WO2022237441A1

WO2022237441A1 - Wireless communication method, communication device, and communication system

Info

Publication number: WO2022237441A1
Application number: PCT/CN2022/086588
Authority: WO
Inventors: 李飞; 舒林; 邓娟
Original assignee: 华为技术有限公司
Priority date: 2021-05-08
Filing date: 2022-04-13
Publication date: 2022-11-17
Also published as: CN115396868A

Abstract

The present application provides a wireless communication method, a communication device, and a communication system. The method comprises: generating a first message authentication code according to a first parameter update type and Kausf, the first parameter update type being a parameter update type supported by a terminal; and sending the first parameter update type and the first message authentication code to a mobility management network element. A terminal actively reports to a network side a parameter update type supported by the terminal, such that the network side can send a corresponding parameter to the terminal according to the parameter update type reported by the terminal, i.e., sending to the terminal the parameter corresponding to the parameter update type supported by the terminal, thereby preventing the network side from sending to the terminal a parameter corresponding to a parameter update type not supported by the terminal, such that resource waste can be reduced. Moreover, during a process of the terminal sending to the network side the parameter update type supported by the terminal, security protection is also implemented on the parameter update type by generating a message authentication code, so as to ensure that the network side can successfully receive the parameter update type supported by the terminal.

Description

A wireless communication method, communication device and communication system

Cross References to Related Applications

This application claims the priority of the Chinese patent application with the application number 202110501343.6 and the application title "a wireless communication method, communication device and communication system" submitted to the China Patent Office on May 08, 2021, the entire contents of which are incorporated by reference in this application.

technical field

The present application relates to the technical field of wireless communication, and in particular to a wireless communication method, communication device and communication system.

Background technique

In the current 3rd generation partnership project (3rd generation partnership project, 3GPP) standard, the protocol predefines the parameter update type supported by the terminal, so that the network side can know the parameter update type supported by the terminal according to the protocol definition. Subsequently, the network side may send parameters corresponding to the parameter update type to the terminal according to the parameter update type supported by the terminal.

However, when the network side has parameters corresponding to a new parameter update type that need to be updated to the terminal, since the network side does not know whether the terminal supports the new parameter update type, the network side cannot judge whether it is necessary to update the parameters corresponding to the new parameter update type Parameters are updated to the terminal.

If the network side directly updates the parameters corresponding to the new parameter update type to the terminal regardless of whether the terminal supports the new parameter update type, then when the terminal does not support the new parameter update type, the terminal needs to discard the received parameter. cause waste of resources.

Contents of the invention

The present application provides a wireless communication method, a communication device and a communication system, which are used to realize that the network side sends corresponding parameters to the terminal according to the parameter update type supported by the terminal, so as to reduce waste of resources.

In a first aspect, the embodiment of the present application provides a wireless communication method, and the method may be executed by a terminal or a module (such as a chip) applied to the terminal. The method includes: generating a first message authentication code according to a first parameter update type and Kausf, the first parameter update type is a parameter update type supported by the terminal, and the Kausf is a link between the terminal and an authentication network element An inter-key; sending the first parameter update type and the first message authentication code to a mobility management network element.

According to the above solution, the terminal actively reports the parameter update type supported by the terminal to the network side, so that the network side can send corresponding parameters to the terminal according to the parameter update type reported by the terminal, that is, send to the terminal the parameter corresponding to the parameter update type supported by the terminal, The network side is prevented from sending parameters corresponding to parameter update types not supported by the terminal to the terminal, thereby reducing waste of resources. Moreover, when the terminal sends the parameter update type supported by the terminal to the network side, the parameter update type is also protected by generating a message authentication code to ensure that the network side can successfully receive the parameter update type supported by the terminal.

In a possible implementation method, receiving a fifth message authentication code from the mobility management network element. The fifth message authentication code is generated according to the first confirmation information and the Kausf, and the first confirmation information It is used to indicate that the data management network element has successfully received the first parameter update type; and the fifth message authentication code is verified according to the second confirmation information and the Kausf.

According to the solution above, after sending the first parameter update type to the network side, the terminal further receives a message authentication code for the first parameter update type, that is, a fifth message authentication code from the network side. Then the terminal checks the fifth message authentication code. When the fifth MAC check is successful, it indicates that the network side has successfully received the first parameter update type. When the fifth MAC check fails, it indicates that the network side has not successfully received the first parameter update type. Parameter update type. Through this solution, the terminal can know whether the network side has successfully received the first parameter update type, avoiding the terminal from blindly repeatedly sending the first parameter update type to the network side, and helping to reduce overhead.

In a possible implementation method, when the verification of the fifth message authentication code is successful, the second confirmation information is saved; or, when the verification of the fifth message authentication code fails, the second confirmation information is discarded And/or reduce the priority of the public land mobile network PLMN where the terminal is located.

According to the above solution, when the verification of the fifth message authentication code succeeds, it indicates that the network side has successfully received the first parameter update type, and the terminal saves the second confirmation information, and the subsequent terminal confirms that the network side has successfully received the second confirmation information according to the stored second confirmation information. To the first parameter update type, so that the terminal can no longer send the first parameter update type to the network side, which helps to reduce overhead. When the fifth MAC check fails, it indicates that the network side has not successfully received the first parameter update type, the terminal discards the second confirmation information, and the subsequent terminal confirms that it has not saved the second confirmation information, then confirms that the network side has not successfully received the first parameter The update type, so that the terminal can send the first parameter update type again from the network side, which helps to improve the possibility that the network side successfully receives the first parameter update type. When the fifth MAC check fails, it indicates that the current network may not be secure enough, and there is a possibility of tampering with the transmitted information (such as the message authentication code sent by the network side to the terminal), so the terminal can reduce the priority of the PLMN where the terminal is located, thereby Risks posed by insecure networks can be reduced.

