WO2022171156A1 - 配置演进分组系统非接入层安全算法的方法及相关装置 - Google Patents

配置演进分组系统非接入层安全算法的方法及相关装置 Download PDF

Info

Publication number
WO2022171156A1
WO2022171156A1 PCT/CN2022/075767 CN2022075767W WO2022171156A1 WO 2022171156 A1 WO2022171156 A1 WO 2022171156A1 CN 2022075767 W CN2022075767 W CN 2022075767W WO 2022171156 A1 WO2022171156 A1 WO 2022171156A1
Authority
WO
WIPO (PCT)
Prior art keywords
nas security
terminal device
access
security algorithm
message
Prior art date
Application number
PCT/CN2022/075767
Other languages
English (en)
French (fr)
Inventor
胡先鸽
杨林平
胡文
强鹂
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP22752316.4A priority Critical patent/EP4290903A1/en
Priority to JP2023548586A priority patent/JP2024506102A/ja
Publication of WO2022171156A1 publication Critical patent/WO2022171156A1/zh
Priority to US18/232,227 priority patent/US20230388802A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/37—Managing security policies for mobile devices or for controlling mobile applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H04W36/0033—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information
    • H04W36/0038—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information of security context information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a method and related apparatus for configuring an evolved packet system (EPS) non-access stratum (non-access stratum, NAS) security algorithm.
  • EPS evolved packet system
  • NAS non-access stratum
  • the registration process of the UE includes two security mode commands (security mode commands, SMC) process.
  • the first SMC process is normal and the second SMC is abnormal, which will result in no EPS NAS security algorithm in the UE after successful registration. Therefore, how to ensure that EPS NAS security is successfully configured for the UE Algorithms have become an urgent problem to be solved.
  • the present application provides a method and related apparatus for configuring an EPS NAS security algorithm, which ensures that the access and mobility management functional entity can successfully configure the EPS NAS security algorithm for a terminal device.
  • the present application provides a method for configuring an EPS NAS security algorithm, the method comprising: an access and mobility management function entity determines that the selected EPS NAS security algorithm is not successfully provided for a terminal device; The management function entity provides the selected EPS NAS security algorithm to the terminal device.
  • the access and mobility management function entity fails to provide the selected EPS NAS security algorithm for the terminal device, it re-provides the selected EPS NAS security algorithm to the terminal device, which can ensure the access and mobility management functions.
  • the entity is able to successfully configure the selected EPS NAS security algorithm for the end device.
  • the method further includes: the access and mobility management function entity sends a message to the terminal device.
  • the terminal device sends a first message, and the first message includes the information element of the selected EPS NAS security algorithm.
  • the access and mobility management function entity determining that the selected EPS NAS security algorithm is not successfully provided for the terminal device includes: determining that the access and mobility management function entity has not received the first complete message, the first completion message is used to indicate that the terminal device has received the first message.
  • the access and mobility management function entity determining that the first completion message has not been received includes: the access and mobility management function entity determining that the first completion message has not been received within a preset time. Done message.
  • the access and mobility management functional entity determines that the selected EPS NAS security algorithm has not been successfully provided for the terminal device by not receiving the first completion message within the preset time, thereby improving the access and mobility management functional entity. Determines the accuracy with which the selected EPS NAS security algorithm has not been successfully provided to the end device.
  • the first message is a security mode command SMC message
  • the first completion message is an SMC completion message
  • the method includes: the access and mobility management functional entity marking the selected EPS NAS security algorithm as invalid.
  • the access and mobility management function entity marks the selected EPS NAS security algorithm as invalid after determining that the selected EPS NAS security algorithm is not successfully provided for the terminal device.
  • the access and mobility management function entity can re-provide the selected EPS NAS security algorithm for the terminal device according to the marked information that the selected EPS NAS security algorithm is invalid, which ensures that the access and mobility management function entity can successfully provide the terminal device with the selected EPS NAS security algorithm.
  • the selected EPS NAS security algorithm is re-provide the selected EPS NAS security algorithm for the terminal device according to the marked information that the selected EPS NAS security algorithm is invalid, which ensures that the access and mobility management function entity can successfully provide the terminal device with the selected EPS NAS security algorithm.
  • the method further includes: the access and mobility management functional entity A registration request message from the terminal device is received.
  • the method further includes: the access and mobility management function entity determines to update the selected EPS NAS security algorithm; the access and mobility management function entity provides the update to the terminal device After the selected EPS NAS security algorithm.
  • the method further includes: determining that the access and mobility management functional entity fails to provide the terminal device with the updated selected EPS NAS security algorithm; The management function entity provides the updated selected EPS NAS security algorithm to the terminal device.
  • the access and mobility management functional entity provides the terminal device with the updated selected EPS NAS security algorithm after determining that the updated selected EPS NAS security algorithm has not been successfully provided to the terminal device, thereby ensuring the access to the terminal device.
  • the access and mobility management functional entity can successfully configure the updated selected EPS NAS security algorithm for the terminal device, so that the EPS NAS security algorithm in the terminal device is consistent with the updated selected EPS NAS security algorithm determined by the access and mobility management functional entity. Consistent.
  • the access and mobility management functional entity supports the N26 interface, and the terminal device supports the S1 mode.
  • a valid fifth-generation mobile communication 5G NAS security context indicated by the terminal device exists in the access and mobility management functional entity.
  • the present application provides a method for configuring an EPS NAS security algorithm, the method comprising: determining by a terminal device that a selected EPS NAS security algorithm corresponding to a fifth-generation mobile communication 5G NAS security context does not exist; Delete the 5G NAS security context; the terminal device sends a second message to the access and mobility management function entity, where the second message is used to request the 5G NAS security context; the terminal device receives information from the access and mobility management function entity and the selected EPS NAS security algorithm information element of the mobility management function entity.
  • the 5G NAS security context in the case where the 5G NAS security context already exists in the terminal device, first determine whether the corresponding selected EPS NAS security algorithm exists in the 5G NAS security context of the terminal device, if the terminal device determines that the 5G NAS security context does not exist If the corresponding selected EPS NAS security algorithm exists, the 5G NAS security context is deleted, and the 5G NAS security context is re-requested to the access and mobility management functional entity, and the access and mobility management functional entity sends the 5G NAS security context to the terminal device again. and the corresponding selected EPS NAS security algorithm information element, which ensures that the terminal device can successfully configure the EPS NAS security algorithm.
  • the determining by the terminal device that the selected EPS NAS security algorithm corresponding to the 5G NAS security context does not exist includes: determining, by the terminal device, that it has not received all the information from the access and mobility management functional entity. The cell of the selected EPS NAS security algorithm.
  • determining that the terminal device has not received the information element of the selected EPS NAS security algorithm from the access and mobility management functional entity includes: the terminal device has not received the information element within a preset time to the selected EPS NAS security algorithm information element from the access and mobility management functional entity.
  • the selected EPS corresponding to the 5G NAS security context does not exist in the terminal device by not receiving the information element of the selected EPS NAS security algorithm from the access and mobility management functional entity within the preset time.
  • the NAS security algorithm improves the accuracy of the selected EPS NAS security algorithm for the terminal device to determine that there is no 5G NAS security context corresponding to it.
  • the method further includes: the terminal device receives the access and mobility management function The third message sent by the entity, the third message includes the 5G NAS security context; the terminal device sends a third completion message to the access and mobility management function entity, and the third completion message is used to indicate that the The terminal device has received the third message.
  • the terminal device activates the 5G NAS security context by receiving the third message that is sent by the access and mobility management function entity and carries the 5G NAS security context, and sends the third completion message to the access and mobility management function entity, It is ensured that the terminal device successfully activates the 5G NAS security context.
  • the terminal device determining that the selected EPS NAS security algorithm corresponding to the 5G NAS security context does not exist includes: determining that the next generation radio access network key set identifier ngKSI does not correspond to the selected EPS NAS security algorithm.
  • the selected EPS NAS security algorithm corresponding to the 5G NAS security context does not exist in the terminal device by determining that the next-generation radio access network key set identifier ngKSI does not have a corresponding selected EPS NAS security algorithm, thereby improving the The accuracy of the selected EPS NAS security algorithm corresponding to the terminal device's determination that there is no 5G NAS security context.
  • the method further includes: the terminal device sets the ngKSI to an invalid value.
  • the terminal device when the terminal device determines that the selected EPS NAS security algorithm corresponding to the 5G NAS security context does not exist, the terminal device sets the ngKSI to an invalid value, so as to report to the access and mobility management function entity in the next registration request Re-request 5G NAS security context.
  • the terminal device is disconnected from the Long Term Evolution LTE system, and the second message is used to request registration to the new wireless NR system.
  • the terminal device determines that the access and mobility management functional entity supports the N26 interface.
  • the access and mobility management functional entity supports the N26 interface, and the terminal device supports the S1 mode.
  • the present application provides an apparatus for configuring an EPS NAS security algorithm.
  • the apparatus may include various modules for implementing the method in the first aspect, and these modules may be implemented in software and/or hardware.
  • the present application provides an apparatus for configuring an EPS NAS security algorithm
  • the apparatus may include various modules for implementing the method in the second aspect, and these modules may be implemented in software and/or hardware.
  • the present application provides an apparatus for configuring an EPS NAS security algorithm.
  • the apparatus may include a processor coupled to the memory.
  • the memory is used for storing program codes
  • the processor is used for executing the program codes in the memory, so as to implement the method in the first aspect or the second aspect or any one of the implementation manners thereof.
  • the apparatus may also include the memory.
  • the present application provides a chip, comprising at least one processor and a communication interface, wherein the communication interface and the at least one processor are interconnected through a line, and the at least one processor is configured to run a computer program or instruction to execute The method according to the first aspect or the second aspect or any one of the possible implementations thereof.
  • the present application provides a computer-readable medium, the computer-readable medium stores program code for device execution, and the program code includes a computer-readable medium for executing the first aspect or the second aspect or any one of them. implement the method described.
  • the present application provides a computer program product comprising instructions, which, when the computer program product is run on a computer, causes the computer to execute the method described in the first aspect or the second aspect or any one of the possible implementations thereof. method.
  • the present application provides an access and mobility management functional entity, comprising at least one processor and a communication interface, the communication interface and the at least one processor are interconnected through a line, and the communication interface communicates with a target system,
  • the at least one processor is configured to run a computer program or instructions to perform the method according to the first aspect or any one of the possible implementations.
  • the present application provides a terminal device, comprising at least one processor and a communication interface, the communication interface and the at least one processor are interconnected through a line, the communication interface communicates with a target system, and the at least one processor
  • the computer is used to run a computer program or instructions to perform the method as described in the second aspect or any one of the possible implementations thereof.
  • the present application provides a communication system, comprising at least one processor and a communication interface, the communication interface and the at least one processor are interconnected through a line, the communication interface communicates with a target system, the at least one The processor is used to run a computer program or instructions to perform the method as described in the first aspect or the second aspect or any of the possible implementations thereof.
  • FIG. 1 is a schematic diagram of a 5G network architecture according to an embodiment of the present application.
  • FIG. 2 is a schematic diagram of another 5G network architecture according to an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of a method for configuring an EPS NAS security algorithm according to an embodiment of the present application
  • FIG. 4 is a schematic flowchart of a method for configuring an EPS NAS security algorithm according to an embodiment of the present application
  • FIG. 5 is a schematic flowchart of a method for configuring an EPS NAS security algorithm according to another embodiment of the present application.
  • FIG. 6 is a schematic flowchart of another method for configuring an EPS NAS security algorithm according to an embodiment of the present application
  • FIG. 7 is a schematic flowchart of a method for configuring an EPS NAS security algorithm according to another embodiment of the present application.
  • FIG. 8 is a schematic flowchart of a method for configuring an EPS NAS security algorithm according to another embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of an apparatus for configuring an EPS NAS security algorithm according to an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of an apparatus for configuring an EPS NAS security algorithm according to another embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of an apparatus for configuring an EPS NAS security algorithm according to another embodiment of the present application.
  • FIG. 1 is a schematic diagram of a 5G network architecture according to an embodiment of the present application, and a 5G system is also referred to as a new wireless communication system, a new access technology (new radio, NR) or a next-generation mobile communication system.
  • a 5G system is also referred to as a new wireless communication system, a new access technology (new radio, NR) or a next-generation mobile communication system.
  • new wireless communication system new access technology (new radio, NR) or a next-generation mobile communication system.
  • NR new access technology
  • the network architecture includes UE, access network (AN), core network and data network (DN).
  • the access network is mainly used to implement functions such as wireless physical layer functions, resource scheduling and wireless resource management, wireless access control and mobility management;
  • the core network may include management equipment and gateway equipment, and the management equipment is mainly used for terminal equipment. Device registration, security authentication, mobility management and location management, etc.
  • the gateway device is mainly used to establish a channel with the terminal device, and forward the data packets between the terminal device and the external data network on the channel;
  • the data network can include network devices ( Such as: servers, routers and other equipment), the data network is mainly used to provide a variety of data business services for terminal equipment.
  • FIG. 1 is only an exemplary architecture diagram.
  • the network architecture may further include other functional units, which are not limited in this embodiment of the present application.
  • the access network in the 5G system can be a radio access network (R)AN, and the (R)AN device in the 5G system can be composed of multiple 5G-(R)AN nodes.
  • the R)AN node may include: a non-3GPP access network such as an access point (AP) of a WiFi network, a next-generation base station (which may be collectively referred to as a new-generation radio access network node NG-RAN node), wherein the following
  • the first-generation base station includes a new air interface base station (NR nodeB, gNB), a new generation of evolved base station (NG-eNB), a central unit (CU) and a distributed unit (distributed unit, DU) separate form gNB, etc.), transceiver point (transmission receive point, TRP), transmission point (transmission point, TP) or other nodes.
  • NR nodeB new air interface base station
  • NG-eNB new generation of evolved base station
  • CU central unit
  • DU distributed
  • the core network may include access and mobility management function (AMF) network elements, session management function (session management function, SMF) network elements, user plane functions (user plane functions, UPF) network element, authentication server function (AUSF) network element, policy control function (PCF) network element, application function (AF) network element, unified data management function (unified data) management, UDM) network element, network slice selection function (network slice selection function, NSSF) network element and other functional units.
  • AMF access and mobility management function
  • SMF session management function
  • UPF user plane functions
  • AUSF authentication server function
  • PCF policy control function
  • AF application function
  • UDM network slice selection function
  • NSSF network slice selection function
  • the AMF network element is mainly responsible for services such as mobility management and access management.
  • the SMF network element is mainly responsible for session management, UE address management and allocation, dynamic host configuration protocol function, and user plane function selection and control.
  • UPF is mainly responsible for external connection to the data network (DN) and data packet routing and forwarding on the user plane, packet filtering, and performing quality of service (QoS) control related functions.
  • AUSF is mainly responsible for the authentication function of terminal equipment.
  • the PCF network element is mainly responsible for providing a unified policy framework for network behavior management, providing policy rules for control plane functions, and acquiring registration information related to policy decisions. It should be noted that these functional units can work independently, or can be combined to implement certain control functions, such as access control and mobility management functions such as access authentication, security encryption, location registration, etc. Session management functions such as establishment, release, and modification of plane transmission paths.
  • the functional units in the 5G network can communicate through the next generation network (NG) interface.
  • the UE can transmit control plane messages with the AMF network element through the NG interface 1 (N1 for short).
  • NG interface 3 (N3 for short) establishes a user plane data transmission channel with UPF
  • AN/RAN equipment can establish a control plane signaling connection with AMF network elements through NG interface 2 (N2 for short)
  • UPF can use NG interface 4 (N4 for short) Exchange information with SMF network elements.
  • UPF can exchange user plane data with data network DN through NG interface 6 (N6 for short), AMF network elements can exchange information with SMF network elements through NG interface 11 (N11 for short), SMF network elements
  • the NG interface 7 (N7 for short) can exchange information with the PCF network element, and the AMF network element can exchange information with the AUSF through the NG interface 12 (N12 for short).
  • the network architecture shown in FIG. 1 is a reference point-based network architecture, and the network architecture is a network architecture in a non-roaming scenario.
  • the method of the present application can also be applied in a roaming scenario, and the network architecture is not limited to a reference point-based network. architecture, or a network architecture based on service-oriented interfaces.
  • FIG. 2 is a schematic diagram of a 5G network architecture according to another embodiment of the present application.
  • the network architecture is mainly a network architecture based on service-oriented interfaces.
  • the core network also includes NEF and NRF network elements.
  • AUSF network elements In the scenario based on service-oriented interfaces, some network elements in the core network are connected through a bus.
  • the SMF network element is connected to the bus through the Nsmf interface
  • the AF network element is connected to the bus through the NAF network element interface
  • the UDM network element is connected to the bus through the Nudm interface
  • the PCF network element is connected to the bus through the NPCF network element interface
  • the NRF network element is connected to the bus through the NPCF network element interface.
  • the UE registration process may include two SMC processes.
  • the first SMC process is normal and the second SMC is abnormal.
  • the network may not re-execute the second SMC process.
  • the configuration information of the EPS NAS security algorithm is issued by the network to the UE in the second SMC process, which will cause the UE to have no EPS NAS security algorithm after the registration is successful, which will cause the UE to switch to long-term evolution (long term evolution). evolution, LTE), problems such as handover failure, service interruption and/or service function discontinuity may occur.
  • the present application proposes a new technical solution.
  • the technical solution proposed in this application can ensure that the access and mobility management functional entity can successfully configure the EPS NAS security algorithm for the terminal device.
  • FIG. 3 is a schematic flowchart of a method for configuring an EPS NAS security algorithm according to an embodiment of the present application. As shown in FIG. 3 , the method includes at least S301 to S302.
  • the access and mobility management function entity determines that the selected EPS NAS security algorithm is not successfully provided for the terminal device.
  • the EPS NAS security algorithm selected by the access and mobility management functional entity for the terminal device may be selected by the access and mobility management functional entity for the terminal device in a scenario where the terminal device does not have a valid EPS NAS security algorithm EPS NAS security algorithm; alternatively, the access and mobility management functional entity provides the selected EPS NAS security algorithm for the terminal device.
