independent core network element, or it can be deployed together with the user plane function network element UPF, the access mobility management network element AMF, the session management network element SMF, the network open network element NEF, the server or the IoT platform. network element.
  • the third message includes a message type, and the message type indicates a message related to the tag device .
  • the tag aggregation network element can use the message type to subscribe the message related to the tag device to the access mobility management network element.
  • the 3GPP network user identifier includes a user hidden identifier SUCI or a permanent user identifier SUPI of the tag device.
  • This embodiment of the present application provides a possible implementation of a 3GPP network user identity.
  • an authentication method comprising: a label aggregation network element determines whether a label device has passed security authentication; the label aggregation network element determines that the label device has passed the security authentication, and sends an operation instruction to an access network device; the operation instruction It is used to instruct the access network device to perform the communication operation with the tag device.
  • the label aggregation network element can be an independent core network element, or it can be deployed together with the user plane function network element UPF, the access mobility management network element AMF, the session management network element SMF, the network open network element NEF, the server or the IoT platform. network element.
  • the authentication method provided by the embodiment of the present application supports the secure access of label devices in a label fusion scenario, provides a unified access process for unified network management of different label devices, and reduces the complexity of fusion management.
  • the label aggregation network element determines whether the label device has passed the security authentication, including: if the first possible implementation of the label device's identity is obtained from the authentication device according to the label device's identity.
  • the third-generation partnership program 3GPP network user identification determines that the label device has passed the security certification.
  • the embodiment of the present application provides a specific implementation of the label aggregation network element judging that the label device has passed the security authentication.
  • the method further includes: a label aggregation network
  • the element sends at least one of the following to the access mobility management network element: a protocol parameter, a communication parameter and an access parameter; wherein, the protocol parameter is used to indicate the communication protocol and/or access between the access network device and the tag device.
  • the communication protocol between the network equipment and the label aggregation network element; the communication parameters are used to support the data transmission rate and/or decoding method used for communication between the access network equipment configuration and the label equipment; the access parameters are used for the access network equipment Configure the rules for tag device access events; the rules for tag device access events include at least one of the following: the trigger time of the tag device access event, the period of the tag device access event, or the number of tag devices corresponding to the tag device access event.
  • the label aggregation network element may also send configuration parameters related to the label device to the access network device through the inbound mobility management network element, so as to support the access network device and the label device. And the communication of the core network, for example, the signaling interaction during the authentication process.
  • the method further includes: sending a third message to the access mobility management network element, the first The three messages are used to subscribe the messages related to the tag device to the access mobility management network element.
  • the label aggregation network element may also subscribe the information related to the label device to the access mobility management network element, so that the access mobility management network element can accurately identify the information related to the label device.
  • the message is routed to the label aggregation network element for processing.
  • the third message includes a message type, and the message type indicates a message related to the tag device.
  • the tag aggregation network element can use the message type to subscribe the message related to the tag device to the access mobility management network element.
  • the label aggregation network element determines whether the label device has passed the security authentication, including: if according to the label device If the identity of the third generation partnership project 3GPP network user identity corresponding to the identity of the label device is not obtained from the authentication device, it is determined that the label device has not passed the security authentication.
  • the embodiment of the present application provides a specific implementation of the label aggregation network element judging that the label device has not passed the security authentication.
  • the method further includes: label aggregation network element Send at least one of the following to the access mobility management network element: communication protocol parameters, device operation parameters and access parameters; wherein the communication protocol parameters are used to indicate the communication protocol and/or access parameters between the access network device and the tag device.
  • the method further includes: sending a third message to the access mobility management network element, the first The three messages are used to subscribe the messages related to the tag device to the access mobility management network element.
  • the third message includes a message type, and the message type indicates a message related to the tag device.
  • the identifier of the tag device includes the wireless access control MAC address of the tag device or the secret identifier of the tag device SID or Electronic Product Code EPC of the tagging device.
  • the 3GPP network user identifier includes a user hidden identifier SUCI or a permanent user identifier SUPI of the tag device.
  • a communication method comprising: after receiving a tag trigger signal, a tag device sends a core network interaction message; the core network interaction message is used for message interaction between the tag device and a core network element.
  • the tag trigger signal is required to stimulate the tag device, so that the tag device can send the core network communication message to interact with the core network element; or, when the tag device is in a dormant state, The tag trigger signal is required to wake up the tag device, so that the tag device can send the core network interaction message to interact with the core network element.
  • the tag device can perform message interaction with the core network element after receiving the tag trigger signal, which provides a feasible solution for the interaction between the tag device and the core network element.
  • the core network interaction message may include any one of the following: a registration message; or a deregistration message; or a session establishment request message; or a session modification request message; or, session deletion request message; or, service request message; or, tag data sending message; registration message is used to register the tag in the core network;
  • the session modification request message is used to modify the session for the tag;
  • the session deletion request message is used to delete the session for the tag;
  • the service request message is used to request service for the tag;
  • the tag data sending message is used to send the tag data.
  • the tag data may be sensor data or preset data, and the like.
  • the tag trigger signal is used to trigger the inventory process; or, the tag trigger signal is used to trigger tag access process; alternatively, the tag trigger signal is used to trigger the tag authentication process; alternatively, the tag trigger signal is used to trigger the tag lock process; alternatively, the tag trigger signal is used to trigger the tag invalidation process; alternatively, the tag trigger signal is used to wake up the tag device; inventory
  • the process is the process of obtaining the label identification; the label access process is the process of reading or writing the label device; the label authentication process is the process of authenticating the label device; the label locking process is the process of locking the label device; the label is invalid
  • a process is the process of deactivating a tag device; waking up a tag device is the process of waking up a tag device.
  • the tag device receives the filtering information; if the tag device matches the filtering information, the tag device sends the core network interaction information.
  • the core network interaction message carries a tag identifier or a session identifier; the tag identifier or session identifier is determined by the inventory process. Or the tag access process is obtained; the inventory process is the process of acquiring the tag identification; the tag access process is the process of reading or writing the tag device.
  • the tag trigger signal is any of the following: select the Select command, challenge the Challenge command, and query the Query command, read command, write command, invalid kill command, lock lock command, wake-up command.
  • the core network interaction message is a non-access stratum NAS message.
  • a communication apparatus configured to be an access network device or a component in the access network device.
  • the device includes: a processing unit, configured to acquire an identifier of a tag device, and determine a third generation partnership project 3GPP network user identifier according to the identifier of the tag device; a communication unit, configured to send a first message to an access mobility management network element; A message includes a 3GPP network subscriber identity, which is used to authenticate the tag device.
  • the communication unit is further configured to receive the authentication result of the tag device through the access mobility management network element.
  • the identification of the label device may be the same identification as the 3GPP network user identification or a different identification.
  • the first message further includes type information, where the type information is used to indicate the type of the tag device.
  • the first message is a non-access stratum NAS registration request
  • the NAS registration request includes the 3GPP network User ID.
  • the access network device obtains the identifier of the label device through the inventory process or the label access process, and the inventory The process is the process of obtaining the tag identification, and the tag access process is the process of reading or writing the tag device.
  • the communication unit is further configured to receive a second message from the access mobility management network element , the second message includes at least one of the following: a protocol parameter, a communication parameter or an access parameter; wherein the protocol parameter is used to indicate the communication protocol between the access network device and the label device and/or the access network device and the label aggregation network Communication protocol between elements; communication parameters are used to support the data transmission rate and/or decoding method used for communication between access network equipment configuration and tag equipment; access parameters are used for access network equipment configuration tag equipment access events
  • the rules of the tag device access event include at least one of the following: the trigger time of the tag device access event, the period of the tag device access event, or the number of tag devices corresponding to the tag device access event.
  • the tag device access event is to perform a read operation, or a write operation, or an invalidation operation on the tag, or an inventory operation for the tag.
  • the read operation can read the information stored by the label device, such as sensor information, etc.
  • the inventory operation refers to the operation of obtaining the label identifier, and the access of the label device can also be called the access of the label device.
  • the processing unit is specifically configured to determine the access network device and the tag according to the second message The communication protocol between the devices and/or the communication protocol between the access network device and the tag aggregation network element; and/or, configure the data transmission rate and/or decoding method used for communication with the tag device; and/or , configure the rules for tag device access events.
  • the communication unit is further configured to receive an operation instruction from the label aggregation network element; the operation instruction It is used for instructing the access network device to perform the communication operation with the tag device; the processing unit is also used for performing the communication operation with the tag device according to the operation instruction.
  • the label aggregation network element can be an independent core network element, or it can be deployed together with the user plane function network element UPF, the access mobility management network element AMF, the session management network element SMF, the network open network element NEF, the server or the IoT platform. network element.
  • the identifier of the tag device includes the wireless access control MAC address of the tag device or the The electronic product code EPC that secretly identifies the SID or tag device.
  • the processing unit includes a label access function module and a label proxy function module.
  • the function module is used to obtain the identification of the label device, the label access function module sends the identification of the label device to the label proxy function module; the label proxy function module is used to determine the 3GPP network user identification according to the identification of the label device.
  • the label proxy function module is further used to generate first information, and the first information is used It is used to indicate the correspondence between the identifier of the label device, the identifier of the label access function module and the 3GPP network user identifier; the label access function module is addressed according to the first information.
  • the 3GPP network user identifier includes the user hidden identifier SUCI or the user permanent identifier SUPI of the tag device. .
  • the communication device provided in the fifth aspect may also be a reader device or a component in the reader device, and the reader device may be deployed in an access network device or a terminal device.
  • the communication device When deployed in an access network device, the communication device may be the above-mentioned access network device or a component in the access network device, and when the reader device is deployed in a terminal device, the communication device may also be a terminal device or a terminal components in the device.
  • the access network device can also be directly used as a reader device, or the terminal device can also be directly used as a reader device; when the access network device is directly used as a reader device, the communication device can be the above-mentioned access network device or a connection device.
  • the communication device When the terminal device is directly used as a reader device, the communication device may be a terminal device or a component in the terminal device.
  • a communication apparatus in a sixth aspect, and the apparatus may be an access mobility management network element or a component in the access mobility management network element.
  • the device includes: a processing unit, used for the communication unit to receive a first message from the access network device, where the first message includes a third generation partnership project 3GPP network user identity of the label device;
  • the management network element sends the 3GPP network user identifier to the authentication device, and the 3GPP network user identifier is used to authenticate the label device.
  • the processing unit is further configured to receive the authentication result of the label device from the authentication device through the communication unit, and send the authentication result of the label device to the access network device through the communication unit.
  • the identification of the label device may be the same identification as the 3GPP network user identification or a different identification.
  • the first message further includes type information, where the type information is used to indicate the type of the tag device.
  • the first message is a non-access stratum NAS registration request
  • the NAS registration request includes the 3GPP network User ID.
  • the processing unit is further configured to receive at least one of the following from the label aggregation network element through the communication unit: Items: protocol parameters, communication parameters and access parameters; wherein, the protocol parameters are used to indicate the communication protocol between the access network device and the label device and/or the communication protocol between the access network device and the label aggregation network element; communication The parameter is used to support the data transmission rate and/or decoding method used for communication between the access network device configuration and the tag device; the access parameter is used for the access network device to configure the rules of the tag device access event; the tag device access event The rules include at least one of the following: the trigger time of the tag device access event, the period of the tag device access event, or the number of tag devices corresponding to the tag device access event; the processing unit is further configured to send the access network device through the communication unit A second message is sent, where the second message includes at least one of communication protocol parameters, device operation parameters, and access parameters.
  • the tag device access event is to perform a read operation, or a write operation, or an invalidation operation on the tag, or an inventory operation for the tag.
  • the read operation can read the information stored by the label device, such as sensor information, etc.
  • the inventory operation refers to the operation of obtaining the label identifier, and the access of the label device can also be called the access of the label device.
  • the processor is further configured to receive a third message from the label aggregation network element through the communication unit , and the third message is used by the label aggregation network element to subscribe the message related to the label device to the access mobility management network element.
  • the label aggregation network element can be an independent core network element, or it can be deployed together with the user plane function network element UPF, the access mobility management network element AMF, the session management network element SMF, the network open network element NEF, the server or the IoT platform. network element.
  • the third message includes a message type, and the message type indicates a message related to the tag device.
  • the 3GPP network user identifier includes a user hidden identifier SUCI or a permanent user identifier SUPI of the tag device.
  • a communication device may be a label aggregation network element or a component in a label aggregation network element.
  • the device includes: a processing unit for judging whether the tag device has passed the security authentication; a communication unit for sending an operation instruction to the access network device after the processing unit determines that the tag device has passed the security authentication; the operation instruction is used for instructing the access network
  • the device performs communication operations with the tag device.
  • the label aggregation network element can be an independent core network element, or it can be deployed together with the user plane function network element UPF, the access mobility management network element AMF, the session management network element SMF, the network open network element NEF, the server or the IoT platform. network element.
  • the processing unit is specifically configured to, if the third generation partnership project 3GPP network user corresponding to the identification of the labeling device is obtained from the authentication device according to the identification of the labeling device. If the label is identified, it is determined that the labeling device has passed the safety certification.
  • the communication unit is further configured to, before the processing unit determines that the label device has passed the security authentication
  • the access mobility management network element sends at least one of the following: a protocol parameter, a communication parameter and an access parameter; wherein the protocol parameter is used to indicate the communication protocol between the access network device and the label device and/or the access network device and the label
  • the communication protocol between the aggregation network elements; the communication parameters are used to support the data transmission rate and/or decoding method used for communication between the access network equipment configuration and the tag equipment; the access parameters are used for the access network equipment to configure the tag equipment connection.
  • the rules of the tag device access event include at least one of the following: the trigger time of the tag device access event, the period of the tag device access event, or the number of tag devices corresponding to the tag device access event.
  • the communication unit is further configured to send a third message to the access mobility management network element,
  • the third message is used to subscribe the access mobility management network element for messages related to the tag device.
  • the third message includes a message type, and the message type indicates a message related to the tag device.
  • the processing unit is specifically configured to, if the tag is not obtained from the authentication device according to the identification of the tag device If the identifier of the device corresponds to the third generation partnership project 3GPP network user identifier, it is determined that the label device has not passed the security certification.
  • the communication unit is further configured to, after the processing unit determines that the label device has not passed the security authentication, Send at least one of the following to the access mobility management network element: communication protocol parameters, device operation parameters and access parameters; wherein the communication protocol parameters are used to indicate the communication protocol and/or access parameters between the access network device and the tag device.
  • the communication unit is further configured to send a third message to the access mobility management network element,
  • the third message is used to subscribe the access mobility management network element for messages related to the tag device.
  • the third message includes a message type, and the message type indicates a message related to the tag device.
  • the identifier of the tag device includes the wireless access control MAC address of the tag device or the secret of the tag device Electronic Product Code EPC that identifies the SID or tag device.
  • the 3GPP network user identifier includes a user hidden identifier SUCI or a permanent user identifier SUPI of the tag device.
  • a communication device in an eighth aspect, is provided, and the communication device may be a label device or a component in the label device.
  • the device includes: a communication unit for sending a core network interaction message after receiving a tag trigger signal; the core network interaction message is used for message interaction between a tag device and a core network element.
  • the core network interaction message may include any one of the following: a registration message; or a deregistration message; or a session establishment request message; or a session modification request message; or, session deletion request message; or, service request message; or, tag data sending message; registration message is used to register the tag in the core network; To establish a session for the tag; the session modification request message is used to modify the session for the tag; the session deletion request message is used to delete the session for the tag; the service request message is used to request services for the tag; the tag data sending message is used to send tag data, tag data It can be sensor data or preset data, etc.
  • the tag trigger signal is used to trigger the inventory process; or, the tag trigger signal is used to trigger tag access process; alternatively, the tag trigger signal is used to trigger the tag authentication process; alternatively, the tag trigger signal is used to trigger the tag lock process; alternatively, the tag trigger signal is used to trigger the tag invalidation process; alternatively, the tag trigger signal is used to wake up the tag device; inventory
  • the process is the process of obtaining the label identification; the label access process is the process of reading or writing the label device; the label authentication process is the process of authenticating the label device; the label locking process is the process of locking the label device; the label is invalid
  • a process is the process of deactivating a tag device; waking up a tag device is the process of waking up a tag device.
  • the communication unit is further configured to receive filtering information; if the filtering information is matched, send the core network interaction information.
  • the core network interaction message carries a tag identifier or a session identifier; the tag identifier or session identifier is determined by the inventory process. Or the tag access process is obtained; the inventory process is the process of acquiring the tag identification; the tag access process is the process of reading or writing the tag device.
  • the tag trigger signal is any of the following: select the Select command, challenge the Challenge command, and query the Query command, read command, write command, invalid kill command, lock lock command, wake-up command.
  • the core network interaction message is a non-access stratum NAS message.
  • a communication device comprising at least one processor and a memory, the at least one processor is coupled with the memory; the memory is used to store a computer program;
  • the at least one processor is configured to execute a computer program stored in the memory, so that the apparatus executes the method according to the first aspect and any one of the implementation manners of the first aspect.
  • a communication device comprising at least one processor and a memory, the at least one processor is coupled with the memory; the memory is used to store a computer program;
  • the at least one processor is configured to execute a computer program stored in the memory, so that the apparatus executes the method according to the second aspect and any one of the implementation manners of the second aspect.
  • a communication device comprising at least one processor and a memory, the at least one processor is coupled with the memory; the memory is used to store a computer program;
  • the at least one processor is configured to execute a computer program stored in the memory, so that the apparatus executes the method according to the third aspect and any one of the implementation manners of the third aspect.
  • a twelfth aspect provides a communication device, comprising at least one processor and a memory, the at least one processor is coupled to the memory; the memory is used to store a computer program;
  • the at least one processor is configured to execute a computer program stored in the memory, so that the apparatus executes the method according to the fourth aspect and any one of the implementation manners of the fourth aspect.
  • a thirteenth aspect provides a computer-readable storage medium, comprising: instructions stored in the computer-readable storage medium; when the computer-readable storage medium is described in the fifth aspect and any implementation manner of the fifth aspect When running on the communication device, the communication device is caused to execute the authentication method described in the first aspect and any implementation manner of the first aspect.
  • the communication apparatus is made to perform the above-mentioned second aspect and any one of the implementation manners of the second aspect. the described authentication method.
  • the communication apparatus is made to perform the above-mentioned third aspect and any one of the implementation manners of the third aspect. the described authentication method.
  • the communication apparatus is made to perform the above-mentioned fourth aspect and any one of the implementation manners of the fourth aspect. method described.
  • a fourteenth aspect provides a wireless communication device, where the communication device includes a processor, for example, applied to the communication device, for implementing the first aspect and the method described in any one of the implementation manners of the first aspect, or , the method described in any implementation manner of the second aspect and the second aspect, or the method described in any implementation manner of the third aspect and the third aspect, or the fourth aspect and the fourth aspect. implement the method described.
  • the communication device may be, for example, a system-on-chip.
  • the chip system further includes a memory, and the memory is used to store necessary program instructions for implementing the functions of the methods described in the first aspect or the second aspect or the third aspect or the fourth aspect and data.
  • the chip system in the above aspects may be a system on chip (system on chip, SOC), or a baseband chip, etc.
  • the baseband chip may include a processor, a channel encoder, a digital signal processor, a modem, an interface module, and the like.
  • a fifteenth aspect provides a communication system, where the communication system includes the access network device described in any of the foregoing implementations, the label aggregation network element described in any of the foregoing implementations, and any of the foregoing implementations The access mobility management network element described in the method and the label device described in any one of the above implementation manners.
  • FIG. 1 is an architectural diagram of a communication system provided by an embodiment of the present application
  • FIG. 2 is an architectural diagram of an RFID system provided by an embodiment of the present application
  • FIG. 3 is an architectural diagram of a UWB system provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of an interaction flow between a tag and a reader provided by an embodiment of the present application
  • FIG. 5 is another communication system architecture diagram provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a protocol stack applicable to the communication system provided by the embodiment of the present application.
  • FIG. 7a is a structural block diagram of a communication device provided by an embodiment of the present application.
  • FIG. 7b is another structural block diagram of a communication device provided by an embodiment of the present application.
  • FIG. 8a is a schematic flowchart of an authentication method provided by an embodiment of the present application.
  • FIG. 8b is another schematic flowchart of the authentication method provided by the embodiment of the present application.
  • FIG. 11 is a schematic flowchart of a communication method provided by an embodiment of the present application.
  • FIG. 12 to FIG. 13 are another structural block diagram of a communication apparatus provided by an embodiment of the present application.
  • the 3rd generation partnership project (3GPP) communication system supports the interconnection and intercommunication between tag equipment (tag) and the 3GPP core network using non-3GPP technology.
  • tags tag equipment
  • 3GPP core network using non-3GPP technology.
  • a new security network element is added, and security authentication is performed on the label device through the newly added security network element. After the authentication is passed, the network element allows the non-3GPP technology to interconnect and communicate between the label device and the 3GPP core network.
  • the non-3GPP technology may be wireless fidelity (Wi-Fi), worldwide interoperability for microwave access (WiMAX), code division multiple access (code division multiple access, CDMA) network, etc.
  • the network functions and entities included in the communication system architecture shown in Figure 1 mainly include: terminal equipment, access network equipment, user plane function network elements, data network, access and mobility management function network elements, session management function network elements, Policy control function network element, application function network element, authentication service function network element and unified database function network element.
  • the figure shows the interaction between network function entities and the corresponding interfaces.
  • UE terminal equipment
  • AMF access and mobility management function network element
  • the terminal equipment can access the 3GPP core network through 3GPP access technology or non-3GPP access technology.
  • the terminal device can be a user equipment (UE), a handheld terminal, a notebook computer, a subscriber unit, a cellular phone, a smart phone, a wireless data card, a personal Personal digital assistant (PDA) computer, tablet, wireless modem, handheld, laptop computer, cordless phone, or wireless local loop loop, WLL) station, machine type communication (machine type communication, MTC) terminal or other devices that can access the network.
  • UE user equipment
  • PDA personal Personal digital assistant
  • WLL wireless local loop loop
  • MTC machine type communication
  • a certain air interface technology is used to communicate with each other between the terminal equipment and the access network equipment.
  • Access network (radio access network, RAN) equipment mainly responsible for radio resource management, quality of service (quality of service, QoS) management, data compression and encryption on the air interface side.
  • the access network equipment may include various forms of base stations, such as: a macro base station, a micro base station (also referred to as a small cell), a relay station, an access point, and the like.
  • base stations such as: a macro base station, a micro base station (also referred to as a small cell), a relay station, an access point, and the like.
  • the names of devices with base station functions may vary.
  • 5G 5th generation
  • gNB in the LTE system
  • gNB in the LTE system
  • gNB in the LTE system
  • gNB In the third generation (3rd generation, 3G) system, it is called a Node B (Node B) and so on.
  • Access and mobility management function (AMF) network element It belongs to the core network element and is mainly responsible for the signaling processing part, such as access control, mobility management, attachment and detachment, and gateway selection, etc. Function.
  • AMF network element provides services for the session in the terminal device, it provides storage resources of the control plane for the session, and stores the session identifier, the SMF network element identifier associated with the session identifier, and the like.
  • Non-3GPP access interworking function This network element allows non-3GPP technology interconnection and interworking between terminal equipment and 3GPP core network. ), worldwide interoperability for microwave access (WiMAX), code division multiple access (CDMA) networks, etc. Compared with trusted non-3GPP access network devices, they can directly access the 3GPP core network , the network element needs to communicate with the 3GPP core network through the security tunnel established by the security gateway, wherein the security gateway is for example: evolved packet data gateway (ePDG), trusted non-3GPP gateway function (trusted Non -3GPP gateway function, TNGF) or non-3GPP interworking function (Non-3GPP interworking function, N3IWF).
  • ePDG evolved packet data gateway
  • trusted non-3GPP gateway function trusted Non -3GPP gateway function
  • TNGF trusted Non -3GPP gateway function
  • N3IWF non-3GPP interworking function
  • Session management function network element: responsible for user plane network element selection, user plane network element redirection, Internet Protocol (IP) address allocation, bearer establishment, modification and release, and QoS control.
  • IP Internet Protocol
  • User plane function (UPF) network element responsible for forwarding and receiving user data in terminal equipment.
  • the user data can be received from the data network and transmitted to the terminal device through the access network device; the UPF network element can also receive the user data from the terminal device through the access network device and forward it to the data network.
  • the transmission resources and scheduling functions that provide services to terminal equipment in the UPF network element are managed and controlled by the SMF network element.
  • PCF Policy control function
  • Authentication service function (authentication server function, AUSF) network element: mainly provides authentication function, supports the authentication of 3GPP access and Non-3GPP access, for details, please refer to 3GPP TS 33.501.
  • Network Exposure Function network element: mainly supports the secure interaction between 3GPP networks and third-party applications. NEF can safely expose network capabilities and events to third parties to enhance or improve application service quality. 3GPP networks are also Relevant data can be safely obtained from a third party to enhance the intelligent decision-making of the network; at the same time, the network element supports the recovery of structured data from the unified database or the storage of structured data in the unified database.
  • Unified database function unified data repository, UDR
  • UDR unified data repository
  • UDM unified data management
  • Application function (AF) network element mainly supports interaction with the 3GPP core network to provide services, such as influencing data routing decisions, policy control functions, or providing some third-party services to the network side.
  • network elements or functions may be network elements in hardware devices, software functions running on dedicated hardware, or virtualized functions instantiated on a platform (eg, a cloud platform).
  • a platform eg, a cloud platform
  • the foregoing network element or function may be implemented by one device, or may be implemented jointly by multiple devices, or may be a functional module in one device, which is not specifically limited in this embodiment of the present application.
  • the system shown in FIG. 1 may further include other functional network elements, which are not limited in this embodiment of the present application.
  • RFID tags can also be called inductive electronic chips, proximity cards, proximity cards, non-contact cards, electronic labels or electronic barcodes, etc.
  • the RFID system mainly includes: RFID Tag, Reader (reader), middleware and other back-end application systems. After the RFID Tag enters the magnetic field, it receives the radio frequency signal sent by the Reader, and the RFID Tag sends the product information in the RFID Tag chip. After the Reader reads and decodes the information, it is sent to the central information system or background application system for data processing. This RFID Tag can be called Passive Tag (passive tag or passive tag).
  • the RFID Tag actively sends a signal of a specific frequency, and after the Reader reads and decodes the signal, it is sent to the central information system or background application system for data processing.
  • This RFID Tag is called Active Tag (active tag or active tag).
  • the UWB system mainly includes: UWB tags (or UWB terminals), UWB base stations, and positioning servers, where the UWB tags may be called tags, and the UWB base stations may be called readers.
  • UWB is a carrier-free communication technology that transmits data using non-sinusoidal narrow pulses in nanoseconds to picoseconds.
  • Very low-power signals can be transmitted over a wide spectrum, for example, data transmission rates of hundreds of Mbit/s to several Gbit/s can be achieved within a range of about 10 meters between UWB base stations and UWB tags.
  • FIG. 4 is a schematic diagram of the interaction flow between Tag (tag) and Reader (interpreter), specifically including:
  • the Reader first sends an excitation signal to the RFID Tag, so that the Tag can obtain energy.
  • S3, Tag and Reader use the Inventory (inventory) series of commands to negotiate the communication parameters of this communication (inventory).
  • the Inventory series of commands include Query (query), QueryRep (query response), acknowledgement (acknowledgement, ACK) and negative acknowledgement (negative acknowledgement, NACK), etc.
  • the communication parameters can be data transmission rate, encoding method, etc.
  • the Access series of commands include an Authenticate (authentication) command, an AuthComm command, a SecureComm command, a KeyUpdate command, a Read command, and a Wirte command.
  • Authenticate is used for two-way authentication between Tag and Reader.
  • instructions such as KeyUpdate, Read, and Wirte are used to perform specific read and write operations.
  • the Reader can be integrated on the network side, and the function modules or network elements integrated on the network side that are consistent with the functions of the Reader can communicate and interact with the label device.
  • a label access function module and a label fusion function module are deployed on the access network equipment, and a label aggregation function module (or a label aggregation network element) is deployed on the core network side.
  • the label access function module is responsible for interacting with the label device; the label proxy function module is used to build a device-granular non-access stratum (NAS) connection for the label device, so that in the subsequent security authentication process Relevant authentication information is passed through NAS messages.
  • NAS device-granular non-access stratum
  • the Reader can also be deployed in the terminal device.
  • the reader is deployed in the access network device as an example for description. It should be understood that when the Reader is deployed in the terminal device, the terminal device can execute this function.