In a possible implementation method, after sending the first parameter update type and the first message authentication code to the mobility management network element, receiving the downlink non-access stratum transmission from the mobility management network element message; when the downlink non-access stratum transmission message contains parameters corresponding to the first parameter update type, it is determined that the data management network element has successfully received the first parameter update type; or, when the downlink non-access stratum The parameter corresponding to the first parameter update type is not included in the access layer transmission message, and the priority of the PLMN where the terminal is located is lowered.

According to the above solution, after the terminal sends the first parameter update type to the network side, it can determine whether the network side has successfully received the first parameter update type by checking whether the network side subsequently sends the parameter corresponding to the first parameter update type to the terminal. . This method does not require the network side to inform the terminal whether the network side has successfully received the first parameter update type through additional indication information (such as a message authentication code), but uses an implicit method to inform the terminal whether the network side has successfully received the first parameter update type. The parameter update type can reduce the signaling interaction between the network side and the terminal, which helps to reduce overhead.

In a possible implementation method, before generating the first message authentication code according to the first parameter update type and Kausf, it further includes one or more of the following: determining that a new global user identity is inserted in the terminal Module USIM; determine that the first parameter update type includes other parameter update types except routing indication update data and default configuration NSSAI update data; determine that the terminal is powered on; determine that the first parameter update type has not been sent; Or determine that no response to the first parameter update type has been received.

According to the above solution, the terminal reports the first parameter update type to the network only when a certain condition is met, which can avoid repeated reporting or invalid reporting, thereby reducing terminal overhead.

In a possible implementation method, send a registration request message to the mobility management network element, where the registration request message includes the first parameter update type and the first message authentication code; or, send the registration request message to the The mobility management network element sends an uplink non-access stratum transmission message, where the uplink non-access stratum transmission message includes the first parameter update type and the first message authentication code.

According to the above solution, in different application scenarios, the update type of the first parameter can be reported to the network side through various messages, which is relatively flexible.

In a possible implementation method, the first parameter update type includes one or more of the following:

Slice authentication credential update, protocol data unit PDU session authentication credential update.

In a second aspect, the embodiment of the present application provides a wireless communication method, and the method may be executed by a data management network element or a module (such as a chip) applied to the data management network element. The method includes: receiving a second parameter update type and a second message authentication code from the terminal; checking whether the second message authentication code matches a third message authentication code according to the second parameter update type, and the first message authentication code matches the third message authentication code. The three-message authentication code is generated according to the second parameter update type and Kausf; wherein, the Kausf is a key between the terminal and the authentication network element.

According to the above solution, the network side can receive the parameter update type supported by the terminal reported by the terminal, so that the network side can send corresponding parameters to the terminal according to the parameter update type supported by the terminal, that is, send the terminal supported parameter update type to the terminal The corresponding parameters prevent the network side from sending parameters corresponding to parameter update types that the terminal does not support to the terminal, thereby reducing blind sending on the network side and helping to reduce resource waste on the network side. In addition, the network side also performs security verification on the received parameter update type supported by the terminal, so as to ensure that the network side can successfully receive the parameter update type supported by the terminal, which helps to achieve correct communication between the network side and the terminal. communication.

In a possible implementation method, send the second parameter update type to the authentication network element; receive the third message authentication code from the authentication network element; verify the second message authentication Whether the code matches the third message authentication code.

According to the above solution, the authentication network element and the data management network element cooperate to verify whether the second message authentication code matches the third message authentication code, specifically, the authentication network element calculates the third message authentication code, and the The data management network element compares the second message authentication code with the third message authentication code, compared with the third message authentication code calculated by the authentication network element, and the second message authentication code and the third message authentication code calculated by the authentication network element The comparison of the three message authentication codes helps to reduce the load on the authentication network element.

In a possible implementation method, sending the second parameter update type and the second message authentication code to the authentication network element; receiving the verification result of the message authentication code from the authentication network element, the The verification result of the message authentication code is that the second message authentication code matches the third message authentication code or the second message authentication code does not match the third message authentication code.

According to the above scheme, the authentication network element checks whether the second message authentication code matches the third message authentication code, and sends the message authentication code check result to the data management network element. In this method, the authentication network element performs the verification. verification function, while the data management network element only needs to obtain the verification result of the message authentication code from the authentication network element, which can realize the decoupling of functions between different network elements and help reduce the amount of information transmission between network elements.

In a possible implementation method, a fourth message authentication code from the authentication network element is received, the fourth message authentication code is generated according to the first confirmation information and the Kausf, and the first confirmation information It is used to indicate that the parameter update type supported by the terminal is successfully received; and the fourth message authentication code is sent to the terminal.