  • the access and mobility management functional entity is the terminal device. Device-reselected EPS NAS security algorithm.
  • An implementation manner for the access and mobility management functional entity to provide the selected EPS NAS security algorithm for the terminal device is: the access and mobility management functional entity sends a first message to the terminal device, and the first message includes the access and mobility management function
  • the entity is the information element (IE) of the EPS NAS security algorithm selected by the terminal device.
  • An example of the first message is an SMC message.
  • the information element of the NAS security algorithm in this embodiment may indicate the algorithm used for encryption and integrity protection
  • the information element of the EPS NAS security algorithm may indicate the algorithm used for encryption and integrity protection in EPS.
  • the information element in this embodiment can also be replaced with information.
  • the information element may be the selected EPS NAS security algorithm itself, or may be information used to indicate the selected EPS NAS security algorithm, for example, may be a valid value used to indicate the selected EPS NAS security algorithm.
  • the specific form of the information element in this embodiment may be bits.
  • an example where the access and mobility management function entity determines that the selected EPS NAS security algorithm is not successfully provided for the terminal device includes: the access and mobility management function entity determines that the first completion from the terminal device is not received.
  • the first completion message is used to indicate that the terminal device has received the information element of the EPS NAS security algorithm selected by the access and mobility management function entity for it.
  • the access and mobility management function entity does not receive the first completion message from the terminal device within a preset time period, it may be determined that the selected EPS NAS is not successfully provided for the terminal device.
  • An example of the first completion message is an SMC completion message.
  • Another example where the access and mobility management function entity determines that the selected EPS NAS security algorithm is not successfully provided to the terminal device includes: the terminal device does not receive the first message from the access and mobility management function entity within a preset time. , then send a first indication message to the access and mobility management function entity, where the first indication message is used to indicate that the terminal device has not successfully received the message of the information element of the EPS NAS security algorithm; the access and mobility management function entity receives the first indication After the message, it is determined that the selected EPS NAS security algorithm was not successfully provided to the terminal device.
  • the access and mobility management functional entity supports the N26 interface
  • the terminal device supports the S1 mode.
  • the N26 interface is the interface between the 4th generation (4th generation, 4G) core network and the 5G core network, that is, the interface between the mobility management entity (MME) network element and the AMF network element, For 4G and 5G interoperability.
  • MME mobility management entity
  • the access and mobility management function entity may receive a Registration Request (Registration Request) message from the terminal device.
  • Registration Request Registration Request
  • the access and mobility management function entity After the access and mobility management function entity receives the registration request message from the terminal device, in response to the registration request message, it can determine whether there is a valid 5G NAS security context indicated by the terminal device on the access and mobility management function entity; if If it exists, it is further judged whether the access and mobility management functional entity has successfully provided the selected EPS NAS security algorithm to the terminal device; if it does not exist, the SMC process is issued to the terminal device to activate the effective 5G NAS security indicated by the terminal device. context.
  • the access and mobility management function entity supports the N26 interface.
  • the entity sends the first SMC process to the terminal device, it can also send the SMC process to the terminal device again and carry the EPS NAS security algorithm selected for the terminal device; there is no indication of the terminal device on the access and mobility management function entity.
  • the access and mobility management functional entity will issue the first SMC process to the terminal device after the , it is not necessary to re-deliver the SMC process to the terminal device and carry the information element of the EPS NAS security algorithm selected for the terminal device.
  • the access and mobility management function entity determines that the selected EPS NAS security algorithm has not been successfully provided for the terminal device, it can mark the marking information of the unsuccessful configuration of the selected EPS NAS security algorithm for the terminal device. .
  • the access and mobility management function entity may be an AMF network element in a 5G network, or a network element with access and mobility management functions in a 6G network.
  • the access and mobility management functional entity provides the selected EPS NAS security algorithm to the terminal device.
  • the access and mobility management function entity determines that the selected EPS NAS security algorithm is not successfully provided for the terminal device, the selected EPS NAS security algorithm is re-provided to the terminal device.
  • the access and mobility management function entity may determine that it is unsuccessful
  • the selected EPS NAS security algorithm is provided to the end device, so the first message is resent to the end device.
  • the access and mobility management function entity may determine that there is no The selected EPS NAS security algorithm is successfully provided for the terminal device, and the selected EPS NAS security algorithm is marked as an invalid value, and then after the access and mobility management function entity receives the registration request message from the terminal device, the access In the case where a valid 5G security context of the terminal device exists on the mobile management function entity, the first message is resent to the terminal device because the selected EPS NAS security algorithm is marked as an invalid value.
  • the access and mobility management function entity updates the selected EPS NAS security algorithm to the terminal device, and when it is determined that the updated EPS NAS security algorithm is not successfully provided for the terminal device, it can generate the selected EPS NAS security algorithm update. indication information; and when receiving an initial access request message (such as a registration request message) from the terminal device, re-provide the updated EPS NAS security algorithm to the terminal device based on the indication information.
  • an initial access request message such as a registration request message
  • the access and mobility management function entity selects the encryption algorithm and the integrity algorithm used in the EPS, and indicates the selected algorithm to the terminal device through the information element of the selected EPS NAS security algorithm, such as by indicating to the terminal
  • the device sends an SMC message, which indicates the selected algorithm to the terminal device by means of the information element of the selected EPS NAS security algorithm.
  • the access and mobility management function entity re-provides the selected EPS NAS security algorithm to the terminal device under the condition that the selected EPS NAS security algorithm is not successfully provided for the terminal device, which can ensure the access and mobility management functional entities are able to successfully configure the selected EPS NAS security algorithm for the terminal device.
  • what the access and mobility management functional entity re-sends is not limited to the EPS NAS security algorithm selected by the access and mobility management functional entity, but may also be the one that supports 5G and/or in the future.
  • the 5G security algorithm obtained by the terminal device of the 6G network when it registers with the 6G network.
  • the 5G security algorithm can be used by the terminal device to subsequently generate the 5G NAS security context.
  • the access and mobility management function entity determines that the NAS security context for the terminal equipment to be subsequently generated by the terminal equipment is not successfully provided, the method for sending the NAS security context to the terminal equipment can be included in this application.
  • the scope of protection of technical solutions can be included in this application.
  • FIG. 4 is a schematic flowchart of a method for configuring an EPS NAS security algorithm according to an embodiment of the present application. As shown in FIG. 4 , the method includes at least S401 to S414. In this embodiment, the access and mobility management functional entity is an AMF network element.
  • the UE sends a registration request message to the AMF network element, where the registration request message carries the value of ngKSI of 7.
  • the registration request message may be referred to as a first registration request message.
  • next generation radio access network key set identifier (key set identifier for next generation radio access network, ngKSI) carried in the first registration request information initiated by the UE to the AMF network element
  • ngKSI next generation radio access network key set identifier for next generation radio access network
  • the AMF network element sends an identity authentication request (identity request) message to the UE.
  • the UE sends an identity authentication response (identity response) message to the AMF network element.
  • the AMF network element sends an authentication request (authentication request) message to the UE.
  • the UE may generate an inactive 5G NAS security context according to the authentication request (authentication request) message.
  • the UE sends an authentication response (authentication response) message to the AMF network element.
  • S402 to S405 are the process of performing identity authentication and authentication authentication between the UE and the AMF network element. After the UE has passed the identity authentication and authentication authentication of the AMF network element, the AMF network element will perform the following registration process with the UE.
  • the AMF network element sends an SMC message to the UE, where the SMC message carries a valid value of ngKSI.
  • This SMC message may be referred to as the first SMC message.
  • the AMF network element After the UE passes the identity authentication and authentication authentication of the AMF network element, the AMF network element sends the first SMC message to the UE.
  • the first SMC message carries the valid value of ngKSI, which is used to activate the 5G NAS security context in the UE.
  • a current security context current security context
  • the valid value of ngKSI can be any integer value from 0 to 6, and each integer value corresponds to a set of 5G NAS security contexts.
  • the UE sends an SMC completion message to the AMF network element.
  • This SMC complete message may be referred to as the first SMC complete message.
  • the UE When the UE successfully receives the first SMC message sent by the AMF network element, and successfully activates the 5G NAS security context according to the valid value of ngKSI carried in the first SMC message, it sends the first SMC complete message to the AMF network element, indicating that the UE has The 5G NAS security context corresponding to the valid value of ngKSI is successfully configured.
  • the AMF network element sends an SMC message to the UE, where the SMC message carries the information element of the selected EPS NAS security algorithm. This SMC message is called the second SMC message.
  • the AMF network element When the AMF network element receives the first SMC complete message sent by the UE, it sends a second SMC message to the UE.
  • the second SMC message carries the information element of the selected EPS NAS security algorithm, which is used to configure the selected EPS for the UE.
  • the EPS NAS security algorithm corresponding to the cell of the NAS security algorithm.
  • the information element of the EPS NAS security algorithm can be any integer value from 0 to 7, and each integer value corresponds to an EPS NAS security algorithm.
  • the UE in this embodiment supports the S1 mode, and the AMF network element supports the N26 interface.
  • the AMF network element does not receive the SMC complete message sent by the UE in response to the second SMC message, and marks the selected EPS NAS security algorithm as invalid.
  • This SMC complete message is referred to as the second SMC complete message.
  • the AMF network element After the AMF network element sends the second SMC message to the UE, the AMF network element does not receive the second SMC complete message sent by the UE, which means that the UE has not successfully configured the EPS NAS security algorithm selected by the AMF in the second SMC message.
  • the selected EPS NAS security algorithm corresponding to the cell.
  • the UE does not receive the second SMC message that is sent by the AMF network element and carries the information element of the selected EPS NAS security algorithm.
  • the UE receives the second SMC message that is sent by the AMF network element and carries the information element of the selected EPS NAS security algorithm, but cannot be successfully configured according to the information element of the selected EPS NAS security algorithm The corresponding selected EPS NAS security algorithm.
  • the above S401 to S409 may be referred to as the first registration process; the registration process described below may be referred to as the second registration process.
  • the UE sends a registration request message to the AMF network element, where the registration request message carries a valid value of ngKSI.
  • the registration request message may be referred to as a second registration request message.
  • the UE After the first registration process, the UE has successfully activated the corresponding 5G NAS security context according to the valid value of ngKSI carried by the AMF network element in the first SMC message.
  • the value of the ngKSI carried in the second registration request message is the valid value of the ngKSI corresponding to the 5G NAS security context in the UE. That is to say, the valid value of ngKSI carried by the UE in the second registration request message is the same as the valid value of ngKSI carried by the AMF network element in the first SMC message in the first registration process.
  • the AMF network element checks the second registration request message.
  • the checking of the second registration request message by the AMF network element includes performing an integrity check on the second registration request message and judging whether the AMF network element can successfully decrypt the NAS message container (NAS message container) in the second registration request message.
  • the AMF network element sends an SMC message to the UE, where the SMC message carries the valid value of ngKSI and the information element of the selected EPS NAS security algorithm.
  • This SMC message may be referred to as a third SMC message.
  • the AMF network element checks whether there is a valid EPS NAS security algorithm in the security context corresponding to the ngKSI of the terminal device, and if not, provides the selected EPS NAS security algorithm through the SMC process.
  • the AMF network element because in S409, the AMF network element marks the selected EPS NAS security algorithm corresponding to the ngKSI in the current security context as invalid, the AMF network element sends the third SMC message to the UE.
  • the third SMC message carries the valid value of ngKSI, the valid value of ngKSI carried by the UE in the second registration request information, and the difference between the valid value of ngKSI carried by the AMF network element in the first SMC message in the first registration request process.
  • the valid values are the same; the information element of the selected EPS NAS security algorithm carried in the third SMC message is the same as the information element of the EPS NAS security algorithm carried by the AMF network element in the second SMC message.
  • the information element that carries the selected EPS NAS security algorithm configures the selected EPS NAS security algorithm.
  • the UE sends an SMC completion message to the AMF network element.
  • This SMC complete message may be referred to as a third SMC complete message.
  • the UE After the UE successfully configures the selected EPS NAS security algorithm corresponding to the information element of the selected EPS NAS security algorithm carried by the AMF network element in the third SMC message, the UE sends a third SMC complete message to the AMF network element.
  • the AMF network element sends a registration success message to the UE.
  • the AMF network element After the UE is successfully registered according to the second registration request message, the AMF network element sends a registration success message to the UE.
  • the UE initiates a registration request message to the AMF network element when there is no 5G NAS security context.
  • the UE supports the S1 mode and the network supports the N26 interface, the UE only successfully receives the first registration request during the first registration process.
  • the AMF network element when the AMF network element does not receive the second SMC complete message from the UE, the AMF network marks that the selected EPS NAS security algorithm has not been configured successfully, and initiates a second registration request at the UE
  • the AMF network element provides the UE with the selected EPS NAS security algorithm again according to the information that the selected EPS NAS security algorithm is not configured successfully, which ensures that the AMF network element can successfully configure the selected EPS NAS security algorithm for the UE. algorithm.
  • FIG. 5 is a schematic flowchart of a method for configuring an EPS NAS security algorithm according to another embodiment of the present application. As shown in FIG. 5 , the method includes at least S501 to S507.
  • the access and mobility management functional entity is an AMF network element.
  • the UE sends a service request message or a registration request message to an AMF network element.
  • the service request message may be referred to as a first service request message
  • the registration request message may be referred to as a first registration request message.
  • the UE enters the connected state after triggering the link establishment by sending an initial access procedure message such as a first service request message or a first registration request message to the AMF.
  • the UE has an effective EPS NAS security algorithm.
  • the AMF network element sends an SMC message to the UE, where the SMC message carries the updated information element of the selected EPS NAS security algorithm.
  • This SMC message may be referred to as the first SMC message.
  • the AMF network element will modify the existing EPS NAS security algorithm in the UE, so the AMF network element carries the information element of the updated selected EPS NAS security algorithm to be configured for the UE in the first SMC message sent to the UE. .
  • the AMF network element does not receive the SMC complete message sent by the UE, marks the updated selected EPS NAS security algorithm configuration failure, and releases the link.
  • This SMC complete message may be referred to as the first SMC complete message.
  • the AMF network element does not receive the first SMC complete message, the initial access process such as the service request or registration request will be terminated. At this time, the AMF network element needs to mark the selected EPS NAS security algorithm configuration failure for updating tag information and release link resources.
  • the UE sends a service request message or a registration request message to the AMF network element again.
  • the service request message may be referred to as a second service request message
  • the registration request message may be referred to as a second registration request message.
  • the UE enters the connected state after triggering the link establishment again by sending an initial access procedure message such as a second service request message or a second registration request message to the AMF network element.
  • the AMF network element confirms that the updated selected EPS NAS security algorithm configuration failure identification information exists.
  • the AMF network element When the AMF network element receives the initial access process message such as the second service request message or the second registration request message sent by the UE, it needs to confirm whether there is identification information indicating that the updated selected EPS NAS security algorithm configuration fails. If the updated selected EPS NAS security algorithm configuration failure identification information exists in the AMF network element, the SMC message carrying the updated selected EPS NAS security algorithm information element needs to be sent to the UE again.
  • the AMF network element sends an SMC message to the UE, where the SMC message carries the updated information element of the selected EPS NAS security algorithm.
  • This SMC message may be referred to as a second SMC message.
  • the AMF network element sends a second SMC message to the UE, where the second SMC message carries the information element of the updated selected EPS NAS security algorithm to be configured for the UE.
  • the updated selected EPS NAS security algorithm information element carried in the second SMC message may be the same as the updated selected EPS NAS security algorithm information element carried in the first SMC message, or may be the same as the updated selected EPS NAS security algorithm information element carried in the first SMC message.
  • the information elements of the updated selected EPS NAS security algorithm carried in an SMC message are different.
  • the UE sends an SMC completion message to the AMF network element.
  • This SMC complete message may be referred to as a second SMC complete message.
  • the UE After the UE successfully configures the updated selected EPS NAS security algorithm corresponding to the information element of the updated selected EPS NAS security algorithm carried by the AMF network element in the second SMC message, the UE sends the second SMC complete to the AMF network element. message, the EPS NAS security algorithm in the UE is consistent with the updated selected EPS NAS security algorithm in the AMF network element.
  • the AMF network element wishes to change the EPS NAS security algorithm in the UE.
  • the AMF network element sends the selected EPS NAS carrying the update to the UE.
  • the SMC message of the information element of the security algorithm but when the AMF network element does not receive the reply of the SMC complete message sent by the UE, the AMF network element marks the updated information that the selected EPS NAS security algorithm has not been successfully modified.
  • the AMF network element re-issues the updated SMC message of the information element of the selected EPS NAS security algorithm to the UE according to the marked information indicating that the updated selected EPS NAS security algorithm has not been successfully modified, ensuring that the AMF network
  • the element can successfully configure the updated selected EPS NAS security algorithm for the UE, so that the EPS NAS security algorithm in the UE is consistent with that in the AMF network element.
  • FIG. 6 is a schematic flowchart of another method for configuring an EPS NAS security algorithm according to an embodiment of the present application. As shown in FIG. 6 , the method includes at least S601 to S604.
  • the terminal device determines that the selected EPS NAS security algorithm corresponding to the 5G NAS security context does not exist.
  • the 5G NAS security context already exists in the terminal device, but the selected EPS NAS security algorithm corresponding to the 5G NAS security context does not exist.
  • An implementation method for the terminal device to activate the 5G NAS security context is: after the terminal device sends a registration request message to the access and mobility management function entity; the access and mobility management function entity sends a third message to the terminal device, and the third message includes: 5G NAS security context; after the terminal device receives the third message and successfully activates the 5G NAS security context according to the third message, it sends a third completion message to the access and mobility management function entity.