  • the functions performed by the access network equipment in the application embodiments. Reader can be called a reader or a reader device.
  • the access network device can also be directly used as a reader device, or the terminal device can also be directly used as a reader device.
  • FIG. 5 is an architecture diagram of another communication system provided by an embodiment of the present application.
  • the label device can access the core network through the 3GPP access technology.
  • the label device accesses the core network through the RAN, and the RAN includes a label access function module and a label proxy function module.
  • Label devices can also access the core network through non-3GPP access technologies.
  • the label device may use a non-3GPP access technology to access the core network through N3IWF or TNGF.
  • the N3IWF or TNGF may also include a label access function module and a label proxy function module.
  • a security tunnel may be established, and when accessing the core network through the TNGF network element, the security tunnel may not be established.
  • the above-mentioned non-3GPP technologies may be wireless fidelity (Wi-Fi) technology, worldwide interoperability for microwave access (WiMAX) technology, code division multiple access (code division multiple access, CDMA) network technology, etc. .
  • the label access function module can communicate with the label device, and can also communicate with the label proxy function module; the label proxy function module can communicate with the label aggregation network element (also referred to as the label aggregation function module).
  • Figure 5 takes the example of a RAN node including a miniature remote radio unit (pico remote radio unit, pRRU) and a baseband unit (baseband Unit, BBU).
  • the radio frequency module of the RFID Reader is co-deployed with the pRRU, or directly integrated into the pRRU.
  • the upper functional modules RFID-L and RFID-H of RFID Reader are deployed in the BBU and core network respectively.
  • the radio frequency module of the UWB base station is co-deployed with the pRRU, or directly integrated into the pRRU.
  • the upper layer functional modules UWB-L and UWB-H of the UWB base station are respectively deployed in the BBU and the core network.
  • RFID-L and UWB-L may be called label access function modules, and RFID-H and UWB-H may be called label aggregation network elements.
  • label agent functional module can be called uni-AGF. The specific functions of the above modules are described as follows:
  • RFID-L It includes the media access control (MAC) protocol layer, which is responsible for interacting with RFID tags; RFID-L can also include the low level reader protocol (LLRP) protocol layer, Responsible for receiving high-level commands of RFID-H and converting them into corresponding air interface operations.
  • MAC media access control
  • LLRP low level reader protocol
  • RFID-H It includes the protocol adaptation layer (PAL), which is responsible for interacting with RFID-L.
  • PAL protocol adaptation layer
  • LLRP protocol can be used; it can also include the application level events (ALE) protocol layer, which is responsible for the interaction with RFID-L.
  • ALE application level events
  • UWB-L It includes the MAC protocol layer, which is responsible for interacting with UWB labels; it can also include the PAL protocol layer, which is responsible for receiving high-level commands of UWB-H and converting them into corresponding air interface operations.
  • UWB-H including the PAL protocol layer, responsible for interacting with UWB-L; UWB-H is also responsible for high-level functions such as network configuration and message routing.
  • UWB/RFID tags do not have a complete UE protocol stack
  • the BBU uses a unified access gateway function (Uni-AGF) to build a NAS connection with tag granularity for tag devices.
  • UWB application server or RFID application server is deployed in enterprise data center or private cloud.
  • RFID-L and UWB-L can be regarded as the label access function module described in the embodiment of the present application
  • RFID-H and UWB-H can be regarded as the label aggregation network element (or referred to as the label aggregation network element described in the embodiment of the present application)
  • Label aggregation function module
  • Uni-AGF may be considered as the label proxy function module described in the embodiments of the present application.
  • FIG. 6 is a protocol stack applicable to the communication system shown in FIG. 5 .
  • Uni-AGF is responsible for building a NAS connection for each tag device (for example, RFID tag or UWB tag), and the constructed control plane channel is "Tag ⁇ -->RFID-L ⁇ -->Uni-AGF ⁇ --> AMF", or, Tag ⁇ -->UWB-L ⁇ -->Uni-AGF ⁇ -->AMF.
  • RFID-H and RFID-L or UWB-H and UWB-L
  • UWB-H and UWB-L perform device-level communication
  • Uni-AGF can be skipped.
  • Figure 6 takes RFID tags and UWB tags as examples to introduce the protocol stack for communication between tag equipment (tag), tag access function module, tag proxy function module, AMF, tag aggregation network element and application server.
  • the label device is RFID tag
  • the label access function module is RFID-L
  • the label agent function module is Uni-AGF
  • the label aggregation network element is RFID-H.
  • the label device is UWB tag
  • the label access function module is UWB-L
  • the label proxy function module is Uni-AGF
  • the label aggregation network element is UWB-H.
  • RFID-H can be deployed independently or integrated in other core network elements.
  • the message interaction between the RFID-H and the AMF is carried out through the internal interface.
  • UWB-H can be deployed independently or integrated in other core network elements.
  • the UWB-H and the AMF exchange messages through the internal interface.
  • the embodiment of the present application provides an authentication method, in which an access network device can obtain an identifier of a tag device, determine a third generation partnership project 3GPP network user identifier according to the identifier of the tag device, and send the first A message, the first message including the 3GPP network user identity for authenticating the tag device.
  • the authentication method provided by the embodiment of the present application can realize the authentication and authentication of different label devices, while supporting the unified network management of various labels, and at the same time, a unified authentication process is provided for the security authentication of label devices, which reduces the complexity of fusion management. sex.
  • FIG. 7a is a schematic diagram of a hardware structure of a communication apparatus 710 according to an embodiment of the present application.
  • the communication device 710 includes a processor 7101 and at least one communication interface (the communication interface 7103 is used as an example in FIG. 7a for illustration), and optionally, a memory 7102 is also included.
  • the processor 7101, the memory 7102 and the communication interface 7103 are connected to each other.
  • the processor 7101 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more processors used to control the execution of the programs of the present application. integrated circuit.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • Communication interface 7103 using any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN) Wait.
  • RAN radio access network
  • WLAN wireless local area networks
  • the memory 7102 may be read-only memory (ROM) or other type of static storage device that can store static information and instructions, random access memory (RAM) or other type of static storage device that can store information and instructions It can also be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, CD-ROM storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of being executed by a computer Access any other medium without limitation.
  • the memory can exist independently or be connected to the processor.
  • the memory can also be integrated with the processor.
  • the memory 7102 is used for storing computer-executed instructions for executing the solution of the present application, and the execution is controlled by the processor 7101 .
  • the processor 7101 is configured to execute the computer-executed instructions stored in the memory 7102, thereby implementing the intent processing method provided by the following embodiments of the present application.
  • the computer-executed instructions in the embodiment of the present application may also be referred to as application code, which is not specifically limited in the embodiment of the present application.
  • the processor 7101 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 7a.
  • the communication apparatus 710 may include multiple processors, such as the processor 7101 and the processor 7106 in FIG. 7a.
  • processors can be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor.
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the communication apparatus 710 may further include an output device 7104 and an input device 7105 .
  • the output device 7104 is in communication with the processor 7101 and can display information in a variety of ways.
  • the output device 7104 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector (projector) Wait.
  • the input device 7105 is in communication with the processor 7101 and can receive user input in a variety of ways.
  • the input device 7105 may be a mouse, a keyboard, a touch screen device, a sensor device, or the like.
  • the above-mentioned communication apparatus 710 may be a general-purpose device or a dedicated device.
  • the communication device 710 may be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, an embedded device, or a similar structure in FIG. 7a. equipment.
  • PDA personal digital assistant
  • This embodiment of the present application does not limit the type of the communication device 710 .
  • the communication device 710 may be a complete terminal, may also be a functional component or component that implements the terminal, or may be a communication chip, such as a baseband chip.
  • the communication interface may be a radio frequency module.
  • the communication interface 7103 can be an input and output interface circuit of the chip, and the input and output interface circuit is used for reading in and outputting baseband signals.
  • the network element described in this embodiment of the present application may also be implemented by the communication device shown in FIG. 7b.
  • the communication device includes at least one processor 7201 , at least one transceiver 7203 , at least one network interface 7204 and one or more antennas 7205 .
  • at least one memory 7202 is also included.
  • the processor 7201, the memory 7202, the transceiver 7203 and the network interface 7204 are connected, for example, through a bus.
  • Antenna 7205 is connected to transceiver 7203.
  • the network interface 7204 is used for the communication device to connect with other communication devices through a communication link, for example, the communication device is connected to the core network element through the S1 interface.
  • the connection may include various types of interfaces, transmission lines, or buses, which are not limited in this embodiment.
  • the processor in this embodiment of the present application may include at least one of the following types: a general-purpose central processing unit (CPU), a digital signal processor (DSP), a microprocessor, An application-specific integrated circuit (ASIC), a microcontroller (MCU), a field programmable gate array (FPGA), or an integrated circuit for implementing logic operations .
  • the processor 7201 may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. At least one processor 7201 may be integrated in one chip or located on multiple different chips.
  • the memory in this embodiment of the present application may include at least one of the following types: read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (random access memory, RAM) or other types of dynamic storage devices that can store information and instructions, or EEPROM.
  • ROM read-only memory
  • RAM random access memory
  • EEPROM electrically erasable programmable read-only memory
  • the memory may also be compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.) , a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, without limitation.
  • the memory 7202 may exist independently and be connected to the processor 7201 .
  • the memory 7202 can also be integrated with the processor 7201, for example, in one chip.
  • the memory 7202 can store program codes for implementing the technical solutions of the embodiments of the present application, and is controlled and executed by the processor 7201 .
  • the processor 7201 is configured to execute the computer program codes stored in the memory 7202, thereby implementing the technical solutions in the embodiments of the present application.
  • the transceiver 7203 may be used to support the reception or transmission of radio frequency signals between the communication device and other network elements, and the transceiver 7203 may be connected to the antenna 7205 .
  • one or more antennas 7205 can receive radio frequency signals
  • the transceiver 7203 can be used to receive the radio frequency signals from the antennas, convert the radio frequency signals into digital baseband signals or digital intermediate frequency signals, and convert the digital baseband signals or digital intermediate frequency signals.
  • the digital intermediate frequency signal is provided to the processor 7201, so that the processor 7201 performs further processing on the digital baseband signal or the digital intermediate frequency signal, such as demodulation processing and decoding processing.
  • the transceiver 7203 may be configured to receive the modulated digital baseband signal or digital intermediate frequency signal from the processor 7201, and convert the modulated digital baseband signal or digital intermediate frequency signal into a radio frequency signal, and transmit the modulated digital baseband signal or digital intermediate frequency signal to a radio frequency signal, and transmit the signal through one or more antennas 7205 The radio frequency signal is transmitted.
  • the transceiver 7203 can selectively perform one or more stages of down-mixing processing and analog-to-digital conversion processing on the radio frequency signal to obtain a digital baseband signal or a digital intermediate frequency signal. The order of precedence is adjustable.
  • the transceiver 7203 can selectively perform one or more stages of up-mixing processing and digital-to-analog conversion processing on the modulated digital baseband signal or digital intermediate frequency signal to obtain a radio frequency signal.
  • the up-mixing processing and digital-to-analog conversion processing The sequence of s is adjustable.
  • Digital baseband signals and digital intermediate frequency signals can be collectively referred to as digital signals.
  • a transceiver may be referred to as a transceiver circuit, a transceiver unit, a transceiver device, a transmission circuit, a transmission unit, or a transmission device, and the like.
  • the communication device 720 may be a whole communication device, a component or a component that realizes the function of the communication device, or a communication chip.
  • the transceiver 7203 may be an interface circuit of the chip, and the interface circuit is used to read in and output baseband signals.
  • An embodiment of the present application provides an authentication method, as shown in Figure 8a, the method includes the following steps:
  • the access network device acquires the identifier of the label device, and determines the third generation partnership project 3GPP network user identifier according to the identifier of the label device.
  • the tag device is a new type of terminal device, and the tag device can access the access network device in a wireless manner.
  • the tag device can access the access network device through Wi-Fi, WiMAX, CDMA network, EPC Gen2 ultra high frequency (UHF) and other non-3GPP technologies;
  • the NR air interface simulates a non-3GPP access technology link to access the access network device; or the label device accesses the access network device through the NR air interface.
  • the label device does not limit the device form to a label, and can be a terminal device of any form.
  • the access network device sends a message to the tag device, requesting the tag device to send the identifier of the tag device. Or, the access network device receives the identifier actively reported by the label device.
  • the identifier of the label device may be the same identifier as the 3GPP network user identifier, or may be an identifier different from the 3GPP network user identifier.
  • the identification of the labeling device includes the MAC address of the labeling device or the secret identifier (SID) of the labeling device or the labeling device.
  • EPC electronic product code
  • the labeling device is an RFID tag
  • the identification of the labeling device can be SID or EPC
  • the labeling device is a UWB tag
  • the identification of the labeling device can be a MAC address.
  • the 3GPP network user identifier of the label device includes a user concealed identifier (subscription concealed identifier, SUCI) of the label device.
  • the access network device can determine the SUCI according to the identification of the label device, or, according to the identification of the label device (Subscription Permanent Identifier, SUPI), determine the SUCI according to the SUPI, and subsequently can use the SUCI to perform security authentication on the label device.
  • SUPI Subscribescription Permanent Identifier
  • the 3GPP network user identity of the label device includes SUPI.
  • the access network device determines the SUPI according to the identifier of the tag device, and can subsequently report the SUPI to the access mobility management network element, so as to perform security authentication on the tag device based on the SUPI.
  • the 3GPP network user identity of the tag device may be SUPI.
  • the identity of the label device may include SUCI or SUPI.
  • the access network device may acquire the identifier of the tag device through an inventory process or a tag access process.
  • the inventory process may be a process of acquiring a tag identifier
  • the tag access process may be a process of performing a read operation or a write operation on the tag device.
  • the access network device may include: a label access function module and a label proxy function module.
  • the label access function module may acquire the identification of the label device, and send the identification of the label device to the label proxy function module.
  • the label proxy function module determines the 3GPP network user identity from the identity of the label device.
  • the access network device sends a first message to the access mobility management network element, where the first message includes the 3GPP network user identity, where the 3GPP network user identity is used to authenticate the label device.
  • the access mobility management network element may be the access and mobility management function described above.
  • it can be the AMF described above.
  • the access network device determines the 3GPP network user identity according to the identity of the label device, it sends the 3GPP network user identity of the label device to the access mobility management network element through a first message, which is used for security authentication of the label device.
  • the first message is used to request the establishment of a NAS connection for the label device, and subsequently information related to the security authentication of the label device, such as a 3GPP network user identity of the label device, is transmitted through a NAS message.
  • the first message is an initial UE message (initial UE message).
  • the first message further includes type information, where the type information is used to indicate the type of the label device.
  • the first message includes "RFID indicator", which instructs the core network to establish a NAS connection for the RFID tag.
  • the label proxy function module determines the 3GPP network user identity of the label device, and sends the label to the access network.
  • the incoming mobility management network element sends the first message.
  • the access mobility management network element receives the first message from the access network device, and sends the 3GPP network user identifier to the authentication device, where the 3GPP network user identifier is used to authenticate the label device.
  • the access mobility management network element obtains the 3GPP network user identity of the tag device from the first message, and selects an authentication device to perform security authentication (or authentication) on the tag device.
  • the 3GPP network user identity of the label device is sent to the authentication device, so that the authentication device authenticates the label device according to the 3GPP network user identity of the label device.
  • the authentication device may authenticate the label device according to the 3GPP network user identity of the label device.
  • the authentication device may be the aforementioned AUSF or UDM.
  • the authentication device can authenticate the label device according to the 3GPP network user identity of the label device, and after the authentication is passed, the authentication device can also store the 3GPP network user identity of the label device.
  • the authentication device includes the AUSF and the UDM, and the AUSF and the UDM cooperate to complete the authentication of the label device.
  • the authentication device includes an authentication, authorization and accounting (authentication, authorization, and accounting, AAA) server of the AUSF and a third party, and the AUSF and the AAA server cooperate to complete the authentication of the label device.
  • the authentication device may also obtain the type information of the label device from the first message, and may select an authentication method that matches the label device according to the type information of the label device for the label device.
  • the device is certified for safety.
  • the authentication device may select an authentication method standardized by RFID or customized by the manufacturer.
  • the authentication device sends the authentication result of the tag device to the access network device by accessing the mobility management network element.
  • the access network device receives the authentication result of the tag device by accessing the mobility management network element.
  • the authentication result is used to indicate whether the label device has passed security authentication or authentication, and the authentication result may also be referred to as security authentication result, authentication result, etc., which is not limited in this embodiment of the present application.
  • steps 801 to 805 provide a unified authentication process to perform security authentication on different labels.
  • the network side can also configure parameters related to the tag device to the access network device.
  • the label aggregation network element deployed on the network side sends parameters related to the label device to the access mobility management network element, and the parameters related to the label device specifically include at least one of the following: protocol parameters, communication parameters or access parameters.
  • the protocol parameter is used to indicate the communication protocol between the access network device and the label device and/or the communication protocol between the access network device and the label aggregation network element; for example, the protocol parameter Protocol version information may be included, for example, the protocol version supported by the label aggregation network element.
  • the communication parameter is used to support the data transmission rate and/or decoding method used for communication between the access network device configuration and the tag device; it can be understood that the communication parameter indicates the access network device configuration
  • the operating parameters related to the label device support the communication between the access network device, the label device and the label aggregation network element.
  • the access parameter is used for the access network device to configure a rule for a tag device access event;
  • the rule for the tag device access event includes at least one of the following: a trigger time of the tag device access event, the The period of the tag device access event or the number of tag devices corresponding to the tag device access event.
  • the tag device access event may refer to a read operation, or a write operation, or an invalidation operation on the tag, or an inventory operation for the tag.
  • the read operation can read the information stored by the label device, such as sensor information, etc.
  • the invalid operation refers to the operation of setting the label to be temporarily unavailable or permanently unavailable
  • the inventory operation refers to the operation of obtaining the label identification
  • the label device accesses also known as tag device access.
  • the access mobility management network element After receiving the parameters related to the label device from the label aggregation network element, the access mobility management network element encapsulates the second message according to the received parameters, and sends the second message to the access network device.
  • the access network device may also complete local configuration according to parameters in the second message. For example, the communication protocol between the access network device and the tag device is determined according to the protocol parameter in the second message, and/or the communication protocol between the access network device and the tag device is determined according to the protocol parameter in the second message.
  • the label aggregates the communication protocol between network elements.
  • the access network device may further configure the data transmission rate and/or decoding method used for communication with the tag device according to the communication parameters in the second message.
  • the access network device may further configure the rule of the label device access event according to the access parameter in the second message.
  • the label access function module receives the second message from the access mobility management network element, and according to the second message parameters to complete the configuration.
  • the tag aggregation network element may also subscribe to the access mobility management network element for messages related to the tag device.
  • the access mobility management network element After the access mobility management network element receives messages sent by other network elements, it can route messages related to the label device to the label aggregation network element according to the subscription of the label aggregation network element, or, Messages related to type label devices are routed to label aggregation network elements.
  • the access network device can determine the 3GPP network user identity of the label device after acquiring the information of the label device, and can also send the 3GPP network user identity of the label device to the access mobility management network element, so as to access the
  • the mobility management network element sends the 3GPP network user identifier of the tag device to the authentication device to authenticate the tag device, and can use a unified authentication process to authenticate different tag devices. While supporting multiple labels for unified network management, it provides a unified authentication process for security authentication of label devices, reducing the complexity of converged management.
  • the authentication method provided by this embodiment of the present application further includes step 800:
  • the access mobility management network element receives a third message from the label aggregation network element, where the third message is used for the label aggregation network element to subscribe to the access mobility management network element for messages related to the label device.
  • the label aggregation network element may be an independently deployed core network network element, or may be integrated in other network elements. For example, it is integrated in a user plane functional network element, or an access mobility management network element, or a session management network element, or a network open network element, or a server, or an IoT platform.
  • the label aggregation network element can be integrated with it.
  • the network elements exchange messages through internal interfaces.
  • the third message includes a message type, and the message type indicates the message related to the tag device.
  • the third message includes a message type "RFID”, which instructs the access mobility management network element to route the message related to the RFID tag to the tag aggregation network element.
  • the third message includes a message type "UWB”, instructing the access mobility management network element to route the message related to the UWB label to the label aggregation network element.
  • a response message may be sent to the access mobility management network element.
  • the access mobility management network element receives the response message, determines that the response message is a message related to the label device, and routes the response message to the label aggregation network element.
  • a secure communication operation can be performed between the label device and the access network device.
  • the label aggregation network element first determines whether the label device has passed the security authentication; if it is determined that the label device has passed the security authentication, the label aggregation network element sends an operation instruction to the access network device; the operation instruction is used to instruct the The access network device performs communication operations with the tag device.
  • the label aggregation network element may send an operation instruction to the access network device through the access mobility management network element.
  • the operation instruction may be an Access series of commands between the Tag and the Reader in the flow shown in FIG. 4 .
  • it may be a "KeyUpdate” command, a "Read” command, or a "Write” command in the Access series of commands.
  • the label aggregation network element determines whether the label device has passed the security authentication, including: if the 3GPP network user identity corresponding to the label device's identity is obtained from the authentication device according to the label device's identity, then: It is determined that the labeling device has passed the safety certification.
  • the label aggregation network element obtains the identity of the label device from the AF, and queries the authentication device for the 3GPP network user identity corresponding to the identity of the label device according to the identity of the label device. If the authentication device stores a 3GPP network user identity corresponding to the identity of the label device, it indicates that the label device has passed the security authentication.
  • the 3GPP network user identifier corresponding to the identifier of the tag device is the 3GPP network user identifier determined according to the identifier of the tag device, for example, the SUPI determined according to the SID of the tag device.
  • the label proxy function module receives an operation instruction sent by the label aggregation network element through the access mobility management network element.
  • the label proxy function module can also send an operation instruction to the label access function module through the internal interface with the label access function module, and the label access function module triggers the communication operation with the label device.
  • the tag access function module sends a "KeyUpdate” command to the tag device, instructing the tag device to update the key.
  • the "KeyUpdate” command may be the "KeyUpdate” command in the Access series commands used between the Tag and the Reader in the flow shown in Figure 4 .
  • the label proxy function module may also maintain the correspondence between the identity of the label access function module, the label device and the 3GPP network user identity of the label device.
  • the received operation instruction can be routed to the corresponding label access function module according to the maintained correspondence.
  • the label proxy function module generates first information, and the first information is used to indicate the correspondence between the identity of the label device, the identity of the label access function module, and the identity of the 3GPP network user. relation.
  • the label proxy function module may also address the label access function module according to the first information.
  • the label proxy function module receives the operation instruction from the label fusion network element, addresses the corresponding label access function module according to the first information, and routes the operation instruction to the label access function module.
  • the label proxy function network element determines the SUPI/SUCI according to the corresponding relationship between the NAS connection and the SUPI/SUCI. It is also possible to determine the corresponding label access function module according to the corresponding relationship indicated by SUPI/SUCI and the first information, and send the operation instruction to the label access function module, so that the operation command can be issued by the label access function module. to the appropriate labeling device.
  • the label fusion network element may also configure parameters related to the label device to the access network device. For the specific authentication process and parameter configuration process, please refer to the foregoing description, which will not be repeated here.
  • the process related to the label device in the embodiment of the present application may be divided into a parameter configuration phase, a security authentication phase, and an access phase.
  • the label aggregation network element may also configure parameters related to the label device to the access network device.
  • the security authentication stage refers to steps 801 to 805 described above.
  • the tag aggregation network element sends an operation instruction to the access network device, and the tag device and the access network device perform corresponding communication operations, such as read and write operations, according to the operation instruction.
  • This embodiment of the present application does not limit the execution sequence of the above three stages.
  • the execution sequence is a parameter configuration stage, a security authentication stage, and an access stage.
  • the above three stages can be implemented alternatively, and the three stages are not indispensable.
  • the tag equipment is RFID tag
  • the access network equipment includes a tag access function module and a tag proxy function module, wherein the tag access function module is RFID-L, and the tag proxy function module is Uni-AGF.
  • the label aggregation network element is RFID-H
  • the authentication device is AUSF/UDM.
  • the access mobility management network element is AMF.
  • the RFID-H subscribes to the AMF for messages related to the RFID tag.
  • the RFID-H can perform device-level communication with the RAN, that is, the messages that the RFID-H interacts with the RAN are not specific to the UE.
  • RFID-H can exchange RFID type messages with RAN through AMF.
  • the RFID-H sends a service message Namf_Communication_NonUeMessageTransfer to the AMF, the message includes an N2 message and a field "N2inforType" representing the type of the N2 message, and the value of the field "N2inforType” is "RFID", indicating that the RFID-H sends The ones are "RFID" type messages.
  • the AMF sends the received N2 message to the RAN.
  • the AMF may also send an "N2inforType” field to the RAN, instructing the RFID-H to send a message of the "RFID” type.
  • the RFID-H can also instruct the AMF to forward the received uplink "RFID" type N2 message to the RFID-H network element by means of subscription/notification.
  • the RFID-H network element can pass the Namf_Communication_
  • the NonUeInfoSubscribe message subscribes to the AMF for messages of type "RFID".
  • the AMF receives the "RFID" type message sent by the RAN side, it can send Namf_Communication_NonUe to the RFID-H
  • An InfoNotify message which includes an "RFID” type message sent by the RAN side. After the RFID-H receives the message, it can obtain the "RFID” type message sent by the RAN side.
  • the "RFID" type message may be a message of the LLRP protocol, that is, the LLRP protocol (or other adaptation protocol) is used for interaction between the RFID-L and the RFID-H.
  • the RFID-H can send the downlink LLRP protocol message to the AMF through the service message Namf_Communication_NonUeMessageTransfer, and the AMF sends the LLRP protocol message to the RAN (specifically, the RFID-L on the RAN side).
  • the security of the RFID-H can be specified, and the RFID-H can directly communicate with other network elements of the core network.
  • RFID-H is used as a third-party application and is not a network element of the core network, the security of RFID-H is uncertain, and the RFID-H network element cannot directly communicate with other network elements of the core network.
  • exposure function, NEF exposure function
  • the RFID-H sends the RFID configuration information to the AMF.
  • the RFID configuration information is the aforementioned parameters related to the tag device, including at least one of a protocol parameter, a communication parameter, and an access parameter.
  • a protocol parameter e.g., a Wi-Fi parameter
  • a communication parameter e.g., a Wi-Fi parameter
  • an access parameter e.g., a Wi-Fi parameter
  • the descriptions of the protocol parameters, communication parameters, and access parameters refer to the foregoing description, and will not be repeated here.
  • the RFID-H transmits the RFID configuration information to the AMF through the servitization message Namf_Communication_NonUeMessageTransfer.
  • the RFID-H may include the RFID configuration information in the N2 message container and send it to the AMF, which is then forwarded to the RAN by the AMF through the N2 message.
  • the RFID configuration information may include the following three items:
  • the capability negotiation message (that is, the aforementioned protocol parameters) is used to negotiate the supported protocol version with RFID-L, and instruct RFID-L to use the negotiated protocol version.
  • the device configuration message (that is, the aforementioned communication parameters) is used to configure the basic operating parameters of the RFID-L, for example, the data transmission rate, the encoding method, and the like.
  • the access parameter may be tag access (or inventory) operation setting information or tag access (or inventory) operation update information.
  • the access parameters are used to configure the tag access (or inventory) event in the RFID-L, as well as the trigger time of the event, the period of the event, the number of tags that trigger the event, and the report content after the trigger event.
  • the AMF sends the RFID configuration information to the RFID-L.
  • the AMF constructs a dedicated N2 message "DOWNLINKNON UE ASSOCIATED RFID TRANSPORT", and sends the constructed message to the RAN.
  • the RAN node forwards the RFID configuration information to RFID-L.
  • the RFID-L completes the configuration according to the RFID configuration information.
  • the RFID-L completes the capability negotiation, the device configuration, and the setting or updating of the tag access (inventory) operation.
  • the RFID-L sends confirmation information/new RFID configuration information to the AMF.
  • step 903 is performed to complete the configuration, and in step 904, confirmation information can be sent to the AMF.
  • step 903 can be skipped, and the RFID configuration information can be further negotiated with RFID-H in step 904.
  • the RFID-L constructs new RFID configuration information, and sends the new RFID configuration information to the AMF.
  • the AMF is forwarded to the RFID-H dedicated upstream N2 message for negotiation, and the dedicated upstream N2 message contains the new RFID configuration information.
  • the AMF sends confirmation information/new RFID configuration information to RFID-H according to the subscription of RFID-H.
  • the RFID-H has subscribed to the AMF for N2 messages of the RFID type through Namf_Communication_NonUeInfoSubscribe.
  • the AMF After receiving the new RFID configuration information, the AMF encapsulates the new RFID configuration information and sends it to the RFID-H network element.
  • AMF uses Namf_Communication_
  • NonUeInfoNotify encapsulates the RFID configuration information and forwards it to the RFID-H network element.
  • steps 901-905 may be performed multiple times.
  • steps 901-905 there is no necessary correspondence between downlink signaling and uplink signaling.
  • step 903 part of the configuration can be completed according to the RFID configuration information, and step 904 is performed one or more times to negotiate other parameters with the RFID-H.
  • RFID-L obtains the SID of the RFID tag.
  • the SID or EPC code can be used as the identification of the RFID tag between the RFID tag and the RFID-L.
  • the RFID-L obtains the SID of the RFID tag through the tag identification process (Tag Identification), it triggers a further mutual authentication process to perform security authentication on the RFID tag.
  • the RFID-L needs to obtain security parameters for mutual authentication, such as encryption keys and/or complete protection keys, from the core network or a third party.
  • RFID-L sends the SID of the RFID tag to Uni-AGF.
  • the RFID-L interacts with the Uni-AGF through the internal interface between the Uni-AGF and the Uni-AGF, triggering the Uni-AGF to establish a NAS connection for the currently authenticated RFID tag, for interacting with the core network to perform security authentication on the RFID tag.
  • Uni-AGF can obtain the identification of RFID-L, and RFID-L sends the SID of the RFID tag to Uni-AGF.
  • Uni-AGF constructs a 3GPP user identity according to the SID of the RFID tag.
  • the 3GPP user identity may include SUCI or SUPI.
  • the RFID tag is securely authenticated based on SUCI.
  • Uni-AGF uses SID to construct SUPI based on the network access identifier (NAI) format defined in RFC 7542, and subsequently converts SUPI into SUCI.
  • NAI network access identifier
  • SUCI contains encrypted SUPI.
  • the Uni-AGF can also directly determine the SUCI according to the SID.
  • SUCI can be constructed from EPC codes.
  • the RFID tag is securely authenticated based on SUPI.
  • the Uni-AGF determines the SUPI according to the identifier (for example, SID or EPC code) reported by the RFID tag, and reports the SUPI to the AMF, and can subsequently perform security authentication on the RFID tag according to the SUPI.
  • the 3GPP network user identifier of the RFID tag may be SUPI.