According to the above scheme, after the network side successfully receives the parameter update type supported by the terminal, the fourth message authentication code is sent to the terminal to inform the terminal that the network side has successfully received the parameter update type supported by the terminal, which can prevent the terminal from blindly repeatedly sending the network The side sends the parameter update type supported by the terminal, which helps to reduce the overhead caused by the interaction between the network side and the terminal.

In a possible implementation method, when the second message authentication code matches the third message authentication code, save the second parameter update type; or, when the second message authentication code matches the third message authentication code If the message authentication codes do not match, the second parameter update type is discarded, and/or the priority of the PLMN where the terminal is located is lowered.

According to the above solution, if the second message authentication code matches the third message authentication code, it indicates that the second parameter update type received by the network side is the same as the first parameter update type sent by the terminal, that is, the network side successfully After receiving the parameter update type supported by the terminal, the network side can save the second parameter update type, so that the subsequent network side can send parameters corresponding to the second parameter update type to the terminal according to the second parameter update type, which helps to avoid The network side sends parameters corresponding to parameter update types that the terminal does not support to the terminal, thereby reducing waste of resources. If the second message authentication code does not match the third message authentication code, it indicates that the second parameter update type received by the network side is different from the first parameter update type sent by the terminal, that is, the network side has not successfully received The parameter update type supported by the terminal, the network side can discard the second parameter update type, so that the subsequent network side will not send the parameters corresponding to the second parameter update type to the terminal, which helps to prevent the network side from sending the terminal to the terminal. The parameters corresponding to the supported parameter update types can reduce resource waste. If the second message authentication code does not match the third message authentication code, it indicates that the current network may not be secure enough, and there is a possibility of tampering with the transmitted information (such as the first parameter update type sent by the terminal to the network side), so the network The priority of the PLMN where the terminal is located can be reduced, thereby reducing the risk caused by an insecure network.

In a third aspect, the embodiment of the present application provides a wireless communication method, which can be executed by an authentication network element or a module (such as a chip) applied to the authentication network element. The method includes: receiving a second parameter update type and a second message authentication code from a data management network element; generating a third message authentication code according to the second parameter update type and Kausf, and the Kausf is the terminal and the authentication the secret key between right network elements; verify whether the second message authentication code matches the third message authentication code; send the message authentication code verification result to the data management network element, and the message authentication code verification The verification result is that the second message authentication code matches the third message authentication code or the second message authentication code does not match the third message authentication code.

According to the above scheme, the authentication network element can verify the second message authentication code received by the data management network element, and send the verification result of the message authentication code to the data management network element, so that the data management network element can know the received Whether the second parameter update type has been tampered with. This solution can ensure that the data management network element can judge whether to use the second parameter update type, which helps to realize correct communication between the network side and the terminal.

In a possible implementation method, when the verification result of the message authentication code is that the second message authentication code matches the third message authentication code, a fourth message authentication code is generated according to the first confirmation information and the Kausf A message authentication code, where the first confirmation information is used to indicate that the data management network element has successfully received the parameter update type supported by the terminal; and sending the fourth message authentication code to the data management network element.

According to the above solution, when the verification result of the message authentication code is that the second message authentication code matches the third message authentication code, the authentication network element generates a fourth message authentication code and sends the fourth message authentication code to the data management The network element, so that the data management network element can send the fourth message authentication code to the terminal to inform the terminal that the network side has successfully received the parameter update type supported by the terminal, which can prevent the terminal from repeatedly sending the parameter update type supported by the terminal to the network side, Helps reduce the overhead between the terminal and the network side.

In a fourth aspect, the embodiment of the present application provides a wireless communication method, which can be executed by an authentication network element or a module (such as a chip) applied to the authentication network element. The method includes: receiving a second parameter update type from a data management network element; generating a third message authentication code according to the second parameter update type and Kausf, and the Kausf is a link between the terminal and the authentication network element a key; sending the third message authentication code to the data management network element.

According to the above scheme, the authentication network element can verify the second message authentication code received by the data management network element, and send the third message authentication code to the data management network element, so that the data management network element can authenticate the second message according to the second message. code and the third message authentication code to determine whether the received second parameter update type has been tampered with. This solution can ensure that the data management network element can judge whether to use the second parameter update type, which helps to realize correct communication between the network side and the terminal.

In a possible implementation method, receiving indication information from the data management network element, where the indication information is used to indicate that the second message authentication code matches the third message authentication code; according to the first confirmation information and the Kausf above, generating a fourth message authentication code; wherein, the first confirmation information is used to indicate that the data management network element has successfully received the parameter update type supported by the terminal; sending the first confirmation message to the data management network element Four Message Authentication Code.

According to the above solution, when receiving the indication information from the data management network element indicating that the second message authentication code matches the third message authentication code, the authentication network element generates a fourth message authentication code, and sends the fourth message authentication code to The message authentication code is sent to the data management network element, so that the data management network element can send the fourth message authentication code to the terminal to inform the terminal that the network side has successfully received the parameter update type supported by the terminal, which can prevent the terminal from repeatedly sending messages to the network side. Send the parameter update type supported by the terminal, which helps to reduce the overhead between the terminal and the network side.

In a fifth aspect, the embodiment of the present application provides a communication device, and the device may be a terminal, or may be a chip for the terminal. The device has the function of realizing any realization method of the first aspect above. This function may be implemented by hardware, or may be implemented by executing corresponding software on the hardware. The hardware or software includes one or more modules corresponding to the above functions.