  • the third completion message is used to indicate that the terminal device has received The third message; after receiving the third completion message from the terminal device, the access and mobility management function entity provides the selected EPS NAS security algorithm to the terminal device.
  • An example of the third message is an SMC message
  • an example of the third completion message is an SMC completion message.
  • an example where the terminal device determines that the selected EPS NAS security algorithm corresponding to the 5G NAS security context does not exist includes: the terminal device determines that the selected EPS NAS security algorithm from the access and mobility management function entity is not received. cell. For example, if the terminal device does not receive the information element of the selected EPS NAS security algorithm from the access and mobility management functional entity within the preset time, it can be determined that the selected EPS NAS security algorithm corresponding to the 5G NAS security context does not exist.
  • the access and mobility management functional entity supports the N26 interface
  • the terminal device supports the S1 mode.
  • Another way for the terminal device to activate the 5G NAS security context is: when the terminal device is connected to the LTE network, it requests registration from the AMF network element in the NR system and completes the registration process. The terminal device activates the 5G NAS security context in the registration process. . After completing the registration process, the terminal device is disconnected from the LTE network, and requests registration from the AMF network element in the NR system again.
  • an example where the terminal device determines that the selected EPS NAS security algorithm corresponding to the 5G NAS security context does not exist includes: there is no corresponding selected EPS NAS security algorithm in the ngKSI of the terminal device, and it can be determined that there is no 5G NAS security algorithm.
  • the selected EPS NAS security algorithm corresponding to the NAS security context includes: there is no corresponding selected EPS NAS security algorithm in the ngKSI of the terminal device, and it can be determined that there is no 5G NAS security algorithm.
  • the selected EPS NAS security algorithm corresponding to the NAS security context includes: there is no corresponding selected EPS NAS security algorithm in the ngKSI of the terminal device, and it can be determined that there is no 5G NAS security algorithm.
  • the terminal device supports the S1 mode, and the terminal device may determine that the AMF network element supports the N26 interface.
  • the terminal device deletes the 5G NAS security context.
  • the terminal device determines that the selected EPS NAS security algorithm corresponding to the 5G NAS security context does not exist, it deletes the activated 5G NAS security context.
  • ngKSI an invalid value, that is, set the value of ngKSI to 7.
  • the terminal device sends a second message to the access and mobility management function entity, where the second message is used to request a 5G NAS security context.
  • the value of ngKSI carried in the second message is 7, and 7 indicates that there is no 5G NAS security context in the terminal device.
  • the access and mobility management function entity after the access and mobility management function entity receives the second message from the terminal device that carries an ngKSI value of 7, the access and mobility management function entity sends a fourth message to the terminal device, in which the fourth message Including a valid value of ngKSI, the valid value of ngKSI can be any integer value from 0 to 6, and each integer value corresponds to a set of 5G NAS security context.
  • the fourth message is an SMC message.
  • the terminal device If the terminal device successfully activates the 5G NAS security context according to the fourth message carrying the valid value of ngKSI sent by the access and mobility management function entity, the terminal device sends a fourth completion message to the access and mobility management function entity, and the fourth The completion message is used to indicate that the terminal device has received the valid value of the ngKSI sent by the access and mobility management function entity, and successfully activated the 5G NAS security context corresponding to the valid value of the ngKSI according to the valid value of the ngKSI.
  • An example of the fourth completion message is an SMC completion message.
  • the message that enables the access and mobility management function entities to know that the 5G NAS security context is provided to the terminal device may be referred to as the second message in this embodiment of the present application.
  • the second message may be a registration request message
  • the access and mobility management function entity may determine whether there is a 5G NAS security context in the terminal device according to the value of ngKSI carried in the registration request message.
  • a value of 7 indicates that there is no 5G NAS security context in the terminal device, and the access and mobility management functional entity needs to provide the terminal device with a 5G NAS security context.
  • the terminal device receives the information element of the selected EPS NAS security algorithm from the access and mobility management functional entity.
  • the terminal device can receive the fifth message sent by the 5G NAS security context, where the fifth message includes the information element of the selected EPS NAS security algorithm determined by the 5G NAS security context,
  • the information element of the selected EPS NAS security algorithm can be any integer value from 0 to 7, and each integer value corresponds to a selected EPS NAS security algorithm.
  • An example of the fifth message is an SMC message.
  • the 5G NAS security context in the case where the 5G NAS security context already exists in the terminal device, it is first determined whether the corresponding selected EPS NAS security algorithm exists in the 5G NAS security context of the terminal device. If the corresponding selected EPS NAS security algorithm does not exist in the security context, delete the 5G NAS security context, re-request the 5G NAS security context from the access and mobility management function entity, and the access and mobility management function entity sends the terminal device again.
  • the 5G NAS security context and the corresponding cells of the selected EPS NAS security algorithm ensure that the terminal device can successfully configure the EPS NAS security algorithm.
  • FIG. 7 is a schematic flowchart of a method for configuring an EPS NAS security algorithm according to another embodiment of the present application. As shown in FIG. 7 , the method includes at least S701 to S719. In this embodiment, the access and mobility management functional entity is an AMF network element.
  • the UE sends a registration request message to the AMF network element, where the registration request message carries the value of ngKSI of 7.
  • the registration request message may be referred to as a first registration request message.
  • the AMF network element sends an application for authentication request (identity request) message to the UE.
  • the UE sends an identity authentication response (identity response) message to the AMF network element.
  • the AMF network element sends an authentication request (authentication request) message to the UE.
  • the UE sends an authentication response (authentication response) message to the AMF network element.
  • the AMF network element sends an SMC message to the UE, where the SMC message carries a valid value of ngKSI.
  • This SMC message may be referred to as the first SMC message.
  • the UE sends the SMC completion information to the AMF network element.
  • This SMC complete message may be referred to as the first SMC complete message.
  • the AMF network element sends an SMC message to the UE, where the SMC message carries the information element of the selected EPS NAS security algorithm. This SMC message is called the second SMC message.
  • the UE does not receive the second SMC message sent by the AMF network element, and deletes the 5G NAS security context.
  • one possible reason why the UE does not receive the second SMC message sent by the AMF network element is that the first registration process is interrupted and the second SMC message does not reach the UE successfully; another possible reason is that the AMF network
  • the element does not perform S708, that is, the AMF network element does not send the information element of the selected EPS NAS security algorithm to the UE. It can be seen from this that S708 in this embodiment is optional, that is, it is not a step that must be performed.
  • the UE sends a first SMC completion message to the AMF network element, indicating that the UE has successfully activated the 5G NAS security context corresponding to the valid value of ngKSI carried in the first SMC message.
  • the UE does not receive the second SMC message sent by the AMF network element, indicating that the selected EPS NAS security algorithm corresponding to the information element of the selected EPS NAS security algorithm carried in the second SMC message does not exist in the UE.
  • the activated 5G NAS security context needs to be deleted, and a registration request is sent to the AMF network element again to request the 5G NAS security context.
  • the above S701 to S709 may be referred to as the first registration process; the registration process described below may be referred to as the second registration process.
  • the UE sends a registration request message to the AMF network element, where the registration request message carries the value of ngKSI of 7.
  • the registration request message may be referred to as a second registration request message.
  • the UE Since in S709, the UE deletes the 5G NAS security context, the value of ngKSI carried in the second registration request message sent by the UE to the AMF network element is 7, and 7 indicates that there is no 5G NAS security context in the UE.
  • the AMF network element sends an identity authentication request (identity request) message to the UE.
  • the UE sends an identity authentication response (identity response) message to the AMF network element.
  • the AMF network element sends an authentication request (authentication request) message to the UE.
  • the UE sends an authentication response (authentication response) message to the AMF network element.
  • the AMF network element sends an SMC message to the UE, where the SMC message carries a valid value of ngKSI.
  • This SMC message may be referred to as a third SMC message.
  • the AMF network element After the UE passes the identity authentication and authentication authentication of the AMF network element, the AMF network element sends a third SMC message to the UE, and the third SMC message carries the valid value of ngKSI, which is used to activate the 5G NAS security context in the UE.
  • the valid value of ngKSI carried in the third SMC message is the same as the valid value of ngKSI carried in the first SMC flow information.
  • the UE sends an SMC completion message to the AMF network element.
  • This SMC complete message may be referred to as a third SMC message.
  • the UE When the UE successfully receives the third SMC message sent by the AMF, and successfully activates the 5G NAS security context according to the valid value of ngKSI carried in the third SMC message, it sends the third SMC complete message to the AMF network element, indicating that the UE has been successfully configured
  • the 5G NAS security context corresponding to the valid value of ngKSI is displayed.
  • the valid value of ngKSI can be any integer value from 0 to 6, and each integer value corresponds to a 5G NAS security context.
  • the AMF network element sends an SMC message to the UE, where the SMC message carries the information element of the selected EPS NAS security algorithm.
  • This SMC message may be referred to as a fourth SMC message.
  • the AMF network element When the AMF network element receives the third SMC complete message sent by the UE, it sends a fourth SMC message to the UE.
  • the fourth SMC message carries the information element of the selected EPS NAS security algorithm, which is used to configure the selected EPS for the UE.
  • the selected EPS NAS security algorithm corresponding to the cell of the NAS security algorithm.
  • the information element of the selected EPS NAS security algorithm carried in the fourth SMC message is the same as the information element of the selected EPS NAS security algorithm carried in the second SMC message.
  • This SMC complete message may be referred to as a fourth SMC message.
  • the UE After the UE successfully configures the selected EPS NAS security algorithm corresponding to the information element of the selected EPS NAS security algorithm carried by the AMF network element in the fourth SMC message, the UE sends a fourth SMC complete message to the AMF network element.
  • the AMF network element sends a registration success message to the UE.
  • the AMF network element After the UE is successfully registered according to the second registration request message, the AMF network element sends a registration success message to the UE. At this time, the UE successfully activates the 5G NAS security context through the second registration request message, and successfully configures the selected EPS NAS security algorithm.
  • the UE sends a registration request message to the AMF when there is no 5G NAS security context.
  • the UE only receives the first SMC message and does not receive the second SMC message configured with the EPS NAS security algorithm
  • the UE actively Delete the activated 5G NAS security context, and in the registration request message initiated to the AMF network element again, request the 5G NAS security context from the AMF network element, and the AMF network element sends the 5G NAS security context and the selected EPS to the terminal device again.
  • the information element of the NAS security algorithm ensures that the terminal device can successfully configure the EPS NAS security algorithm.
  • FIG. 8 is a schematic flowchart of a method for configuring an EPS NAS security algorithm according to another embodiment of the present application. This embodiment is applicable to the scenario in which the terminal device has completed the registration process with the NR system in the LTE system and successfully activated the 5G NAS security context, and then disconnects from the LTE system and requests registration from the NR system again. As shown in FIG. 8 , the method includes at least S801 to S811. In this embodiment, the access and mobility management functional entity is an AMF network element.
  • the UE determines that there is no EPS NAS security algorithm in the current security context, and deletes the current security context.
  • the UE Before the UE initiates a registration request to the NR system, it needs to determine whether there is a valid EPS NAS security algorithm corresponding to ngKSI in the current security context in the UE. If there is no valid EPS NAS security algorithm corresponding to ngKSI in the current security context in the UE, delete the current security context in the UE, that is, change the value of the NAS key set identifier in ngKSI to 7, and 7 indicates that the There is no 5G NAS security context.
  • the UE sends a registration request message to the AMF network element, where the registration request message carries a value of ngKSI of 7.
  • the AMF network element sends an authentication request (identity request) message to the UE.
  • the UE sends an identity authentication response (identity response) message to the AMF network element.
  • the AMF network element sends an authentication request (authentication request) message to the UE.
  • the UE sends an authentication response (authentication response) message to the AMF network element.
  • the AMF network element sends an SMC message to the UE, where the SMC message carries a valid value of ngKSI.
  • This SMC message may be referred to as the first SMC message.
  • the UE sends an SMC completion message to the AMF network element.
  • This SMC complete message may be referred to as the first SMC complete message.
  • the AMF network element sends an SMC message to the UE, where the SMC message carries the information element of the selected EPS NAS security algorithm. This SMC message is called the second SMC message.
  • the UE sends an SMC completion message to the AMF network element.
  • the AMF network element sends registration completion information to the UE.
  • This SMC complete message is referred to as the second SMC complete message.
  • the UE completes the registration process with the NR system when connecting to the LTE system, and has successfully activated the 5G NAS security context.
  • the element re-requests the 5G NAS security context, and the AMF network element sends the information element of the 5G NAS security context and the selected EPS NAS security algorithm to the UE again, ensuring that the UE can successfully configure the EPS NAS security algorithm.
  • FIG. 9 is a schematic structural diagram of an apparatus for configuring an EPS NAS security algorithm according to an embodiment of the present application.
  • the apparatus 900 may include a processing module 901 and a sending module 902 .
  • the apparatus 900 may be used to implement the operations implemented by the access and mobility management functional entity or the AMF network element in the embodiments shown in any one of FIG. 3 to FIG. 5 .
  • the apparatus 900 may be used to implement the method shown in FIG. 3 above.
  • the processing module 901 is used to implement S301
  • the sending module 902 is used to implement S302.
  • the apparatus 900 may further include a receiving module.
  • the apparatus 900 in this implementation manner can be used to implement the method shown in FIG. 4 above.
  • the processing module 901 is used to implement S409 and S411
  • the sending module 902 is used to implement S402, S404, S406, S408, S412 and S414, and the receiving module is used to implement S401, S403, S405, S407, S410 and S413.
  • the apparatus 900 may further include a receiving module.
  • the apparatus 900 in this implementation manner can be used to implement the method shown in FIG. 5 above.
  • the processing module 901 is used to implement S503 and S505
  • the sending module 902 is used to implement S502 and S506
  • the receiving module is used to implement S501, S504 and S507.
  • FIG. 10 is a schematic structural diagram of an apparatus for configuring an EPS NAS security algorithm according to another embodiment of the present application.
  • the apparatus 1000 may include a processing module 1001 , a sending module 1002 and a receiving module 1003 .
  • the apparatus 1000 may be used to implement the operations implemented by the terminal device in any of the embodiments shown in FIG. 6 to FIG. 8 .
  • the apparatus 1000 may be used to implement the method shown in FIG. 6 above.
  • the processing module 1001 is used to implement S601 and S602
  • the sending module 1002 is used to implement S603
  • the receiving module 1003 is used to implement S604.
  • the apparatus 1000 may be used to implement the method shown in FIG. 7 above.
  • the processing module 1001 is used to implement S709
  • the sending module 1002 is used to implement S701, S703, S705, S707, S710, S712, S714, S716 and S718, and the receiving module 1003 is used to implement S702, S704, S706, S708, S711, S713, S715, S717 and S719.
  • the apparatus 1000 may be used to implement the method shown in FIG. 8 above.
  • the processing module 1001 is used to implement S801
  • the sending module 1002 is used to implement S802, S804, S806, S808 and S810
  • the receiving module 1003 is used to implement S803, S805, S807, S809 and S811.
  • FIG. 11 is a schematic structural diagram of an apparatus for configuring an EPS NAS security algorithm according to another embodiment of the present application.
  • the apparatus 1100 shown in FIG. 11 may be used to execute the method implemented by the access and mobility management functional entity or the AMF network element in any one of the embodiments shown in FIGS. 3 to 5 or may be used to execute the method shown in FIGS. 6 to 8 A method implemented by a terminal device in any one of the embodiments shown in the above.
  • the apparatus 1100 in this embodiment includes: a memory 1101 , a processor 1102 , a communication interface 1103 , and a bus 1104 .
  • the memory 1101 , the processor 1102 , and the communication interface 1103 are connected to each other through the bus 1104 for communication.
  • the memory 1101 may be a read only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM).
  • the memory 1101 may store programs, and when the programs stored in the memory 1101 are executed by the processor 1102 , the processor 1102 may be used to execute various steps of the methods shown in FIGS. 3 to 8 .
  • the processor 1102 can use a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for executing related programs to The method for configuring the EPS NAS security algorithm according to the method embodiment of the present application is implemented.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • the processor 1102 may also be an integrated circuit chip with signal processing capability.
  • each step of the method of each embodiment of the present application may be completed by an integrated logic circuit of hardware in the processor 1102 or an instruction in the form of software.
  • the above-mentioned processor 1102 may also be a general-purpose processor, a digital signal processor (digital signal processing, DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, Discrete gate or transistor logic devices, discrete hardware components.
  • DSP digital signal processor
  • ASIC application-specific integrated circuit
  • FPGA field programmable gate array
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the steps of the method disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • the software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art.
  • the storage medium is located in the memory 1101, and the processor 1102 reads the information in the memory 1101, and completes the functions required to be performed by each method in the embodiments of the present application in combination with its hardware. For example, each of the embodiments shown in FIG. 3 to FIG. 8 can be executed. steps/functions.
  • the communication interface 1103 can use, but is not limited to, a transceiver such as a transceiver to implement communication between the device 1100 and other devices or a communication network.
  • a transceiver such as a transceiver to implement communication between the device 1100 and other devices or a communication network.
  • the bus 1104 may include a pathway for communicating information between the various components of the apparatus 1100 (eg, the memory 1101, the processor 1102, the communication interface 1103).
  • the apparatus 1100 shown in this embodiment of the present application may be an electronic device, or may also be a chip configured in the electronic device.
  • the processor in the embodiment of the present application may be a central processing unit (central processing unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (digital signal processors, DSP), application-specific integrated circuits (application specific integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the memory in the embodiments of the present application may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically programmable Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be random access memory (RAM), which acts as an external cache.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • DDR SDRAM double data rate synchronous dynamic random access memory
  • enhanced SDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous connection dynamic random access memory Fetch memory
  • direct memory bus random access memory direct rambus RAM, DR RAM
  • the above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination.
  • the above-described embodiments may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server or data center by wire (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, a data center, or the like that contains one or more sets of available media.
  • the usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media.
  • the semiconductor medium may be a solid state drive.
  • At least one means one or more, and “plurality” means two or more.
  • At least one item(s) below” or similar expressions thereof refer to any combination of these items, including any combination of single item(s) or plural items(s).
  • at least one item (a) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c may be single or multiple .
  • the size of the sequence numbers of the above-mentioned processes does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, and should not be dealt with in the embodiments of the present application. implementation constitutes any limitation.
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium.
  • the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution, and the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: a U disk, a removable hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk and other media that can store program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了通信技术领域中一种配置EPS NAS安全算法的方法及相关装置。本申请提供的技术方案中，接入和移动管理功能实体需要判断是否为终端设备成功提供了所选的EPS NAS安全算法，当接入和移动管理功能实体确定没有成功为终端设备提供所选的EPS NAS安全算法后，向终端设备重新提供所选的EPS NAS安全算法。本申请的提供的技术方案，确保了接入和移动管理功能实体能够为终端设备成功配置EPS NAS安全算法。