  • the AMF receives the SID or EPC code sent by the RFID-L, and constructs the SUPI according to the SID or EPC code.
  • the Uni-AGF attempts to establish a NAS connection for the RFID tag.
  • the Uni-AGF can also store the correspondence between the RFID-L identifier, the SID of the RFID tag, and the SUPI (or SUCI) of the RFID tag.
  • the Uni-AGF can be responsible for multiple RFID-Ls, and the Uni-AGF can address one RFID-L that the Uni-AGF is responsible for according to the stored correspondence.
  • the Uni-AGF sends a NAS registration request to the AMF, where the NAS registration request includes the above-mentioned SUCI or SUPI.
  • the Uni-AGF sends a NAS registration request to the AMF, trying to establish a NAS connection for the RFID tag. Subsequent mutual authentication messages are forwarded by Uni-AGF.
  • the NAS registration request may be the first message described in this embodiment of the present application.
  • the NAS registration request includes the SUCI, so that the network side performs security authentication on the RFID tag according to the SUCI.
  • the NAS registration request can also carry the type information "RFID Indicator" of the RFID tag.
  • RFID Indicator is used to indicate the type of device connected by Uni-AGF NAS.
  • RFID Indicator may also affect the authentication process.
  • the authentication device can choose different authentication methods and parameters according to the type of device. Taking the authentication method defined in ISO 29167-19 as an example, RFID-L needs to obtain the encryption key and message authentication key corresponding to the RFID tag from the database (for example, UDM), and the UDM can also perform the corresponding authentication according to the instructions of the RFID Indicator method.
  • the root key is stored in the UDM, and the intermediate network element (such as AMF) derives the root key and sends the derived information to the RAN side (RFID-L) and the tag device (RFID tag). ).
  • AMF selects a suitable AUSF.
  • AMF selection of AUSF is the same as subsection 6.3.4 in TS 23.501. After AMF selects AUSF, it establishes the path between "tag ⁇ ->RFID-L ⁇ ->AMF ⁇ ->AUSF ⁇ ->UDM".
  • the AUSF and the RFID tag can complete the two-way authentication based on the above-mentioned signaling related to the mutual authentication of the path.
  • the AUSF can authenticate the RFID tag according to the 3GPP user identification (ie SUCI or SUPI) of the RFID tag sent by the AMF.
  • an RFID-standardized or manufacturer-defined authentication method may be used, and the above channel is used to transmit RFID-standardized or manufacturer-defined authentication signaling.
  • EAP Extensible Authentication Protocol
  • the AUSF can also obtain security parameters (secret keys, etc.) from the AAA-S of a third party, and the AUSF and the AAS-S interact through the AAA interface or indirectly through the AAA-P network element.
  • the security authentication signaling exchange channel established at this time is: tag ⁇ ->RFIDL ⁇ ->AMF ⁇ ->AUSF ⁇ ->AAAS, or tag ⁇ ->RFIDL ⁇ ->AMF
  • the AUSF can also send the authentication result of the RFID tag to the RFID-L through the AMF.
  • AMF registers the RFID tag to AUSF.
  • AUSF can store the SUPI corresponding to the SID of the RFID tag.
  • AMF sends a notification message to Uni-AGF, instructing the RFID tag to complete the registration.
  • the Uni-AGF ends the registration process.
  • the RFID-L notifies the Uni-AGF of the authentication result, and the Uni-AGF ends the registration process.
  • the Uni-AGF receives the registration failure message sent by the AMF, and the Uni-AGF ends the registration process.
  • the Uni-AGF can stop the NAS timer to end the registration process.
  • Step 913 is an optional step, and Uni-AGF can also obtain the registration information of the RFID tag in other ways.
  • Uni-AGF can obtain the information of successful RFID tag registration from RFID-L.
  • the RFID-L can notify the Uni-AGF whether the authentication of the RFID tag is successful, and if the authentication is successful, the registration is considered successful.
  • the RFID-H generates an LLRP message, including an operation instruction.
  • the LLRP message includes an access command, and the access command is the operation command described in the embodiment of the present application.
  • the operation instruction is an access operation to be performed for the target Tag, for example, it may be an Access series of commands used between the Tag and the Reader in the flow shown in FIG. 4 .
  • the operation instruction may be a "Read” command, a "Write” command or a "KeyUpdate” command that instructs the RFID tag to execute.
  • RFID-H judges whether the RFID tag has completed the security authentication, if completed, execute steps 916 to 919, and if the security authentication has not been completed, execute steps 900 to 913.
  • the RFID-H can query the AUSF (or UDM) to find the SUPI corresponding to the SID of the RFID tag, it indicates that the RFID tag has completed security authentication.
  • the RFID-H can send an LLRP message to the RFID-L where the RFID tag is located through a NAS message to instruct the RFID tag to execute an access command, such as a "Read” command or a "Write” command.
  • the RFID-L triggers the authentication process and supports steps 900-913.
  • step 901 an access request can be reported, and after the mutual authentication between the RFID tag and the AUSF is completed, the access operation is triggered by itself, and the RFID tag is instructed to execute the access command.
  • RFID-H can obtain operation instructions from a third-party application server (for example, AF), and then notify RFID-L and RFID tag to execute operation instructions through downlink signaling.
  • RFID-H generates an operation instruction, and then notifies RFID-L and RFID tag to execute the operation instruction through downlink signaling.
  • the RFID-H sends an operation instruction to the AMF.
  • the RFID-H transmits the LLRP message containing the operation instruction to the AMF through the servitization message Namf_Communicaiton_N1N2MessageTransfer.
  • AMF sends an operation instruction to Uni-AGF.
  • the AMF forwards the operation instruction to the Uni-AGF through a NAS message.
  • the Uni-AGF sends an operation instruction to the corresponding RFID-L.
  • the Uni-AGF routes the downlink LLRP message to the RFID-L corresponding to the RFID tag according to the saved correspondence.
  • the RFID-L performs the communication operation indicated by the operation instruction.
  • the RFID-L parses the operation instruction and executes the corresponding communication operation, for example, instructing the RFID tag to execute the KeyUpdate command, or instructing the RFID tag to execute the Read command.
  • step 915 it indicates that the RFID tag has not performed the mutual authentication process, and steps 900-905 need to be re-executed. If step 900 has already completed the subscription, step 900 may be skipped.
  • step 901 an operation instruction can be carried to trigger the RFID-L to perform inventory (access), and after obtaining the SID of the RFID tag, the mutual authentication process is triggered, that is, steps 906-913 are executed. After the subsequent authentication is completed, the RFID tag directly executes the operation instruction carried in step 901.
  • steps 900-905 may be referred to as a parameter configuration process
  • steps 906-913 may be referred to as a two-way authentication process
  • steps 914-919 may be referred to as a secure access process.
  • This embodiment of the present application does not limit the execution order of the three processes in the method shown in FIG. 9 .
  • the execution sequence is a parameter configuration process, a two-way authentication process, and a secure access process.
  • one of the above three processes can be selected for execution, and none of the three processes is indispensable.
  • RFID-H can be deployed independently or integrated in other core network elements.
  • the message interaction between the RFID-H and the AMF can be omitted or considered to be carried out through the internal interface.
  • the message exchange between Uni-AGF and RFID-L can also be omitted or considered to be carried out through the internal interface.
  • the security authentication process of the RFID tag is realized.
  • the functions of the RFID Reader and some high-level components are integrated into the 3GPP network, and the device-level two-way authentication process is realized by means of the Uni-AGF building a NAS connection.
  • the method shown in FIG. 9 can also be used for the architecture in which the RFID tag accesses the core network through a non-3GPP, and the RFID-L and Uni-AGF are implemented by a non-3GPP interworking function (such as the N3IWF or TNGF shown in the figure); or, The RAN in the method shown in Figure 9 is replaced by a non-3GPP interworking function.
  • the embodiment of the present application also provides an authentication method, which is applicable to the system shown in FIG. 5 and can perform security authentication on the UWB tag.
  • the label device is UWB tag
  • the access network device includes a label access function module and a label proxy function module, wherein the label access function module is UWB-L, and the label proxy function module is Uni-AGF.
  • the label aggregation network element is UWB-H
  • the authentication device is AUSF/UDM.
  • the access mobility management network element is AMF.
  • the method includes the following steps:
  • the UWB-H subscribes to the AMF for messages related to the UWB tag.
  • the UWB-H can perform device-level communication with the RAN, that is, the messages exchanged between the UWB-H and the RAN are not specific to the UE.
  • UWB-H can exchange UWB type messages with RAN through AMF.
  • UWB-H sends a service message Namf_Communication_NonUeMessageTransfer to AMF, which includes an N2 message and a field "N2inforType" indicating the type of the N2 message, and the value of this field "N2inforType" is "UWB", indicating that UWB-H sends is a "UWB" type of message.
  • the AMF sends the received N2 message to the RAN.
  • the AMF may also send an "N2inforType” field to the RAN, instructing the UWB-H to send a "UWB” type message.
  • the UWB-H can also instruct the AMF to forward the received uplink "UWB" type N2 message to the UWB-H network element by means of subscription/notification.
  • the UWB-H network element can pass the Namf_Communication_
  • the NonUeInfoSubscribe message subscribes to the AMF for messages of type "UWB".
  • the AMF receives the "UWB" type message sent by the RAN side, it can send Namf_Communication_NonUe to the UWB-H
  • InfoNotify message which includes a "UWB” type message sent by the RAN side.
  • the UWB-H receives the message, it can obtain the "UWB" type message sent by the RAN side.
  • the "UWB" type message may be UWB application layer information, that is, the UWB protocol (or other adaptation protocol) is used for interaction between UWB-L and UWB-H.
  • the UWB-H can send the downlink UWB application layer information to the AMF through the service message Namf_Communication_NonUeMessageTransfer, and the AMF then sends the UWB application layer information to the RAN (specifically, UWB-L on the RAN side).
  • the UWB-H when the UWB-H is a network element of the core network, the security of the UWB-H can be specified, and the UWB-H can directly communicate with other network elements of the core network.
  • UWB-H is used as a third-party application and is not a network element of the core network, the security of UWB-H is uncertain, and the UWB-H network element cannot directly communicate with other network elements of the core network.
  • exposure function, NEF exposure function
  • the UWB-H sends UWB configuration information to the AMF.
  • the UWB configuration information is the aforementioned parameters related to the tag device, including at least one of a protocol parameter, a communication parameter, and an access parameter.
  • the descriptions of the protocol parameters, communication parameters, and access parameters refer to the foregoing description, and will not be repeated here.
  • the UWB configuration information may also not include access parameters, which is not limited in this embodiment of the present application.
  • the UWB-H sends the UWB configuration information to the AMF through the service message Namf_Communication_NonUeMessageTransfer.
  • the UWB-H may include the UWB configuration information in the N2 message container and send it to the AMF, and the AMF will forward it to the RAN through the N2 message.
  • the UWB configuration information may include the following two items:
  • the capability negotiation message (that is, the aforementioned protocol parameters) is used to negotiate the supported protocol version with UWB-L, and instruct UWB-L to use the negotiated protocol version.
  • the device configuration message (that is, the aforementioned communication parameters) is used to configure the basic operating parameters of the UWB-L, for example, the data transmission rate, the encoding method, and the like.
  • the AMF sends UWB configuration information to the UWB-L.
  • the AMF constructs a dedicated N2 message "DOWNLINKNON UE ASSOCIATED UWB TRANSPORT", and sends the constructed message to the RAN.
  • the RAN node forwards the UWB configuration information to the UWB-L.
  • the UWB-L completes the configuration according to the UWB configuration information.
  • the UWB-L completes capability negotiation, device configuration, and setting or updating of tag access (inventory) operations.
  • the UWB-L sends confirmation information/new UWB configuration information to the AMF.
  • step 903 is performed to complete the configuration, and in step 904, confirmation information can be sent to the AMF.
  • step 1003 may be skipped, and in step 1004, the UWB configuration information is further negotiated with the UWB-H.
  • the UWB-L constructs new UWB configuration information, and sends the new UWB configuration information to the AMF.
  • the dedicated upstream N2 message is forwarded to the UWB-H through the AMF, and the dedicated upstream N2 message contains the new UWB configuration information.
  • the AMF sends confirmation information/new UWB configuration information to the UWB-H according to the subscription of the UWB-H.
  • UWB-H has subscribed to AMF for N2 messages of UWB type through Namf_Communication_NonUeInfoSubscribe.
  • the AMF After receiving the new UWB configuration information, the AMF encapsulates the new UWB configuration information and sends it to the UWB-H network element.
  • AMF uses Namf_Communication_
  • NonUeInfoNotify encapsulates UWB configuration information and forwards it to the UWB-H network element.
  • steps 1001-1005 may be performed multiple times.
  • steps 1001-1005 may be performed multiple times.
  • steps 1001-1005 may be performed multiple times.
  • step 1003 part of the configuration may be completed according to the UWB configuration information, and step 1004 may be performed one or more times to negotiate other parameters with UWB-H.
  • UWB-L obtains the MAC identifier of the UWB tag.
  • the MAC identifier can be used as the unique identifier of the UWB tag between the UWB tag and the UWB-L. After UWB-L obtains the MAC identifier of the UWB tag through the Tag Identification process, it triggers a further mutual authentication process to perform security authentication on the UWB tag.
  • UWB-L needs to obtain security parameters for mutual authentication, such as encryption keys and/or complete protection keys, from the core network or a third party.
  • UWB-L sends the MAC identifier of the UWB tag to Uni-AGF.
  • the UWB-L interacts with the Uni-AGF through the internal interface between the Uni-AGF and the Uni-AGF, triggering the Uni-AGF to establish a NAS connection for the currently authenticated UWB tag, which is used to interact with the core network to perform security authentication on the UWB tag.
  • Uni-AGF can obtain the identifier of UWB-L, and UWB-L sends the MAC identifier of UWB tag to Uni-AGF.
  • the Uni-AGF constructs a 3GPP user identity according to the MAC identity of the UWB tag.
  • the 3GPP user identity may include SUCI or SUPI.
  • security authentication is performed on the UWB tag based on SUCI.
  • the Uni-AGF uses the MAC identifier to construct SUPI based on the network access identifier (NAI) format defined in RFC 7542, and subsequently converts the SUPI into SUCI.
  • NAI network access identifier
  • SUCI contains encrypted SUPI.
  • the Uni-AGF can also directly determine the SUCI according to the MAC identifier.
  • security authentication is performed on the UWB tag based on SUPI.
  • the Uni-AGF determines the SUPI according to the identifier reported by the UWB tag, and reports the SUPI to the AMF, and can subsequently perform security authentication on the UWB tag according to the SUPI.
  • the 3GPP network user identity of the UWB tag may be SUPI.
  • the AMF receives the MAC identifier sent by the UWB-L, and constructs the SUPI according to the MAC identifier.
  • the Uni-AGF attempts to establish a NAS connection for the UWB tag.
  • the Uni-AGF can also store the correspondence between the identifier of UWB-L, the MAC identifier of UWB tag, and the SUPI (or SUCI) of UWB tag.
  • the Uni-AGF can be responsible for multiple UWB-Ls, and the Uni-AGF can address one UWB-L that the Uni-AGF is responsible for according to the stored correspondence.
  • the Uni-AGF sends a NAS registration request to the AMF, where the NAS registration request includes the above-mentioned SUCI or SUPI.
  • the Uni-AGF sends a NAS registration request to the AMF, trying to establish a NAS connection for the UWB tag, and the subsequent mutual authentication messages are forwarded by the Uni-AGF.
  • the NAS registration request may be the first message described in this embodiment of the present application.
  • the NAS registration request includes the SUCI, so that the network side performs security authentication on the UWB tag according to the SUCI.
  • the NAS registration request can also carry the type information "UWB Indicator" of the UWB tag.
  • UWB Indicator is used to indicate the type of device connected to the NAS by the Uni-AGF.
  • UWB Indicator may also affect the authentication process.
  • the authentication device can choose different authentication methods and parameters according to the type of the device. Taking the authentication method defined in ISO 21167-19 as an example, UWB-L needs to obtain the encryption key and message authentication key corresponding to the UWB tag from the database (for example, UDM), and the UDM can also perform the corresponding authentication according to the instructions of the UWB Indicator method. Taking the authentication method defined in 3GPP as an example, the root key is stored in the UDM, and the intermediate network element (such as AMF) is derived according to the root key, and the derived information is sent to the RAN side (UWB-L) and the tag device (UWB tag). ).
  • the intermediate network element such as AMF
  • AMF selects a suitable AUSF.
  • AMF selection of AUSF is the same as subsection 6.3.4 in TS 23.501. After AMF selects AUSF, it establishes the path between "label ⁇ ->UWB-L ⁇ ->AMF ⁇ ->AUSF ⁇ ->UDM".
  • the AUSF and the UWB tag can complete the bidirectional authentication based on the signaling related to the above-mentioned path mutual authentication.
  • the AUSF can authenticate the UWB tag according to the 3GPP user identity (ie SUCI or SUPI) of the UWB tag sent by the AMF.
  • UWB-standardized or manufacturer-defined authentication method may be used, and the above channel is used to transmit UWB-standardized or manufacturer-defined authentication signaling.
  • the EAP authentication method supported by the 5G network can be used, and the process defined in TS 33.501 can be directly reused at this time.
  • the AUSF can also obtain security parameters (secret keys, etc.) from the AAA-S of a third party, and the AUSF and the AAS-S interact through the AAA interface or indirectly through the AAA-P network element.
  • the security authentication signaling exchange channel established at this time is: label ⁇ ->UWBL ⁇ ->AMF ⁇ ->AUSF ⁇ ->AAAS, or label ⁇ ->UWBL ⁇ ->AMF
  • the AUSF can also send the authentication result of the UWB tag to the UWB-L through the AMF.
  • AMF registers the UWB tag to AUSF.
  • AUSF can store the SUPI corresponding to the MAC identifier of the UWB tag.
  • the AMF sends a notification message to the Uni-AGF, indicating that the registration is completed.
  • the Uni-AGF ends the registration process.
  • the UWB-L notifies the Uni-AGF of the authentication result, and the Uni-AGF ends the registration process.
  • the Uni-AGF receives the registration failure message sent by the AMF, and the Uni-AGF ends the registration process.
  • the Uni-AGF can stop the NAS timer to end the registration process.
  • Step 1013 is an optional step, and Uni-AGF can also obtain the registration information of the UWB tag in other ways.
  • Uni-AGF can obtain UWB tag registration success information from UWB-L.
  • the UWB-L receives the authentication result through the AMF in step 1011, it can notify the Uni-AGF whether the UWB tag is authenticated successfully, and if the authentication is successful, it is considered that the registration is successful.
  • UWB-H generates UWB application layer information, including operation instructions.
  • the UWB application layer information includes an access command, and the access command is the operation command described in the embodiment of the present application.
  • the operation instruction is an access operation to be performed for the target Tag.
  • the UWB application layer information may be an Access series of commands similar to those used between the Tag and the Reader in the flow shown in FIG. 4 .
  • the operation instruction may be a "Read” command or a "Write" command that instructs the UWB tag to execute.
  • UWB-H judges whether the UWB tag has completed the security authentication. If the security authentication is completed, perform steps 1016 to 1019. If the security authentication is not completed, perform steps 1000 to 1013.
  • the UWB-H can query the AUSF (or UDM) to find the SUPI corresponding to the MAC identifier of the UWB tag, it indicates that the UWB tag has completed the security authentication.
  • the UWB-H can send UWB application layer information to the UWB-L where the UWB tag is located through a NAS message to instruct the UWB tag to execute an access command, such as a "Read” command or a "Write" command.
  • UWB-L triggers the authentication process and supports steps 1000-1013.
  • step 1001 an access request can be reported, and after the mutual authentication between the UWB tag and the AUSF is completed, the access operation is triggered by itself, and the UWB tag is instructed to execute the access command.
  • UWB-H can obtain operation instructions from a third-party application server (for example, AF), and then notify UWB-L and UWB tag to execute operation instructions through downlink signaling.
  • UWB-H generates an operation instruction, and then notifies UWB-L and UWB tag to execute the operation instruction through downlink signaling.
  • the UWB-H sends an operation instruction to the AMF.
  • the UWB-H transmits the UWB application layer information including the operation instruction to the AMF through the service message Namf_Communicaiton_N1N2MessageTransfer.
  • AMF sends an operation instruction to Uni-AGF.
  • the AMF forwards the operation instruction to the Uni-AGF through a NAS message.
  • the Uni-AGF sends an operation instruction to the corresponding UWB-L.
  • the Uni-AGF routes the downlink UWB application layer information to the UWB-L corresponding to the UWB tag according to the stored correspondence.
  • the UWB-L performs the communication operation indicated by the operation instruction.
  • the UWB-L parses the operation instruction and executes the corresponding communication operation, for example, instructing the UWB tag to execute the KeyUpdate command, or instructing the UWB tag to execute the Read command.
  • step 1000 may be skipped.
  • step 1001 an operation instruction can be carried to trigger the UWB-L to perform inventory (access), and after obtaining the MAC identifier of the UWB tag, the mutual authentication process is triggered, that is, steps 1006-1013 are executed. After the subsequent authentication is completed, the UWB tag directly executes the operation instruction carried in step 1001.
  • UWB-H can be deployed independently or integrated in other core network elements.
  • the message interaction between the UWB-H and the AMF can be omitted or considered to be carried out through the internal interface.
  • the message interaction between the Uni-AGF and the UWB-L can also be omitted or considered to be performed through the internal interface.
  • steps 1000 to 1005 may be referred to as a parameter configuration process
  • steps 1006 to 1013 may be referred to as a two-way authentication process
  • steps 1014 to 1019 may be referred to as a secure access process.
  • This embodiment of the present application does not limit the execution order of the three processes in the method shown in FIG. 10 .
  • the execution sequence is a parameter configuration process, a two-way authentication process, and a secure access process.
  • one of the above three processes can be selected for execution, and none of the three processes is indispensable.
  • the security authentication process of UWB tag is realized based on a possible tag fusion architecture.
  • the functions of UWB Reader and some high-level components are integrated into the 3GPP network, and the bidirectional authentication process of device granularity is realized by means of Uni-AGF's proxy construction of NAS connection.
  • the method shown in Figure 10 can also be used for the architecture in which the UWB tag accesses the core network through a non-3GPP, at this time UWB-L and Uni-AGF are implemented by a non-3GPP interworking function (such as the N3IWF or TNGF shown in the figure); or,
  • the RAN in the method shown in Figure 9 is replaced by a non-3GPP interworking function.
  • tag devices, reader devices and core network elements can complete authentication and authentication for different tag devices based on processes such as inventory process, tag access process, authentication process or registration process, as shown in Figure 11.
  • the embodiment of the present application also provides a communication method, so that the tag device can perform the inventory process, the tag access process, the authentication process or the registration process based on the communication method shown in FIG. 11, which is convenient for the reader device and the core network.
  • the element implements the above authentication method and reduces the complexity of fusion management.
  • the tag device can also implement interaction with the core network through the communication method shown in FIG. 11 below.
  • FIG. 11 is a communication method provided by an embodiment of the application. As shown in FIG. 11 , the method may include:
  • the tag device receives a tag trigger signal.
  • the tag device can receive the tag trigger signal sent by the reader device, the reader device can be deployed in the access network device or the terminal device, or the access network device can be directly used as the reader device, or the terminal device can directly as a reader device.
  • the tag trigger signal is required to stimulate the tag device, so that the tag device can send the core network communication message to interact with the core network element; or, when the tag device is in a dormant state, The tag trigger signal is required to wake up the tag device, so that the tag device can send the core network interaction message to interact with the core network element.
  • the tag trigger signal can be used to trigger the inventory process; alternatively, the tag trigger signal can be used to trigger the tag access process; alternatively, the tag trigger signal can be used to trigger the tag authentication process; or the tag trigger signal can be used to trigger the tag locking process; alternatively, the tag trigger signal can be used to trigger the tag failure process; alternatively, the tag trigger signal can be used to wake up the tag device.
  • the inventory process is the process of obtaining the label identification;
  • the label access process is the process of reading or writing the label device;
  • the label authentication process is the process of authenticating the label device;
  • the label locking process is the process of locking the label device. ;
  • the label invalidation process is the process of making the label invalid;
  • the wake-up label device is the process of waking up the label device.
  • the tag trigger signal is any one of the following: select Select command, challenge Challenge command, query Query command, read Read command, write Write command, invalid Kill command, lock Lock command, and wake up command.
  • the tag trigger signal when the tag trigger signal is a Select command or a Query command, the tag trigger signal can be used to trigger the inventory process.
  • the tag trigger signal when the tag trigger signal is a Read command or a Write command, the tag trigger signal can be used to trigger the tag access process.
  • the tag trigger signal When the tag trigger signal is a Challenge command, the tag trigger signal can be used to trigger the tag authentication process.
  • the tag trigger signal When the tag trigger signal is a fail Kill command, the tag trigger signal can be used to trigger the tag failure process.
  • the tag trigger signal is a lock command
  • the tag trigger signal when the tag trigger signal is a wake-up command, the tag trigger signal can be used to wake up the tag device.
  • the tag device sends a core network interaction message.
  • the tag device may send a core network interaction message to the access mobility management network element.
  • the core network interaction message may include any one of the following: a registration message; or a deregistration message; or a session establishment request message; or a session modification request message; or a session deletion request message; or a service request message ; or, tag data to send a message.
  • the registration message is used to register the tag in the core network; the deregistration message is used to deregister the tag in the core network; the session establishment request message is used to establish a session for the tag; the session modification request message is used to modify the session for the tag; the session deletion request message It is used to delete the session for the tag; the service request message is used to serve the tag request; the tag data sending message is used to send the tag data, and the tag data can be sensor data or preset data.
  • the core network interaction message may include a registration message, or a session establishment request message, or a session modification request message, or a service request message, or a tag data sending message.
  • the core network interaction message may include a registration message, or a session establishment request message, or a session modification request message, or a service request message, or a tag data sending message.
  • the core network interaction message may include a registration message, or a session establishment request message, or a session modification request message, or a service request message, or a tag data sending message.
  • the core network interaction message may include a registration message, or a session establishment request message, or a session modification request message, or a service request message, or a tag data sending message.
  • the core network interaction message may include a registration message, or a deregistration message, or a session deletion request message, or a session modification request message, or a service request message.
  • the core network interaction message may include a registration message, or a session establishment request message, or a session modification request message, or a service request message, or a tag data sending message.
  • the core network interaction message also carries a tag identifier or a session identifier.
  • the tag identifier or the session identifier can be obtained by the inventory process or the tag access process.
  • the core network interaction message is a non-access stratum NAS message.
  • the core network interaction message when the core network interaction message includes a registration message, the core network interaction message may be a NAS registration message.
  • the core network interaction message when the core network interaction message includes a deregistration message, the core network interaction message may be a NAS deregistration message.
  • the core network interaction message when the core network interaction message includes a session establishment request message, the core network interaction message may be a NAS session establishment request message.
  • the core network interaction message includes a session modification request message, the core network interaction message may be a NAS session modification request message.
  • the core network interaction message when the core network interaction message includes a session deletion request message, the core network interaction message may be a NAS session deletion request message.
  • the core network interaction message includes a service request message, the core network interaction message may be a NAS service request message.
  • the core network interaction message includes a tag data transmission message
  • the core network interaction message may be a NAS tag data transmission message.
  • the tag device receives the filtering information, and if the tag device matches the filtering information, the tag device sends a core network interaction message.
  • the tag trigger signal may include filtering information.
  • the filtering information may include tag identification, and may also include filtering information set according to the content stored by the labeling device, and the content stored by the labeling device may include sensor information and the like.
  • the tag device can directly execute the above 1102 after receiving the tag trigger signal sent by the reader device; it can also execute the following 1101a first, and then execute the above 1102; or execute the following 1101b first, and then execute the above 1102 .
  • the tag device performs any one of the following processes: an inventory process, or a tag access process, or a tag authentication process, or a tag lock process, or a tag invalidation process, or wake up the tag device.
  • the tag device may execute the above process based on the corresponding tag trigger signal during the interaction with the reader device.
  • the tag device executes the process of establishing or modifying the reader device resource.
  • the tag device may also execute the process of establishing or modifying the reader device resource during the interaction with the reader device, so as to communicate with the reader device according to the established resource or the modified resource.
  • FIG. 12 shows a possible schematic structural diagram of the communication apparatus involved in the above embodiment.
  • the communication apparatus shown in FIG. 12 may be the access network device described in the embodiment of the present application, or may be a component in the access network device implementing the above method, or may be a chip applied in the access network device.
  • the communication device shown in FIG. 12 may also be the label aggregation network element described in the embodiment of the present application, may also be a component in the label aggregation network element that implements the above method, or may be a chip applied in the label aggregation network element .
  • the communication device shown in FIG. 12 may also be the access mobility management network element described in the embodiments of the present application, may also be a component in the access mobility management network element that implements the above method, or may be applied to the access mobility management network element. Manage chips in NEs.
  • the chip may be a System-On-a-Chip (SOC) or a baseband chip with a communication function, or the like.
  • the communication device includes a processing unit 1201 and a communication unit 1202 .
  • the processing unit may be one or more processors, and the communication unit may be a transceiver or a communication interface.
  • the processing unit 1201 can be configured to support the communication device to perform the processing actions in the foregoing method embodiments. Specifically, it can perform the processing actions performed by the access mobility management network element in FIG. 8a, FIG. 8b, FIG. 9, FIG. 10, or FIG. 11. , or, the processing actions performed by the access network device in FIG. 8a, FIG. 8b, FIG. 9, FIG. 10 or FIG.
  • the processing actions performed by the tag aggregation network element alternatively, may perform the processing actions performed by the tag devices in Figures 8a, 8b, 9, 10, or 11, and/or other processes for the techniques described herein.
  • the communication unit 1202 is used to support the communication between the communication apparatus and other communication apparatuses or devices, and can specifically perform the sending and/or sending and/or performed by the access mobility management network element in FIG. 8a, FIG. 8b, FIG. 9, FIG. 10 or FIG. 11. or receiving, alternatively, the sending and/or receiving actions performed by the access network device in FIG. 8a, FIG. 8b, FIG. 9, FIG. 10 or FIG. 11 may be performed, or, FIG. 8a, FIG. 8b, FIG. 9.
  • the sending and/or receiving actions performed by the tag aggregation network element in FIG. 10 or FIG. 11, or the sending and/or receiving actions performed by the tag device in FIG. 8a, FIG. 8b, FIG. 9, FIG. 10 or FIG. 11 may be performed. or the act of receiving, and/or other processes for the techniques described herein.
  • the communication device may further include a storage unit 1203, where the storage unit 1203 is configured to store program codes and/or data of the communication device.
  • the processing unit 1201 may include at least one processor, the communication unit 1202 may be a transceiver or a communication interface, and the storage unit 1203 may include a memory.
  • An embodiment of the present application provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium; the instructions are used to execute the method shown in FIG. 8 a , FIG. 8 b , FIG. 9 , FIG. 10 or FIG. 11 .
  • Embodiments of the present application provide a computer program product including instructions, which, when executed on a communication device, cause the communication device to execute the method shown in FIG. 8a , FIG. 8b , FIG. 9 , FIG. 10 or FIG. 11 .
  • An embodiment of the present application provides a wireless communication device, including: an instruction is stored in the wireless communication device; when the wireless communication device runs on the communication device shown in FIG. 7a, FIG. 7b, and FIG. The method shown in Fig. 8a, Fig. 8b, Fig. 9, Fig. 10 or Fig. 11.
  • the wireless communication device may be a chip.
  • An embodiment of the present application provides a communication system, including: the aforementioned access network device, a label aggregation network element, and an access mobility management network element.
  • the processors in the embodiments of the present application may include, but are not limited to, at least one of the following: a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), and a microcontroller (microcontroller unit, MCU). ), or artificial intelligence processors and other types of computing devices that run software, each computing device may include one or more cores for executing software instructions to perform operations or processing.
  • the processor can be a separate semiconductor chip, or can be integrated with other circuits into a semiconductor chip. For example, it can form a SoC (on-chip) with other circuits (such as codec circuits, hardware acceleration circuits, or various bus and interface circuits).
  • the processor may further include necessary hardware accelerators, such as field programmable gate arrays (FPGA), PLDs (Programmable Logic Devices) , or a logic circuit that implements dedicated logic operations.
  • FPGA field programmable gate arrays
  • PLD Programmable Logic Devices
  • the memory in this embodiment of the present application may include at least one of the following types: read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (random access memory) , RAM) or other types of dynamic storage devices that can store information and instructions, and can also be electrically erasable programmable read-only memory (electrically erasable programmable read-only memory, EEPROM).
  • ROM read-only memory
  • RAM random access memory
  • EEPROM electrically erasable programmable read-only memory
  • the memory may also be compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.) , a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, without limitation.
  • CD-ROM compact disc read-only memory
  • optical disc storage including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.
  • magnetic disk storage medium or other magnetic storage device or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, without limitation.
  • At least one means one or more.
  • “Plural” means two or more.
  • the character “/” generally indicates that the associated objects are an “or” relationship.
  • At least one item(s) below” or similar expressions thereof refer to any combination of these items, including any combination of single item(s) or plural items(s).
  • At least one (a) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c may be single or multiple .
  • words such as “first” and “second” are used to distinguish the same or similar items with basically the same function and effect. Those skilled in the art can understand that the words “first”, “second” and the like do not limit the quantity and execution order, and the words “first”, “second” and the like are not necessarily different.
  • the disclosed apparatus and method for accessing a database may be implemented in other manners.
  • the embodiments of the database access apparatus described above are only illustrative.
  • the division of the modules or units is only a logical function division.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection of database access devices or units through some interfaces, which may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place, or may be distributed to multiple different places . Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a readable storage medium.
  • the technical solutions of the embodiments of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, which are stored in a storage medium , including several instructions to make a device (which may be a single chip microcomputer, a chip, etc.) or a processor to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: a U disk, a removable hard disk, a ROM, a RAM, a magnetic disk, or an optical disk and other mediums that can store program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请实施例公开了一种鉴权方法及通信装置，涉及通信领域，支持多种标签进行统一网络管理的同时，提供统一的认证流程对标签设备进行安全认证，降低了融合管理的复杂性。所述方法包括：接入网设备获取标签设备的标识，根据标签设备的标识确定第三代合作伙伴计划3GPP网络用户标识；接入网设备还可以向接入移动管理网元发送第一消息，第一消息包括3GPP网络用户标识，3GPP网络用户标识用于认证标签设备。其中，标签设备可以是RFID标签、UWB标签以及蓝牙设备等。