In a sixth aspect, the embodiment of the present application provides a communication device, and the device may be a data management network element, or may be a chip or a module for the data management network element. The device has the function of implementing any implementation method of the second aspect above. This function may be implemented by hardware, or may be implemented by executing corresponding software on the hardware. The hardware or software includes one or more modules corresponding to the above functions.

In a seventh aspect, the embodiment of the present application provides a communication device, and the device may be an authentication network element, or may be a chip or a module used for the authentication network element. The device has the function of realizing any realization method of the above-mentioned third aspect or fourth aspect. This function may be implemented by hardware, or may be implemented by executing corresponding software on the hardware. The hardware or software includes one or more modules corresponding to the above functions.

In an eighth aspect, the embodiment of the present application provides a communication device, including a processor and a memory; the memory is used to store computer instructions, and when the device is running, the processor executes the computer instructions stored in the memory so that the device executes Any implementation method in the first aspect to the fourth aspect above.

In a ninth aspect, the embodiment of the present application provides a communication device, including a unit or means (means) for performing each step of any implementation method in the first aspect to the fourth aspect.

In a tenth aspect, the embodiment of the present application provides a communication device, including a processor and an interface circuit, the processor is configured to communicate with other devices through the interface circuit, and execute any implementation method in the first aspect to the fourth aspect above. The processor includes one or more.

In the eleventh aspect, the embodiment of the present application provides a communication device, including a processor coupled to the memory, and the processor is used to call the program stored in the memory to execute any implementation in the first aspect to the fourth aspect above method. The memory may be located within the device or external to the device. And there may be one or more processors.

In the twelfth aspect, the embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores instructions, and when it runs on the communication device, the above-mentioned first aspect to the fourth aspect Any implementation method of is executed.

In a thirteenth aspect, the embodiment of the present application also provides a computer program product, the computer program product includes a computer program or instruction, when the computer program or instruction is run by a communication device, any of the above first to fifth aspects The implementation method is executed.

In a fourteenth aspect, the embodiment of the present application further provides a chip system, including: a processor, configured to execute any implementation method in the first aspect to the fourth aspect above.

In a fifteenth aspect, the embodiment of the present application provides a communication system, the communication system includes a data management network element for performing any implementation method of the above second aspect, and an authentication network element for performing any implementation method of the above third aspect. right network element.

In a sixteenth aspect, the embodiment of the present application provides a communication system, the communication system includes a data management network element for performing any implementation method of the above second aspect, and an authentication network element for performing any implementation method of the above fourth aspect. right network element.

Description of drawings

Figure 1 is a parameter configuration architecture diagram defined by 3GPP;

FIG. 2 is a schematic diagram of a wireless communication method provided by an embodiment of the present application;

FIG. 3 is a schematic diagram of a wireless communication method provided by an embodiment of the present application;

FIG. 4 is a schematic diagram of a wireless communication method provided by an embodiment of the present application;

FIG. 5 is a schematic diagram of a wireless communication method provided by an embodiment of the present application;

FIG. 6 is a schematic diagram of a wireless communication method provided by an embodiment of the present application;

FIG. 7 is a schematic diagram of a wireless communication method provided by an embodiment of the present application;

FIG. 8 is a schematic diagram of a wireless communication method provided by an embodiment of the present application;

FIG. 9 is a schematic diagram of a communication device provided by an embodiment of the present application;

FIG. 10 is a schematic diagram of a communication device provided by an embodiment of the present application.

Detailed ways

Fig. 1 is a parameter configuration architecture diagram defined by 3GPP. Wherein, the home network delivers the configuration information to the terminal through the service network. Specifically, the unified data management (unified data management, UDM) network element of the home network sends the configuration information to the terminal through the access and mobility management function (AMF) network element of the serving network.

In a non-roaming scenario, the serving network and the home network are the same public land mobile network (PLMN).

In the roaming scenario, the serving network is the visited network, and the serving network and the home network are different PLMNs. Wherein, the visited network may be a visited PLMN (visited PLMN, vPLMN), and the home network may be a home public land mobile network (home public land mobile network, hPLMN).

A terminal may also be called terminal equipment, user equipment (user equipment, UE), mobile station, mobile terminal, and so on. Terminals can be widely used in various scenarios, such as device-to-device (D2D), vehicle-to-everything (V2X) communication, machine-type communication (MTC), Internet of Things ( internet of things, IOT), virtual reality, augmented reality, industrial control, autonomous driving, telemedicine, smart grid, smart furniture, smart office, smart wearables, smart transportation, smart city, etc. Terminals can be mobile phones, tablet computers, computers with wireless transceiver functions, wearable devices, vehicles, drones, helicopters, airplanes, ships, robots, robotic arms, smart home devices, etc. The embodiment of the present application does not limit the specific technology and specific device form adopted by the terminal.

The AMF network element performs functions such as mobility management and access authentication/authorization. In addition, it is also responsible for transmitting user policies between terminals and policy control function (policy control function, PCF) network elements.

The UDM network element performs functions such as managing subscription data and user access authorization.

The authentication server function (authentication server function, AUSF) network element is responsible for authenticating users to determine whether users or devices are allowed to access the network.