Description

配置演进分组系统非接入层安全算法的方法及相关装置
本申请要求于2021年02月10日提交中国国家知识产权局、申请号为202110183922.0、申请名称为“配置演进分组系统非接入层安全算法的方法及相关装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种配置演进分组系统(evolved packet system，EPS)非接入层(non-access stratum，NAS)安全算法的方法及相关装置。
背景技术
目前，在第五代移动通信(5th generation，5G)网络支持N26接口、用户设备(user equipment，UE)支持S1模式的情况下，UE的注册流程中包括两次安全模式命令(security mode command，SMC)流程。
在UE的注册流程中，会出现第一次SMC流程正常，第二次SMC异常的情况，这会导致注册成功后的UE中无EPS NAS安全算法，因此，如何确保为UE成功配置EPS NAS安全算法成为了亟需解决的问题。
发明内容
本申请提供了一种配置EPS NAS安全算法的方法及相关装置，确保了接入和移动管理功能实体能够为终端设备成功配置EPS NAS安全算法。
第一方面，本申请提供一种配置EPS NAS安全算法的方法，所述方法包括：接入和移动管理功能实体确定没有成功为终端设备提供所选的EPS NAS安全算法；所述接入和移动管理功能实体向所述终端设备提供所述所选的EPS NAS安全算法。
本方法中，接入和移动管理功能实体在未成功为终端设备提供所选的EPS NAS安全算法的情况下，向终端设备重新提供所选的EPS NAS安全算法，可以确保接入和移动管理功能实体能够为终端设备成功配置所选的EPS NAS安全算法。
在一种可能的实现方式中，所述接入和移动管理功能实体确定没有成功为终端设备提供所选的EPS NAS安全算法之前，所述方法还包括：所述接入和移动管理功能实体向所述终端设备发送第一消息，所述第一消息包括所述所选的EPS NAS安全算法的信元。
在一种可能的实现方式中，所述接入和移动管理功能实体确定没有成功为终端设备提供所选的EPS NAS安全算法包括：所述接入和移动管理功能实体确定未收到第一完成消息，所述第一完成消息用于表示所述终端设备已接收到所述第一消息。
在一种可能的实现方式中，所述接入和移动管理功能实体确定未收到第一完成消息包括：所述接入和移动管理功能实体确定在预设时间内未收到所述第一完成消息。
该实现方式中，接入和移动管理功能实体通过在预设时间内未收到第一完成消息来确定没有成功为终端设备提供所选的EPS NAS安全算法，提高了接入和移动管理功 能实体确定没有成功为终端设备提供所选的EPS NAS安全算法的准确度。
在一种可能的实现方式中，所述第一消息为安全模式命令SMC消息，所述第一完成消息为SMC完成消息。
在一种可能的实现方式中，所述方法包括：所述接入和移动管理功能实体将所述所选的EPS NAS安全算法标记为无效。
该实现方式中，接入和移动管理功能实体在确定没有成功为终端设备提供所选的EPS NAS安全算法之后，将所选的EPS NAS安全算法标记为无效。接入和移动管理功能实体可以根据标记的所选的EPS NAS安全算法为无效的信息为终端设备重新提供所选的EPS NAS安全算法，确保了接入和移动管理功能实体能够成功为终端设备提供所选的EPS NAS安全算法。
在一种可能的实现方式中，所述接入和移动管理功能实体向所述终端设备提供所述所选的EPS NAS安全算法之前，所述方法还包括：所述接入和移动管理功能实体接收来自所述终端设备的注册请求消息。
在一种可能的实现方式中，所述方法还包括：所述接入和移动管理功能实体确定更新所选的EPS NAS安全算法；所述接入和移动管理功能实体向所述终端设备提供更新后的所选的EPS NAS安全算法。
在一种可能的实现方式中，所述方法还包括：所述接入和移动管理功能实体确定没有成功为所述终端设备提供更新后的所选的EPS NAS安全算法；所述接入和移动管理功能实体向所述终端设备提供所述更新后的所选的EPS NAS安全算法。
该实现方式中，接入和移动管理功能实体在确定没有成功为终端设备提供更新后的所选的EPS NAS安全算法后，向终端设备提供更新后的所选的EPS NAS安全算法，确保了接入和移动管理功能实体能够成功为终端设备配置更新的所选的EPS NAS安全算法，使得终端设备中的EPS NAS安全算法与接入和移动管理功能实体确定的更新的所选的EPS NAS安全算法一致。
在一种可能的实现方式中，所述接入和移动管理功能实体支持N26接口，所述终端设备支持S1模式。
在一种可能的实现方式中，所述接入和移动管理功能实体中存在所述终端设备指示的有效第五代移动通信5G NAS安全上下文。
第二方面，本申请提供一种配置EPS NAS安全算法的方法，所述方法包括：终端设备确定不存在第五代移动通信5G NAS安全上下文对应的所选的EPS NAS安全算法；所述终端设备删除所述5G NAS安全上下文；所述终端设备向接入和移动管理功能实体发送第二消息，所述第二消息用于请求所述5G NAS安全上下文；所述终端设备接收来自所述接入和移动管理功能实体的所述所选的EPS NAS安全算法的信元。
本方法中，在终端设备中已经存在5G NAS安全上下文的情况下，首先确定终端设备的5G NAS安全上下文中是否存在对应的所选的EPS NAS安全算法，若终端设备确定5G NAS安全上下文中不存在对应的所选的EPS NAS安全算法，则将5G NAS安全上下文删除，重新向接入和移动管理功能实体请求5G NAS安全上下文，接入和移动管理功能实体再次向终端设备发送5G NAS安全上下文和对应的所选的EPS NAS安全算法的信元，确保了终端设备能够成功配置EPS NAS安全算法。
在一种可能的实现方式中，所述终端设备确定不存在5G NAS安全上下文对应的所选的EPS NAS安全算法包括：所述终端设备确定没有接收来自所述接入和移动管理功能实体的所选的EPS NAS安全算法的信元。
在一种可能的实现方式中，所述终端设备确定没有接收来自所述接入和移动管理功能实体的所选的EPS NAS安全算法的信元包括：所述终端设备在预设时间内没有接收到来自所述接入和移动管理功能实体的所选的EPS NAS安全算法的信元。
该实现方式中，通过在预设时间内没有接收到来自接入和移动管理功能实体的所选的EPS NAS安全算法的信元来确定终端设备中不存在5G NAS安全上下文对应的所选的EPS NAS安全算法，提高了终端设备确定不存在5G NAS安全上下文对应的所选的EPS NAS安全算法的准确度。
在一种可能的实现方式中，所述终端设备确定不存在5G NAS安全上下文对应的所选的EPS NAS安全算法之前，所述方法还包括：所述终端设备接收所述接入和移动管理功能实体发送的第三消息，所述第三消息包括所述5G NAS安全上下文；所述终端设备向所述接入和移动管理功能实体发送第三完成消息，所述第三完成消息用于表示所述终端设备已接收到所述第三消息。
该实现方式中，终端设备通过接收接入和移动管理功能实体发送的携带有5G NAS安全上下文的第三消息激活了5G NAS安全上下文，并向接入和移动管理功能实体发送第三完成消息，确保了终端设备成功激活了5G NAS安全上下文。
在一种可能的实现方式中，所述终端设备确定不存在5G NAS安全上下文对应的所选的EPS NAS安全算法包括：确定下一代无线接入网密钥集标识ngKSI没有对应的所选的EPS NAS安全算法。
该实现方式中，通过确定下一代无线接入网密钥集标识ngKSI没有对应的所选的EPS NAS安全算法来确定终端设备中不存在5G NAS安全上下文对应的所选的EPS NAS安全算法，提高了终端设备确定不存在5G NAS安全上下文对应的所选的EPS NAS安全算法的准确度。
在一种可能的实现方式中，所述方法还包括：所述终端设备将所述ngKSI设为无效值。
该实现方式中，在终端设备确定不存在5G NAS安全上下文对应的所选的EPS NAS安全算法，终端设备将所述ngKSI设为无效值，以便在下一次注册请求中向接入和移动管理功能实体重新请求5G NAS安全上下文。
在一种可能的实现方式中，所述终端设备与长期演进LTE系统断开连接，所述第二消息用于请求注册至新无线NR系统。
在一种可能的实现方式中，所述终端设备确定所述接入和移动管理功能实体支持N26接口。
在一种可能的实现方式中，所述接入和移动管理功能实体支持N26接口，所述终端设备支持S1模式。
第三方面，本申请提供一种配置EPS NAS安全算法的装置，所述装置可以包括用于实现第一方面中的方法的各个模块，这些模块可以通过软件和/或硬件的方式实现。
第四方面，本申请提供一种配置EPS NAS安全算法的装置，所述装置可以包括用 于实现第二方面中的方法的各个模块，这些模块可以通过软件和/或硬件的方式实现。
第五方面，本申请提供一种配置EPS NAS安全算法的装置。该装置可以包括与存储器耦合的处理器。其中，该存储器用于存储程序代码，该处理器用于执行该存储器中的程序代码，以实现第一方面或第二方面或其中任意一种实现方式中的方法。
可选地，该装置还可以包括该存储器。
第六方面，本申请提供一种芯片，包括至少一个处理器和通信接口，所述通信接口和所述至少一个处理器通过线路互联，所述至少一个处理器用于运行计算机程序或指令，以执行如第一方面或第二方面或其中任意一种可能的实现方式所述的方法。
第七方面，本申请提供一种计算机可读介质，该计算机可读介质存储用于设备执行的程序代码，该程序代码包括用于执行如第一方面或第二方面或其中任意一种可能的实现方式所述的方法。
第八方面，本申请提供一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行如第一方面或第二方面或其中任意一种可能的实现方式所述的方法。
第九方面，本申请提供一种接入和移动管理功能实体，包括至少一个处理器和通信接口，所述通信接口和所述至少一个处理器通过线路互联，所述通信接口与目标系统通信，所述至少一个处理器用于运行计算机程序或指令，以执行如第一方面或其中任意一种可能的实现方式所述的方法。
第十方面，本申请提供一种终端设备，包括至少一个处理器和通信接口，所述通信接口和所述至少一个处理器通过线路互联，所述通信接口与目标系统通信，所述至少一个处理器用于运行计算机程序或指令，以执行如第二方面或其中任意一种可能的实现方式所述的方法。
第十一方面，本申请提供一种通信系统，包括至少一个处理器和通信接口，所述通信接口和所述至少一个处理器通过线路互联，所述通信接口与目标系统通信，所述至少一个处理器用于运行计算机程序或指令，以执行如第一方面或第二方面或其中任意一种可能的实现方式所述的方法。
附图说明
图1为本申请的实施例的一种5G网络架构的示意图；
图2为本申请的实施例的另一种5G网络架构的示意图；
图3为本申请的实施例的一种配置EPS NAS安全算法的方法的流程示意图；
图4为本申请一个实施例的配置EPS NAS安全算法的方法的流程示意图；
图5为本申请另一个实施例的配置EPS NAS安全算法的方法的流程示意图；
图6为本申请的实施例的另一种配置EPS NAS安全算法的方法的流程示意图；
图7为本申请又一个实施例的配置EPS NAS安全算法的方法的流程示意图；
图8为本申请又一个实施例的配置EPS NAS安全算法的方法的流程示意图；
图9为本申请一个实施例的一种配置EPS NAS安全算法的装置的示意性结构图；
图10为本申请另一个实施例的一种配置EPS NAS安全算法的装置的示意性结构图；
图11为本申请又一个实施例的一种配置EPS NAS安全算法的装置的示意性结构图。
具体实施方式
图1为本申请一个实施例的5G网络架构的示意图，5G系统也称为新无线通信系统、新接入技术(new radio，NR)或者下一代移动通信系统。
如图1所示，该网络架构包括UE、接入网(access network，AN)、核心网和数据网络(data network，DN)。其中，接入网主要用于实现无线物理层功能、资源调度和无线资源管理、无线接入控制以及移动性管理等功能；核心网可以包含管理设备和网关设备，管理设备主要用于终端设备的设备注册、安全认证、移动性管理和位置管理等，网关设备主要用于与终端设备间建立通道，在该通道上转发终端设备和外部数据网络之间的数据包；数据网络可以包含网络设备(如：服务器、路由器等设备)，数据网络主要用于为终端设备提供多种数据业务服务。需要说明的是，图1仅为示例性架构图，除图1中所示功能单元之外，该网络架构还可以包括其他功能单元，本申请实施例对此不进行限定。
5G系统中的接入网可以是无线接入网(radio access network，(R)AN)，5G系统中的(R)AN设备可以由多个5G-(R)AN节点组成，该5G-(R)AN节点可以包括：非3GPP的接入网络如WiFi网络的接入点(access point，AP)、下一代基站(可统称为新一代无线接入网节点NG-RAN node)，其中，下一代基站包括新空口基站(NR nodeB，gNB)、新一代演进型基站(NG-eNB)、中心单元(central unit，CU)和分布式单元(distributed unit，DU)分离形态的gNB等)、收发点(transmission receive point，TRP)、传输点(transmission point，TP)或其它节点。
如图1所示，核心网可以包括接入和移动性管理功能(access and mobility management function，AMF)网元、会话管理功能(session management function，SMF)网元、用户面功能(user plane function，UPF)网元、鉴权服务器功能(authentication server function，AUSF)网元、策略控制功能(policy control function，PCF)网元、应用功能(application function，AF)网元、统一数据管理功能(unified data management，UDM)网元、网络切片选择功能(network slice selection function，NSSF)网元等多个功能单元。
AMF网元主要负责移动性管理、接入管理等服务。SMF网元主要负责会话管理、UE地址管理和分配、动态主机配置协议功能、用户面功能的选择和控制等。UPF主要负责对外连接到数据网络(data network，DN)以及用户面的数据包路由转发、报文过滤、执行服务质量(quality of service，QoS)控制相关功能等。AUSF主要负责对终端设备的认证功能等。PCF网元主要负责为网络行为管理提供统一的策略框架、提供控制面功能的策略规则、获取与策略决策相关的注册信息等。需要说明的是，这些功能单元可以独立工作，也可以组合在一起实现某些控制功能，如对终端设备的接入鉴权、安全加密、位置注册等接入控制和移动性管理功能，以及用户面传输路径的建立、释放和更改等会话管理功能。
5G网络中各功能单元之间可以通过下一代网络(next generation，NG)接口进行 通信，如：UE可以通过NG接口1(简称N1)与AMF网元进行控制面消息的传输，RAN设备可以通过NG接口3(简称N3)与UPF建立用户面数据传输通道，AN/RAN设备可以通过NG接口2(简称N2)与AMF网元建立控制面信令连接，UPF可以通过NG接口4(简称N4)与SMF网元进行信息交互，UPF可以通过NG接口6(简称N6)与数据网络DN交互用户面数据，AMF网元可以通过NG接口11(简称N11)与SMF网元进行信息交互，SMF网元可以通过NG接口7(简称N7)与PCF网元进行信息交互，AMF网元可以通过NG接口12(简称N12)与AUSF进行信息交互。
图1所示网络架构为基于参考点网络架构，且该网络架构为非漫游场景下的网络架构，当然本申请的方法也可以应用在漫游场景下，并且网络架构也不限于基于参考点的网络架构，也可以采用基于服务化接口的网络架构。
图2为本申请另一个实施例的5G网络架构的示意图。如图2所示，该网络架构主要是基于服务化接口的网络架构。该网络架构与图1所示的网络架构相比较而言，核心网还包括NEF和NRF网元。
基于服务化接口的场景下，核心网中的部分网元通过总线方式连接。如图2所示，AUSF网元、AMF网元、SMF网元、AF网元、UDM、PCF网元、网络存储功能(network repository function，NRF)网元、网络开放功能(network exposure function，NEF)网元和NSSF网元通过总线互连，所述网元在通过总线互连时，采用服务化接口，例如，AUSF网元通过Nausf接口连接到总线上，AMF网元采用Namf接口连接到总线上，SMF网元通过Nsmf接口连接到总线上，AF网元采用NAF网元接口连接到总线上，UDM采用Nudm接口连接到总线上，PCF网元通过NPCF网元接口连接到总线上，NRF通过Nnrf接口连接到总线上，NEF通过Nnef接口连接到总线上，NSSF通过Nnssf接口连接到总线上。
目前，在5G网络支持N26接口、终端设备支持S1模式的情况下，UE的注册流程中可以包括两次SMC流程。在UE的注册流程中，会出现第一次SMC流程正常，第二次SMC异常的情况。在这种情况下，当UE再次发起注册请求时，由于第一次SMC流程正常，即UE和网络之间的5G NAS安全上下文正常，因此网络可能不再重新执行第二次SMC流程。但是，EPS NAS安全算法的配置信息是网络在第二次SMC流程中向UE下发的，这会导致注册成功后的UE中无EPS NAS安全算法，从而导致UE后续切换至长期演进(long term evolution，LTE)时会出现切换失败、业务中断和/或业务功能不连续等问题。
针对上述问题，本申请提出了新的技术方案。本申请提出的技术方案可以确保接入和移动管理功能实体能够为终端设备成功配置EPS NAS安全算法。
图3为本申请的实施例的一种配置EPS NAS安全算法的方法的流程示意图。如图3所示，该方法至少包括S301至S302。
S301，接入和移动管理功能实体确定没有成功为终端设备提供所选的EPS NAS安全算法。
本实施例中，接入和移动管理功能实体为终端设备提供所选的EPS NAS安全算法可以是接入和移动管理功能实体在终端设备没有有效EPS NAS安全算法的场景下为该终端设备选择的EPS NAS安全算法；或者，接入和移动管理功能实体为终端设备提 供所选的EPS NAS安全算法可以是终端设备上已有有效EPS NAS安全算法的场景下，接入和移动管理功能实体为终端设备重新选择的EPS NAS安全算法。