Description

一种鉴权方法及通信装置
本申请要求于2020年12月31日提交国家知识产权局、申请号为PCT/CN2020/142560、申请名称为“一种鉴权方法及通信装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉通信领域，尤其涉及一种鉴权方法及通信装置。
背景技术
随着通信技术的演进发展，标签设备(tag)被越来越多的企业、个人所使用，利用标签设备可以实现设备之间近距离、非接触式的通信。
标签设备包括射频识别(radio frequency identification，RFID)标签、无源物联网(passive internet of things，passive IoT)设备、低功耗设备、超宽带(ultrawideband，UWB)标签、无源终端设备、半无源终端设备、有源终端设备、低能力(reduced capability，Redcap)终端、其他物联网设备以及蓝牙设备等。无源终端设备是从射频信号获取能量的终端设备；半无源终端设备是从射频信号或者太阳能或者风能等获取能量的终端设备；有源终端设备是依靠自身电池提供能量的设备。目前，各个厂商对标签设备的安全认证流程差异巨大，当企业使用多种标签设备时，大大增加了企业对标签管理的复杂性。
发明内容
本申请实施例提供一种鉴权方法及通信装置，支持多种标签进行统一网络管理的同时，提供统一的认证流程对标签设备进行安全认证，降低了融合管理的复杂性。
第一方面，提供一种鉴权方法，包括：接入网设备获取标签设备的标识，根据标签设备的标识确定第三代合作伙伴计划3GPP网络用户标识；接入网设备还可以向接入移动管理网元发送第一消息，第一消息包括3GPP网络用户标识，3GPP网络用户标识用于认证标签设备。接入网设备还可以通过所述接入移动管理网元接收所述标签设备的鉴权结果。标签设备的标识可以是与3GPP网络用户标识相同的标识或者不同的标识。
目前缺乏统一的认证流程对融合场景下标签设备进行安全认证，各个厂商对标签设备的安全认证流程差异巨大，大大增加了融合管理的复杂性。本申请实施例提供一种鉴权方法，接入网设备可以获取标签设备的标识，根据标签设备的标识确定第三代合作伙伴计划3GPP网络用户标识，向接入移动管理网元发送第一消息，第一消息包括3GPP网络用户标识，用于认证标签设备。通过本申请实施例提供的鉴权方法可以实现对不同标签设备的鉴权认证，支持多种标签进行统一网络管理的同时，提供统一的认证流程对标签设备进行安全认证，降低了融合管理的复杂性。
结合第一方面，在第一方面的第一种可能的实现方式中，第一消息还包括类型信息，类型信息用于指示标签设备的类型。
本申请实施例中，接入网设备还可以通过第一消息向认证设备通知标签设备的类型，以便认证设备选择与标签设备匹配的认证方法和认证参数。
结合第一方面或以上第一方面的任意一种可能的实现方式，在第一方面的第二种可能的实现方式中，第一消息为非接入层NAS注册请求，NAS注册请求包括3GPP网络用户 标识。
本申请实施例中，接入网设备可以通过NAS注册请求向接入移动管理网元发送3GPP网络用户标识。
结合第一方面或以上第一方面的任意一种可能的实现方式，在第一方面的第三种可能的实现方式中，接入网设备通过盘存过程或者标签访问过程获取标签设备的标识，盘存过程是获取标签标识的过程，标签访问过程是对标签设备进行读操作或者写操作的过程。
本申请实施例中，接入网设备可以通过盘存过程或者标签访问过程获取标签设备的标识，为接入网设备获取标签设备的标识提供了多种可行性方案。
结合第一方面或以上第一方面的任意一种可能的实现方式，在第一方面的第四种可能的实现方式中，所述方法还包括：从接入移动管理网元接收第二消息，第二消息包括以下至少一项：协议参数、通信参数或接入参数；其中，协议参数用于指示接入网设备与标签设备之间的通信协议和/或接入网设备与标签汇聚网元之间的通信协议；通信参数用于支持接入网设备配置与标签设备之间进行通信所用的数据传输速率和/或解码方式；接入参数用于接入网设备配置标签设备接入事件的规则；标签设备接入事件的规则包括以下至少一项：标签设备接入事件的触发时间、标签设备接入事件的周期或标签设备接入事件对应的标签设备数量。标签设备接入事件是对标签进行读操作，或者写操作，或者失效操作，或者对标签进行盘存操作。读操作可以读取标签设备存储的信息，例如传感器信息等，盘存操作指的是获取标签标识的操作，标签设备接入，也可以称为标签设备访问。
本申请实施例中，还可以向接入网设备发送与标签设备相关的配置参数，以支持接入网设备、标签设备以及核心网的通信，例如，认证过程中的信令交互。
结合第一方面或以上第一方面的任意一种可能的实现方式中，在第一方面的第五种可能的实现方式中，所述方法还包括：根据第二消息确定接入网设备与标签设备之间的通信协议和/或接入网设备与标签汇聚网元之间的通信协议；和/或，配置与标签设备之间进行通信所用的数据传输速率和/或解码方式；和/或，配置标签设备接入事件的规则。
本申请实施例中，接入网设备可以根据核心网下发的配置参数完成本地配置，以便与标签设备以及核心网进行通信，例如，认证过程中的信令交互。
结合第一方面或以上第一方面的任意一种可能的实现方式，在第一方面的第六种可能的实现方式中，所述方法还包括：从标签汇聚网元接收操作指令；操作指令用于指示接入网设备执行与标签设备之间的通信操作。根据操作指令执行与标签设备之间的通信操作。
本申请实施例提供的方法，将标签设备的解读器融合在核心网，即本申请实施例所述的标签汇聚网元。本申请实施例还支持标签汇聚网元与标签设备之间通过3GPP网络进行通信，例如，向标签设备发送操作指令，指示标签设备执行具体的接入操作，例如，读操作或写操作等。标签汇聚网元可以是独立的核心网网元，或者是与用户面功能网元UPF或者接入移动管理网元AMF或者会话管理网元SMF或者网络开放网元NEF或者服务器或者物联网平台共同部署的网元。
结合第一方面或以上第一方面的任意一种可能的实现方式，在第一方面的第七种可能的实现方式中，标签设备的标识包括标签设备的无线访问控制MAC地址或标签设备的秘密标识SID或标签设备的电子产品码EPC。
本申请实施例提供了标签设备的标识的具体实现，以便根据标签设备的标签确定标签 设备的3GPP网络用户标识。
结合第一方面或以上第一方面的任意一种可能的实现方式，在第一方面的第八种可能的实现方式中，接入网设备包括：标签接入功能模块以及标签代理功能模块；接入网设备根据标签设备的标识确定3GPP网络用户标识，包括：标签接入功能模块获取标签设备的标识，标签接入功能模块向标签代理功能模块发送标签设备的标识；标签代理功能模块根据标签设备的标识确定3GPP网络用户标识。
本申请实施例提供了一种可能的融合场景，在接入网设备增加标签接入功能模块以及标签代理功能模块，标签汇聚网元为核心网侧支持与标签设备通信的网元。标签接入功能模块支持RAN与标签设备进行通信，标签代理功能模块支持标签设备与核心网网元或高层的标签汇聚网元进行通信。
结合第一方面或以上第一方面的任意一种可能的实现方式，在第一方面的的第九种可能的实现方式中，所述方法还包括：标签代理功能模块生成第一信息，第一信息用于指示标签设备的标识、标签接入功能模块的标识以及3GPP网络用户标识之间的对应关系；标签代理功能模块根据第一信息寻址标签接入功能模块。
本申请实施例中，标签代理功能模块可以维护、管理多个标签接入功能模块，基于第一信息标签代理功能模块可以在接收到下行信令时寻址到相应的标签接入功能模块，以便将下行信令传输给相应的标签设备。
结合第一方面或以上第一方面的任意一种可能的实现方式，在第一方面的的第十种可能的实现方式中，3GPP网络用户标识包括标签设备的用户隐藏标识SUCI或用户永久标识SUPI。
本申请实施例提供了3GPP网络用户标识的一种可能的实现。
需要说明的是，第一方面提供的鉴权方法也可以适用于读写器设备，即由读写器设备执行上述接入网设备所设置执行的功能。该读写器设备可以部署在接入网设备或终端设备中，当读写器设备部署在接入网设备中时，读写器设备也可以描述为接入网设备，当读写器设备部署在终端设备中时，读写器设备也可以描述为终端设备。接入网设备也可以直接作为读写器设备，或者终端设备也可以直接作为读写器设备。
第二方面，提供一种鉴权方法，所述方法包括：接入移动管理网元从接入网设备接收第一消息，第一消息包括标签设备的第三代合作伙伴计划3GPP网络用户标识；移动管理网元向认证设备发送3GPP网络用户标识，3GPP网络用户标识用于认证标签设备。接入移动管理网元还可以从认证设备接收该标签设备的鉴权结果，向接入网设备发送该鉴权结果。标签设备的标识可以是与3GPP网络用户标识相同的标识或者不同的标识。
目前缺乏统一的认证流程对融合场景下标签设备进行安全认证，各个厂商对标签设备的安全认证流程差异巨大，大大增加了融合管理的复杂性。本申请实施例提供一种鉴权方法，接入网设备可以获取标签设备的标识，根据标签设备的标识确定第三代合作伙伴计划3GPP网络用户标识，向接入移动管理网元发送第一消息，第一消息包括3GPP网络用户标识，用于认证标签设备。通过本申请实施例提供的鉴权方法可以实现对不同标签设备的鉴权认证，支持多种标签进行统一网络管理的同时，提供统一的认证流程对标签设备进行安全认证，降低了融合管理的复杂性。
结合第二方面的第一种可能的实现方式，在第二方面的第一种可能的实现方式中，第 一消息还包括类型信息，类型信息用于指示标签设备的类型。
本申请实施例中，接入网设备还可以通过第一消息向认证设备通知标签设备的类型，以便认证设备选择与标签设备匹配的认证方法和认证参数。
结合第二方面或以上第二方面的任意一种可能的实现方式，在第二方面的第二种可能的实现方式中，第一消息为非接入层NAS注册请求，NAS注册请求包括3GPP网络用户标识。
本申请实施例中，接入网设备可以通过NAS注册请求向接入移动管理网元发送3GPP网络用户标识。
结合第二方面或以上第二方面的任意一种可能的实现方式，在第二方面的第三种可能的实现方式中，所述方法还包括：从标签汇聚网元接收以下至少一项：协议参数、通信参数以及接入参数；其中，协议参数用于指示接入网设备与标签设备之间的通信协议和/或接入网设备与标签汇聚网元之间的通信协议；通信参数用于支持接入网设备配置与标签设备之间进行通信所用的数据传输速率和/或解码方式；接入参数用于接入网设备配置标签设备接入事件的规则；标签设备接入事件的规则包括以下至少一项：标签设备接入事件的触发时间、标签设备接入事件的周期或标签设备接入事件对应的标签设备数量；向接入网设备发送第二消息，第二消息包括通信协议参数、设备运行参数以及接入参数中的至少一项。标签设备接入事件是对标签进行读操作，或者写操作，或者失效操作，或者对标签进行盘存操作。盘存操作指的是获取标签标识的操作。读操作可以读取标签存储的信息，例如传感器信息等，标签设备接入也可以称为标签设备访问。
本申请实施例中，还可以通过接入移动管理网元向接入网设备发送与标签设备相关的配置参数，以支持接入网设备、标签设备以及核心网的通信，例如，认证过程中的信令交互。
结合第二方面或以上第二方面的任意一种可能的实现方式，在第二方面的第四种可能的实现方式中，所述方法还包括：从标签汇聚网元接收第三消息，第三消息用于标签汇聚网元向接入移动管理网元订阅与标签设备相关的消息。
本申请实施例中，标签汇聚网元还可以向接入移动管理网元订阅标签设备相关的消息，以便接入移动管理网元可以准确地将与标签设备相关的消息路由至标签汇聚网元进行处理。标签汇聚网元可以是独立的核心网网元，或者是与用户面功能网元UPF或者接入移动管理网元AMF或者会话管理网元SMF或者网络开放网元NEF或者服务器或者物联网平台共同部署的网元。
结合第二方面或以上第二方面的任意一种可能的实现方式，在第二方面的第五种可能的实现方式中，所述第三消息包括消息类型，消息类型指示与标签设备相关的消息。
本申请实施例中，提供标签汇聚网元订阅消息的一种具体实现，具体地，标签汇聚网元可以利用消息类型向接入移动管理网元订阅标签设备相关的消息。
结合第二方面或以上第二方面的任意一种可能的实现方式，在第二方面的第六种可能的实现方式中，3GPP网络用户标识包括标签设备的用户隐藏标识SUCI或用户永久标识SUPI。
本申请实施例提供了3GPP网络用户标识的一种可能的实现。
第三方面，提供一种鉴权方法，所述方法包括：标签汇聚网元判断标签设备是否通过 安全认证；标签汇聚网元确定标签设备通过安全认证，向接入网设备发送操作指令；操作指令用于指示接入网设备执行与标签设备之间的通信操作。标签汇聚网元可以是独立的核心网网元，或者是与用户面功能网元UPF或者接入移动管理网元AMF或者会话管理网元SMF或者网络开放网元NEF或者服务器或者物联网平台共同部署的网元。
本申请实施例提供的鉴权方法支持标签融合场景下标签设备的安全接入，提供统一的接入流程对不同的标签设备进行统一网络管理，降低了融合管理的复杂性。
结合第三方面，在第三方面的第一种可能的实现方式中，标签汇聚网元判断标签设备是否通过安全认证，包括：若根据标签设备的标识从认证设备获取标签设备的标识对应的第三代合作伙伴计划3GPP网络用户标识，则确定标签设备通过安全认证。
本申请实施例提供了标签汇聚网元判断标签设备通过安全认证的一种具体实现。
结合第三方面或以上第三方面的任意一种可能的实现，在第三方面的第二种可能的实现方式中，标签汇聚网元确定标签设备通过安全认证之前，方法还包括：标签汇聚网元向接入移动管理网元发送以下至少一项：协议参数、通信参数以及接入参数；其中，其中，协议参数用于指示接入网设备与标签设备之间的通信协议和/或接入网设备与标签汇聚网元之间的通信协议；通信参数用于支持接入网设备配置与标签设备之间进行通信所用的数据传输速率和/或解码方式；接入参数用于接入网设备配置标签设备接入事件的规则；标签设备接入事件的规则包括以下至少一项：标签设备接入事件的触发时间、标签设备接入事件的周期或标签设备接入事件对应的标签设备数量。
本申请实施例中，在标签设备进行安全接入之前，标签汇聚网元还可以通过入移动管理网元向接入网设备发送与标签设备相关的配置参数，以支持接入网设备、标签设备以及核心网的通信，例如，认证过程中的信令交互。
结合第三方面或以上第三方面的任意一种可能的实现，在第三方面的第三种可能的实现方式中，所述方法还包括：向接入移动管理网元发送第三消息，第三消息用于向接入移动管理网元订阅与标签设备相关的消息。
本申请实施例中，在标签设备进行安全接入之前，标签汇聚网元还可以向接入移动管理网元订阅标签设备相关的消息，以便接入移动管理网元可以准确地将与标签设备相关的消息路由至标签汇聚网元进行处理。
结合第三方面或以上第三方面的任意一种可能的实现，在第三方面的第四种可能的实现方式中，第三消息包括消息类型，消息类型指示与标签设备相关的消息。
本申请实施例中，提供标签汇聚网元订阅消息的一种具体实现，具体地，标签汇聚网元可以利用消息类型向接入移动管理网元订阅标签设备相关的消息。
结合第三方面或以上第三方面的任意一种可能的实现，在第三方面的第五种可能的实现方式中，标签汇聚网元判断标签设备是否通过安全认证，包括：若根据标签设备的标识从认证设备未获取标签设备的标识对应的第三代合作伙伴计划3GPP网络用户标识，则确定标签设备未通过安全认证。
本申请实施例提供了标签汇聚网元判断标签设备未通过安全认证的一种具体实现。
结合第三方面或以上第三方面的任意一种可能的实现，在第三方面的第六种可能的实现方式中，确定标签设备未通过安全认证之后，所述方法还包括：标签汇聚网元向接入移动管理网元发送以下至少一项：通信协议参数、设备运行参数以及接入参数；其中，通信 协议参数用于指示接入网设备与标签设备之间的通信协议和/或接入网设备与标签汇聚网元之间的通信协议；设备运行参数用于支持接入网设备配置与标签设备相关的功能；接入参数用于支持接入网设备配置标签设备接入接入网设备的规则。
结合第三方面或以上第三方面的任意一种可能的实现，在第三方面的第七种可能的实现方式中，所述方法还包括：向接入移动管理网元发送第三消息，第三消息用于向接入移动管理网元订阅与标签设备相关的消息。
结合第三方面或以上第三方面的任意一种可能的实现，在第三方面的第七种可能的实现方式中，第三消息包括消息类型，消息类型指示与标签设备相关的消息。
结合第三方面或以上第三方面的任意一种可能的实现，在第三方面的第八种可能的实现方式中，标签设备的标识包括标签设备的无线访问控制MAC地址或标签设备的秘密标识SID或标签设备的电子产品码EPC。
结合第三方面或以上第三方面的任意一种可能的实现，在第三方面的第九种可能的实现方式中，3GPP网络用户标识包括标签设备的用户隐藏标识SUCI或用户永久标识SUPI。
第四方面，提供了一种通信方法，所述方法包括：标签设备在接收标签触发信号后，发送核心网交互消息；核心网交互消息用于标签设备与核心网网元进行消息交互。
其中，当标签设备是无源设备时，需要标签触发信号对标签设备进行激励，使得标签设备可以发送核心网交消息，以与核心网网元进行交互；或者，当标签设备处于休眠状态时，需要标签触发信号对标签设备进行唤醒，使得标签设备可以发送核心网交互消息，以与核心网网元进行交互。
本申请实施例提供的鉴权方法中，标签设备可以在接收到标签触发信号后与核心网网元进行消息交互，为标签设备与核心网网元交互提供了一种可行性方案。
结合第四方面，在第四方面的第一种可能的实现方式中，核心网交互消息可以包括以下任意一项：注册消息；或者，去注册消息；或者，会话建立请求消息；或者，会话修改请求消息；或者，会话删除请求消息；或者，服务请求消息；或者，标签数据发送消息；注册消息用于在核心网注册标签；去注册消息用于在核心网去注册标签；会话建立请求消息用于为标签建立会话；会话修改请求消息用于为标签修改会话；会话删除请求消息用于为标签删除会话；服务请求消息用于为标签请求服务；标签数据发送消息用于发送标签数据。标签数据可以是传感器数据或者预置数据等。
结合第四方面或以上第四方面的任意一种可能的实现，在第四方面的第二种可能的实现方式中，标签触发信号用于触发盘存过程；或者，标签触发信号用于触发标签访问过程；或者，标签触发信号用于触发标签认证过程；或者，标签触发信号用于触发标签锁定过程；或者，标签触发信号用于触发标签失效过程；或者，标签触发信号用于唤醒标签设备；盘存过程是获取标签标识的过程；标签访问过程是对标签设备进行读操作或者写操作的过程；标签认证过程是对标签设备进行认证的过程；标签锁定过程是对标签设备进行锁定的过程；标签失效过程是使标签设备失效的过程；唤醒标签设备是唤醒标签设备的过程。
结合第四方面或以上第四方面的任意一种可能的实现，在第四方面的第三种可能的实现方式中，标签设备接收过滤信息；如果标签设备匹配过滤信息，标签设备发送核心网交互消息。
结合第四方面或以上第四方面的任意一种可能的实现，在第四方面的第四种可能的实 现方式中，核心网交互消息携带标签标识或者会话标识；标签标识或者会话标识由盘存过程或者标签访问过程获得；盘存过程是获取标签标识的过程；标签访问过程是对标签设备进行读操作或者写操作的过程。
结合第四方面或以上第四方面的任意一种可能的实现，在第四方面的第五种可能的实现方式中，标签触发信号为以下任意一项：选择Select命令、挑战Challenge命令、查询Query命令、读Read命令、写Write命令、失效Kill命令、锁定Lock命令、唤醒命令。
结合第四方面或以上第四方面的任意一种可能的实现，在第四方面的第六种可能的实现方式中，核心网交互消息是非接入层NAS消息。
第五方面，提供了一种通信装置，该通信装置可以是接入网设备或者接入网设备中的部件。该装置包括：处理单元，用于获取标签设备的标识，根据标签设备的标识确定第三代合作伙伴计划3GPP网络用户标识；通信单元，用于向接入移动管理网元发送第一消息，第一消息包括3GPP网络用户标识，3GPP网络用户标识用于认证标签设备。通信单元还用于，通过所述接入移动管理网元接收所述标签设备的鉴权结果。标签设备的标识可以是与3GPP网络用户标识相同的标识或者不同的标识。
结合第五方面，在第五方面的第一种可能的实现方式中，第一消息还包括类型信息，类型信息用于指示标签设备的类型。
结合第五方面或以上第五方面的任意一种可能的实现方式，在第五方面的第二种可能的实现方式中，第一消息为非接入层NAS注册请求，NAS注册请求包括3GPP网络用户标识。
结合第五方面或以上第五方面的任意一种可能的实现方式，在第五方面的第三种可能的实现方式中，接入网设备通过盘存过程或者标签访问过程获取标签设备的标识，盘存过程是获取标签标识的过程，标签访问过程是对标签设备进行读操作或者写操作的过程。
结合第五方面或以上第五方面的任意一种可能的实现方式中，在第五方面的第四种可能的实现方式中，通信单元还用于，从接入移动管理网元接收第二消息，第二消息包括以下至少一项：协议参数、通信参数或接入参数；其中，协议参数用于指示接入网设备与标签设备之间的通信协议和/或接入网设备与标签汇聚网元之间的通信协议；通信参数用于支持接入网设备配置与标签设备之间进行通信所用的数据传输速率和/或解码方式；接入参数用于接入网设备配置标签设备接入事件的规则；标签设备接入事件的规则包括以下至少一项：标签设备接入事件的触发时间、标签设备接入事件的周期或标签设备接入事件对应的标签设备数量。标签设备接入事件是对标签进行读操作，或者写操作，或者失效操作，或者对标签进行盘存操作。读操作可以读取标签设备存储的信息，例如传感器信息等，盘存操作指的是获取标签标识的操作，标签设备接入，也可以称为标签设备访问。
结合第五方面或以上第五方面的任意一种可能的实现方式中，在第五方面的第五种可能的实现方式中，处理单元具体用于，根据第二消息确定接入网设备与标签设备之间的通信协议和/或接入网设备与标签汇聚网元之间的通信协议；和/或，配置与标签设备之间进行通信所用的数据传输速率和/或解码方式；和/或，配置标签设备接入事件的规则。
结合第五方面或以上第五方面的任意一种可能的实现方式中，在第五方面的第六种可能的实现方式中，通信单元还用于，从标签汇聚网元接收操作指令；操作指令用于指示接入网设备执行与标签设备之间的通信操作；处理单元还用于，根据操作指令执行与标签设 备之间的通信操作。标签汇聚网元可以是独立的核心网网元，或者是与用户面功能网元UPF或者接入移动管理网元AMF或者会话管理网元SMF或者网络开放网元NEF或者服务器或者物联网平台共同部署的网元。
结合第五方面或以上第五方面的任意一种可能的实现方式中，在第五方面的第七种可能的实现方式中，标签设备的标识包括标签设备的无线访问控制MAC地址或标签设备的秘密标识SID或标签设备的电子产品码EPC。
结合第五方面或以上第五方面的任意一种可能的实现方式中，在第五方面的第八种可能的实现方式中，处理单元包括标签接入功能模块以及标签代理功能模块，标签接入功能模块，用于获取标签设备的标识，标签接入功能模块向标签代理功能模块发送标签设备的标识；标签代理功能模块，用于根据标签设备的标识确定3GPP网络用户标识。
结合第五方面或以上第五方面的任意一种可能的实现方式中，在第五方面的第九种可能的实现方式中，标签代理功能模块还用于，生成第一信息，第一信息用于指示标签设备的标识、标签接入功能模块的标识以及3GPP网络用户标识之间的对应关系；根据第一信息寻址标签接入功能模块。
结合第五方面或以上第五方面的任意一种可能的实现方式中，在第五方面的第十种可能的实现方式中，3GPP网络用户标识包括标签设备的用户隐藏标识SUCI或用户永久标识SUPI。
需要说明的是，第五方面提供的通信装置也可以是读写器设备或者读写器设备中的部件，该读写器设备可以部署在接入网设备或终端设备中，当读写器设备部署在接入网设备中时，该通信装置可以是上述接入网设备或者接入网设备中的部件，当读写器设备部署在终端设备中时，该通信装置还可以是终端设备或者终端设备中的部件。接入网设备也可以直接作为读写器设备，或者终端设备也可以直接作为读写器设备；当接入网设备直接作为读写器设备时，该通信装置可以是上述接入网设备或者接入网设备中的部件，当终端设备直接作为读写器设备时，该通信装置可以是终端设备或者终端设备中的部件。
第六方面，提供一种通信装置，该装置可以是接入移动管理网元或接入移动管理网元中的部件。该装置包括：处理单元，用于通信单元从接入网设备接收第一消息，第一消息包括标签设备的第三代合作伙伴计划3GPP网络用户标识；处理单元还用于，通过通信单元向移动管理网元向认证设备发送3GPP网络用户标识，3GPP网络用户标识用于认证标签设备。处理单元还用于，通过通信单元从认证设备接收该标签设备的鉴权结果，通过通信单元想接入网设备发送该标签设备的鉴权结果。标签设备的标识可以是与3GPP网络用户标识相同的标识或者不同的标识。
结合第六方面，在第六方面的第一种可能的实现方式中，第一消息还包括类型信息，类型信息用于指示标签设备的类型。
结合第六方面或以上第六方面的任意一种可能的实现方式，在第六方面的第二种可能的实现方式中，第一消息为非接入层NAS注册请求，NAS注册请求包括3GPP网络用户标识。
结合第六方面或以上第六方面的任意一种可能的实现方式，在第六方面的第三种可能的实现方式中，处理单元还用于，通过通信单元从标签汇聚网元接收以下至少一项：协议参数、通信参数以及接入参数；其中，协议参数用于指示接入网设备与标签设备之间的通 信协议和/或接入网设备与标签汇聚网元之间的通信协议；通信参数用于支持接入网设备配置与标签设备之间进行通信所用的数据传输速率和/或解码方式；接入参数用于接入网设备配置标签设备接入事件的规则；标签设备接入事件的规则包括以下至少一项：标签设备接入事件的触发时间、标签设备接入事件的周期或标签设备接入事件对应的标签设备数量；处理单元还用于，通过通信单元向接入网设备发送第二消息，第二消息包括通信协议参数、设备运行参数以及接入参数中的至少一项。标签设备接入事件是对标签进行读操作，或者写操作，或者失效操作，或者对标签进行盘存操作。读操作可以读取标签设备存储的信息，例如传感器信息等，盘存操作指的是获取标签标识的操作，标签设备接入，也可以称为标签设备访问。
结合第六方面或以上第六方面的任意一种可能的实现方式，在第六方面的第四种可能的实现方式中，处理器还用于，通过通信单元从标签汇聚网元接收第三消息，第三消息用于标签汇聚网元向接入移动管理网元订阅与标签设备相关的消息。标签汇聚网元可以是独立的核心网网元，或者是与用户面功能网元UPF或者接入移动管理网元AMF或者会话管理网元SMF或者网络开放网元NEF或者服务器或者物联网平台共同部署的网元。
结合第六方面或以上第六方面的任意一种可能的实现方式，在第六方面的第五种可能的实现方式中，第三消息包括消息类型，消息类型指示与标签设备相关的消息。
结合第六方面或以上第六方面的任意一种可能的实现方式，在第六方面的第六种可能的实现方式中，3GPP网络用户标识包括标签设备的用户隐藏标识SUCI或用户永久标识SUPI。
第七方面，提供了一种通信装置，该通信装置可以是标签汇聚网元或标签汇聚网元中的部件。该装置包括：处理单元，用于判断标签设备是否通过安全认证；通信单元，用于在处理单元确定标签设备通过安全认证后，向接入网设备发送操作指令；操作指令用于指示接入网设备执行与标签设备之间的通信操作。标签汇聚网元可以是独立的核心网网元，或者是与用户面功能网元UPF或者接入移动管理网元AMF或者会话管理网元SMF或者网络开放网元NEF或者服务器或者物联网平台共同部署的网元。
结合第七方面，在第七方面的第一种可能的实现方式中，处理单元具体用于，若根据标签设备的标识从认证设备获取标签设备的标识对应的第三代合作伙伴计划3GPP网络用户标识，则确定标签设备通过安全认证。
结合第七方面或以上第七方面的任意一种可能的实现方式，在第七方面的第二种可能的实现方式中，通信单元还用于，在处理单元确定标签设备通过安全认证之前，向接入移动管理网元发送以下至少一项：协议参数、通信参数以及接入参数；其中，协议参数用于指示接入网设备与标签设备之间的通信协议和/或接入网设备与标签汇聚网元之间的通信协议；通信参数用于支持接入网设备配置与标签设备之间进行通信所用的数据传输速率和/或解码方式；接入参数用于接入网设备配置标签设备接入事件的规则；标签设备接入事件的规则包括以下至少一项：标签设备接入事件的触发时间、标签设备接入事件的周期或标签设备接入事件对应的标签设备数量。
结合第七方面或以上第七方面的任意一种可能的实现方式，在第七方面的第三种可能的实现方式中，通信单元还用于，向接入移动管理网元发送第三消息，第三消息用于向接入移动管理网元订阅与标签设备相关的消息。
结合第七方面或以上第七方面的任意一种可能的实现方式，在第七方面的第四种可能的实现方式中，第三消息包括消息类型，消息类型指示与标签设备相关的消息。
结合第七方面或以上第七方面的任意一种可能的实现方式，在第七方面的第五种可能的实现方式中，处理单元具体用于，若根据标签设备的标识从认证设备未获取标签设备的标识对应的第三代合作伙伴计划3GPP网络用户标识，则确定标签设备未通过安全认证。
结合第七方面或以上第七方面的任意一种可能的实现方式，在第七方面的第六种可能的实现方式中，通信单元还用于，在处理单元确定标签设备未通过安全认证之后，向接入移动管理网元发送以下至少一项：通信协议参数、设备运行参数以及接入参数；其中，通信协议参数用于指示接入网设备与标签设备之间的通信协议和/或接入网设备与标签汇聚网元之间的通信协议；设备运行参数用于支持接入网设备配置与标签设备相关的功能；接入参数用于支持接入网设备配置标签设备接入接入网设备的规则。
结合第七方面或以上第七方面的任意一种可能的实现方式，在第七方面的第七种可能的实现方式中，通信单元还用于，向接入移动管理网元发送第三消息，第三消息用于向接入移动管理网元订阅与标签设备相关的消息。
结合第七方面或以上第七方面的任意一种可能的实现方式，在第七方面的第八种可能的实现方式中，第三消息包括消息类型，消息类型指示与标签设备相关的消息。
结合第七方面或以上第七方面的任意一种可能的实现方式，在第七方面的第九种可能的实现方式中，标签设备的标识包括标签设备的无线访问控制MAC地址或标签设备的秘密标识SID或标签设备的电子产品码EPC。
结合第七方面或以上第七方面的任意一种可能的实现方式，在第七方面的第十种可能的实现方式中，3GPP网络用户标识包括标签设备的用户隐藏标识SUCI或用户永久标识SUPI。
第八方面，提供了一种通信装置，该通信装置可以是标签设备或标签设备中的部件。该装置包括：通信单元，用于在接收标签触发信号后，发送核心网交互消息；核心网交互消息用于标签设备与核心网网元进行消息交互。
结合第八方面，在第八方面的第一种可能的实现方式中，核心网交互消息可以包括以下任意一项：注册消息；或者，去注册消息；或者，会话建立请求消息；或者，会话修改请求消息；或者，会话删除请求消息；或者，服务请求消息；或者，标签数据发送消息；注册消息用于在核心网注册标签；去注册消息用于在核心网去注册标签；会话建立请求消息用于为标签建立会话；会话修改请求消息用于为标签修改会话；会话删除请求消息用于为标签删除会话；服务请求消息用于为标签请求服务；标签数据发送消息用于发送标签数据，标签数据可以是传感器数据或者预置数据等。
结合第八方面或以上第八方面的任意一种可能的实现，在第八方面的第二种可能的实现方式中，标签触发信号用于触发盘存过程；或者，标签触发信号用于触发标签访问过程；或者，标签触发信号用于触发标签认证过程；或者，标签触发信号用于触发标签锁定过程；或者，标签触发信号用于触发标签失效过程；或者，标签触发信号用于唤醒标签设备；盘存过程是获取标签标识的过程；标签访问过程是对标签设备进行读操作或者写操作的过程；标签认证过程是对标签设备进行认证的过程；标签锁定过程是对标签设备进行锁定的过程；标签失效过程是使标签设备失效的过程；唤醒标签设备是唤醒标签设备的过程。
结合第八方面或以上第八方面的任意一种可能的实现，在第八方面的第三种可能的实现方式中，通信单元，还用于接收过滤信息；如果匹配过滤信息，发送核心网交互消息。
结合第八方面或以上第八方面的任意一种可能的实现，在第八方面的第四种可能的实现方式中，核心网交互消息携带标签标识或者会话标识；标签标识或者会话标识由盘存过程或者标签访问过程获得；盘存过程是获取标签标识的过程；标签访问过程是对标签设备进行读操作或者写操作的过程。
结合第八方面或以上第八方面的任意一种可能的实现，在第八方面的第五种可能的实现方式中，标签触发信号为以下任意一项：选择Select命令、挑战Challenge命令、查询Query命令、读Read命令、写Write命令、失效Kill命令、锁定Lock命令、唤醒命令。
结合第八方面或以上第八方面的任意一种可能的实现，在第八方面的第六种可能的实现方式中，核心网交互消息是非接入层NAS消息。
第九方面，提供了一种通信装置，包括至少一个处理器和存储器，所述至少一个处理器与所述存储器耦合；所述存储器，用于存储计算机程序；
所述至少一个处理器，用于执行所述存储器中存储的计算机程序，以使得所述装置执行如上述第一方面以及第一方面任意一种实现方式所述的方法。
第十方面，提供了一种通信装置，包括至少一个处理器和存储器，所述至少一个处理器与所述存储器耦合；所述存储器，用于存储计算机程序；
所述至少一个处理器，用于执行所述存储器中存储的计算机程序，以使得所述装置执行如上述第二方面以及第二方面任意一种实现方式所述的方法。
第十一方面，提供了一种通信装置，包括至少一个处理器和存储器，所述至少一个处理器与所述存储器耦合；所述存储器，用于存储计算机程序；
所述至少一个处理器，用于执行所述存储器中存储的计算机程序，以使得所述装置执行如上述第三方面以及第三方面任意一种实现方式所述的方法。
第十二方面，提供了一种通信装置，包括至少一个处理器和存储器，所述至少一个处理器与所述存储器耦合；所述存储器，用于存储计算机程序；
所述至少一个处理器，用于执行所述存储器中存储的计算机程序，以使得所述装置执行如上述第四方面以及第四方面任意一种实现方式所述的方法。
第十三方面，提供了一种计算机可读存储介质，包括：计算机可读存储介质中存储有指令；当计算机可读存储介质在上述第五方面以及第五方面任意一种实现方式所述的通信装置上运行时，使得通信装置执行如上述第一方面以及第一方面任意一种实现方式所述的鉴权方法。
或，当计算机可读存储介质在上述第六方面以及第六方面任意一种实现方式所述的通信装置上运行时，使得通信装置执行如上述第二方面以及第二方面任意一种实现方式所述的鉴权方法。
或，当计算机可读存储介质在上述第七方面以及第七方面任意一种实现方式所述的通信装置上运行时，使得通信装置执行如上述第三方面以及第三方面任意一种实现方式所述的鉴权方法。
或，当计算机可读存储介质在上述第八方面以及第八方面任意一种实现方式所述的通信装置上运行时，使得通信装置执行如上述第四方面以及第四方面任意一种实现方式所述 的方法。
第十四方面，提供了一种无线通信装置，该通信装置包括处理器，例如，应用于通信装置中，用于实现上述第一方面以及第一方面任意一种实现方式所述的方法，或，上述第二方面以及第二方面任意一种实现方式所述的方法，或上述第三方面以及第三方面任意一种实现方式所述的方法，或上述第四方面以及第四方面任意一种实现方式所述的方法。该通信装置例如可以是芯片系统。在一种可行的实现方式中，所述芯片系统还包括存储器，所述存储器，用于保存实现上述第一方面或第二方面或第三方面或第四方面所述方法的功能必要的程序指令和数据。
上述方面中的芯片系统可以是片上系统(system on chip，SOC)，也可以是基带芯片等，其中基带芯片可以包括处理器、信道编码器、数字信号处理器、调制解调器和接口模块等。
第十五方面，提供了一种通信系统，所述通信系统包括上述任意一种实现方式所述的接入网设备、上述任意一种实现方式所述的标签汇聚网元、上述任意一种实现方式所述的接入移动管理网元以及上述任意一种实现方式所述的标签设备。
附图说明
图1为本申请实施例提供的通信系统的架构图；
图2为本申请实施例提供的RFID系统的架构图；
图3为本申请实施例提供的UWB系统的架构图；
图4为本申请实施例提供的标签和解读器的交互流程示意图；
图5为本申请实施例提供的另一种通信系统架构图；
图6为本申请实施例提供的通信系统适用的协议栈示意图；
图7a为本申请实施例提供的通信装置的结构框图；
图7b为本申请实施例提供的通信装置的另一结构框图；
图8a为本申请实施例提供的鉴权方法的流程示意图；
图8b为本申请实施例提供的鉴权方法的另一流程示意图；
图9为本申请实施例提供的RFID tag安全认证的流程示意图；
图10为本申请实施例提供的UWB tag安全认证的流程示意图；
图11为本申请实施例提供的通信方法的流程示意图；
图12～图13为本申请实施例提供的通信装置的另一结构框图。
具体实施方式
第三代合作伙伴计划(3rd generation partnership project，3GPP)通信系统支持标签设备(tag)和3GPP核心网之间采用非3GPP技术互连互通。参考图1，相对于3GPP的系统架构新增安全网元，通过新增的安全网元对标签设备进行安全认证。认证通过后，该网元允许标签设备和3GPP核心网之间采用非3GPP技术互连互通。其中，非3GPP技术可以是无线保真(wireless fidelity，Wi-Fi)、全球微波互联接入(worldwide interoperability for microwave access，WiMAX)、码分多址(code division multiple access，CDMA)网络等。
图1所示的通信系统架构包含的网络功能和实体主要有：终端设备、接入网设备、用户面功能网元、数据网络、接入和移动性管理功能网元、会话管理功能网元、策略控制功能网元、应用功能网元、认证服务功能网元和统一数据库功能网元。图中展示了网络功能 实体之间的交互关系以及对应的接口，例如，UE(终端设备)和AMF(接入和移动性管理功能网元)之间可以通过N1接口进行交互，其他网络功能实体之间的交互类似，不再赘述。
终端设备：终端设备可以通过3GPP接入技术或非3GPP接入技术接入3GPP核心网。在此场景下，终端设备可以为用户设备(user equipment，UE)、手持终端、笔记本电脑、用户单元(subscriber unit)、蜂窝电话(cellular phone)、智能电话(smart phone)、无线数据卡、个人数字助理(personal digital assistant，PDA)电脑、平板型电脑、无线调制解调器(modem)、手持设备(handheld)、膝上型电脑(laptop computer)、无绳电话(cordless phone)或者无线本地环路(wireless local loop，WLL)台、机器类型通信(machine type communication，MTC)终端或是其他可以接入网络的设备。终端设备与接入网设备之间采用某种空口技术相互通信。
接入网(radio access network，RAN)设备：主要负责空口侧的无线资源管理、服务质量(quality of service，QoS)管理、数据压缩和加密等功能。所述接入网设备可以包括各种形式的基站，例如：宏基站，微基站(也称为小站)，中继站，接入点等。在采用不同的无线接入技术的系统中，具备基站功能的设备的名称可能会有所不同，例如，在第五代(5th generation，5G)系统中，称为gNB；在LTE系统中，称为演进的节点B(evolved NodeB，eNB或者eNodeB)；在第三代(3rd generation，3G)系统中，称为节点B(Node B)等。