The mobility management network element, data management network element, and authentication network element in the embodiment of the present application may be AMF, UDM, and AUSF in the fifth generation (5th generation, 5G) network, or they may be, or they may be in the future Network elements with the functions of the above-mentioned AMF, UDM, and AUSF in communication such as the sixth generation (6th generation, 6G) network, which are not limited in this application. In the embodiment of the present application, AMF, UDM, and AUSF are respectively used as examples of mobility management network elements, data management network elements, and authentication network elements for description.

In order to solve the problem that the network side cannot determine whether the parameters corresponding to the new parameter update type need to be updated to the terminal, the solution provided by the implementation of this application can refer to the wireless communication method shown in Figure 2, including the following steps:

Step 201, the terminal generates a first message authentication code (message authentication code, MAC) according to the first parameter update type and Kausf.

The first parameter update type is a parameter update type supported by the terminal. For example, the first parameter update type may be other parameter update types supported by the terminal except "routing indicator update data" and "default configured NSSAI update data", such as the supported terminal parameter update data set type list (supported UE parameters update data set types list), for example including update of slice authentication credentials, and/or update of secondary authentication credentials. The "credentials" here can be understood as parameters. Wherein, the update of the secondary authentication credential may also be referred to as the update of the protocol data unit session authentication credential.

Among them, the Chinese name of routing indicator update data is routing instruction update data, and the Chinese name of default configured NSSAI update data is the default configuration of network slicing selection assistance information (network slicing selection assistance information, NSSAI) update data.

The reason why these two parameter update types are excluded in one implementation is that the terminals of the existing 3GPP version support these two parameter update types, and UDM knows that the terminal supports these two parameter update types, so there is no need to report . Of course, it is also possible to report these two parameter update types.

As an implementation method, the first parameter update type may also include routing indication update data and default configuration NSSAI update data to be compatible with old features.

The Kausf is the key between the terminal and AUSF. As an implementation method, Kausf is used as a key (key), and the first parameter update type is used as an input parameter to calculate the first MAC. As another implementation method, Kausf is used as a key (key), and the first parameter update type and the first count value are used as input parameters to calculate the first MAC. The first MAC is used to prevent the first parameter update type from being tampered with during sending. Among them, Kausf is the key between the terminal and AUSF.

As an implementation method, the terminal may directly perform the above step 201, that is, send the first parameter update type to the network side.

As another implementation method, when one or more of the following conditions 1 to 5 are met, the terminal determines to send the first parameter update type to the network side, that is, executes the above step 201:

Condition 1, a new universal subscriber identity module (USIM) card is inserted into the terminal.

That is, when a USIM card is newly inserted, the terminal may be triggered to send the first parameter update type to the UDM.

Condition 2, the newly inserted USIM card supports the first parameter update type.

That is, when the new card supports the first parameter update similarity, the terminal may be triggered to send the first parameter update type to the UDM.

Condition 3, the terminal is turned on.

That is, when the terminal is turned on, the terminal may be triggered to send the first parameter update type to the UDM.

Condition 4, the first parameter update type has not been sent to the UDM.

That is, when the first parameter update type has not been sent to the UDM, the first parameter update type may be sent to the UDM.

Condition 5, no response for the first parameter update type has been received from the UDM.

That is, when the terminal sends the first parameter update type to the UDM but does not receive a response from the UDM, the terminal may resend the first parameter update type to the UDM.

Wherein, the response here may be a MAC, such as the fifth MAC as described below.

Step 202, the terminal sends the first parameter update type and the first MAC to the AMF.

As an implementation method, the terminal carries the first parameter update type and the first MAC in the registration request message sent to the AMF.

As another implementation method, the terminal carries the first parameter update type and the first MAC in an uplink non-access stratum (non access stratum, NAS) transmission message sent to the AMF.

According to the above scheme, the terminal actively reports the parameter update type supported by the terminal to the network side, that is, the first parameter update type, so that the network side can send corresponding parameters to the terminal according to the first parameter update type, that is, send the terminal the same parameter as the first parameter update type. The parameters corresponding to the update type avoid the network side from sending to the terminal the parameters corresponding to the parameter update type not supported by the terminal, thereby reducing waste of resources. Moreover, when the terminal sends the parameter update type supported by the terminal to the network side, the parameter update type is also protected by generating a message authentication code, that is, the first MAC, so as to ensure that the network side can successfully receive the terminal support. The parameter update type for .

Wherein, what the terminal sends is the first parameter update type and the first MAC, and what the AMF receives is the second parameter update type and the second MAC. Under normal circumstances, the type of the second parameter update received by the AMF is the same as the type of the first parameter update sent by the terminal, and the second MAC received by the AMF is the same as the first MAC sent by the terminal. But when the network is not secure enough, the above information sent by the terminal may be tampered with, resulting in the second parameter update type received by the AMF may be different from the first parameter update type sent by the terminal, and the second MAC received by the AMF is the same as the one sent by the terminal. The first MAC may be different.

After receiving the second parameter update type and the second MAC, the AMF sends the second parameter update type and the second MAC to the UDM. Subsequently, the UDM can verify the received second MAC according to the second parameter update type. If the second MAC verification is successful, the UDM confirms that the parameter update type supported by the terminal has been successfully received, that is, the UDM receives The second parameter update type is the same as the first parameter update type sent by the terminal.

Wherein, the UDM checks the received second MAC, which may also be referred to as the UDM checking whether the second MAC matches the third MAC, and the third MAC is generated by the AUSF according to the second parameter update type and Kausf.