接入和移动管理功能实体为终端设备提供所选的EPS NAS安全算法的一种实现方式为：接入和移动管理功能实体向终端设备发送第一消息，第一消息包括接入和移动管理功能实体为终端设备所选的EPS NAS安全算法的信元(information element，IE)。其中，第一消息的一种示例为SMC消息。
本实施例中的NAS安全算法的信元可以指示用于加密和完整性保护的算法，EPS NAS安全算法的信元可以指示EPS中用于加密和完整性保护的算法。本实施例中的信元也可以替换为信息。其中该信元可以是所选的EPS NAS安全算法本身，也可以是用于指示所选的EPS NAS安全算法的信息，例如，可以是用于指示所选的EPS NAS安全算法的有效值。示例性的，本实施例中的信元的具体形式可以是比特位。
该实现方式中，接入和移动管理功能实体确定没有成功为终端设备提供所选的EPS NAS安全算法的一种示例包括：接入和移动管理功能实体确定没有接收到来自终端设备的第一完成消息，第一完成消息用于表示终端设备已接收到接入和移动管理功能实体为其选择的EPS NAS安全算法的信元。例如，接入和移动管理功能实体在预设时长内没有接收到来自终端设备的第一完成消息时，可以确定没有成功为终端设备提供所选的EPS NAS。其中，第一完成消息的一种示例为SMC完成消息。
接入和移动管理功能实体确定没有成功为终端设备提供所选的EPS NAS安全算法的另一种示例包括：终端设备在预设时间内没有接收到来自接入和移动管理功能实体的第一消息，则向接入和移动管理功能实体发送第一指示消息，第一指示消息用于指示终端设备没有成功接收EPS NAS安全算法的信元的消息；接入和移动管理功能实体接收到第一指示消息之后，确定没有成功为终端设备提供所选的EPS NAS安全算法。
本实施例的一些实现方式中，接入和移动管理功能实体支持N26接口，终端设备支持S1模式。其中，N26接口为第四代移动通信(4th generation，4G)核心网与5G核心网之间的接口，即移动管理节点功能(mobility management entity，MME)网元与AMF网元之间的接口，用于4G与5G的互操作。终端设备支持S1模式表示该终端设备支持连接至LTE网络。
本实施例中的一些实现方式中，在接入和移动管理功能实体确定是否成功向终端设备提供所选的EPS NAS安全算法之前，或者在接入和移动管理功能实体向终端提供所选的EPS NAS安全算法之前，接入和移动管理功能实体可以接收来自终端设备的注册请求(Registration Request)消息。
作为一个示例，接入和移动管理功能实体接收来自终端设备的注册请求消息之后，响应于该注册请求消息可以判断接入和移动管理功能实体上是否存在终端设备指示的有效5G NAS安全上下文；若存在，则进一步判断接入和移动管理功能实体是否成功向终端设备提供过所选的EPS NAS安全算法；若不存在，则向终端设备下发SMC流程，以激活终端设备指示的有效5G NAS安全上下文。
其中，接入和移动管理功能实体上不存在终端设备指示的有效5G NAS安全上下文的情况下，若终端设备支持S1模式且接入和移动管理功能实体支持N26接口，则接入和移动管理功能实体向终端设备下发第一次SMC流程之后，还可以向终端设备再 次下发SMC流程并携带为终端设备所选的EPS NAS安全算法；接入和移动管理功能实体上不存在终端设备指示的有效5G NAS安全上下文的情况下，若终端设备不支持S1模式和/或接入和移动管理功能实体不支持N26接口，则接入和移动管理功能实体向终端设备下发第一次SMC流程之后，可以不用向终端设备再次下发SMC流程并携带为终端设备所选的EPS NAS安全算法的信元。
本实施例中，可选的，接入和移动管理功能实体确定没有成功为终端设备提供所选的EPS NAS安全算法后，可以标记未成功为终端设备配置所选的EPS NAS安全算法的标记信息。
示例性的，接入和移动管理功能实体可以为5G网络中的AMF网元，也可以为6G网络中具有接入和移动性管理功能的网元。
S302，接入和移动管理功能实体向终端设备提供所选的EPS NAS安全算法。
也就是说，在接入和移动管理功能实体确定没有成功为终端设备提供所选的EPS NAS安全算法之后，向终端设备重新提供所选的EPS NAS安全算法。
例如，若接入和移动管理功能实体向终端设备发送第一消息之后，(在预设时间内)没有接收到来自终端设备的第一完成消息，则接入和移动管理功能实体可以确定没有成功为终端设备提供所选的EPS NAS安全算法，因此向终端设备重新发送第一消息。
又如，若接入和移动管理功能实体向终端设备发送第一消息之后，(在预设时间内)没有接收到来自终端设备的第一完成消息，则接入和移动管理功能实体可以确定没有成功为终端设备提供所选的EPS NAS安全算法，并将所选的EPS NAS安全算法标记为无效值，然后在接入和移动管理功能实体接收到来自终端设备的注册请求消息之后，在接入和移动管理功能实体上存在终端设备的有效5G安全上下文的情况下，因为所选的EPS NAS安全算法标记为无效值而向终端设备重新发送第一消息。该示例的一种实现方式可以参考图4所示的实施例。
再如，接入和移动管理功能实体向终端设备更新所选的EPS NAS安全算法，且确定没有成功为终端设备提供该更新的EPS NAS安全算法时，可以生成所选的EPS NAS安全算法更新的指示信息；并在接收到来自终端设备的初始接入请求消息(例如注册请求消息)时，基于该指示信息重新向终端设备提供该更新的EPS NAS安全算法。该示例的一种实现方式可以参考图5所示的实施例。
作为一种示例，接入和移动管理功能实体选择在EPS中使用的加密算法和完整性算法，并通过所选的EPS NAS安全算法的信元向终端设备指示所选的算法，例如通过向终端设备发送SMC消息，该SMC消息包括所选的EPS NAS安全算法的信元的方式向终端设备指示所选的算法。
本申请提出的技术方案中，接入和移动管理功能实体在未成功为终端设备提供所选的EPS NAS安全算法的情况下，向终端设备重新提供所选的EPS NAS安全算法，可以确保接入和移动管理功能实体能够为终端设备成功配置所选的EPS NAS安全算法。
需要说明的是，本申请实施例提供的方法中接入和移动管理功能实体重新发送的不限于是接入和移动管理功能实体所选的EPS NAS安全算法，也可以是未来支持5G 和/或6G网络的终端设备向6G网络注册时获取的关于5G的安全算法，该5G的安全算法可以用于终端设备后续生成5G NAS安全上下文。
也就是说，只要是接入和移动管理功能实体在确定没有成功为终端设备提供的用于终端设备后续生成NAS安全上下文的情况下，向终端设备发送该NAS安全上下文的方法都可纳入本申请技术方案的保护范围。
图4为本申请一个实施例的配置EPS NAS安全算法的方法的流程示意图。如图4所示，该方法至少包括S401至S414。在本实施例中，接入和移动管理功能实体为AMF网元。
S401，UE向AMF网元发送注册请求消息，该注册请求消息中携带ngKSI的值为7。为了便于描述，该注册请求消息可以称为第一注册请求消息。
此时UE侧无5G NAS安全上下文，故在UE向AMF网元发起的第一注册请求信息中携带的下一代无线接入网密钥集标识(key set identifier for next generation radio access network，ngKSI)的值为7，7表示UE侧无5G NAS安全上下文。
S402，AMF网元向UE发送身份认证请求(identity request)消息。
S403，UE向AMF网元发送身份认证回复(identity response)消息。
S404，AMF网元向UE发送鉴权认证请求(authentication request)消息。
可选的，UE在接收到来自AMF网元发送的鉴权认证请求(authentication request)消息之后，可以根据该鉴权认证请求(authentication request)消息生成未激活的5G NAS安全上下文。
S405，UE向AMF网元发送鉴权认证回复(authentication response)消息。
S402至S405为UE与AMF网元进行身份认证和鉴权认证的过程，当UE通过了AMF网元的身份认证和鉴权认证后，AMF网元会与UE进行下面的注册流程。
S406，AMF网元向UE发送SMC消息，该SMC消息中携带ngKSI的有效值。该SMC消息可以称为第一SMC消息。
当UE通过了AMF网元的身份认证和鉴权认证之后，AMF网元向UE发送第一SMC消息，第一SMC消息中携带ngKSI的有效值，用来激活UE中的5G NAS安全上下文，此时UE中会存在与第一SMC消息中携带的ngKSI的有效值对应的当前安全上下文(current security context)。其中，ngKSI的有效值可以为0至6中任意一个整数值，每个整数值对应一套5G NAS安全上下文。
S407，UE向AMF网元发送SMC完成消息。该SMC完成消息可以称为第一SMC完成消息。
当UE成功接收AMF网元发送的第一SMC消息，并且根据第一SMC消息中携带的ngKSI的有效值成功激活了5G NAS安全上下文后，向AMF网元发送第一SMC完成消息，表示UE已经成功配置了ngKSI的有效值对应的5G NAS安全上下文。
S408，AMF网元向UE发送SMC消息，该SMC消息中携带所选的EPS NAS安全算法的信元。该SMC消息称为第二SMC消息。
当AMF网元接收到UE发送的第一SMC完成消息后，向UE发送第二SMC消息，第二SMC消息中携带所选的EPS NAS安全算法的信元，用来为UE配置所选的EPS NAS安全算法的信元对应的EPS NAS安全算法。其中，EPS NAS安全算法的信元可 以为0至7中任意一个整数值，每个整数值对应一个EPS NAS安全算法。
可以理解的是，本实施例中的UE支持S1模式，且AMF网元支持N26接口。
S409，AMF网元没有接收到UE响应于第二SMC消息发送的SMC完成消息，将所选的EPS NAS安全算法标记为无效。该SMC完成消息称为第二SMC完成消息。
当AMF网元向UE发送第二SMC消息后，AMF网元没有接收到UE发送的第二SMC完成消息，则表示UE没有成功配置AMF在第二SMC消息中携带的所选的EPS NAS安全算法的信元对应的所选的EPS NAS安全算法。
一种可能的实现方式，由于网络信号异常等因素，UE没有接收到AMF网元发送的携带有所选的EPS NAS安全算法的信元的第二SMC消息。
另一种可能的实现方式，UE接收到了AMF网元发送的携带有所选的EPS NAS安全算法的信元的第二SMC消息，但未能根据所选的EPS NAS安全算法的信元成功配置对应的所选的EPS NAS安全算法。
上述S401至S409可以称为第一次注册流程；下面描述的注册流程可以称为第二次注册流程。
S410，UE向AMF网元发送注册请求消息，该注册请求信息中携带ngKSI的有效值。该注册请求消息可以称为第二注册请求消息。
UE经过第一次注册流程，已经根据AMF网元在第一SMC消息中携带的ngKSI的有效值成功激活了对应的5G NAS安全上下文。UE向AMF网元发起第二注册请求消息时，第二注册请求消息中携带的ngKSI的值为与UE中的5G NAS安全上下文对应的ngKSI的有效值。也就是说，UE在第二注册请求消息中携带的ngKSI的有效值与AMF网元在第一次注册流程中的第一SMC消息中携带的ngKSI的有效值相同。
S411，AMF网元对第二注册请求消息进行检查。
AMF网元对第二注册请求消息的检查包括对第二注册请求消息进行完整性检查和判断AMF网元是否能够对第二注册请求消息中的NAS信息箱(NAS message container)解密成功。
S412，AMF网元向UE发送SMC消息，该SMC消息中携带ngKSI的有效值和所选的EPS NAS安全算法的信元。该SMC消息可以称为第三SMC消息。
具体地，AMF网元检查终端设备的ngKSI对应的安全上下文中是否存在有效的EPS NAS安全算法，若不存在，则通过SMC流程提供所选的EPS NAS安全算法。
本实施例中，因为在S409中，AMF网元将当前的安全上下文中的ngKSI对应的所选的EPS NAS安全算法标记为无效，所以AMF网元向UE发送第三SMC消息。
示例性的，第三SMC消息中携带ngKSI的有效值与UE在第二注册请求信息中携带的ngKSI的有效值和AMF网元在第一注册请求流程中的第一SMC消息中携带的ngKSI的有效值相同；第三SMC消息中携带的所选的EPS NAS安全算法的信元与AMF网元在第二SMC消息中携带的EPS NAS安全算法的信元相同，终端设备根据第三SMC消息中携带的所选的EPS NAS安全算法的信元配置所选的EPS NAS安全算法。
S413，UE向AMF网元发送SMC完成消息。该SMC完成消息可以称为第三SMC完成消息。
当UE成功配置AMF网元在第三SMC消息中携带的所选的EPS NAS安全算法的 信元对应的所选的EPS NAS安全算法后，向AMF网元发送第三SMC完成消息。
S414，AMF网元向UE发送注册成功消息。
当UE根据第二注册请求消息注册成功后，AMF网元向UE发送注册成功消息。
本申请提出的技术方案中，UE在无5G NAS安全上下文时向AMF网元发起注册请求消息，UE支持S1模式，网络支持N26接口时，UE在第一次注册过程中只成功收到第一SMC消息，并激活了5G NAS安全上下文；AMF网元未收到来自UE的第二SMC完成消息时，AMF网络标记所选的EPS NAS安全算法未配置成功，并在UE发起第二次注册请求消息时，AMF网元根据标记的所选的EPS NAS安全算法未配置成功的信息，再次为UE提供所选的EPS NAS安全算法，确保了AMF网元能够成功为UE配置所选的EPS NAS安全算法。
图5为本申请另一个实施例的配置EPS NAS安全算法的方法的流程示意图。如图5所示，该方法至少包括S501至S507。在本实施例中，接入和移动管理功能实体为AMF网元。
S501，UE向AMF网元发送业务请求消息或注册请求消息。该业务请求消息可以称为第一业务请求消息，该注册请求消息可以称为第一注册请求消息。
UE通过向AMF发送第一业务请求消息或第一注册请求消息等初始接入流程消息，触发链路建立后进入连接态。
在本实施例中，UE存在有效的EPS NAS安全算法。
S502，AMF网元向UE发送SMC消息，该SMC消息中携带更新的所选的EPS NAS安全算法的信元。该SMC消息可以称为第一SMC消息。
AMF网元将要对UE中已经存在的EPS NAS安全算法进行修改，故AMF网元在向UE发送的第一SMC消息中携带了将要为UE配置的更新的所选的EPS NAS安全算法的信元。
S503，AMF网元未收到UE发送的SMC完成消息，标记更新的所选的EPS NAS安全算法配置失败，释放链路。该SMC完成消息可以称为第一SMC完成消息。
若AMF网元未收到第一SMC完成消息，将导致此次业务请求或注册请求等初始接入流程终止，此时AMF网元需要标记用于表示更新的所选的EPS NAS安全算法配置失败的标记信息，并释放链路资源。
S504，UE再次向AMF网元发送业务请求消息或注册请求消息。该业务请求消息可以称为第二业务请求消息，该注册请求消息可以称为第二注册请求消息。
UE通过向AMF网元发送第二业务请求消息或第二注册请求消息等初始接入流程消息，再次触发链路建立后进入连接态。
S505，AMF网元确认存在更新的所选的EPS NAS安全算法配置失败的标识信息。
当AMF网元接收到UE发送的第二业务请求消息或第二注册请求消息等初始接入流程消息后，需要确认是否存在用于表示更新的所选的EPS NAS安全算法配置失败的标识信息。若AMF网元中存在更新的所选的EPS NAS安全算法配置失败的标识信息，则需要再次向UE发送携带更新的所选的EPS NAS安全算法的信元的SMC消息。
S506，AMF网元向UE发送SMC消息，该SMC消息中携带更新的所选的EPS NAS安全算法的信元。该SMC消息可以称为第二SMC消息。
AMF网元向UE发送第二SMC消息，第二SMC消息中携带了将要为UE配置的更新的所选的EPS NAS安全算法的信元。
可选的，第二SMC消息中携带的更新的所选的EPS NAS安全算法的信元可以与第一SMC消息中携带的更新的所选的EPS NAS安全算法的信元相同，也可以与第一SMC消息中携带的更新的所选的EPS NAS安全算法的信元不同。
S507，UE向AMF网元发送SMC完成消息。该SMC完成消息可以称为第二SMC完成消息。
当UE成功配置了AMF网元在第二SMC消息中携带的更新的所选的EPS NAS安全算法的信元对应的更新的所选的EPS NAS安全算法后，向AMF网元发送第二SMC完成消息，此时UE中的EPS NAS安全算法与AMF网元中的更新的所选的EPS NAS安全算法一致。
本申请提出的技术方案中，UE中存在EPS NAS安全算法，AMF网元希望改变UE中的EPS NAS安全算法，当UE处于连接态时，AMF网元向UE发送携带更新的所选的EPS NAS安全算法的信元的SMC消息，但是AMF网元未收到UE发送的SMC完成消息的回复时，AMF网元标记更新的所选的EPS NAS安全算法未修改成功的信息，当UE再一次处于连接态时，AMF网元根据标记的更新的所选的EPS NAS安全算法未修改成功的信息，为UE重新下发更新的所选的EPS NAS安全算法的信元的SMC消息，确保了AMF网元能够成功为UE配置更新的所选的EPS NAS安全算法，使得UE中EPS NAS安全算法与AMF网元中的一致。
图6为本申请的实施例的另一种配置EPS NAS安全算法的方法的流程示意图。如图6所示，该方法至少包括S601至S604。
S601，终端设备确定不存在5G NAS安全上下文对应的所选的EPS NAS安全算法。
本实施例中，终端设备中已经存在5G NAS安全上下文，但不存在5G NAS安全上下文对应的所选的EPS NAS安全算法。
终端设备激活5G NAS安全上下文的一种实现方式为：终端设备向接入和移动管理功能实体发送注册请求消息后；接入和移动管理功能实体向终端设备发送第三消息，第三消息中包括5G NAS安全上下文；终端设备接收第三消息并根据第三消息成功激活5G NAS安全上下文后，向接入和移动管理功能实体发送第三完成消息，第三完成消息用于表示终端设备已接收到第三消息；接入和移动管理功能实体接收到来自终端设备的第三完成消息后，向终端设备提供所选的EPS NAS安全算法。其中，第三消息的一种示例为SMC消息，第三完成消息的一种示例为SMC完成消息。
该实现方式中，终端设备确定不存在5G NAS安全上下文对应的所选的EPS NAS安全算法的一种示例包括：终端设备确定没有接收来自接入和移动管理功能实体的所选的EPS NAS安全算法的信元。例如，终端设备在预设时间内没有接收来自接入和移动管理功能实体的所选的EPS NAS安全算法的信元，可以确定不存在5G NAS安全上下文对应的所选的EPS NAS安全算法。