接入和移动性管理功能(access and mobility management function，AMF)网元：属于核心网网元，主要负责信令处理部分，例如：接入控制、移动性管理、附着与去附着以及网关选择等功能。AMF网元为终端设备中的会话提供服务的情况下，会为该会话提供控制面的存储资源，以及存储会话标识、与会话标识关联的SMF网元标识等。
非3GPP接入互通功能(non-3GPP access interworking function)：该网元允许终端设备和3GPP核心网之间采用非3GPP技术互连互通，其中非3GPP技术例如：无线保真(wirelessfidelity，Wi-Fi)、全球微波互联接入(worldwide interoperability for microwave access，WiMAX)、码分多址(code division multiple access，CDMA)网络等，相对于可信的非3GPP接入网设备可以直接接入3GPP核心网，该网元需要通过安全网关建立的安全隧道来与3GPP核心网互连互通，其中安全网关例如：演进型分组数据网关(evolved packet data gateway，ePDG)、受信任的非3GPP网关功能(trusted Non-3GPP gateway function，TNGF)或者非3GPP互通功能(Non-3GPP interworking function，N3IWF)。
会话管理功能(session management function，SMF)网元：负责用户面网元选择，用户面网元重定向，因特网协议(internet protocol，IP)地址分配，承载的建立、修改和释放以及QoS控制。
用户面功能(user plane function，UPF)网元：负责终端设备中用户数据的转发和接收。可以从数据网络接收用户数据，通过接入网设备传输给终端设备；UPF网元还可以通过接入网设备从终端设备接收用户数据，转发到数据网络。UPF网元中为终端设备提供服务的传输资源和调度功能由SMF网元管理控制的。
策略控制功能(policy control function，PCF)网元：主要支持提供统一的策略框架来控制网络行为，提供策略规则给控制层网络功能，同时负责获取与策略相关的用户签约信息。
认证服务功能(authentication server function，AUSF)网元：主要提供认证功能，支持3GPP接入和Non-3GPP接入的认证，具体可参考3GPP TS 33.501。
网络开放功能(Network Exposure Function，NEF)网元：主要支持3GPP网络和第三方应用安全的交互，NEF能够安全的向第三方暴露网络能力和事件，用于加强或者改善应用服务质量，3GPP网络同样可以安全的从第三方获取相关数据，用以增强网络的智能决策；同时该网元支持从统一数据库恢复结构化数据或者向统一数据库中存储结构化数据。
统一数据库功能(unified data repository，UDR)网元/统一数据管理(unified data management/UDM)网元：主要负责存储结构化数据，存储的内容包括签约数据和策略数据、对外暴露的结构化数据和应用相关的数据。
应用功能(application function，AF)网元：主要支持与3GPP核心网交互来提供服务，例如影响数据路由决策，策略控制功能或者向网络侧提供第三方的一些服务。
应理解，上述网元或者功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行的软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。可选的，上述网元或者功能可以由一个设备实现，也可以由多个设备共同实现，还可以是一个设备内的一个功能模块，本申请实施例对此不作具体限定。尽管未示出，图1所示系统还可以包括其他功能网元，本申请实施例对此不做限制。
以下结合附图介绍两种标签设备：RFID标签和UWB标签。
(1)RFID标签还可以称为感应式电子晶片、近接卡、感应卡、非接触卡、电子标签或电子条码等。参考图2，RFID系统主要包含：RFID Tag、Reader(解读器)、中间件以及其他后端应用系统。RFID Tag进入磁场后，接收Reader发出的射频信号，RFID Tag发送RFID Tag芯片中的产品信息，Reader读取信息并解码后，送至中央信息系统或后台应用系统进行数据处理。这种RFID Tag可以称为Passive Tag(无源标签或被动标签)。
或者，RFID Tag主动发送特定频率的信号，Reader读取信号并解码后，送至中央信息系统或后台应用系统进行数据处理。这种RFID Tag称为Active Tag(有源标签或主动标签)。
(2)参考图3，UWB系统主要包含：UWB标签(或UWB终端)、UWB基站以及定位服务器，其中，UWB标签可以称为tag，UWB基站可以称为reader。UWB是一种无载波通信技术，利用纳秒至微微秒级的非正弦波窄脉冲传输数据。可以在较宽的频谱上传送极低功率的信号，例如，UWB基站和UWB标签之间可以在10米左右的范围内实现数百Mbit/s至数Gbit/s的数据传输速率。
图4为Tag(标签)和Reader(解读器)的交互流程示意图，具体包括：
S1、Reader先向RFID Tag发送激励信号，使得Tag获取能量。
S2、Reader使用Select(选择)命令选中符合条件的标签，
S3、Tag和Reader之间使用Inventory(盘存)系列命令协商本次通信(盘存)的通信参数。
其中，Inventory系列命令包括Query(查询)、QueryRep(查询响应)、确认应答(acknowledgement，ACK)和否定应答(negative acknowledgement，NACK)等，通信参数可以是数据传输速率、编码方式等。
S4、Tag和Reader之间使用Access(接入)系列命令进行安全认证以及具体的读写操 作。
其中，Access系列命令包括Authenticate(认证)命令、AuthComm命令、SecureComm命令、KeyUpdate命令、Read命令和Wirte命令等。具体地，Authenticate用于Tag和Reader之间的双向认证，完成安全认证流程后，利用KeyUpdate、Read和Wirte等指令执行具体的读写操作。
为了实现对多种标签的统一网络管理，可以将Reader融合在网络侧，通过网络侧融合的与Reader功能一致的功能模块或网元与标签设备进行通信交互。一种可能的实现方式中，在接入网设备部署标签接入功能模块以及标签融合功能模块，在核心网侧部署标签汇聚功能模块(或标签汇聚网元)。其中，标签接入功能模块负责与标签设备进行交互；标签代理功能模块用于为标签设备代建设备粒度的非接入层(non-access stratum，NAS)连接，以便在后续的安全认证流程中通过NAS消息传递相关的认证信息。
或者也可以将Reader部署在终端设备中，本申请实施例中，是以Reader部署在接入网设备中为例进行说明，应理解，当Reader部署在终端设备中时，可以由终端设备执行本申请实施例中接入网设备所执行的功能。Reader可以称为读写器，也可以称为读写器设备。
或者接入网设备也可以直接作为读写器设备，或者终端设备也可以直接作为读写器设备。
图5是本申请实施例提供的另一种通信系统架构图。其中，标签设备可以通过3GPP接入技术接入核心网。例如，标签设备通过RAN接入核心网，RAN包括标签接入功能模块和标签代理功能模块。标签设备也可以通过非3GPP接入技术接入核心网。例如，图5所示的架构中，标签设备可以采用非3GPP接入技术通过N3IWF或TNGF接入核心网。N3IWF或TNGF也可以包括标签接入功能模块和标签代理功能模块。示例性的，通过N3IWF网元接入核心网时，可以建立安全隧道，通过TNGF网元接入核心网时，可以不建立安全隧道。上述非3GPP技术可以是无线保真(wireless fidelity，Wi-Fi)技术、全球微波互联接入(worldwide interoperability for microwave access，WiMAX)技术、码分多址(code division multiple access，CDMA)网络技术等。
需要说明的是，标签接入功能模块可以和标签设备进行通信，还可以与标签代理功能模块进行通信；标签代理功能模块可以和标签汇聚网元(还可以称为标签汇聚功能模块)进行通信。
图5以RAN节点包括微型射频拉远模块(pico remote radio unit，pRRU)和基带单元(baseband Unit，BBU)为例。示例性的，RFID Reader的射频模块与pRRU共部署，或者直接融合到pRRU上。RFID Reader的上层功能模块RFID-L和RFID-H分别部署到BBU和核心网中。UWB基站的射频模块与pRRU共部署，或者直接融合到pRRU上。UWB基站的上层功能模块UWB-L和UWB-H分别部署到BBU和核心网中。其中，RFID-L、UWB-L可以称为标签接入功能模块，RFID-H、UWB-H可以称为标签汇聚网元。此外，标签代理功能模块可以称为uni-AGF。上述模块的具体功能说明如下：
(1)RFID-L：包括介质访问控制(media access control，MAC)协议层，负责与RFID标签进行交互；RFID-L还可以包括底层读写器协议(low level reader protocol，LLRP)协议层，负责接收RFID-H的高层命令，并转换成相应的空口操作。
(2)RFID-H：包括协议适配层(protocol adaptation layer，PAL)，负责和RFID-L进 行交互，具体可以使用LLRP协议；还可以包括应用层事件(application level events ALE)协议层，负责接收后端服务器的服务调用，并转换成具体的高层命令，通过LLRP协议发送给RFID-L。
(3)UWB-L：包括MAC协议层，负责与UWB标签进行交互；还可以包括PAL协议层，负责接收UWB-H的高层命令，并转换成相应的空口操作。
(4)UWB-H：包括PAL协议层，负责与UWB-L进行交互；UWB-H还负责网络配置和消息路由等高层功能。
需要说明的是，因为UWB/RFID标签并不具备完整的UE协议栈，所以BBU使用统一接入网关功能模块(unified access gateway function，Uni-AGF)为标签设备代建标签粒度的NAS连接。UWB应用服务器或RFID应用服务器部署于企业数据中心或者私有云中。
前文仅以RFID、UWB作为示例介绍各个功能模块的部署，图5所示的架构适用于其他标签设备的融合管理，本申请实施例对此不作限制。其中，RFID-L、UWB-L可以认为是本申请实施例所述的标签接入功能模块；RFID-H、UWB-H可以认为是本申请实施例所述的标签汇聚网元(或称为标签汇聚功能模块)；Uni-AGF可以认为是本申请实施例所述的标签代理功能模块。
图6是图5所示通信系统适用的协议栈。其中Uni-AGF负责为每个标签设备(例如，RFID标签或UWB标签)代建NAS连接，构建的控制面通道为“Tag<-->RFID-L<-->Uni-AGF<-->AMF”，或者，Tag<-->UWB-L<-->Uni-AGF<-->AMF。另外RFID-H与RFID-L(或者UWB-H与UWB-L)进行设备级通讯时，如完成基本设备配置，可以跳过Uni-AGF。图6以RFID标签、UWB标签为例，介绍了标签设备(tag)、标签接入功能模块、标签代理功能模块、AMF、标签汇聚网元以及应用服务器之间进行通信的协议栈。其中，在RFID中，标签设备为RFID tag，标签接入功能模块为RFID-L，标签代理功能模块为Uni-AGF，标签汇聚网元为RFID-H。在UWB中，标签设备为UWB tag，标签接入功能模块为UWB-L，标签代理功能模块为Uni-AGF，标签汇聚网元为UWB-H。
需要说明的是，RFID-H可以独立部署，也集成在其他核心网网元中。当RFID-H集成在AMF上时，RFID-H与AMF之间通过内部接口进行消息交互。UWB-H可以独立部署，也集成在其他核心网网元中。当UWB-H集成在AMF上时，UWB-H与AMF之间通过内部接口进行消息交互。
目前缺乏统一的认证流程对融合场景下标签设备进行安全认证，各个厂商对标签设备的安全认证流程差异巨大，大大增加了融合管理的复杂性。本申请实施例提供一种鉴权方法，接入网设备可以获取标签设备的标识，根据所述标签设备的标识确定第三代合作伙伴计划3GPP网络用户标识，向接入移动管理网元发送第一消息，所述第一消息包括所述3GPP网络用户标识，用于认证所述标签设备。通过本申请实施例提供的鉴权方法可以实现对不同标签设备的鉴权认证，支持多种标签进行统一网络管理的同时，提供统一的认证流程对标签设备进行安全认证，降低了融合管理的复杂性。
本申请实施例所述的网元，可以通过图7a中的通信装置710来实现。图7a所示为本申请实施例提供的通信装置710的硬件结构示意图。该通信装置710包括处理器7101以及至少一个通信接口(图7a中仅是示例性的以包括通信接口7103为例进行说明)，可选的，还包括存储器7102。其中，处理器7101、存储器7102以及通信接口7103之间互相连 接。
处理器7101可以是一个通用中央处理器(central processing unit，CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
通信接口7103，使用任何收发器一类的装置，用于与其他设备或通信网络进行通信，如以太网，无线接入网(radio access network，RAN)，无线局域网(wireless local area networks，WLAN)等。
存储器7102可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，也可以与处理器相连接。存储器也可以和处理器集成在一起。
其中，存储器7102用于存储执行本申请方案的计算机执行指令，并由处理器7101来控制执行。处理器7101用于执行存储器7102中存储的计算机执行指令，从而实现本申请下述实施例提供的意图处理方法。
可选的，本申请实施例中的计算机执行指令也可以称之为应用程序代码，本申请实施例对此不作具体限定。
在具体实现中，作为一种实施例，处理器7101可以包括一个或多个CPU，例如图7a中的CPU0和CPU1。
在具体实现中，作为一种实施例，通信装置710可以包括多个处理器，例如图7a中的处理器7101和处理器7106。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
在具体实现中，作为一种实施例，通信装置710还可以包括输出设备7104和输入设备7105。输出设备7104和处理器7101通信，可以以多种方式来显示信息。例如，输出设备7104可以是液晶显示器(liquid crystal display，LCD)，发光二级管(light emitting diode，LED)显示设备，阴极射线管(cathode ray tube，CRT)显示设备，或投影仪(projector)等。输入设备7105和处理器7101通信，可以以多种方式接收用户的输入。例如，输入设备7105可以是鼠标、键盘、触摸屏设备或传感设备等。
上述的通信装置710可以是一个通用设备或者是一个专用设备。在具体实现中，通信装置710可以是台式机、便携式电脑、网络服务器、掌上电脑(personal digital assistant，PDA)、移动手机、平板电脑、无线终端装置、嵌入式设备或有图7a中类似结构的设备。本申请实施例不限定通信装置710的类型。
需要说明的是，通信装置710可以是终端整机，也可以是实现终端上的功能部件或组件，也可以是通信芯片，例如基带芯片等。通信装置710是终端整机时，通信接口可以是射频模块。当通信装置710为通信芯片，通信接口7103可以是该芯片的输入输出接口电 路，输入输出接口电路用于读入和输出基带信号。
本申请实施例所述的网元还可以通过图7b所示的通信装置来实现。参考图7b，通信装置包括至少一个处理器7201、至少一个收发器7203、至少一个网络接口7204和一个或多个天线7205。可选的，还包括至少一个存储器7202。处理器7201、存储器7202、收发器7203和网络接口7204相连，例如通过总线相连。天线7205与收发器7203相连。网络接口7204用于通信装置通过通信链路与其它通信装置相连，例如通信装置通过S1接口与核心网网元相连。在本申请实施例中，所述连接可包括各类接口、传输线或总线等，本实施例对此不做限定。
本申请实施例中的处理器，例如处理器7201，可以包括如下至少一种类型：通用中央处理器(central processing unit，CPU)、数字信号处理器(digital signal processor，DSP)、微处理器、特定应用集成电路专用集成电路(application-specific integrated circuit，ASIC)、微控制器(microcontroller unit，MCU)、现场可编程门阵列(field programmable gate array，FPGA)、或者用于实现逻辑运算的集成电路。例如，处理器7201可以是一个单核(single-CPU)处理器或多核(multi-CPU)处理器。至少一个处理器7201可以是集成在一个芯片中或位于多个不同的芯片上。
本申请实施例中的存储器，例如存储器7202，可以包括如下至少一种类型：只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是EEPROM。在某些场景下，存储器还可以是只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。
存储器7202可以是独立存在，与处理器7201相连。可选的，存储器7202也可以和处理器7201集成在一起，例如集成在一个芯片之内。其中，存储器7202能够存储执行本申请实施例的技术方案的程序代码，并由处理器7201来控制执行，被执行的各类计算机程序代码也可被视为是处理器7201的驱动程序。例如，处理器7201用于执行存储器7202中存储的计算机程序代码，从而实现本申请实施例中的技术方案。
收发器7203可以用于支持通信装置与其他网元之间射频信号的接收或者发送，收发器7203可以与天线7205相连。具体地，一个或多个天线7205可以接收射频信号，该收发器7203可以用于从天线接收所述射频信号，并将射频信号转换为数字基带信号或数字中频信号，并将该数字基带信号或数字中频信号提供给所述处理器7201，以便处理器7201对该数字基带信号或数字中频信号做进一步的处理，例如解调处理和译码处理。此外，收发器7203可以用于从处理器7201接收经过调制的数字基带信号或数字中频信号，并将该经过调制的数字基带信号或数字中频信号转换为射频信号，并通过一个或多个天线7205发送所述射频信号。具体地，收发器7203可以选择性地对射频信号进行一级或多级下混频处理和模数转换处理以得到数字基带信号或数字中频信号，所述下混频处理和模数转换处理的先后顺序是可调整的。收发器7203可以选择性地对经过调制的数字基带信号或数字中频信号时进行一级或多级上混频处理和数模转换处理以得到射频信号，所述上混频处理和 数模转换处理的先后顺序是可调整的。数字基带信号和数字中频信号可以统称为数字信号。收发器可以称为收发电路、收发单元、收发器件、发送电路、发送单元或者发送器件等等。
需要说明的是，通信装置720可以是通信装置整机，也可以是实现通信装置功能的部件或组件，也可以是通信芯片。当通信装置720为通信芯片，收发器7203可以是该芯片的接口电路，该接口电路用于读入和输出基带信号。
本申请实施例提供一种鉴权方法，如图8a所示，所述方法包括以下步骤：
801、接入网设备获取标签设备的标识，根据所述标签设备的标识确定第三代合作伙伴计划3GPP网络用户标识。
其中，标签设备是一种新类型的终端设备，标签设备可以通过无线的方式接入接入网设备。例如，标签设备可以通过Wi-Fi、WiMAX、CDMA网络、EPC Gen2超高频(ultra high frequency，UHF)等非3GPP技术接入接入网设备；或者，标签设备通过与接入网设备之间的NR空口模拟非3GPP接入技术链路接入接入网设备；或者标签设备通过NR空口接入接入网设备。需要说明的是，标签设备并不限制设备形态是标签，可以是任意形态的终端设备。
示例性的，接入网设备向标签设备发送消息，请求标签设备发送标签设备的标识。或者，接入网设备接收标签设备主动上报的标识。
其中，标签设备的标识可以是与3GPP网络用户标识相同的标识，也可以是与3GPP网络用户标识不同的标识。
以标签设备的标识是与3GPP网络用户标识不同的标识为例，所述标签设备的标识包括所述标签设备的MAC地址或所述标签设备的秘密标识(secret identifier，SID)或所述标签设备的电子产品码(electronic product code，EPC)。例如，当标签设备为RFID tag，标签设备的标识可以是SID或EPC，当标签设备为UWB tag，标签设备的标识可以是MAC地址。
一种可能的实现方式中，标签设备的3GPP网络用户标识包括所述标签设备的用户隐藏标识(subscription concealed identifier，SUCI)。接入网设备可以根据标签设备的标识确定SUCI，或者，根据标签设备的标识确定(Subscription Permanent Identifier，SUPI)，根据SUPI确定SUCI，后续可以利用SUCI对所述标签设备进行安全认证。
另一种可能的实现方式中，标签设备的3GPP网络用户标识包括SUPI。示例性的，接入网设备根据标签设备的标识确定SUPI，后续可以将SUPI上报给接入移动管理网元，以便基于SUPI对标签设备进行安全认证。在这种实现方式中，标签设备的3GPP网络用户标识可以为SUPI。
以标签设备的标识是与3GPP网络用户标识相同的标识为例，标签设备的标识可以包括SUCI或SUPI。
示例性的，接入网设备可以通过盘存过程或者标签访问过程获取标签设备的标识。
其中，盘存过程可以是获取标签标识的过程，标签访问过程可以是对标签设备进行读操作或者写操作的过程。
具体实现中，所述接入网设备可以包括：标签接入功能模块以及标签代理功能模块。
所述标签接入功能模块可以获取所述标签设备的标识，并向所述标签代理功能模块发送所述标签设备的标识。所述标签代理功能模块从根据所述标签设备的标识确定所述3GPP 网络用户标识。
802、所述接入网设备向接入移动管理网元发送第一消息，所述第一消息包括所述3GPP网络用户标识，所述3GPP网络用户标识用于认证所述标签设备。
其中，接入移动管理网元可以是前文所述的接入和移动性管理功能。例如，可以是前文所述的AMF。接入网设备根据标签设备的标识确定3GPP网络用户标识后，通过第一消息向接入移动管理网元发送所述标签设备的3GPP网络用户标识，用于对所述标签设备进行安全认证。
示例性的，所述第一消息用于请求为所述标签设备建立NAS连接，后续通过NAS消息传输与所述标签设备的安全认证相关的信息，例如，所述标签设备的3GPP网络用户标识。一种可能的实现方式中，所述第一消息初始UE消息(initial UE message)。
一种可能的实现方式中，所述第一消息还包括类型信息，所述类型信息用于指示所述标签设备的类型。示例的，所述第一消息包括“RFID indicator”，指示核心网为RFID标签建立NAS连接。
一种可能的实现方式中，在所述接入网设备包括标签接入功能模块以及标签代理功能模块的场景中，标签代理功能模块确定所述标签设备的3GPP网络用户标识后，向所述接入移动管理网元发送所述第一消息。
803、接入移动管理网元从接入网设备接收第一消息，向认证设备发送所述3GPP网络用户标识，所述3GPP网络用户标识用于认证所述标签设备。
示例性的，接入移动管理网元从第一消息中获取所述标签设备的3GPP网络用户标识，选择认证设备对所述标签设备进行安全认证(或鉴权)。例如，向所述认证设备发送所述标签设备的3GPP网络用户标识，以便认证设备根据标签设备的3GPP网络用户标识对该标签设备进行鉴权。
804、认证设备可以根据所述标签设备的3GPP网络用户标识对所述标签设备进行鉴权。
接入移动管理网元选择认证设备后，就建立了“标签设备<->接入网设备<->接入移动管理网元<->认证设备”的通路。后续可以利用上述通路完成认证相关信令的交互，实现对标签设备的安全认证。其中，认证设备可以是前文所述的AUSF或UDM。认证设备可以根据标签设备的3GPP网络用户标识对标签设备进行认证，认证通过后，认证设备还可以存储标签设备的3GPP网络用户标识。一种可能的实现方式中，认证设备包括AUSF和UDM，AUSF和UDM协作完成对标签设备的认证。或者，认证设备包括AUSF和第三方的认证、授权和计费功能(authentication,authorization,and accounting，AAA)服务器，AUSF和AAA服务器协作完成对标签设备的认证。
一种可能的实现方式中，认证设备还可以从第一消息中获取所述标签设备的类型信息，可以根据所述标签设备的类型信息选择与所述标签设备相匹配的认证方法对所述标签设备进行安全认证。
示例的，所述第一消息包括的类型信息为“RFID indicator”，则认证设备可以选择RFID标准化或者厂商自定义的认证方法。
805、认证设备通过接入移动管理网元向接入网设备发送标签设备的鉴权结果。相应的，接入网设备通过接入移动管理网元接收标签设备的鉴权结果。
其中，鉴权结果用于指示该标签设备是否通过安全认证或鉴权，鉴权结果还可以称为安全认证结果、认证结果等，本申请实施例对此不做限制。
需要说明的是，步骤801～805提供了统一的认证流程对不同标签进行安全认证。在进行安全认证之前，网络侧还可以向接入网设备配置与标签设备相关的参数。示例性的，网络侧部署的标签汇聚网元向接入移动管理网元发送与标签设备相关的参数，与标签设备相关的参数具体包括以下至少一项：协议参数、通信参数或接入参数。
其中，所述协议参数用于指示所述接入网设备与所述标签设备之间的通信协议和/或所述接入网设备与标签汇聚网元之间的通信协议；示例的，协议参数可以包括协议版本信息，例如，可以是标签汇聚网元支持的协议版本。
所述通信参数用于支持所述接入网设备配置与所述标签设备之间进行通信所用的数据传输速率和/或解码方式；可以理解的是，通过所述通信参数指示接入网设备配置与标签设备相关的运行参数，支持接入网设备与标签设备、标签汇聚网元之间进行通信。
所述接入参数用于所述接入网设备配置标签设备接入事件的规则；所述标签设备接入事件的规则包括以下至少一项：所述标签设备接入事件的触发时间、所述标签设备接入事件的周期或所述标签设备接入事件对应的标签设备数量。
其中，标签设备接入事件可以是指对标签进行读操作，或者写操作，或者失效操作，或者对标签进行盘存操作。
其中，读操作可以读取标签设备存储的信息，例如传感器信息等，失效操作指的是设置标签临时不能使用或者永久不能使用的操作；盘存操作指的是获取标签标识的操作，标签设备接入，也可以称为标签设备访问。
接入移动管理网元从标签汇聚网元接收与标签设备相关的参数后，根据接收到的参数封装第二消息，向接入网设备发送第二消息。
接入网设备从接入移动管理网元接收第二消息后，还可以根据第二消息中的参数完成本地配置。例如，根据所述第二消息中的协议参数确定接入网设备与所述标签设备之间的通信协议，和/或，根据所述第二消息中的协议参数确定所述接入网设备与所述标签汇聚网元之间的通信协议。
接入网设备还可以根据所述第二消息中的通信参数配置与所述标签设备之间进行通信所用的数据传输速率和/或解码方式。
接入网设备还可以根据所述第二消息中的接入参数配置所述标签设备接入事件的规则。
需要说明的是，在所述接入网设备包括标签接入功能模块以及标签代理功能模块的场景中，标签接入功能模块从接入移动管理网元接收第二消息，并根据第二消息中的参数完成配置。
一种可能的实现方式中，网络侧向接入网设备配置与标签设备相关的参数之前，标签汇聚网元还可以向所述接入移动管理网元订阅与标签设备相关的消息。所述接入移动管理网元接收到其他网元发送的消息后，可以根据标签汇聚网元的订阅将与标签设备相关的消息路由至标签汇聚网元，或者，将与某一种或几种类型标签设备相关的消息路由至标签汇聚网元。
图8a所示的方法中，接入网设备可以在获取标签设备的信息后确定标签设备的3GPP 网络用户标识，还可以向接入移动管理网元发送标签设备的3GPP网络用户标识，以便接入移动管理网元将标签设备的3GPP网络用户标识发送给认证设备对标签设备进行认证，可以利用统一的认证流程对不同的标签设备进行认证。支持多种标签进行统一网络管理的同时，提供统一的认证流程对标签设备进行安全认证，降低了融合管理的复杂性。
示例的，参考图8b，本申请实施例提供的鉴权方法还包括步骤800：
800、接入移动管理网元从标签汇聚网元接收第三消息，所述第三消息用于所述标签汇聚网元向所述接入移动管理网元订阅与标签设备相关的消息。
其中，标签汇聚网元可以是独立部署的核心网网元，也可以集成在其他网元中。例如，集成在用户面功能网元、或者接入移动管理网元、或者会话管理网元、或者网络开放网元、或者服务器、或者物联网平台。当标签汇聚网元集成在用户面功能网元、或者接入移动管理网元、或者会话管理网元、或者网络开放网元、或者服务器、或者物联网平台上时，标签汇聚网元可以与其集成的网元之间通过内部接口进行消息交互。
一种可能的实现方式中，所述第三消息包括消息类型，所述消息类型指示所述与标签设备相关的消息。示例的，所述第三消息包括消息类型“RFID”，指示所述接入移动管理网元将与RFID标签相关的消息路由至标签汇聚网元。或者，所述第三消息包括消息类型“UWB”，指示所述接入移动管理网元将与UWB标签相关的消息路由至标签汇聚网元。
当接入网设备(或接入网设备包括的标签接入网元)根据接收到的第二消息完成配置，可以向所述接入移动管理网元发送响应消息。所述接入移动管理网元接收所述响应消息，判断响应消息是与标签设备相关的消息，则将响应消息路由至标签汇聚网元。
一种可能的实现方式中，当根据步骤801～805完成标签设备的安全认证后，标签设备和接入网设备之间可以进行安全的通信操作。
示例的，标签汇聚网元首先判断标签设备是否通过安全认证；若确定所述标签设备通过安全认证，所述标签汇聚网元则向接入网设备发送操作指令；所述操作指令用于指示所述接入网设备执行与标签设备之间的通信操作。
例如，标签汇聚网元可以通过接入移动管理网元向接入网设备发送操作指令。所述操作指令可以是图4所示流程中，Tag和Reader之间的Access系列命令。示例的，可以是Access系列命令中的“KeyUpdate”命令、“Read”命令或“Write”等命令。
一种可能的实现方式中，所述标签汇聚网元判断标签设备是否通过安全认证，包括：若根据所述标签设备的标识从认证设备获取所述标签设备的标识对应的3GPP网络用户标识，则确定所述标签设备通过安全认证。
示例性的，标签汇聚网元从AF获取标签设备的标识，根据标签设备的标识向认证设备查询与标签设备的标识对应的3GPP网络用户标识。若认证设备中存储有标签设备的标识对应的3GPP网络用户标识，则表明标签设备已通过安全认证。其中，标签设备的标识对应的3GPP网络用户标识即根据标签设备的标识确定的3GPP网络用户标识，例如，根据标签设备的SID确定的SUPI。
在接入网设备包括标签接入功能模块和标签代理功能模块的场景下，标签代理功能模块通过接入移动管理网元接收标签汇聚网元发送的操作指令。标签代理功能模块还可以通过与标签接入功能模块之间的内部接口向标签接入功能模块发送操作指令，由标签接入功能模块触发与标签设备之间的通信操作。例如，标签接入功能模块向标签设备发送 “KeyUpdate”命令，指示标签设备更新密钥。“KeyUpdate”命令可以是图4所示流程中，Tag和Reader之间使用Access系列命令中的“KeyUpdate”命令。
一种可能的实现方式中，标签代理功能模块还可以维护标签接入功能模块的标识、标签设备的以及所述标签设备的3GPP网络用户标识之间的对应关系。当标签代理功能模块对应多个标签接入功能模块，可以根据维护的对应关系将接收到的操作指令路由至相应的标签接入功能模块。
示例性的，所述标签代理功能模块生成第一信息，所述第一信息用于指示所述标签设备的标识、所述标签接入功能模块的标识以及所述3GPP网络用户标识之间的对应关系。
所述标签代理功能模块还可以根据所述第一信息寻址所述标签接入功能模块。例如，所述标签代理功能模块从标签融合网元接收操作指令，根据所述第一信息寻址到相应的标签接入功能模块，将操作指令路由至该标签接入功能模块。示例的，标签代理功能网元接收承载操作指令的NAS消息后，根据NAS连接和SUPI/SUCI的对应关系，确定SUPI/SUCI。还可以根据SUPI/SUCI以及第一信息指示的对应关系，确定对应的标签接入功能模块，将操作指令发送给该标签接入功能模块，从而可以由该标签接入功能模块将操作指令下发给相应的标签设备。
一种可能的实现方式中，若标签融合网元根据所述标签设备的标识从认证设备未获取所述标签设备的标识对应的第三代合作伙伴计划3GPP网络用户标识，则确定所述标签设备未通过安全认证。则进入步骤801～805，对标签设备进行安全认证。在对标签设备进行安全认证之前，标签汇聚网元还可以向接入网设备配置与标签设备相关的参数。具体认证过程以及参数配置过程参考前文所述，在此不做赘述。
需要说明的是，本申请实施例中与标签设备相关的流程可以分为参数配置阶段、安全认证阶段以及接入阶段。其中，参数配置阶段即标签汇聚网元还可以向接入网设备配置与标签设备相关的参数。安全认证阶段即前文所述的步骤801～805。接入阶段即标签汇聚网元向接入网设备发送操作指令，标签设备和接入网设备根据操作指令执行相应的通信操作，例如，读、写操作。
本申请实施例对上述三个阶段的执行顺序不做限制，一种可能的实现方式中执行的先后顺序是参数配置阶段、安全认证阶段以及接入阶段。另外，上述三个阶段可以择一执行，三个阶段并非缺一不可。
以下结合附图详细介绍本申请实施例提供的鉴权方法，该方法适用于图5所示的系统，可以对RFID tag进行安全认证。其中，标签设备为RFID tag，接入网设备(RAN)包括标签接入功能模块以及标签代理功能模块，其中，标签接入功能模块为RFID-L，标签代理功能模块为Uni-AGF。标签汇聚网元为RFID-H，认证设备为AUSF/UDM。接入移动管理网元为AMF。如图9所示，所述方法包括以下步骤：
900、RFID-H向AMF订阅与RFID tag相关的消息。
示例性的，RFID-H可以与RAN进行设备级通讯，即RFID-H与RAN交互的消息不是针对特定UE的。RFID-H可以通过AMF与RAN交互RFID类型的消息。示例性的，RFID-H向AMF发送服务化消息Namf_Communication_NonUeMessageTransfer，该消息包括N2消息以及表示该N2消息的类型的字段“N2inforType”，该字段“N2inforType”取值为“RFID”，表明RFID-H发送的是“RFID”类型的消息。AMF向RAN发送接收到的 N2消息。可选的，AMF还可以向RAN发送“N2inforType”字段，指示RFID-H发送“RFID”类型的消息。
RFID-H还可以通过订阅/通知的方式指示AMF将接收到的上行“RFID”类型的N2消息转发给RFID-H网元。示例性的，RFID-H网元可以通过Namf_Communication_
NonUeInfoSubscribe消息向AMF订阅“RFID”类型的消息。当AMF接收RAN侧发送的“RFID”类型的消息后，可以向RFID-H发送Namf_Communication_NonUe
InfoNotify消息，该消息包括RAN侧发送的“RFID”类型的消息。RFID-H接收该消息可以获取到RAN侧发送的“RFID”类型的消息。
示例性的，“RFID”类型的消息可以为LLRP协议的消息，即RFID-L与RFID-H之间采用LLRP协议(或者其他适配协议)进行交互。RFID-H可以通过服务化消息Namf_Communication_NonUeMessageTransfer将下行的LLRP协议消息发送给AMF，AMF再将LLRP协议消息发送给RAN(具体可以是RAN侧的RFID-L)。
需要说明的是，当RFID-H是核心网的网元，即可以明确RFID-H安全性，RFID-H可以直接与核心网的其他网元进行通信。当RFID-H作为第三方的应用，不是核心网的网元，RFID-H的安全性不确定，RFID-H网元不能直接和核心网的其他网元进行通信，需要通过网络开放功能(network exposure function，NEF)间接通讯，RFID-H发送的消息需要通过NEF网元转发至核心网的其他网元。
901、RFID-H向AMF发送RFID配置信息。
其中，RFID配置信息即前文所述的与标签设备相关的参数，包括协议参数、通信参数以及接入参数中的至少一项。协议参数、通信参数以及接入参数的说明参考前文，在此不做赘述。
示例性的，RFID-H通过服务化消息Namf_Communication_NonUeMessageTransfer向AMF传输RFID配置信息。示例性的，RFID-H可以将RFID配置信息包含在N2消息容器中发送给AMF，由AMF通过N2消息转发给RAN。
一种可能的实现方式中，RFID配置信息可以包含以下三项：
能力协商消息(即前文所述的协议参数)，用于与RFID-L协商支持的协议版本，并指示RFID-L使用协商后的协议版本。
设备配置消息(即前文所述的通信参数)，用于配置RFID-L基本的运行参数，例如，可以是数据传输速率、编码方式等。
接入参数，可以是标签接入(或盘存)操作设置信息或标签接入(或盘存)操作更新信息。可选地，接入参数用于配置RFID-L中的标签接入(或盘存)事件，以及事件的触发时间、事件的周期、触发事件的标签数量和触发事件后的报告内容。
902、AMF向RFID-L发送RFID配置信息。
示例性的，AMF接收RFID-H发送的RFID配置信息后，构建专用的N2消息“DOWNLINKNON UE ASSOCIATED RFID TRANSPORT”，向RAN发送构建的消息。RAN节点接收后将RFID配置信息转发给RFID-L。
903、RFID-L根据RFID配置信息完成配置。
示例性的，RFID-L根据接收到的RFID配置信息，完成能力协商、设备配置以及标签接入(盘存)操作的设置或更新。
904、RFID-L向AMF发送确认信息/新的RFID配置信息。
当RFID-L使用步骤902下发的RFID配置信息，则执行步骤903完成配置，在步骤904可以向AMF发送确认信息。
可选的，当RFID-L不认可步骤902下发的RFID配置信息，则可以跳过步骤903，在步骤904与RFID-H进一步协商RFID配置信息。示例性的，RFID-L构建新的RFID配置信息，向AMF发送新的RFID配置信息。例如，通过AMF转发给RFID-H专用的上行N2消息进行协商，专用的上行N2消息包含新的RFID配置信息。