As an example, two verification methods are introduced below, that is, the following implementation method 1 and implementation method 2.

Implementation method 1: UDM sends the second parameter update type to AUSF, AUSF generates a third MAC according to the second parameter update type and Kausf, AUSF sends the third MAC to UDM, and UDM checks whether the second MAC matches the third MAC. Wherein, when the second MAC is the same as the third MAC, the verification of the second MAC is successful, or referred to as verifying that the second MAC matches the third MAC. When the second MAC is different from the third MAC, the verification of the second MAC fails, or it is called that the verification of the second MAC does not match the third MAC.

Implementation method 2: UDM sends the second parameter update type to AUSF, AUSF generates a third MAC according to the second parameter update type and Kausf, AUSF sends the third MAC to UDM, and AUSF checks whether the second MAC matches the third MAC. Then, the AUSF sends the MAC verification result to the UDM, and the MAC verification result is that the second MAC matches the third MAC or the second MAC does not match the third MAC.

If the second message authentication code matches the third message authentication code, it indicates that the second parameter update type received by the network side is the same as the first parameter update type sent by the terminal, that is, the network side successfully receives the terminal support Parameter update type, the network side can save the second parameter update type, so that the subsequent network side can send the parameters corresponding to the second parameter update type to the terminal according to the second parameter update type, which helps to prevent the network side from sending the terminal Parameters corresponding to parameter update types not supported by the terminal are sent, thereby reducing waste of resources. If the second message authentication code does not match the third message authentication code, it indicates that the second parameter update type received by the network side is different from the first parameter update type sent by the terminal, that is, the network side has not successfully received The parameter update type supported by the terminal, the network side can discard the second parameter update type, so that the subsequent network side will not send the parameters corresponding to the second parameter update type to the terminal, which helps to prevent the network side from sending the terminal to the terminal. The parameters corresponding to the supported parameter update types can reduce resource waste. If the second message authentication code does not match the third message authentication code, it indicates that the current network may not be secure enough, and there is a possibility of tampering with the transmitted information (such as the first parameter update type sent by the terminal to the network side), so the network The priority of the PLMN where the terminal is located can be reduced, thereby reducing the risk caused by an insecure network.

Wherein, if the MAC verification result shows that the second MAC matches the third MAC, it indicates that the UDM has successfully received the parameter update type supported by the terminal, and the UDM may also inform the terminal that the UDM has successfully received the parameter update type supported by the terminal. Two different methods are described below, namely the implementation method A and the implementation method B below.

To implement method A, the UDM sends a fourth MAC to the terminal. The fourth MAC is generated by the AUSF according to the first confirmation information and Kausf. The first confirmation information is used to indicate that the parameter update type supported by the terminal is successfully received. After receiving the fifth MAC, the terminal verifies the fifth MAC according to the second confirmation information and Kausf.

Wherein, what the UDM sends is the fourth MAC, and what the terminal receives is the fifth MAC. Under normal circumstances, the fifth MAC is the same as the fourth MAC. If there is a security risk in the network, the fourth MAC sent by the UDM may be tampered with, and the fifth MAC received by the terminal may be different from the fourth MAC.

Wherein, the second confirmation information used when the terminal checks the fifth MAC is the same confirmation information as the first confirmation information used when the AUSF generates the fourth MAC, for example, it may be the same 1-bit information.

As an implementation method, the method for the terminal to verify the fifth MAC may be, for example, using Kausf as a key and using the second confirmation information as an input parameter to calculate and obtain the sixth MAC. Then the terminal judges whether the sixth MAC is the same as the fifth MAC. When the sixth MAC is the same as the fifth MAC, the verification of the fifth MAC succeeds, and when the sixth MAC is different from the fifth MAC, the verification of the fifth MAC fails. The successful verification of the fifth MAC also means that the fourth MAC sent by the UDM is the same as the fifth MAC received by the terminal.

When the verification of the fifth message authentication code succeeds, it indicates that the network side has successfully received the first parameter update type, then the terminal can save the second confirmation information, and the subsequent terminal confirms that the network side has successfully received the second confirmation information according to the saved second confirmation information. A parameter update type, so that the terminal can no longer send the first parameter update type to the network side, which helps to reduce overhead. When the fifth MAC check fails, it indicates that the network side has not successfully received the first parameter update type, then the terminal can discard the second confirmation information, and the subsequent terminal confirms that it has not saved the second confirmation information, then confirms that the network side has not successfully received the second confirmation information. A parameter update type, so that the terminal can send the first parameter update type again from the network side, which helps to improve the possibility that the network side successfully receives the first parameter update type. When the fifth MAC check fails, it indicates that the current network may not be secure enough, and there is a possibility of tampering with the transmitted information (such as the message authentication code sent by the network side to the terminal), so the terminal can reduce the priority of the PLMN where the terminal is located, thereby Risks posed by insecure networks can be reduced.

As an implementation method, when the UDM checks the second MAC through the above implementation method 1, the method for the UDM to obtain the fourth MAC may be: when the MAC check result generated by the AUSF is that the second MAC matches the third MAC , the AUSF generates a fourth MAC according to the first confirmation information and Kausf, and then the AUSF sends the fourth MAC to the UDM.