在该种可能的实现方式中，接入和移动管理功能实体支持N26接口，终端设备支持S1模式。
终端设备激活5G NAS安全上下文的另一种实现方式为：终端设备连接在LTE网 络时向NR系统中的AMF网元请求注册并完成注册流程，终端设备在该注册流程中激活了5G NAS安全上下文。在完成该注册流程之后，终端设备与LTE网络断开连接，再次向NR系统中的AMF网元请求注册。
该实现方式中，终端设备确定不存在5G NAS安全上下文对应的所选的EPS NAS安全算法的一种示例包括：终端设备的ngKSI中没有对应的所选的EPS NAS安全算法，可以确定不存在5G NAS安全上下文对应的所选的EPS NAS安全算法。
在该种可能的实现方式中，终端设备支持S1模式，并且终端设备可以确定AMF网元支持N26接口。
S602，终端设备删除5G NAS安全上下文。
若终端设备确定不存在5G NAS安全上下文对应的所选的EPS NAS安全算法，则删除已经激活的5G NAS安全上下文。
可选的，若终端设备确定不存在5G NAS安全上下文对应的所选的EPS NAS安全算法，将ngKSI设为无效值，即将ngKSI的值设置为7。
S603，终端设备向接入和移动管理功能实体发送第二消息，第二消息用于请求5G NAS安全上下文。
作为一种示例，终端设备向接入和移动管理功能实体发送第二消息时，第二消息中携带ngKSI的值为7，7表示终端设备中不存在5G NAS安全上下文。
可选的，当接入和移动管理功能实体接收到来自终端设备的携带有ngKSI的值为7的第二消息后，接入和移动管理功能实体向终端设备发送第四消息，第四消息中包括一个ngKSI的有效值，ngKSI的有效值可以为0至6中任意一个整数值，每个整数值对应一套5G NAS安全上下文。其中，第四消息的一个示例为SMC消息。
若终端设备根据接入和移动管理功能实体发送的携带有ngKSI的有效值的第四消息成功激活了5G NAS安全上下文，则终端设备向接入和移动管理功能实体发送第四完成消息，第四完成消息用于表示终端设备已接收到接入和移动管理功能实体发送的ngKSI的有效值，并根据ngKSI的有效值成功激活了该ngKSI的有效值对应的5G NAS安全上下文。其中，第四完成消息的一个示例为SMC完成消息。
可选的，能够使接入和移动管理功能实体获知向终端设备提供5G NAS安全上下文的消息都可以称为本申请实施例中的第二消息。
例如，第二消息可以是注册请求消息，接入和移动管理功能实体可以根据注册请求消息中携带的ngKSI的值来判断终端设备中是否存在5G NAS安全上下文，若注册请求消息中携带的ngKSI的值为7，表示终端设备中不存在5G NAS安全上下文，接入和移动管理功能实体需要为终端设备提供5G NAS安全上下文。
S604，终端设备接收来自接入和移动管理功能实体的所选的EPS NAS安全算法的信元。
作为一个示例，终端设备在重新激活了5G NAS安全上下文之后，能够接收5G NAS安全上下文发送的第五消息，第五消息中包括5G NAS安全上下文确定的所选的EPS NAS安全算法的信元，所选的EPS NAS安全算法的信元可以为0至7中任意一个整数值，每个整数值对应一个所选的EPS NAS安全算法。其中，第五消息的一个示例为SMC消息。
本申请提出的技术方案中，在终端设备中已经存在5G NAS安全上下文的情况下，首先确定终端设备的5G NAS安全上下文中是否存在对应的所选的EPS NAS安全算法，若终端设备确定5G NAS安全上下文中不存在对应的所选的EPS NAS安全算法，则将5G NAS安全上下文删除，重新向接入和移动管理功能实体请求5G NAS安全上下文，接入和移动管理功能实体再次向终端设备发送5G NAS安全上下文和对应的所选的EPS NAS安全算法的信元，确保了终端设备能够成功配置EPS NAS安全算法。
图7为本申请又一个实施例的配置EPS NAS安全算法的方法的流程示意图。如图7所示，该方法至少包括S701至S719。在本实施例中，接入和移动管理功能实体为AMF网元。
S701，UE向AMF网元发送注册请求消息，该注册请求消息中携带ngKSI的值为7。为了便于描述，该注册请求消息可以称为第一注册请求消息。
S702，AMF网元向UE发送申请认证请求(identity request)消息。
S703，UE向AMF网元发送身份认证回复(identity response)消息。
S704，AMF网元向UE发送鉴权认证请求(authentication request)消息。
S705，UE向AMF网元发送鉴权认证回复(authentication response)消息。
S706，AMF网元向UE发送SMC消息，该SMC消息中携带ngKSI的有效值。该SMC消息可以称为第一SMC消息。
S707，UE向AMF网元发送SMC完成信息。该SMC完成消息可以称为第一SMC完成消息。
本实施例中的S701至S707可以参考S401至S407，此处不再进行赘述。
S708，AMF网元向UE发送SMC消息，该SMC消息中携带所选的EPS NAS安全算法的信元。该SMC消息称为第二SMC消息。
S709，UE没有接收到AMF网元发送的第二SMC消息，删除5G NAS安全上下文。
本实施例中，UE没有接收到AMF网元发送的第二SMC消息的一种可能的原因为第一次注册流程中断导致第二SMC消息没有成功到达UE；另一种可能的原因为AMF网元并没有执行S708，即AMF网元并没有向UE发送所选的EPS NAS安全算法的信元。由此可知，本实施例中的S708是可选的，即不是必须执行的步骤。
在S707中，UE向AMF网元发送了第一SMC完成消息，表示UE已经成功激活了第一SMC消息中携带的ngKSI的有效值对应的5G NAS安全上下文。但UE没有接收到AMF网元发送的第二SMC消息，表示UE中不存在第二SMC消息中携带的所选的EPS NAS安全算法的信元对应的所选的EPS NAS安全算法，此时UE需要删除已经激活的5G NAS安全上下文，并向AMF网元再次发起注册请求，用于请求5G NAS安全上下文。
上述S701至S709可以称为第一次注册流程；下面描述的注册流程可以称为第二次注册流程。
S710，UE向AMF网元发送注册请求消息，该注册请求消息中携带ngKSI的值为7。该注册请求消息可以称为第二注册请求消息。
由于在S709中，UE删除了5G NAS安全上下文，故在UE向AMF网元发送的第 二注册请求消息中携带的ngKSI的值为7，7表示UE中无5G NAS安全上下文。
S711，AMF网元向UE发送身份认证请求(identity request)消息。
S712，UE向AMF网元发送身份认证回复(identity response)消息。
S713，AMF网元向UE发送鉴权请求(authentication request)消息。
S714，UE向AMF网元发送鉴权回复(authentication response)消息。
需要说明的是，S711至S714可以参考S402至S405，此处不再进行赘述。
S715，AMF网元向UE发送SMC消息，该SMC消息中携带ngKSI的有效值。该SMC消息可以称为第三SMC消息。
当UE通过了AMF网元的身份认证和鉴权认证之后，AMF网元向UE发送第三SMC消息，第三SMC消息中携带ngKSI的有效值，用来激活UE中的5G NAS安全上下文。
可选的，第三SMC消息中携带ngKSI的有效值与第一次SMC流程信息中携带ngKSI的有效值相同。
S716，UE向AMF网元发送SMC完成消息。该SMC完成消息可以称为第三SMC消息。
当UE成功接收AMF发送的第三SMC消息，并且根据第三SMC消息中携带的ngKSI的有效值成功激活了5G NAS安全上下文后，向AMF网元发送第三SMC完成消息，表示UE已经成功配置了ngKSI的有效值对应的5G NAS安全上下文。其中，ngKSI的有效值可以为0至6中任意一个整数值，每个整数值对应一个5G NAS安全上下文。
S717，AMF网元向UE发送SMC消息，该SMC消息中携带所选的EPS NAS安全算法的信元。该SMC消息可以称为第四SMC消息。
当AMF网元接收到UE发送的第三SMC完成消息后，向UE发送第四SMC消息，第四SMC消息中携带所选的EPS NAS安全算法的信元，用来为UE配置所选的EPS NAS安全算法的信元对应的所选的EPS NAS安全算法。
可选的，第四SMC消息中携带的所选的EPS NAS安全算法的信元与第二SMC消息中携带的所选的EPS NAS安全算法的信元相同。
S718，UE向AMF网元发送SMC完成消息。该SMC完成消息可以称为第四SMC消息。
当UE成功配置AMF网元在第四SMC消息中携带的所选的EPS NAS安全算法的信元对应的所选的EPS NAS安全算法后，向AMF网元发送第四SMC完成消息。
S719，AMF网元向UE发送注册成功消息。
当UE根据第二注册请求消息注册成功后，AMF网元向UE发送注册成功消息。此时UE通过第二注册请求消息成功激活了5G NAS安全上下文，并成功配置了所选的EPS NAS安全算法。
本申请提出的技术方案中，UE在无5G NAS安全上下文时向AMF发起注册请求消息，当UE只接收到第一SMC消息，未接收到配置EPS NAS安全算法的第二SMC消息时，UE主动删除已经激活的5G NAS安全上下文，并在再次向AMF网元发起的注册请求消息中，向AMF网元请求5G NAS安全上下文，AMF网元再次向终端设备 发送5G NAS安全上下文和所选的EPS NAS安全算法的信元，确保了终端设备能够成功配置EPS NAS安全算法。
图8为本申请又一个实施例的配置EPS NAS安全算法的方法的流程示意图。本实施例适用于终端设备已经在LTE系统完成与NR系统的注册流程，并成功激活了5G NAS安全上下文时，与LTE系统断开连接并再次向NR系统请求注册的场景。如图8所示，该方法至少包括S801至S811。在本实施例中，接入和移动管理功能实体为AMF网元。
S801，UE确定当前的安全上下文中没有EPS NAS安全算法，删除当前的安全上下文。
UE在向NR系统发起注册请求之前，需要确定UE中当前的安全上下文中是否存在ngKSI对应的有效的EPS NAS安全算法。若UE中当前的安全上下文中不存在ngKSI对应的有效的EPS NAS安全算法，则将UE中当前的安全上下文删除，即将ngKSI中的NAS密钥集标识符的值改为7，7表示UE中不存在5G NAS安全上下文。
S802，UE向AMF网元发送注册请求消息，该注册请求消息中携带ngKSI的值为7。
S803，AMF网元向UE发送申请认证请求(identity request)消息。
S804，UE向AMF网元发送身份认证回复(identity response)消息。
S805，AMF网元向UE发送鉴权认证请求(authentication request)消息。
S806，UE向AMF网元发送鉴权认证回复(authentication response)消息。
S807，AMF网元向UE发送SMC消息，该SMC消息中携带ngKSI的有效值。该SMC消息可以称为第一SMC消息。
S808，UE向AMF网元发送SMC完成消息。该SMC完成消息可以称为第一SMC完成消息。
S809，AMF网元向UE发送SMC消息，该SMC消息中携带所选的EPS NAS安全算法的信元。该SMC消息称为第二SMC消息。
S810，UE向AMF网元发送SMC完成消息。
S811，AMF网元向UE发送注册完成信息。该SMC完成消息称为第二SMC完成消息。
本实施例中的S802至S811可以参考S710至S719，此处不再进行赘述。
本申请提出的技术方案中，UE在连接至LTE系统时完成与NR系统的注册流程，已经成功激活了5G NAS安全上下文，与LTE网络断开连接后，再次向NR系统发起注册请求时，首先判断UE中的5G NAS安全上下文中是否存在EPS NAS安全算法，若UE中的5G NAS安全上下文中不存在EPS NAS安全算法，则删除UE中的5G NAS安全上下文，并在注册请求中向AMF网元重新请求5G NAS安全上下文，AMF网元再次向UE发送5G NAS安全上下文和所选的EPS NAS安全算法的信元，确保了UE能够成功配置EPS NAS安全算法。
图9为本申请一个实施例的一种配置EPS NAS安全算法的装置的示意性结构图。如图9所示，装置900可以包括处理模块901和发送模块902。装置900可以用于实现图3至图5中任意一个所示的实施例中由接入和移动管理功能实体或AMF网元实 现的操作。
在一种可能的实现方式中，装置900可以用于实现上述图3所示的方法。例如，处理模块901用于实现S301，发送模块902用于实现S302。
在另一种可能的实现方式中，装置900还可以包括接收模块。该实现方式中的装置900可以用于实现上述图4所示的方法。例如，处理模块901用于实现S409和S411，发送模块902用于实现S402、S404、S406、S408、S412和S414，接收模块用于实现S401、S403、S405、S407、S410和S413。
在又一种可能的实现方式中，装置900还可以包括接收模块。该实现方式中的装置900可以用于实现上述图5所示的方法。例如，处理模块901用于实现S503和S505，发送模块902用于实现S502和S506，接收模块用于实现S501、S504和S507。
图10为本申请另一个实施例的一种配置EPS NAS安全算法的装置的示意性结构图。如图10所示，装置1000可以包括处理模块1001、发送模块1002和接收模块1003。装置1000可以用于实现图6至图8中任意一个所示的实施例中由终端设备实现的操作。
在一种可能的实现方式中，装置1000可以用于实现上述图6所示的方法。例如，处理模块1001用于实现S601和S602，发送模块1002用于实现S603，接收模块1003用于实现S604。
在另一种可能的实现方式中，装置1000可以用于实现上述图7所示的方法。例如，处理模块1001用于实现S709，发送模块1002用于实现S701、S703、S705、S707、S710、S712、S714、S716和S718，接收模块1003用于实现S702、S704、S706、S708、S711、S713、S715、S717和S719。
在又一种可能的实现方式中，装置1000可以用于实现上述图8所示的方法。例如，处理模块1001用于实现S801，发送模块1002用于实现S802、S804、S806、S808和S810，接收模块1003用于实现S803、S805、S807、S809和S811。
图11为本申请又一个实施例的一种配置EPS NAS安全算法的装置的示意性结构图。图11所示的装置1100可以用于执行图3至图5中任意一个所示的实施例中由接入和移动管理功能实体或AMF网元实现的方法或可以用于执行图6至图8中任意一个所示的实施例中由终端设备实现的方法。
如图11所示，本实施例的装置1100包括：存储器1101、处理器1102、通信接口1103以及总线1104。其中，存储器1101、处理器1102、通信接口1103通过总线1104实现彼此之间的通信连接。
存储器1101可以是只读存储器(read only memory，ROM)，静态存储设备，动态存储设备或者随机存取存储器(random access memory，RAM)。存储器1101可以存储程序，当存储器1101中存储的程序被处理器1102执行时，处理器1102可以用于执行图3至图8所示的方法的各个步骤。
处理器1102可以采用通用的中央处理器(central processing unit，CPU)，微处理器，应用专用集成电路(application specific integrated circuit，ASIC)，或者一个或多个集成电路，用于执行相关程序，以实现本申请方法实施例的配置EPS NAS安全算法的方法。
处理器1102还可以是一种集成电路芯片，具有信号的处理能力。在实现过程中， 本申请各个实施例的方法的各个步骤可以通过处理器1102中的硬件的集成逻辑电路或者软件形式的指令完成。
上述处理器1102还可以是通用处理器、数字信号处理器(digital signal processing，DSP)、专用集成电路(ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1101，处理器1102读取存储器1101中的信息，结合其硬件完成本申请实施例中各个方法所需执行的功能，例如，可以执行图3至图8所示实施例的各个步骤/功能。
通信接口1103可以使用但不限于收发器一类的收发装置，来实现装置1100与其他设备或通信网络之间的通信。
总线1104可以包括在装置1100各个部件(例如，存储器1101、处理器1102、通信接口1103)之间传送信息的通路。
应理解，本申请实施例所示的装置1100可以是电子设备，或者，也可以是配置于电子设备中的芯片。
应理解，本申请实施例中的处理器可以为中央处理单元(central processing unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的随机存取存储器(random access memory，RAM)可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
上述实施例，可以全部或部分地通过软件、硬件、固件或其他任意组合来实现。当使用软件实现时，上述实施例可以全部或部分地以计算机程序产品的形式实现。所 述计算机程序产品包括一个或多个计算机指令或计算机程序。在计算机上加载或执行所述计算机指令或计算机程序时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以为通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集合的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质。半导体介质可以是固态硬盘。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A,B可以是单数或者复数。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系，但也可能表示的是一种“和/或”的关系，具体可参考前后文进行理解。
本申请中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器、随机存取存储器、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (27)