905、AMF根据RFID-H的订阅向RFID-H发送确认信息/新的RFID配置信息。
如步骤900所述，RFID-H已经通过Namf_Communication_NonUeInfoSubscribe向AMF订阅RFID类型的N2消息。AMF接收到新的RFID配置信息后，对新的RFID配置信息进行封装后发送给RFID-H网元。示例性的，AMF使用Namf_Communication_
NonUeInfoNotify封装RFID配置信息后转发给RFID-H网元。
需要说明的是，若RFID-H与RAN(RFID-L)之间可以多次进行上下行信令的交互，即步骤901-905可能执行多次。另外下行信令和上行信令没有必然的对应关系，例如，步骤903中可以根据RFID配置信息完成部分配置，一次或者多次执行步骤904与RFID-H协商其他参数。
906、RFID-L获取RFID tag的SID。
需要说明的是，RFID tag和RFID-L之间可以采用SID或EPC码作为RFID tag的标识。当RFID-L通过标签识别过程(Tag Identification)获取RFID tag的SID后，触发进一步的相互认证流程，对RFID tag进行安全认证。
在相互认证流程中，RFID-L需要从核心网或者第三方获取用于相互认证的安全参数，例如，加密秘钥和/或完整保护密钥。
907、RFID-L向Uni-AGF发送RFID tag的SID。
示例性的，RFID-L通过与Uni-AGF之间的内部接口与Uni-AGF交互，触发Uni-AGF为当前认证的RFID tag建立NAS连接，用于与核心网交互对RFID tag进行安全认证。
需要说明的是，在交互过程中，Uni-AGF可以获取RFID-L的标识，RFID-L将RFID tag的SID发送给Uni-AGF。
908、Uni-AGF根据RFID tag的SID构建3GPP用户标识。该3GPP用户标识可以包括SUCI或SUPI。
一种可能的实现方式中，基于SUCI对RFID tag进行安全认证。示例性的，Uni-AGF基于RFC 7542定义的网络访问标识(network access identifier，NAI)格式使用SID构建SUPI，后续将SUPI转换成SUCI。其中，SUCI包含加密的SUPI。一种可能的实现方式中，Uni-AGF也可以直接根据SID确定SUCI。或者，可以根据EPC码构建SUCI。
另一种可能的实现方式中，基于SUPI对RFID tag进行安全认证。示例性的，在步骤906中，Uni-AGF根据RFID tag上报的标识(例如，SID或EPC码)确定SUPI，并将SUPI上报给AMF，后续可以根据SUPI对RFID tag进行安全认证。在这种实现方式中，RFID tag的3GPP网络用户标识可以为SUPI。步骤908中，AMF接收RFID-L发送的SID或EPC码，根据SID或EPC码构建SUPI。
示例性的，Uni-AGF尝试为RFID tag建立NAS连接。可选的，Uni-AGF还可以保存 RFID-L的标识、RFID tag的SID、RFID tag的SUPI(或SUCI)之间的对应关系。当前，Uni-AGF可以负责多个RFID-L，Uni-AGF可以根据保存的对应关系寻址Uni-AGF负责的一个RFID-L。
909、Uni-AGF向AMF发送NAS注册请求，NAS注册请求包括上述SUCI或SUPI。
Uni-AGF向AMF发送NAS注册请求，尝试为RFID tag建立NAS连接。后续的相互认证消息均由Uni-AGF代为转发。NAS注册请求可以是本申请实施例所述的第一消息。
需要说明的是，NAS注册请求包括所述SUCI，以便网络侧根据所述SUCI对RFID tag进行安全认证。NAS注册请求中除了携带SUCI外，还可以携带RFID tag的类型信息“RFID Indicator”。RFID Indicator用于指示被Uni-AGF代建NAS连接的设备的类型。
“RFID Indicator”可能也会影响认证流程，例如，认证设备可以根据设备的类型选择不同的认证方法、参数。以ISO 29167-19中定义的认证方法为例，RFID-L需要从数据库中(例如，UDM)获取RFID tag对应的加密秘钥和消息认证秘钥，UDM还可以根据RFID Indicator指示执行相应的认证方法。以3GPP中定义的认证方法为例，UDM中保存根秘钥，中间网元(如AMF)根据根秘钥进行衍生，并将衍生信息发送给RAN侧(RFID-L)、标签设备(RFID tag)。
910、AMF选择合适的AUSF。
AMF选择AUSF的原则同TS 23.501中的6.3.4小节。AMF选择完AUSF后，就建立了“标签<->RFID-L<->AMF<->AUSF<->UDM”之间的通路。
911、RFID tag和AUSF进行双向认证。
示例性的，AUSF和RFID tag可以基于上述通路交互认证相关的信令，完成双向认证。AUSF可以根据AMF发送的该RFID tag的3GPP用户标识(即SUCI或SUPI)对该RFID tag进行认证。
可以理解的是，设备类型不同，设备所述支持的认证方法不同，认证的流程有所不同。例如，可以使用RFID标准化或者厂商自定义的认证方法，上述通道用于传输RFID标准化或者厂商自定义的认证信令。
或者，可以使用5G网络支持的可扩展身份验证协议(extensible authentication protocol，EAP)认证方法，此时直接复用TS 33.501中定义的流程。
需要说明的是，AUSF也可以从第三方的AAA-S中获取安全参数(秘钥等)，AUSF和AAS-S使用AAA接口或者间接通过AAA-P网元进行交互。此时建立的安全认证信令交互通道为：标签<->RFIDL<->AMF<->AUSF<->AAAS，或者标签<->RFIDL<->AMF
<->AUSF<->AAAP<->AAAS。由于相关安全参数保存在第三方网元，减少了对运营商的依赖，有利于跨运营商的认证。
可选的，AUSF还可以通过AMF向RFID-L发送RFID tag的认证结果。
912、AMF将RFID tag注册到AUSF。
在此过程中，AUSF可以存储RFID tag的SID对应的SUPI。
913、AMF向Uni-AGF发送通知消息，指示RFID tag完成注册。
需要说明的是，如果上述认证过程失败或注册过程失败，则Uni-AGF结束注册流程。示例性的，如果步骤911中认证失败，RFID-L通知Uni-AGF认证结果，Uni-AGF则结束注册流程。或者，步骤913中Uni-AGF接收到AMF送的注册失败消息，Uni-AGF结束注 册流程。例如，Uni-AGF可以停止NAS定时器以结束注册流程。
步骤913为可选步骤，Uni-AGF还可以通过其它方式获取RFID tag完成注册的信息。例如，Uni-AGF可以从RFID-L获取RFID tag注册成功的信息。示例性的，在步骤911中RFID-L通过AMF接收到AUSF发送的认证结果后，可以向Uni-AGF通知RFID tag是否认证成功，若认证成功则认为注册成功。
914、RFID-H生成LLRP消息，包括操作指令。
其中，LLRP消息包含接入命令，接入指令即本申请实施例所述的操作指令。操作指令是针对目标Tag要执行的接入操作，例如，可以是图4所示流程中Tag和Reader之间使用的Access系列命令。示例的，操作指令可以是指示所述RFID tag执行的“Read”命令、“Write”命令或“KeyUpdate”命令。
915、RFID-H判断RFID tag是否完成安全认证，若完成执行步骤916～步骤919，若未完成安全认证则执行步骤900～913。
示例性的，若RFID-H可以在AUSF(或UDM)中查询到RFID tag的SID对应的SUPI，则表明RFID tag已经完成安全认证。RFID-H可以通过NAS消息向RFID tag所在的RFID-L发送LLRP消息，以指示RFID tag执行接入命令，例如，“Read”命令或“Write”命令。
否则，RFID-L则触发认证流程，支持步骤900～913。可选的，步骤901中可以上报接入请求，并且在RFID tag和AUSF的相互认证完成后，自行触发接入操作，指示RFID tag执行接入命令。
可选的，RFID-H可以从第三方应用服务器(例如，AF)获取操作指令，然后通过下行信令通知RFID-L、RFID tag执行操作指令。或者，RFID-H生成操作指令，然后通过下行信令通知RFID-L、RFID tag执行操作指令。
916、RFID-H向AMF发送操作指令。
示例性的，RFID-H通过服务化消息Namf_Communicaiton_N1N2MessageTransfer将包含操作指令的LLRP消息传输给AMF。
917、AMF向Uni-AGF发送操作指令。
示例性的，AMF通过NAS消息将操作指令转发给Uni-AGF。
918、Uni-AGF向对应的RFID-L发送操作指令。
示例性的，Uni-AGF根据保存的对应关系将下行LLRP消息路由至RFID tag对应的RFID-L。
919、RFID-L执行所述操作指令指示的通信操作。
示例性的，RFID-L解析操作指令后并执行相应的通信操作，例如，指示RFID tag执行KeyUpdate命令，或指示RFID tag执行Read命令。
需要说明的是，如果步骤915中在AUSF或UDM中未查询到SID对应的SUPI信息，则表明RFID tag还未执行相互认证流程，则需要重新执行步骤900-905。如果步骤900已经完成订阅，则可跳过步骤900。
另外步骤901中可以携带操作指令，以触发RFID-L进行盘存(接入)，获取到RFID tag的SID之后触发相互认证流程，即执行步骤906-913。后续认证完成后RFID tag直接执行步骤901中携带的操作指令。
图9所示流程中，步骤900～905可以称为参数配置流程，步骤906～913可以称为双向 认证流程，步骤914～919可以称为安全接入流程。本申请实施例对图9所示方法中的这三个流程的执行顺序不做限制，一种可能的实现方式中执行的先后顺序是参数配置流程、双向认证流程以及安全接入流程。另外，上述三个流程可以择一执行，三个流程并非缺一不可。
需要说明的是，RFID-H可以独立部署，也集成在其他核心网网元中。当RFID-H集成在AMF上时，RFID-H与AMF之间的消息交互可以省略或者视为通过内部接口进行。当Uni-AGF和RFID-L均部署在RAN上时，Uni-AGF和RFID-L之间的消息交互也可以省略或视为通过内部接口进行。
图9所示的方法中，基于一种可能的标签融合架构，实现RFID tag的安全认证流程。示例性的，将RFID Reader和部分高层组件功能融合入3GPP网络，通过Uni-AGF代建NAS连接的方式实现设备粒度的双向认证流程。图9所示的方法也可以用于RFID tag通过非3GPP接入核心网的架构，此时RFID-L和Uni-AGF由非3GPP互通功能(例如图所示的N3IWF或TNGF)实现；或者，图9所示的方法中的RAN由非3GPP互通功能替代。
本申请实施例还提供一种鉴权方法，该方法适用于图5所示的系统，可以对UWB tag进行安全认证。其中，标签设备为UWB tag，接入网设备包括标签接入功能模块以及标签代理功能模块，其中，标签接入功能模块为UWB-L，标签代理功能模块为Uni-AGF。标签汇聚网元为UWB-H，认证设备为AUSF/UDM。接入移动管理网元为AMF。如图10所示，所述方法包括以下步骤：
1000、UWB-H向AMF订阅与UWB tag相关的消息。
示例性的，UWB-H可以与RAN进行设备级通讯，即UWB-H与RAN交互的消息不是针对特定UE的。UWB-H可以通过AMF与RAN交互UWB类型的消息。示例性的，UWB-H向AMF发送服务化消息Namf_Communication_NonUeMessageTransfer，该消息包括N2消息以及表示该N2消息的类型的字段“N2inforType”，该字段“N2inforType”取值为“UWB”，表明UWB-H发送的是“UWB”类型的消息。AMF向RAN发送接收到的N2消息。可选的，AMF还可以向RAN发送“N2inforType”字段，指示UWB-H发送“UWB”类型的消息。
UWB-H还可以通过订阅/通知的方式指示AMF将接收到的上行“UWB”类型的N2消息转发给UWB-H网元。示例性的，UWB-H网元可以通过Namf_Communication_
NonUeInfoSubscribe消息向AMF订阅“UWB”类型的消息。当AMF接收RAN侧发送的“UWB”类型的消息后，可以向UWB-H发送Namf_Communication_NonUe
InfoNotify消息，该消息包括RAN侧发送的“UWB”类型的消息。UWB-H接收该消息可以获取到RAN侧发送的“UWB”类型的消息。
示例性的，“UWB”类型的消息可以为UWB应用层信息，即UWB-L与UWB-H之间采用UWB协议(或者其他适配协议)进行交互。UWB-H可以通过服务化消息Namf_Communication_NonUeMessageTransfer将下行的UWB应用层信息发送给AMF，AMF再将UWB应用层信息发送给RAN(具体可以是RAN侧的UWB-L)。
需要说明的是，当UWB-H是核心网的网元，即可以明确UWB-H安全性，UWB-H可以直接与核心网的其他网元进行通信。当UWB-H作为第三方的应用，不是核心网的网元，UWB-H的安全性不确定，UWB-H网元不能直接和核心网的其他网元进行通信，需要通过 网络开放功能(network exposure function，NEF)间接通讯，UWB-H发送的消息需要通过NEF网元转发至核心网的其他网元。
1001、UWB-H向AMF发送UWB配置信息。
其中，UWB配置信息即前文所述的与标签设备相关的参数，包括协议参数、通信参数以及接入参数中的至少一项。协议参数、通信参数以及接入参数的说明参考前文，在此不做赘述。在图10所示实施例中，UWB配置信息也可以不包括接入参数，本申请实施例在此不做限制。
示例性的，UWB-H通过服务化消息Namf_Communication_NonUeMessageTransfer向AMF发送UWB配置信息。示例性的，UWB-H可以将UWB配置信息包含在N2消息容器中发送给AMF，由AMF通过N2消息转发给RAN。
一种可能的实现方式中，UWB配置信息可以包含以下两项：
能力协商消息(即前文所述的协议参数)，用于与UWB-L协商支持的协议版本，并指示UWB-L使用协商后的协议版本。
设备配置消息(即前文所述的通信参数)，用于配置UWB-L基本的运行参数，例如，可以是数据传输速率、编码方式等。
1002、AMF向UWB-L发送UWB配置信息。
示例性的，AMF接收UWB-H发送的UWB配置信息后，构建专用的N2消息“DOWNLINKNON UE ASSOCIATED UWB TRANSPORT”，向RAN发送构建的消息。RAN节点接收后将UWB配置信息转发给UWB-L。
1003、UWB-L根据UWB配置信息完成配置。
示例性的，UWB-L根据接收到的UWB配置信息，完成能力协商、设备配置以及标签接入(盘存)操作的设置或更新。
1004、UWB-L向AMF发送确认信息/新的UWB配置信息。
当UWB-L使用步骤902下发的UWB配置信息，则执行步骤903完成配置，在步骤904可以向AMF发送确认信息。
可选的，当UWB-L不认可步骤1002下发的UWB配置信息，则可以跳过步骤1003，在步骤1004与UWB-H进一步协商UWB配置信息。示例性的，UWB-L构建新的UWB配置信息，向AMF发送新的UWB配置信息。例如，通过AMF转发给UWB-H专用的上行N2消息，专用的上行N2消息包含新的UWB配置信息。
1005、AMF根据UWB-H的订阅向UWB-H发送确认信息/新的UWB配置信息。
如步骤1000所述，UWB-H已经通过Namf_Communication_NonUeInfoSubscribe向AMF订阅UWB类型的N2消息。AMF接收到新的UWB配置信息后，对新的UWB配置信息进行封装后发送给UWB-H网元。示例性的，AMF使用Namf_Communication_
NonUeInfoNotify封装UWB配置信息后转发给UWB-H网元。
需要说明的是，若UWB-H与RAN(UWB-L)之间可以多次进行上下行信令的交互，即步骤1001-1005可能执行多次。另外下行信令和上行信令没有必然的对应关系，例如，步骤1003中可以根据UWB配置信息完成部分配置，一次或者多次执行步骤1004与UWB-H协商其他参数。
1006、UWB-L获取UWB tag的MAC标识。
需要说明的是，UWB tag和UWB-L之间可以采用MAC标识作为UWB tag的唯一标识。当UWB-L通过标签识别过程(Tag Identification)获取UWB tag的MAC标识后，触发进一步的相互认证流程，对UWB tag进行安全认证。
在相互认证流程中，UWB-L需要从核心网或者第三方获取用于相互认证的安全参数，例如，加密秘钥和/或完整保护密钥。
1007、UWB-L向Uni-AGF发送UWB tag的MAC标识。
示例性的，UWB-L通过与Uni-AGF之间的内部接口与Uni-AGF交互，触发Uni-AGF为当前认证的UWB tag建立NAS连接，用于与核心网交互对UWB tag进行安全认证。
需要说明的是，在交互过程中，Uni-AGF可以获取UWB-L的标识，UWB-L将UWB tag的MAC标识发送给Uni-AGF。
1008、Uni-AGF根据UWB tag的MAC标识构建3GPP用户标识。该3GPP用户标识可以包括SUCI或SUPI。
一种可能的实现方式中，基于SUCI对UWB tag进行安全认证。示例性的，Uni-AGF基于RFC 7542定义的网络访问标识(network access identifier，NAI)格式使用MAC标识构建SUPI，后续将SUPI转换成SUCI。其中，SUCI包含加密的SUPI。一种可能的实现方式中，Uni-AGF也可以直接根据MAC标识确定SUCI。
另一种可能的实现方式中，基于SUPI对UWB tag进行安全认证。示例性的，步骤1006中，Uni-AGF根据UWB tag上报的标识确定SUPI，并将SUPI上报给AMF，后续可以根据SUPI对UWB tag进行安全认证。在这种实现方式中，UWB tag的3GPP网络用户标识可以为SUPI。步骤1008中，AMF接收UWB-L发送的MAC标识，根据MAC标识构建SUPI。
示例性的，Uni-AGF尝试为UWB tag建立NAS连接。可选的，Uni-AGF还可以保存UWB-L的标识、UWB tag的MAC标识、UWB tag的SUPI(或SUCI)之间的对应关系。当前，Uni-AGF可以负责多个UWB-L，Uni-AGF可以根据保存的对应关系寻址Uni-AGF负责的一个UWB-L。
1009、Uni-AGF向AMF发送NAS注册请求，NAS注册请求包括上述SUCI或SUPI。
Uni-AGF向AMF发送NAS注册请求，尝试为UWB tag建立NAS连接，后续的相互认证消息均由Uni-AGF代为转发。NAS注册请求可以是本申请实施例所述的第一消息。
需要说明的是，NAS注册请求包括所述SUCI，以便网络侧根据所述SUCI对UWB tag进行安全认证。NAS注册请求中除了携带SUCI外，还可以携带UWB tag的类型信息“UWB Indicator”。UWB Indicator用于指示被Uni-AGF代建NAS连接的设备的类型。
“UWB Indicator”可能也会影响认证流程，例如，认证设备可以根据设备的类型选择不同的认证方法、参数。以ISO 21167-19中定义的认证方法为例，UWB-L需要从数据库中(例如，UDM)获取UWB tag对应的加密秘钥和消息认证秘钥，UDM还可以根据UWB Indicator指示执行相应的认证方法。以3GPP中定义的认证方法为例，UDM中保存根秘钥，中间网元(如AMF)根据根秘钥进行衍生，并将衍生信息发送给RAN侧(UWB-L)、标签设备(UWB tag)。
1010、AMF选择合适的AUSF。
AMF选择AUSF的原则同TS 23.501中的6.3.4小节。AMF选择完AUSF后，就建立 了“标签<->UWB-L<->AMF<->AUSF<->UDM”之间的通路。
1011、UWB tag和AUSF进行双向认证。
示例性的，AUSF和UWB tag可以基于上述通路交互认证相关的信令，完成双向认证。AUSF可以根据AMF发送的该UWB tag的3GPP用户标识(即SUCI或SUPI)对该UWB tag进行认证。
可以理解的是，设备类型不同，设备所述支持的认证方法不同，认证的流程有所不同。例如，可以使用UWB标准化或者厂商自定义的认证方法，上述通道用于传输UWB标准化或者厂商自定义的认证信令。
或者，可以使用5G网络支持的EAP认证方法，此时直接复用TS 33.501中定义的流程。
需要说明的是，AUSF也可以从第三方的AAA-S中获取安全参数(秘钥等)，AUSF和AAS-S使用AAA接口或者间接通过AAA-P网元进行交互。此时建立的安全认证信令交互通道为：标签<->UWBL<->AMF<->AUSF<->AAAS，或者标签<->UWBL<->AMF
<->AUSF<->AAAP<->AAAS。由于相关安全参数保存在第三方网元，减少了对运营商的依赖，有利于跨运营商的认证。
可选的，AUSF还可以通过AMF向UWB-L发送UWB tag的认证结果。
1012、AMF将UWB tag注册到AUSF。
在此过程中，AUSF可以存储UWB tag的MAC标识对应的SUPI。
1013、AMF向Uni-AGF发送通知消息，指示完成注册。
需要说明的是，如果上述认证过程失败或注册过程失败，则Uni-AGF结束注册流程。示例性的，如果步骤1011中认证失败，UWB-L通知Uni-AGF认证结果，Uni-AGF则结束注册流程。或者，步骤1013中Uni-AGF接收到AMF送的注册失败消息，Uni-AGF结束注册流程。例如，Uni-AGF可以停止NAS定时器以结束注册流程。
步骤1013为可选步骤，Uni-AGF还可以通过其它方式获取UWB tag完成注册的信息。例如，Uni-AGF可以从UWB-L获取UWB tag注册成功的信息。示例性的，在步骤1011中UWB-L通过AMF接收到认证结果后，可以向Uni-AGF通知UWB tag是否认证成功，若认证成功则认为注册成功。
1014、UWB-H生成UWB应用层信息，包括操作指令。
其中，UWB应用层信息包含接入命令，接入指令即本申请实施例所述的操作指令。操作指令是针对目标Tag要执行的接入操作，例如，UWB应用层信息可以是类似与图4所示流程中Tag和Reader之间使用的Access系列命令。示例的，操作指令可以是指示所述UWB tag执行的“Read”命令或“Write”命令。
1015、UWB-H判断UWB tag是否完成安全认证，若完成执行步骤1016～步骤1019，若未完成安全认证则执行步骤1000～1013。
示例性的，若UWB-H可以在AUSF(或UDM)中查询到UWB tag的MAC标识对应的SUPI，则表明UWB tag已经完成安全认证。UWB-H可以通过NAS消息向UWB tag所在的UWB-L发送UWB应用层信息，以指示UWB tag执行接入命令，例如，“Read”命令或“Write”命令。
否则，UWB-L则触发认证流程，支持步骤1000～1013。可选的，步骤1001中可以上 报接入请求，并且在UWB tag和AUSF的相互认证完成后，自行触发接入操作，指示UWB tag执行接入命令。
可选的，UWB-H可以从第三方应用服务器(例如，AF)获取操作指令，然后通过下行信令通知UWB-L、UWB tag执行操作指令。或者，UWB-H生成操作指令，然后通过下行信令通知UWB-L、UWB tag执行操作指令。
1016、UWB-H向AMF发送操作指令。
示例性的，UWB-H通过服务化消息Namf_Communicaiton_N1N2MessageTransfer将包含操作指令的UWB应用层信息传输给AMF。
1017、AMF向Uni-AGF发送操作指令。
示例性的，AMF通过NAS消息将操作指令转发给Uni-AGF。
1018、Uni-AGF向对应的UWB-L发送操作指令。
示例性的，Uni-AGF根据保存的对应关系将下行UWB应用层信息路由至UWB tag对应的UWB-L。
1019、UWB-L执行所述操作指令指示的通信操作。
示例性的，UWB-L解析操作指令后并执行相应的通信操作，例如，指示UWB tag执行KeyUpdate命令，或指示UWB tag执行Read命令。
需要说明的是，如果步骤1015中在AUSF或UDM中未查询到MAC标识对应的SUPI信息，则表明UWB tag还未执行相互认证流程，则需要重新执行步骤1000-1005。如果步骤1000已经完成订阅，则可跳过步骤1000。
另外步骤1001中可以携带操作指令，以触发UWB-L进行盘存(接入)，获取到UWB tag的MAC标识之后触发相互认证流程，即执行步骤1006-1013。后续认证完成后UWB tag直接执行步骤1001中携带的操作指令。
具体实现中，UWB-H可以独立部署，也集成在其他核心网网元中。当UWB-H集成在AMF上时，UWB-H与AMF之间的消息交互可以省略或者视为通过内部接口进行。当Uni-AGF和UWB-L均部署在RAN上时，Uni-AGF和UWB-L之间的消息交互也可以可以省略或者视为通过内部接口进行。
图10所示流程中，步骤1000～1005可以称为参数配置流程，步骤1006～1013可以称为双向认证流程，步骤1014～1019可以称为安全接入流程。本申请实施例对图10所示方法中的这三个流程的执行顺序不做限制，一种可能的实现方式中执行的先后顺序是参数配置流程、双向认证流程以及安全接入流程。另外，上述三个流程可以择一执行，三个流程并非缺一不可。
图10所示的方法中，基于一种可能的标签融合架构，实现UWB tag的安全认证流程。具体地，将UWB Reader和部分高层组件功能融合入3GPP网络，通过Uni-AGF代建NAS连接的方式实现设备粒度的双向认证流程。图10所示的方法也可以用于UWB tag通过非3GPP接入核心网的架构，此时UWB-L和Uni-AGF由非3GPP互通功能(例如图所示的N3IWF或TNGF)实现；或者，图9所示的方法中的RAN由非3GPP互通功能替代。
基于上述鉴权方法，标签设备、读写器设备和核心网网元可以基于盘存过程、标签访问过程、认证过程或注册过程等过程完成对不同标签设备的鉴权认证，如图11所示，本申请实施例还提供了一种通信方法，以使标签设备可以基于图11所示的通信方法执行盘存 过程、标签访问过程、认证过程或注册过程等过程，便于读写器设备和核心网网元实现上述鉴权方法，降低融合管理的复杂性。同时，标签设备还可以通过下述图11所示的通信方法实现与核心网的交互。
图11为本申请实施例提供的一种通信方法，如图11所示，该方法可以包括：
1101、标签设备接收标签触发信号。
其中，标签设备可以接收读写器设备发送的标签触发信号，该读写器设备可以部署在接入网设备或终端设备中，或者接入网设备直接作为读写器设备，或者，终端设备直接作为读写器设备。
其中，当标签设备是无源设备时，需要标签触发信号对标签设备进行激励，使得标签设备可以发送核心网交消息，以与核心网网元进行交互；或者，当标签设备处于休眠状态时，需要标签触发信号对标签设备进行唤醒，使得标签设备可以发送核心网交互消息，以与核心网网元进行交互。
示例性的，标签触发信号可以用于触发盘存过程；或者，标签触发信号可以用于触发标签访问过程；或者，标签触发信号可以用于触发标签认证过程；或者，标签触发信号可以用于触发标签锁定过程；或者，标签触发信号可以用于触发标签失效过程；或者，标签触发信号可以用于唤醒标签设备。
其中，盘存过程是获取标签标识的过程；标签访问过程是对标签设备进行读操作或者写操作的过程；标签认证过程是对标签设备进行认证的过程；标签锁定过程是对标签设备进行锁定的过程；标签失效过程是使标签失效的过程；唤醒标签设备是唤醒标签设备的过程。通过标签锁定过程，可以让标签设备存储的全部或者部分内容不可修改。
可选的，标签触发信号为以下任意一项：选择Select命令、挑战Challenge命令、查询Query命令、读Read命令、写Write命令、失效Kill命令、锁定Lock命令、唤醒命令。
其中，当标签触发信号为选择Select命令或者查询Query命令时，标签触发信号可以用于触发盘存过程。当标签触发信号为Read命令或者写Write命令时，标签触发信号可以用于触发标签访问过程。当标签触发信号为挑战Challenge命令时，标签触发信号可以用于触发标签认证过程。当标签触发信号为失效Kill命令时，标签触发信号可以用于触发标签失效过程。当标签触发信号为锁定Lock命令时，标签触发信号可以用于触发标签锁定过程；当标签触发信号为唤醒命令时，标签触发信号可以用于唤醒标签设备。
1102、标签设备发送核心网交互消息。
其中，标签设备可以向接入移动管理网元发送核心网交互消息。
示例性的，核心网交互消息可以包括以下任意一项：注册消息；或者，去注册消息；或者，会话建立请求消息；或者，会话修改请求消息；或者，会话删除请求消息；或者，服务请求消息；或者，标签数据发送消息。
其中，注册消息用于在核心网注册标签；去注册消息用于在核心网去注册标签；会话建立请求消息用于为标签建立会话；会话修改请求消息用于为标签修改会话；会话删除请求消息用于为标签删除会话；服务请求消息用于为标签请求服务；标签数据发送消息用于发送标签数据，标签数据可以是传感器数据或者预置数据等。
其中，若标签触发信号用于触发盘存过程，核心网交互消息可以包括注册消息、或者会话建立请求消息、或者会话修改请求消息、或者服务请求消息、或者标签数据发送消息。
若标签触发信号用于触发标签访问过程，核心网交互消息可以包括注册消息、或者会话建立请求消息、或者会话修改请求消息、或者服务请求消息、或者标签数据发送消息。
若标签触发信号用于触发标签认证过程，核心网交互消息可以包括注册消息、或者会话建立请求消息、或者会话修改请求消息、或者服务请求消息、或者标签数据发送消息。
若标签触发信号用于触发标签锁定过程，核心网交互消息可以包括注册消息、或者会话建立请求消息、或者会话修改请求消息、或者服务请求消息、或者标签数据发送消息。
若标签触发信号用于触发标签失效过程，核心网交互消息可以包括注册消息、或者去注册消息、或者会话删除请求消息、或者会话修改请求消息、或者服务请求消息。
若标签触发信号用于唤醒标签设备，核心网交互消息可以包括注册消息、或者会话建立请求消息、或者会话修改请求消息、或者服务请求消息、或者标签数据发送消息。
可选的，核心网交互消息还携带标签标识或者会话标识。
其中，标签标识或者会话标识可以由盘存过程或者标签访问过程获得。
可选的，核心网交互消息是非接入层NAS消息。
其中，当核心网交互消息包括注册消息时，核心网交互消息可以为NAS注册消息。当核心网交互消息包括去注册消息时，核心网交互消息可以为NAS去注册消息。当核心网交互消息包括会话建立请求消息时，核心网交互消息可以为NAS会话建立请求消息。当核心网交互消息包括会话修改请求消息时，核心网交互消息可以为NAS会话修改请求消息。当核心网交互消息包括会话删除请求消息时，核心网交互消息可以为NAS会话删除请求消息。当核心网交互消息包括服务请求消息时，核心网交互消息可以为NAS服务请求消息。当核心网交互消息包括标签数据发送消息时，核心网交互消息可以为NAS标签数据发送消息。
可选的，标签设备接收过滤信息，如果标签设备匹配过滤信息，标签设备发送核心网交互消息。
其中，标签触发信号可以包括过滤信息。
其中，过滤信息可以包括标签标识，也可以包括根据标签设备存储的内容设置的过滤信息，标签设备存储的内容可以包括传感器信息等。
可选的，标签设备可以在接收到读写器设备发送的标签触发信号后，直接执行上述1102；也可以先执行下述1101a，再执行上述1102；或者先执行下述1101b，再执行上述1102。
1101a、标签设备执行下述任一过程：盘存过程、或者标签访问过程、或者标签认证过程、或者标签锁定过程、或者标签失效过程、或者唤醒标签设备。
其中，标签设备可以在与读写器设备的交互过程中基于相应的标签触发信号执行上述流程。
1101b、标签设备执行读写器设备资源建立或者修改过程。
其中，标签设备还可以在与读写器设备的交互过程中执行读写器设备资源建立或者修改过程，以根据建立的资源或者修改后的资源与读写器设备进行通信。
在采用对应各个功能划分各个功能模块的情况下，图12示出上述实施例中所涉及的通信装置的一种可能的结构示意图。图12所示的通信装置可以是本申请实施例所述的接入网设备，也可以是接入网设备中实现上述方法的部件，或者，也可以是应用于接入网设 备中的芯片。图12所示的通信装置也可以是本申请实施例所述的标签汇聚网元，也可以是标签汇聚网元中实现上述方法的部件，或者，也可以是应用于标签汇聚网元中的芯片。图12所示的通信装置也可以是本申请实施例所述的接入移动管理网元，也可以是接入移动管理网元中实现上述方法的部件，或者，也可以是应用于接入移动管理网元中的芯片。
其中，所述芯片可以是片上系统(System-On-a-Chip，SOC)或者是具备通信功能的基带芯片等。如图12所示，通信装置包括处理单元1201以及通信单元1202。处理单元可以是一个或多个处理器，通信单元可以是收发器或者通信接口。
处理单元1201，可用于支持通信装置执行上述方法实施例中的处理动作，具体的，可以执行图8a、图8b、图9、图10或图11中由接入移动管理网元执行的处理动作，或者，可以执行图8a、图8b、图9、图10或图11中由接入网设备执行的处理动作，或者，可以执行图8a、图8b、图9、图10或图11中由标签汇聚网元执行的处理动作，或者，可以执行图8a、图8b、图9、图10或图11中由标签设备执行的处理动作，和/或用于本文所描述的技术的其它过程。
通信单元1202，用于支持通信装置与其他通信装置或设备之间的通信，具体可以执行图8a、图8b、图9、图10或图11中由接入移动管理网元执行的发送和/或接收的动作，或者，可以执行图8a、图8b、图9、图10或图11中由接入网设备执行的发送和/或接收的动作，或者，可以执行图8a、图8b、图9、图10或图11中由标签汇聚网元执行的发送和/或接收的动作，或者，可以执行图8a、图8b、图9、图10或图11中由标签设备执行的发送和/或接收的动作，和/或用于本文所描述的技术的其它过程。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
如图13所示，通信装置还可以包括存储单元1203，存储单元1203用于存储通信装置的程序代码和/或数据。
处理单元1201可以包括至少一个处理器，通信单元1202可以为收发器或者通信接口，存储单元1203可以包括存储器。
本申请实施例提供一种计算机可读存储介质，计算机可读存储介质中存储有指令；指令用于执行如图8a、图8b、图9、图10或图11所示的方法。
本申请实施例提供一种包括指令的计算机程序产品，当其在通信装置上运行时，使得通信装置执行如图8a、图8b、图9、图10或图11所示的方法。
本申请实施例提供一种无线通信装置，包括：无线通信装置中存储有指令；当无线通信装置在图7a、图7b、图12至图13所示的通信装置上运行时，使得通信装置执行如图8a、图8b、图9、图10或图11所示的方法。该无线通信装置可以为芯片。
本申请实施例提供一种通信系统，包括：前述接入网设备、标签汇聚网元和接入移动管理网元。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将通信装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。
本申请实施例中的处理器，可以包括但不限于以下至少一种：中央处理单元(central  processing unit，CPU)、微处理器、数字信号处理器(DSP)、微控制器(microcontroller unit，MCU)、或人工智能处理器等各类运行软件的计算设备，每种计算设备可包括一个或多个用于执行软件指令以进行运算或处理的核。该处理器可以是个单独的半导体芯片，也可以跟其他电路一起集成为一个半导体芯片，例如，可以跟其他电路(如编解码电路、硬件加速电路或各种总线和接口电路)构成一个SoC(片上系统)，或者也可以作为一个ASIC的内置处理器集成在所述ASIC当中，该集成了处理器的ASIC可以单独封装或者也可以跟其他电路封装在一起。该处理器除了包括用于执行软件指令以进行运算或处理的核外，还可进一步包括必要的硬件加速器，如现场可编程门阵列(field programmable gate array，FPGA)、PLD(可编程逻辑器件)、或者实现专用逻辑运算的逻辑电路。
本申请实施例中的存储器，可以包括如下至少一种类型：只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmabler-only memory，EEPROM)。在某些场景下，存储器还可以是只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。
本申请中，“至少一个”是指一个或者多个。“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b，或c中的至少一项(个)，可以表示：a，b，c，a-b，a-c，b-c，或a-b-c，其中a，b，c可以是单个，也可以是多个。另外，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。
在本申请所提供的几个实施例中，应该理解到，所揭露的数据库访问装置和方法，可以通过其它的方式实现。例如，以上所描述的数据库访问装置实施例仅仅是示意性的，例如，所述模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个装置，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，数据库访问装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是一个物理单元或多个物理单元，即可以位于一个地方，或者也可以分布到多个不同地方。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个可读取存储介质中。基于这样的理解，本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该软件产品存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何在本申请揭露的技术范围内的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (77)