As another implementation method, when the UDM checks the second MAC through the above implementation method 2, the method for the UDM to obtain the fourth MAC may be: when the UDM determines that the second MAC matches the second MAC, it sends indication information to the AUSF , the indication information is used to indicate that the second MAC matches the third MAC; then, according to the indication information, the AUSF triggers generation of a fourth MAC according to the first confirmation information and Kausf, and then the AUSF sends the fourth MAC to the UDM.

To implement method B, the terminal receives a downlink non-access stratum transmission message from the AMF, wherein, when the downlink non-access stratum transmission message contains parameters corresponding to the first parameter update type, it is determined that the UDM has successfully received the first parameter update type, and when The downlink non-access stratum transmission message does not include the parameters corresponding to the first parameter update type, and it is determined that the UDM has not successfully received the first parameter update type, and then the terminal may lower the priority of the PLMN where the terminal is located.

Specifically, when the UDM sends parameters to the terminal, if the second MAC matches the third MAC, the UDM can send the parameter corresponding to the second parameter update type to the terminal, where the second parameter update type is the same as the first MAC address. A parameter update of the same type. If the second MAC does not match the third MAC, the UDM does not send the parameter corresponding to the second parameter update type to the terminal, where the second parameter update type may be the same as or different from the first parameter update type. The terminal judges whether the UDM has successfully received the first parameter update type by judging whether the UDM has sent the parameter corresponding to the first parameter update type.

The method shown in FIG. 2 above will be specifically described below in conjunction with the different specific implementation solutions shown in FIG. 3 to FIG. 6 below.

Fig. 3 is a kind of wireless communication method provided by the embodiment of the present application, the method includes the following steps:

Step 301, the terminal sends a first request to the AMF. Correspondingly, the AMF receives the first request.

The first request may be a registration request or an uplink NAS transport (UL NAS transport) message.

The first request includes a first parameter update type and a first MAC, and optionally also includes a first count value (counter) and/or an acknowledgment indication (ACK indication).

When the first count value is used when calculating the first MAC, the first count value needs to be carried in the first request.

Wherein, the acknowledgment indication is used to indicate to return a response after receiving the first parameter update type, and the response may include a MAC.

Optionally, when any one or more of conditions 1 to 5 described in step 201 above is satisfied, the first request carries the first parameter update type and the first MAC, and optionally, also carries A first count value and/or a confirmation indication.

As an implementation method, the first parameter update type and the first MAC can be encapsulated into a container (container), which is transparent to AMF, that is, AMF does not need to read the content of the container, and AMF directly This container is passed to UDM. Optionally, the container further includes a first count value and/or a confirmation indication.

It should be noted that if this solution is applied to the initial registration scenario, the first request may be a registration request, and the registration request may be carried in a security mode complete (security mode complete) message, and the security mode completion message may be the registration request For security protection.

In step 302, the AMF sends a second request to the UDM. Correspondingly, the UDM receives the second request.

Wherein, the terminal sends the first parameter update type, the first MAC and the first count value, and the UDM receives the second parameter update type, the second MAC and the second count value. Under normal circumstances, the second parameter update type received by the UDM is the same as the first parameter update type sent by the terminal, the second MAC received by the UDM is the same as the first MAC sent by the terminal, and the second count value received by the UDM is the same as The first count values sent by the terminal are the same. However, when the network is not secure enough, the above information sent by the terminal may be tampered with, resulting in that the second parameter update type received by UDM may be different from the first parameter update type sent by the terminal, and the second MAC received by UDM is the same as that sent by the terminal. The first MAC may be different, and the second count value received by the UDM may be different from the first count value sent by the terminal.

The second request includes a second parameter update type and a second MAC.

Wherein, when the first request includes the first count value, the second request also includes the second count value. When the first request includes the confirmation indication, the second request also includes the confirmation indication.

The second request may be a UE context management registration request, a subscription data management acquisition request, or a subscription data management notification message.

In step 303, the UDM sends a third request to the AUSF. Correspondingly, the AUSF receives the third request.

The third request includes a permanent subscription identifier (subscription permanent identifier, SUPI), a second parameter update type, and a second MAC.

Wherein, when the second request includes the second count value, the third request also includes the second count value. When the second request includes an acknowledgment indication, the third request also includes an acknowledgment indication.

The second request may be a UE parameter update (UE parameter update, UPU) protection request or a UPU data type verification request.

Among them, SUPI is used to uniquely identify a terminal. AUSF can obtain the key (Kausf) corresponding to the SUPI according to the SUPI. That is, the AUSF stores Kausf corresponding to each terminal, and the AUSF needs to obtain the corresponding Kausf according to the SUPI, so as to ensure that the AUSF and the terminal use the same Kausf.

In step 304, the AUSF checks the second MAC.

Checking the second MAC here may also be described as: checking the second parameter update type, or as: checking whether the second parameter update type matches the second MAC. Specifically, the AUSF generates the third MAC in the same way as the terminal generates the first MAC. If the third MAC is the same as the second MAC, the verification of the second MAC is successful, indicating that the first parameter update type has not been tampered with during transmission, that is, the second parameter update type is the same as the first parameter update type. If the second MAC is different from the first MAC, the verification of the second MAC fails, indicating that the first parameter update type may be tampered with during transmission, that is, the second parameter update type may be different from the first parameter update type.