  1. 一种配置演进分组系统EPS非接入层NAS安全算法的方法，其特征在于，所述方法包括：
    接入和移动管理功能实体确定没有成功为终端设备提供所选的EPS NAS安全算法；
    所述接入和移动管理功能实体向所述终端设备提供所述所选的EPS NAS安全算法。
  2. 根据权利要求1所述的方法，其特征在于，所述接入和移动管理功能实体确定没有成功为终端设备提供所选的EPS NAS安全算法之前，所述方法还包括：
    所述接入和移动管理功能实体向所述终端设备发送第一消息，所述第一消息包括所述所选的EPS NAS安全算法的信元。
  3. 根据权利要求1或2所述的方法，其特征在于，所述接入和移动管理功能实体确定没有成功为终端设备提供所选的EPS NAS安全算法包括：
    所述接入和移动管理功能实体确定未收到第一完成消息，所述第一完成消息用于表示所述终端设备已接收到所述第一消息。
  4. 根据权利要求3所述的方法，其特征在于，所述接入和移动管理功能实体确定未收到第一完成消息包括：
    所述接入和移动管理功能实体确定在预设时间内未收到所述第一完成消息。
  5. 根据权利要求3或4所述的方法，其特征在于，所述第一消息为安全模式命令SMC消息，所述第一完成消息为SMC完成消息。
  6. 根据权利要求1至5任一项所述的方法，其特征在于，所述接入和移动管理功能实体向所述终端设备提供所述所选的EPS NAS安全算法包括：
    所述接入和移动管理功能实体向所述终端设备发送所述所选的EPS NAS安全算法的信元。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，所述方法还包括：
    所述接入和移动管理功能实体将所述所选的EPS NAS安全算法标记为无效。
  8. 根据权利要求1至7中任一项所述的方法，其特征在于，所述接入和移动管理功能实体向所述终端设备提供所述所选的EPS NAS安全算法之前，所述方法还包括：
    所述接入和移动管理功能实体接收来自所述终端设备的注册请求消息。
  9. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述接入和移动管理功能实体确定更新所选的EPS NAS安全算法；
    所述接入和移动管理功能实体向所述终端设备提供更新后的所选的EPS NAS安全算法。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    所述接入和移动管理功能实体确定没有成功为所述终端设备提供更新后的所选的EPS NAS安全算法；
    所述接入和移动管理功能实体向所述终端设备提供所述更新后的所选的EPS NAS安全算法。
  11. 根据权利要求1至10中任一项所述的方法，其特征在于，所述接入和移动管 理功能实体支持N27接口，所述终端设备支持S1模式。
  12. 根据权利要求1至11中任一项所述的方法，其特征在于，所述接入和移动管理功能实体中存在所述终端设备指示的有效第五代移动通信5G NAS安全上下文。
  13. 一种配置演进分组系统EPS非接入层NAS安全算法的方法，其特征在于，所述方法包括：
    终端设备确定不存在第五代移动通信5G NAS安全上下文对应的所选的EPS NAS安全算法；
    所述终端设备删除所述5G NAS安全上下文；
    所述终端设备向接入和移动管理功能实体发送第二消息，所述第二消息用于请求所述5G安全上下文；
    所述终端设备接收来自所述接入和移动管理功能实体的所述所选的EPS NAS安全算法的信元。
  14. 根据权利要求13所述的方法，其特征在于，所述终端设备确定不存在5G NAS安全上下文对应的所选的EPS NAS安全算法包括：
    所述终端设备确定没有接收来自所述接入和移动管理功能实体的所选的EPS NAS安全算法的信元。
  15. 根据权利要求14所述的方法，其特征在于，所述终端设备确定没有接收来自所述接入和移动管理功能实体的所选的EPS NAS安全算法的信元包括：
    所述终端设备在预设时间内没有接收到来自所述接入和移动管理功能实体的所选的EPS NAS安全算法的信元。
  16. 根据权利要求13至15中任一项所述的方法，其特征在于，所述终端设备确定不存在5G NAS安全上下文对应的所选的EPS NAS安全算法之前，所述方法还包括：
    所述终端设备接收所述接入和移动管理功能实体发送的第三消息，所述第三消息包括所述5G NAS安全上下文；
    所述终端设备向所述接入和移动管理功能实体发送第三完成消息，所述第三完成消息用于表示所述终端设备已接收到所述第三消息。
  17. 根据权利要求13至16中任一项所述的方法，其特征在于，所述终端设备确定不存在5G NAS安全上下文对应的所选的EPS NAS安全算法包括：
    确定下一代无线接入网密钥集标识ngKSI没有对应的所选的EPS NAS安全算法。
  18. 根据权利要求17所述的方法，其特征在于，所述方法还包括：
    所述终端设备将所述ngKSI设为无效值。
  19. 根据权利要求17或18所述的方法，其特征在于，所述终端设备与长期演进LTE系统断开连接，所述第二消息用于请求注册至新无线NR系统。
  20. 根据权利要求19所述的方法，其特征在于，所述终端设备确定所述接入和移动管理功能实体支持N27接口。
  21. 根据权利要求13至20中任一项所述的方法，其特征在于，所述接入和移动管理功能实体支持N27接口，所述终端设备支持S1模式。
  22. 一种配置演进分组系统EPS非接入层NAS安全算法的装置，其特征在于，包括用于实现权利要求1至12中任一项所述的方法的各个功能模块。
  23. 一种配置演进分组系统EPS非接入层NAS安全算法的装置，其特征在于，包括用于实现权利要求13至21中任一项所述的方法的各个功能模块。
  24. 一种配置演进分组系统EPS非接入层NAS安全算法的装置，其特征在于，包括：存储器和处理器；
    所述存储器用于存储程序指令；
    所述处理器用于调用所述存储器中的程序指令执行如权利要求1至12中任一项所述的方法或权利要求13至21中任一项所述的方法。
  25. 一种芯片，其特征在于，包括至少一个处理器和通信接口，所述通信接口和所述至少一个处理器通过线路互联，所述至少一个处理器用于运行计算机程序或指令，以执行如权利要求1至12中任一项所述的方法或权利要求13至21中任一项所述的方法。
  26. 一种计算机可读介质，其特征在于，所述计算机可读介质存储用于计算机执行的程序代码，该程序代码包括用于执行如权利要求1至12中任一项所述的方法或权利要求13至21中任一项所述的方法的指令。
  27. 一种计算机程序产品，其特征在于，所述计算机程序产品包括指令，当所述指令被执行时，使得计算机执行权利要求1至12中任一项所述的方法或权利要求13至21中任一项所述的方法。
PCT/CN2022/075767 2021-02-10 2022-02-10 配置演进分组系统非接入层安全算法的方法及相关装置 WO2022171156A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP22752316.4A EP4290903A1 (en) 2021-02-10 2022-02-10 Method for configuring evolved packet system non-access stratum security algorithm, and related apparatus
JP2023548586A JP2024506102A (ja) 2021-02-10 2022-02-10 進化型パケットシステム非アクセス層セキュリティアルゴリズムを構成する方法、および関連装置
US18/232,227 US20230388802A1 (en) 2021-02-10 2023-08-09 Method for configuring evolved packet system non-access stratum security algorithm and related apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110183922.0 2021-02-10
CN202110183922.0A CN114915966A (zh) 2021-02-10 2021-02-10 配置演进分组系统非接入层安全算法的方法及相关装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/232,227 Continuation US20230388802A1 (en) 2021-02-10 2023-08-09 Method for configuring evolved packet system non-access stratum security algorithm and related apparatus