  1. 一种鉴权方法，其特征在于，包括：
    读写器设备获取标签设备的标识，根据所述标签设备的标识确定第三代合作伙伴计划3GPP网络用户标识；
    所述读写器设备向接入移动管理网元发送第一消息，所述第一消息包括所述3GPP网络用户标识，所述3GPP网络用户标识用于认证所述标签设备。
  2. 根据权利要求1所述的方法，其特征在于，所述第一消息还包括类型信息，所述类型信息用于指示所述标签设备的类型。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一消息为非接入层NAS注册请求，NAS注册请求包括所述3GPP网络用户标识。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述读写器设备获取所述标签设备的标识，包括：
    所述读写器设备通过盘存过程或者标签访问过程获取所述标签设备的标识，所述盘存过程是获取标签标识的过程，所述标签访问过程是对所述标签设备进行读操作或者写操作的过程。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述方法还包括：
    从所述接入移动管理网元接收第二消息，所述第二消息包括以下至少一项：协议参数、通信参数或接入参数；
    其中，所述协议参数用于指示所述读写器设备与所述标签设备之间的通信协议和/或所述读写器设备与标签汇聚网元之间的通信协议；所述通信参数用于支持所述读写器设备配置与所述标签设备之间进行通信所用的数据传输速率和/或解码方式；所述接入参数用于所述读写器设备配置标签设备接入事件的规则；所述标签设备接入事件的规则包括以下至少一项：所述标签设备接入事件的触发时间、所述标签设备接入事件的周期或所述标签设备接入事件对应的标签设备数量。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    根据所述第二消息确定所述读写器设备与所述标签设备之间的通信协议和/或所述读写器设备与所述标签汇聚网元之间的通信协议；和/或，
    配置与所述标签设备之间进行通信所用的数据传输速率和/或解码方式；和/或，
    配置所述标签设备接入事件的规则。
  7. 根据权要求1-6任一项所述的方法，其特征在于，所述方法还包括：
    从标签汇聚网元接收操作指令；所述操作指令用于指示所述读写器设备执行与所述标签设备之间的通信操作；
    根据所述操作指令执行与所述标签设备之间的通信操作。
  8. 根据权利要求1-7任一项所述的方法，其特征在于，所述标签设备的标识包括所述标签设备的无线访问控制MAC地址或所述标签设备的秘密标识SID或所述标签设备的电子产品码EPC。
  9. 根据权利要求1-8任一项所述的方法，其特征在于，所述读写器设备包括：
    标签接入功能模块以及标签代理功能模块；
    所述读写器设备根据所述标签设备的标识确定3GPP网络用户标识，包括：
    所述标签接入功能模块获取所述标签设备的标识，所述标签接入功能模块向所述标签代理功能模块发送所述标签设备的标识；
    所述标签代理功能模块根据所述标签设备的标识确定所述3GPP网络用户标识。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    所述标签代理功能模块生成第一信息，所述第一信息用于指示所述标签设备的标识、所述标签接入功能模块的标识以及所述3GPP网络用户标识之间的对应关系；
    所述标签代理功能模块根据所述第一信息寻址所述标签接入功能模块。
  11. 根据权利要求1-10任一项所述的方法，其特征在于，所述3GPP网络用户标识包括所述标签设备的用户隐藏标识SUCI或用户永久标识SUPI。
  12. 一种鉴权方法，其特征在于，包括：
    接入移动管理网元从读写器设备接收第一消息，所述第一消息包括标签设备的第三代合作伙伴计划3GPP网络用户标识；
    所述移动管理网元向认证设备发送所述3GPP网络用户标识，所述3GPP网络用户标识用于认证所述标签设备。
  13. 根据权利要求12所述的方法，其特征在于，所述第一消息还包括类型信息，所述类型信息用于指示所述标签设备的类型。
  14. 根据权利要求12或13所述的方法，其特征在于，所述第一消息为非接入层NAS注册请求，NAS注册请求包括所述3GPP网络用户标识。
  15. 根据权利要求12-13任一项所述的方法，其特征在于，所述方法还包括：
    从标签汇聚网元接收以下至少一项：协议参数、通信参数以及接入参数；其中，所述协议参数用于指示所述读写器设备与所述标签设备之间的通信协议和/或所述读写器设备与标签汇聚网元之间的通信协议；所述通信参数用于支持所述读写器设备配置与所述标签设备之间进行通信所用的数据传输速率和/或解码方式；所述接入参数用于所述读写器设备配置标签设备接入事件的规则；所述标签设备接入事件的规则包括以下至少一项：所述标签设备接入事件的触发时间、所述标签设备接入事件的周期或所述标签设备接入事件对应的标签设备数量；
    向所述读写器设备发送第二消息，所述第二消息包括所述通信协议参数、所述设备运行参数以及所述接入参数中的至少一项。
  16. 根据权利要求12-15任一项所述的方法，其特征在于，所述方法还包括：
    从标签汇聚网元接收第三消息，所述第三消息用于所述标签汇聚网元向所述接入移动管理网元订阅与标签设备相关的消息。
  17. 根据权利要求16所述的方法，其特征在于，所述第三消息包括消息类型，所述消息类型指示所述与标签设备相关的消息。
  18. 根据权利要求12-17任一项所述的方法，其特征在于，所述3GPP网络用户标识包括所述标签设备的用户隐藏标识SUCI或用户永久标识SUPI。
  19. 一种鉴权方法，其特征在于，包括：
    标签汇聚网元判断标签设备是否通过安全认证；
    所述标签汇聚网元确定所述标签设备通过安全认证，向读写器设备发送操作指令；所述操作指令用于指示所述读写器设备执行与标签设备之间的通信操作。
  20. 根据权利要求19所述的方法，其特征在于，所述标签汇聚网元判断标签设备是否通过安全认证，包括：
    若根据所述标签设备的标识从认证设备获取所述标签设备的标识对应的第三代合作伙伴计划3GPP网络用户标识，则确定所述标签设备通过安全认证。
  21. 根据权利要求20所述的方法，其特征在于，所述标签汇聚网元确定所述标签设备通过安全认证之前，所述方法还包括：
    所述标签汇聚网元向接入移动管理网元发送以下至少一项：协议参数、通信参数以及接入参数；
    其中，所述协议参数用于指示所述读写器设备与所述标签设备之间的通信协议和/或所述读写器设备与标签汇聚网元之间的通信协议；所述通信参数用于支持所述读写器设备配置与所述标签设备之间进行通信所用的数据传输速率和/或解码方式；所述接入参数用于所述读写器设备配置标签设备接入事件的规则；所述标签设备接入事件的规则包括以下至少一项：所述标签设备接入事件的触发时间、所述标签设备接入事件的周期或所述标签设备接入事件对应的标签设备数量。
  22. 根据权利要求21所述的方法，其特征在于，所述方法还包括：
    向接入移动管理网元发送第三消息，所述第三消息用于向所述接入移动管理网元订阅与标签设备相关的消息。
  23. 根据权利要求22所述的方法，其特征在于，所述第三消息包括消息类型，所述消息类型指示所述与标签设备相关的消息。
  24. 根据权利要求19所述的方法，其特征在于，所述标签汇聚网元判断标签设备是否通过安全认证，包括：
    若根据所述标签设备的标识从认证设备未获取所述标签设备的标识对应的3GPP网络用户标识，则确定所述标签设备未通过安全认证。
  25. 根据权利要求24所述的方法，其特征在于，所述确定所述标签设备未通过安全认证之后，所述方法还包括：
    所述标签汇聚网元向接入移动管理网元发送以下至少一项：通信协议参数、设备运行参数以及接入参数；
    其中，所述通信协议参数用于指示所述读写器设备与所述标签设备之间的通信协议和/或所述读写器设备与所述标签汇聚网元之间的通信协议；所述设备运行参数用于支持所述读写器设备配置与所述标签设备相关的功能；所述接入参数用于支持所述读写器设备配置所述标签设备接入所述读写器设备的规则。
  26. 根据权利要求24或25所述的方法，其特征在于，所述方法还包括：
    向接入移动管理网元发送第三消息，所述第三消息用于向所述接入移动管理网元订阅与标签设备相关的消息。
  27. 根据权利要求26所述的方法，其特征在于，所述第三消息包括消息类型，所述消息类型指示所述与标签设备相关的消息。
  28. 根据权利要求19-27任一项所述的方法，其特征在于，所述标签设备的标识包括所述标签设备的无线访问控制MAC地址或所述标签设备的秘密标识SID或所述标签设备的电子产品码EPC。
  29. 根据权利要求19-28任一项所述的方法，其特征在于，所述3GPP网络用户标识包括所述标签设备的用户隐藏标识SUCI或用户永久标识SUPI。
  30. 一种通信方法，其特征在于，包括：
    标签设备在接收标签触发信号后，发送核心网交互消息；所述核心网交互消息用于标签设备与核心网网元进行消息交互。
  31. 根据权利要求30所述的方法，其特征在于，所述核心网交互消息包括以下任意一项：
    注册消息；或者，
    去注册消息；或者，
    会话建立请求消息；或者，
    会话修改请求消息；或者，
    会话删除请求消息；或者，
    服务请求消息；或者，
    标签数据发送消息；
    所述注册消息用于在核心网注册标签；所述去注册消息用于在核心网去注册标签；所述会话建立请求消息用于为标签建立会话；所述会话修改请求消息用于为标签修改会话；所述会话删除请求消息用于为标签删除会话；所述服务请求消息用于为标签请求服务；所述标签数据发送消息用于发送标签数据。
  32. 根据权利要求30或31所述的方法，其特征在于，
    所述标签触发信号用于触发盘存过程；或者，
    所述标签触发信号用于触发标签访问过程；或者，
    所述标签触发信号用于触发标签认证过程；或者，
    所述标签触发信号用于触发标签锁定过程；或者，
    所述标签触发信号用于触发标签失效过程；或者，
    所述标签触发信号用于唤醒标签设备；
    所述盘存过程是获取标签标识的过程；所述标签访问过程是对所述标签设备进行读操作或者写操作的过程；所述标签认证过程是对所述标签设备进行认证的过程；所述标签锁定过程是对所述标签设备进行锁定的过程；所述标签失效过程是使所述标签设备失效的过程；所述唤醒标签设备是唤醒所述标签设备的过程。
  33. 根据权利要求30-32任一项所述的方法，其特征在于，所述标签设备发送所述核心网交互消息，包括：
    所述标签设备接收过滤信息；
    如果所述标签设备匹配所述过滤信息，所述标签设备发送所述核心网交互消息。
  34. 根据权利要求30-33任一项所述的方法，其特征在于，所述核心网交互消息携带标签标识或者会话标识；所述标签标识或者所述会话标识由盘存过程或者标签访问过程获得；所述盘存过程是获取所述标签标识的过程；所述标签访问过程是对所述标签设备进行读操作或者写操作的过程。
  35. 根据权利要求30-34任一项所述的方法，其特征在于，所述标签触发信号为以下任意一项：选择Select命令、挑战Challenge命令、查询Query命令、读Read命令、写Write 命令、失效Kill命令、锁定Lock命令、唤醒命令。
  36. 根据权利要求30-35任一项所述的方法，其特征在于，所述核心网交互消息是非接入层NAS消息。
  37. 一种通信装置，其特征在于，包括：
    处理单元，用于获取标签设备的标识，根据所述标签设备的标识确定第三代合作伙伴计划3GPP网络用户标识；
    通信单元，用于向接入移动管理网元发送第一消息，所述第一消息包括所述3GPP网络用户标识，所述3GPP网络用户标识用于认证所述标签设备。
  38. 根据权利要求37所述的装置，其特征在于，所述第一消息还包括类型信息，所述类型信息用于指示所述标签设备的类型。
  39. 根据权利要求37或38所述的装置，其特征在于，所述第一消息为非接入层NAS注册请求，NAS注册请求包括所述3GPP网络用户标识。
  40. 根据权利要求37-39任一项所述的装置，其特征在于，所述处理单元，还用于通过盘存过程或者标签访问过程获取所述标签设备的标识，所述盘存过程是获取标签标识的过程，所述标签访问过程是对所述标签设备进行读操作或者写操作的过程。
  41. 根据权利要求37-40任一项所述的装置，其特征在于，所述通信单元还用于，从所述接入移动管理网元接收第二消息，所述第二消息包括以下至少一项：协议参数、通信参数或接入参数；
    其中，所述协议参数用于指示读写器设备与所述标签设备之间的通信协议和/或读写器设备与标签汇聚网元之间的通信协议；所述通信参数用于支持所述读写器设备配置与所述标签设备之间进行通信所用的数据传输速率和/或解码方式；所述接入参数用于所述读写器设备配置标签设备接入事件的规则；所述标签设备接入事件的规则包括以下至少一项：所述标签设备接入事件的触发时间、所述标签设备接入事件的周期或所述标签设备接入事件对应的标签设备数量。
  42. 根据权利要求41所述的装置，其特征在于，
    所述处理单元具体用于，根据所述第二消息确定所述读写器设备与所述标签设备之间的通信协议和/或所述读写器设备与所述标签汇聚网元之间的通信协议；和/或，
    配置与所述标签设备之间进行通信所用的数据传输速率和/或解码方式；和/或，
    配置所述标签设备接入事件的规则。
  43. 根据权利要求37-42任一项所述的装置，其特征在于，
    所述通信单元还用于，从标签汇聚网元接收操作指令；所述操作指令用于指示所述读写器设备执行与所述标签设备之间的通信操作；
    所述处理单元还用于，根据所述操作指令执行与所述标签设备之间的通信操作。
  44. 根据权利要求37-43任一项所述的装置，其特征在于，所述标签设备的标识包括所述标签设备的无线访问控制MAC地址或所述标签设备的秘密标识SID或所述标签设备的电子产品码EPC。
  45. 根据权利要求37-44任一项所述的装置，其特征在于，所述处理单元包括标签接入功能模块以及标签代理功能模块，
    所述标签接入功能模块，用于获取所述标签设备的标识，所述标签接入功能模块向所 述标签代理功能模块发送所述标签设备的标识；
    所述标签代理功能模块，用于根据所述标签设备的标识确定所述3GPP网络用户标识。
  46. 根据权利要求45所述的装置，其特征在于，所述标签代理功能模块还用于，生成第一信息，所述第一信息用于指示所述标签设备的标识、所述标签接入功能模块的标识以及所述3GPP网络用户标识之间的对应关系；
    根据所述第一信息寻址所述标签接入功能模块。
  47. 根据权利要求37-46任一项所述的装置，其特征在于，所述3GPP网络用户标识包括所述标签设备的用户隐藏标识SUCI或用户永久标识SUPI。
  48. 一种通信装置，其特征在于，包括：
    处理单元，用于通信单元从读写器设备接收第一消息，所述第一消息包括标签设备的第三代合作伙伴计划3GPP网络用户标识；
    所述处理单元还用于，通过所述通信单元向认证设备发送所述3GPP网络用户标识，所述3GPP网络用户标识用于认证所述标签设备。
  49. 根据权利要求48所述的装置，其特征在于，所述第一消息还包括类型信息，所述类型信息用于指示所述标签设备的类型。
  50. 根据权利要求48或49所述的装置，其特征在于，所述第一消息为非接入层NAS注册请求，NAS注册请求包括所述3GPP网络用户标识。
  51. 根据权利要求48-50任一项所述的装置，其特征在于，
    所述处理单元还用于，通过所述通信单元从标签汇聚网元接收以下至少一项：协议参数、通信参数以及接入参数；其中，所述协议参数用于指示所述读写器设备与所述标签设备之间的通信协议和/或所述读写器设备与标签汇聚网元之间的通信协议；所述通信参数用于支持所述读写器设备配置与所述标签设备之间进行通信所用的数据传输速率和/或解码方式；所述接入参数用于所述读写器设备配置标签设备接入事件的规则；所述标签设备接入事件的规则包括以下至少一项：所述标签设备接入事件的触发时间、所述标签设备接入事件的周期或所述标签设备接入事件对应的标签设备数量；
    所述处理单元还用于，通过所述通信单元向所述读写器设备发送第二消息，所述第二消息包括所述通信协议参数、所述设备运行参数以及所述接入参数中的至少一项。
  52. 根据权利要求48-51任一项所述的装置，其特征在于，所述处理器还用于，通过所述通信单元从标签汇聚网元接收第三消息，所述第三消息用于所述标签汇聚网元向所述接入移动管理网元订阅与标签设备相关的消息。
  53. 根据权利要求52所述的装置，其特征在于，所述第三消息包括消息类型，所述消息类型指示所述与标签设备相关的消息。
  54. 根据权利要求48-53任一项所述的装置，其特征在于，所述3GPP网络用户标识包括所述标签设备的用户隐藏标识SUCI或用户永久标识SUPI。
  55. 一种通信装置，其特征在于，包括：
    处理单元，用于判断标签设备是否通过安全认证；
    通信单元，用于在所述处理单元确定所述标签设备通过安全认证后，向读写器设备发送操作指令；所述操作指令用于指示所述读写器设备执行与标签设备之间的通信操作。
  56. 根据权利要求55所述的装置，其特征在于，所述处理单元具体用于，若根据所述 标签设备的标识从认证设备获取所述标签设备的标识对应的第三代合作伙伴计划3GPP网络用户标识，则确定所述标签设备通过安全认证。
  57. 根据权利要求56所述的装置，其特征在于，所述通信单元还用于，在所述处理单元确定所述标签设备通过安全认证之前，向接入移动管理网元发送以下至少一项：协议参数、通信参数以及接入参数；
    其中，所述协议参数用于指示所述读写器设备与所述标签设备之间的通信协议和/或所述读写器设备与标签汇聚网元之间的通信协议；所述通信参数用于支持所述读写器设备配置与所述标签设备之间进行通信所用的数据传输速率和/或解码方式；所述接入参数用于所述读写器设备配置标签设备接入事件的规则；所述标签设备接入事件的规则包括以下至少一项：所述标签设备接入事件的触发时间、所述标签设备接入事件的周期或所述标签设备接入事件对应的标签设备数量。
  58. 根据权利要求57所述的装置，其特征在于，所述通信单元还用于，向所述接入移动管理网元发送第三消息，所述第三消息用于向所述接入移动管理网元订阅与标签设备相关的消息。
  59. 根据权利要求58所述的装置，其特征在于，所述第三消息包括消息类型，所述消息类型指示所述与标签设备相关的消息。
  60. 根据权利要求55所述的装置，其特征在于，所述处理单元具体用于，若根据所述标签设备的标识从认证设备未获取所述标签设备的标识对应的3GPP网络用户标识，则确定所述标签设备未通过安全认证。
  61. 根据权利要求60所述的装置，其特征在于，所述通信单元还用于，在所述处理单元确定所述标签设备未通过安全认证之后，向接入移动管理网元发送以下至少一项：通信协议参数、设备运行参数以及接入参数；
    其中，所述通信协议参数用于指示所述读写器设备与所述标签设备之间的通信协议和/或所述读写器设备与所述标签汇聚网元之间的通信协议；所述设备运行参数用于支持所述读写器设备配置与所述标签设备相关的功能；所述接入参数用于支持所述读写器设备配置所述标签设备接入所述读写器设备的规则。
  62. 根据权利要求60或61所述的装置，其特征在于，所述通信单元还用于，向所述接入移动管理网元发送第三消息，所述第三消息用于向所述接入移动管理网元订阅与标签设备相关的消息。
  63. 根据权利要求62所述的装置，其特征在于，所述第三消息包括消息类型，所述消息类型指示所述与标签设备相关的消息。
  64. 根据权利要求55-63任一项所述的装置，其特征在于，所述标签设备的标识包括所述标签设备的无线访问控制MAC地址或所述标签设备的秘密标识SID或所述标签设备的电子产品码EPC。
  65. 根据权利要求55-64任一项所述的装置，其特征在于，所述3GPP网络用户标识包括所述标签设备的用户隐藏标识SUCI或用户永久标识SUPI。
  66. 一种通信装置，其特征在于，包括：
    通信单元，用于在接收标签触发信号后，发送核心网交互消息；所述核心网交互消息用于标签设备与核心网网元进行消息交互。
  67. 根据权利要求66所述的装置，其特征在于，所述核心网交互消息包括以下任意一项：
    注册消息；或者，
    去注册消息；或者，
    会话建立请求消息；或者，
    会话修改请求消息；或者，
    会话删除请求消息；或者，
    服务请求消息；或者，
    标签数据发送消息；
    所述注册消息用于在核心网注册标签；所述去注册消息用于在核心网去注册标签；所述会话建立请求消息用于为标签建立会话；所述会话修改请求消息用于为标签修改会话；所述会话删除请求消息用于为标签删除会话；所述服务请求消息用于为标签请求服务；所述标签数据发送消息用于发送标签数据。
  68. 根据权利要求66或67所述的装置，其特征在于，
    所述标签触发信号用于触发盘存过程；或者，
    所述标签触发信号用于触发标签访问过程；或者，
    所述标签触发信号用于触发标签认证过程；或者，
    所述标签触发信号用于触发标签锁定过程；或者，
    所述标签触发信号用于触发标签失效过程；或者，
    所述标签触发信号用于唤醒标签设备；
    所述盘存过程是获取标签标识的过程；所述标签访问过程是对所述标签设备进行读操作或者写操作的过程；所述标签认证过程是对所述标签设备进行认证的过程；所述标签锁定过程是对所述标签设备进行锁定的过程；所述标签失效过程是使所述标签设备失效的过程；所述唤醒标签设备是唤醒所述标签设备的过程。
  69. 根据权利要求66-68任一项所述的装置，其特征在于，所述通信单元，还用于接收过滤信息，如果匹配所述过滤信息，发送所述核心网交互消息。
  70. 根据权利要求66-69任一项所述的装置，其特征在于，所述核心网交互消息携带标签标识或者会话标识；所述标签标识或者所述会话标识由盘存过程或者标签访问过程获得；所述盘存过程是获取所述标签标识的过程；所述标签访问过程是对所述标签设备进行读操作或者写操作的过程。
  71. 根据权利要求66-70任一项所述的装置，其特征在于，所述标签触发信号为以下任意一项：选择Select命令、挑战Challenge命令、查询Query命令、读Read命令、写Write命令、失效Kill命令、锁定Lock命令、唤醒命令。
  72. 根据权利要求66-71任一项所述的装置，其特征在于，所述核心网交互消息是非接入层NAS消息。
  73. 一种通信装置，其特征在于，包括处理器，所述处理器与存储器耦合；
    存储器，用于存储计算机程序；
    处理器，用于执行所述存储器中存储的计算机程序，以使得所述装置执行如权利要求1至36中任一项所述的方法。
  74. 一种计算机可读存储介质，包括程序或指令，当所述程序或指令被处理器运行时，如权利要求1至36中任意一项所述的方法被执行。
  75. 一种计算机程序产品，其特征在于，所述计算机程序产品包括指令，当所述指令被运行时，使得如权利要求1至36任一项所述的方法被执行。
  76. 一种芯片，其特征在于，所述芯片包括处理器和接口电路，所述接口电路和所述处理器耦合，所述处理器用于运行计算机程序或指令，使得如权利要求1至36任一项所述的方法被执行。
  77. 一种通信系统，其特征在于，包括如权利要求37-47中任一所述的通信装置，如权利要求48-54中任一所述的通信装置，如权利要求55-65中任一所述的通信装置，和如权利要求66-72中任一所述的通信装置。
PCT/CN2021/116801 2020-12-31 2021-09-06 一种鉴权方法及通信装置 WO2022142446A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP21913193.5A EP4258718A1 (en) 2020-12-31 2021-09-06 Authentication method and communication apparatus
CN202180086463.2A CN116686314A (zh) 2020-12-31 2021-09-06 一种鉴权方法及通信装置
KR1020237025838A KR20230125301A (ko) 2020-12-31 2021-09-06 인증 방법 및 통신 장치
US18/344,158 US20230345243A1 (en) 2020-12-31 2023-06-29 Authentication method and communication apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
PCT/CN2020/142560 WO2022141600A1 (zh) 2020-12-31 2020-12-31 一种鉴权方法及通信装置
CNPCT/CN2020/142560 2020-12-31

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/344,158 Continuation US20230345243A1 (en) 2020-12-31 2023-06-29 Authentication method and communication apparatus

Publications (1)

Publication Number Publication Date
WO2022142446A1 true WO2022142446A1 (zh) 2022-07-07

Family

ID=82258943

Family Applications (2)

Application Number Title Priority Date Filing Date
PCT/CN2020/142560 WO2022141600A1 (zh) 2020-12-31 2020-12-31 一种鉴权方法及通信装置
PCT/CN2021/116801 WO2022142446A1 (zh) 2020-12-31 2021-09-06 一种鉴权方法及通信装置

Family Applications Before (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/142560 WO2022141600A1 (zh) 2020-12-31 2020-12-31 一种鉴权方法及通信装置

Country Status (5)

Country Link
US (1) US20230345243A1 (zh)
EP (1) EP4258718A1 (zh)
KR (1) KR20230125301A (zh)
CN (1) CN116686314A (zh)
WO (2) WO2022141600A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024027475A1 (zh) * 2022-08-04 2024-02-08 华为技术有限公司 一种通信方法及装置
WO2024066417A1 (zh) * 2022-09-26 2024-04-04 华为技术有限公司 管理标签状态的方法和通信装置
WO2024065698A1 (zh) * 2022-09-30 2024-04-04 Oppo广东移动通信有限公司 通信方法、装置、设备、存储介质、芯片、产品及程序

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117979373A (zh) * 2022-10-25 2024-05-03 华为技术有限公司 通信方法、系统、存储介质和程序产品

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101641939A (zh) * 2007-02-23 2010-02-03 西门子公司 用于为认证服务器提供rfid标识数据的装置和方法
US20130107806A1 (en) * 2011-10-31 2013-05-02 Samsung Electronics Co., Ltd. Apparatus and method for configuring access in a wireless network
CN103093170A (zh) * 2013-01-16 2013-05-08 深圳市中兴长天信息技术有限公司 一种电子标签快速识别的方法及装置
CN103729661A (zh) * 2012-10-15 2014-04-16 成都西谷曙光数字技术有限公司 一种超低功耗有源电子标签读写系统和方法
CN107124282A (zh) * 2017-05-18 2017-09-01 西安电子科技大学 基于MIPv6的云环境下RFID认证系统及方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107547472A (zh) * 2016-06-27 2018-01-05 中国电信股份有限公司 基于rfid实现身份认证的方法、用户终端和系统
CN107231231B (zh) * 2017-06-16 2020-09-25 深圳市盛路物联通讯技术有限公司 一种终端设备安全接入物联网的方法及系统
CN109309916A (zh) * 2017-07-28 2019-02-05 颜馨 一种rfid数据传输与认证系统及方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101641939A (zh) * 2007-02-23 2010-02-03 西门子公司 用于为认证服务器提供rfid标识数据的装置和方法
US20130107806A1 (en) * 2011-10-31 2013-05-02 Samsung Electronics Co., Ltd. Apparatus and method for configuring access in a wireless network
CN103729661A (zh) * 2012-10-15 2014-04-16 成都西谷曙光数字技术有限公司 一种超低功耗有源电子标签读写系统和方法
CN103093170A (zh) * 2013-01-16 2013-05-08 深圳市中兴长天信息技术有限公司 一种电子标签快速识别的方法及装置
CN107124282A (zh) * 2017-05-18 2017-09-01 西安电子科技大学 基于MIPv6的云环境下RFID认证系统及方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
3GPP TS 33.501

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024027475A1 (zh) * 2022-08-04 2024-02-08 华为技术有限公司 一种通信方法及装置
WO2024066417A1 (zh) * 2022-09-26 2024-04-04 华为技术有限公司 管理标签状态的方法和通信装置
WO2024065698A1 (zh) * 2022-09-30 2024-04-04 Oppo广东移动通信有限公司 通信方法、装置、设备、存储介质、芯片、产品及程序

Also Published As

Publication number Publication date
EP4258718A1 (en) 2023-10-11
US20230345243A1 (en) 2023-10-26
WO2022141600A1 (zh) 2022-07-07
CN116686314A (zh) 2023-09-01
KR20230125301A (ko) 2023-08-29

Similar Documents

Publication Publication Date Title
WO2022142446A1 (zh) 一种鉴权方法及通信装置
CN104205667B (zh) 用于触发多个无线设备的技术和配置
US10075992B2 (en) Techniques to enable Wi-Fi direct services application service platform capability negotiation
US10194476B2 (en) Wi-Fi direct services mechanisms for wireless gigabit display extension
US20220394471A1 (en) Method for automatically accessing wireless local area network by internet of things device, and apparatus
US20230337002A1 (en) Security context generation method and apparatus, and computer-readable storage medium
US20210051477A1 (en) Apparatus and method for access control, management, and protection in wireless communication system
CN114071510A (zh) 一种通信方法及装置
US20240098145A1 (en) Packet transmission method and related apparatus
WO2021233340A1 (zh) 网络注册的方法和装置
US20230179342A1 (en) Method and apparatus for physical downlink shared channel (pdsch) hybrid automatic repeat request (harq)-acknowledgement (ack) feedback in wireless communication
US20220225463A1 (en) Communications method, apparatus, and system
US20230048268A1 (en) Authentication event processing method, apparatus, and system
US11363561B2 (en) Method and apparatus for reporting information by terminal, and computer storage medium
CN114629627A (zh) 一种认证方法及装置
WO2020086542A1 (en) Technologies for performance data streaming
WO2024055697A1 (zh) 通信方法和装置
WO2024067047A1 (zh) 一种通信方法及装置
WO2022022639A1 (zh) 一种通信方法及装置
WO2024001241A1 (zh) 一种信息写入方法及装置
WO2024055871A1 (zh) 一种通信系统中传输数据的方法和通信装置
US20240147233A1 (en) System for and method of deauthentication or disassociation for a connection
TWI815311B (zh) 增強使用者設備（ｕｅ）對ｕｅ路由選擇策略（ｕｒｓｐ）規則選擇的處理的方法及使用者設備
WO2023116556A1 (zh) 会话切换的方法和装置
WO2023246457A1 (zh) 安全决策协商方法及网元

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21913193

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 202180086463.2

Country of ref document: CN

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112023013265

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 2021913193

Country of ref document: EP

Effective date: 20230706

ENP Entry into the national phase

Ref document number: 20237025838

Country of ref document: KR

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 112023013265

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20230630