Publications (1)

Publication Number Publication Date
WO2022171156A1 true WO2022171156A1 (zh) 2022-08-18

Family

ID=82761984

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/075767 WO2022171156A1 (zh) 2021-02-10 2022-02-10 配置演进分组系统非接入层安全算法的方法及相关装置

Country Status (6)

Country Link
US (1) US20230388802A1 (zh)
EP (1) EP4290903A1 (zh)
JP (1) JP2024506102A (zh)
CN (1) CN114915966A (zh)
TW (1) TWI816295B (zh)
WO (1) WO2022171156A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021027439A1 (en) * 2019-08-14 2021-02-18 Mediatek Singapore Pte. Ltd. Apparatuses and methods for delivery of inter-system non-access stratum (nas) security algorithms

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101835156A (zh) * 2010-05-21 2010-09-15 中兴通讯股份有限公司 一种用户接入安全保护的方法及系统
CN102595369A (zh) * 2012-02-29 2012-07-18 大唐移动通信设备有限公司 一种nas算法的传输方法及装置
CN107786511A (zh) * 2016-08-27 2018-03-09 北京信威通信技术股份有限公司 集群系统中实现群组通信安全的方法
CN109644339A (zh) * 2017-01-30 2019-04-16 瑞典爱立信有限公司 连接模式期间5g中的安全性上下文处理
CN109819439A (zh) * 2017-11-19 2019-05-28 华为技术有限公司 密钥更新的方法及相关实体
CN112055984A (zh) * 2019-04-08 2020-12-08 联发科技（新加坡）私人有限公司 从非接入层透明容器失败恢复5g非接入层

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
TWI783184B (zh) * 2018-10-17 2022-11-11 新加坡商聯發科技（新加坡）私人有限公司 行動性更新時的使用者設備金鑰推導方法及相關使用者設備

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101835156A (zh) * 2010-05-21 2010-09-15 中兴通讯股份有限公司 一种用户接入安全保护的方法及系统
CN102595369A (zh) * 2012-02-29 2012-07-18 大唐移动通信设备有限公司 一种nas算法的传输方法及装置
CN107786511A (zh) * 2016-08-27 2018-03-09 北京信威通信技术股份有限公司 集群系统中实现群组通信安全的方法
CN109644339A (zh) * 2017-01-30 2019-04-16 瑞典爱立信有限公司 连接模式期间5g中的安全性上下文处理
CN109819439A (zh) * 2017-11-19 2019-05-28 华为技术有限公司 密钥更新的方法及相关实体
CN112055984A (zh) * 2019-04-08 2020-12-08 联发科技（新加坡）私人有限公司 从非接入层透明容器失败恢复5g非接入层

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; 3GPP System Architecture Evolution (SAE); Security architecture (Release 15)", 3GPP STANDARD; TECHNICAL SPECIFICATION; 3GPP TS 33.401, vol. SA WG3, no. V15.11.0, 27 March 2020 (2020-03-27), pages 1 - 163, XP051861198 *

Also Published As

Publication number Publication date
TW202239245A (zh) 2022-10-01
JP2024506102A (ja) 2024-02-08
CN114915966A (zh) 2022-08-16
EP4290903A1 (en) 2023-12-13
US20230388802A1 (en) 2023-11-30
TWI816295B (zh) 2023-09-21

Similar Documents

Publication Publication Date Title
US11812496B2 (en) User group session management method and apparatus
US11259344B2 (en) Network architecture and information exchange method and apparatus
JP7317139B2 (ja) ワイヤレス通信システムにおける制御プレーン上でのセルラー版モノのインターネット（ｃｉｏｔ）データ転送のための方法および装置
WO2019185062A1 (zh) 一种通信方法及装置
EP3461071A1 (en) Communication control method, and related network element
BR112020019997A2 (pt) método e aparelho de transmissão de pacote
EP3965446B1 (en) Communication method and device thereof
TW202040978A (zh) 處理流關聯丟失錯誤的方法及裝置
EP3860176B1 (en) Method, apparatus, and system for obtaining capability information of terminal
US20220272607A1 (en) Network Access Method and Communication Apparatus
US11602010B2 (en) Open control plane for mobile networks
US11463921B2 (en) Policy control method, apparatus, and system
EP3735092B1 (en) Transmission methods, transmission apparatus, computer readable storage medium and system
WO2019174582A1 (zh) 一种消息传输方法和装置
WO2020042848A1 (zh) 一种网络切片管理方法及装置
US11323931B2 (en) Communication method and apparatus for a terminal device moving from a first access node to a second access node
US20230388802A1 (en) Method for configuring evolved packet system non-access stratum security algorithm and related apparatus
JP2020504521A (ja) 無線リソース制御接続の再確立
WO2019137169A1 (zh) 数据传输方法、装置、设备及计算机可读存储介质
CN114884612A (zh) 用于传输业务报文的方法和装置
WO2021254116A1 (zh) 通信方法和装置
US11991516B2 (en) Session migration method and apparatus
WO2023185960A1 (zh) 通信方法及装置
WO2021238280A1 (zh) 一种通信方法、装置及系统
WO2023072271A1 (zh) 管理安全上下文的方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22752316

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2023548586

Country of ref document: JP

ENP Entry into the national phase

Ref document number: 2022752316

Country of ref document: EP

Effective date: 20230906

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 11202306026U

Country of ref document: SG