The specific process for the AUSF to generate the third MAC is as follows: As an implementation method, the third MAC is calculated by using Kausf as a key and the second parameter update type received by the AUSF as an input parameter. As another implementation method, if the third request also carries the second count value, AUSF uses Kausf as the key, uses the second parameter update type and the second count value received by AUSF as input parameters, and calculates the third MAC.

Wherein, the AUSF checks the second MAC, which may also be referred to as whether the AUSF checks whether the third MAC matches the second MAC.

In step 305, the AUSF generates a fourth MAC.

Wherein, when the third request contains an acknowledgment indication, and the second MAC verification is successful in step 304, the AUSF executes the step 305; If it fails, the AUSF does not execute step 305.

Wherein, the method for AUSF to generate the fourth MAC is: AUSF generates the first acknowledgment information (ACK) according to the acknowledgment indication, then uses Kausf as the key, and uses the first acknowledgment information and the second count value as input parameters to calculate the fourth MAC . Wherein, the count value used when generating the fourth MAC is the same as the count value used when generating the third MAC, both being the second count value. It should be noted that the first confirmation information used by the AUSF may also be sent to the AUSF by the UDM.

Wherein, the first confirmation information is used to indicate that the UDM has successfully received the first parameter update type or the UDM has successfully verified the received parameter update type.

The generation of the first acknowledgment information (ACK) described in this application only means that the AUSF performs MAC calculation according to the first acknowledgment information, and does not necessarily require the generation of the first acknowledgment information, because the first acknowledgment information can be fixed 1-bit data, It can be directly used as the input to calculate the MAC, and does not need to be generated.

In step 306, the AUSF sends a third response to the UDM. Correspondingly, the UDM receives the third response.

The third response is a response to the third request.

The third response includes the MAC check result. Wherein, the MAC verification result is success of the second MAC verification or failure of the second MAC verification.

The MAC verification result here may also be described as: the result of verifying the second parameter update type, or as: the result of verifying whether the second parameter update type matches the second MAC.

Optionally, the third response further includes a fourth MAC. When the third response includes the fourth MAC, optionally the third response may also include the first confirmation information.

Step 307, when the MAC verification result is that the second MAC verification is successful, the UDM saves the second parameter update type; when the MAC verification result is the second MAC verification failure, the UDM discards the second parameter update type and/or reduces The priority of the PLMN where the terminal is located.

Wherein, the result of the MAC verification is that the verification of the second MAC is successful, which can also be understood as that the second MAC matches the third MAC. The result of the MAC verification is that the second MAC verification fails, which can also be understood as the fact that the second MAC does not match the third MAC.

The reason why the priority of the PLMN where the terminal is located is lowered is that there may be a problem of tampering with the transmitted information (such as the update type of the first parameter) in the network, so there may be a security risk.

Step 308, the UDM sends a second response to the AMF. Correspondingly, the AMF receives the second response.

The second response carries the fourth MAC.

Wherein, when the UDM receives the fourth MAC from the AUSF, the step 308 is performed; when the UDM does not receive the fourth MAC from the AUSF, the step 308 may not be performed.

Step 309, the AMF sends a first response to the terminal. Correspondingly, the terminal receives the first response.

When the first request is a registration request, the first response is a registration acceptance, or a downlink NAS transport (DL NAS transport) message.

When the first request is an uplink NAS transport message, the first response is a downlink NAS transport (DL NAS transport) message.

The first response includes the fifth MAC.

Wherein, the UDM sends the fourth MAC, and the first response received by the terminal carries the fifth MAC. Under normal circumstances, the fifth MAC is the same as the fourth MAC. If there is a security risk in the network, the fourth MAC sent by the UDM may be tampered with, and the fifth MAC received by the terminal may be different from the fourth MAC. It should be noted that the fourth MAC sent by the UDM may be tampered before the AMF sends the first response, or may be tampered on the air interface after the AMF sends the first response.

Step 310, the terminal checks the fifth MAC.

Under normal circumstances, the fifth MAC received by the terminal is the same as the fourth MAC sent by the UDM. However, when the network is not secure enough, the fourth MAC sent by the UDM may be tampered with, so that the fifth MAC received by the terminal may be different from the fourth MAC sent by the UDM.

Specifically, the terminal verifies the fifth MAC according to the second confirmation information and Kausf. Wherein, checking the fifth MAC here may also be described as: checking the second confirmation information, or as: checking whether the second confirmation information matches the fifth MAC.

Wherein, when the terminal receives the fifth MAC, the step 310 is performed; when the terminal does not receive the fifth MAC, the step 310 is not performed.

Wherein, when the fifth MAC is the same as the fourth MAC, the fifth MAC is generated according to the first confirmation information and Kausf.

Specifically, the terminal generates the sixth MAC in the same way as the AUSF generates the fourth MAC. If the sixth MAC is the same as the fifth MAC, the verification of the fifth MAC is successful, indicating that the UDM has successfully received the parameter update type (ie, the first parameter update type) supported by the terminal, and also indicates that the fourth MAC has not been blocked during transmission. tamper. If the sixth MAC is different from the fifth MAC, then the verification of the fifth MAC fails, indicating that the fourth MAC has been tampered with during transmission.

The specific process for the terminal to generate the sixth MAC is: using Kausf as a key, and using the second confirmation information and the first count value as input parameters to obtain the sixth MAC through calculation. Wherein, the count value used to generate the sixth MAC is the same as the count value used to generate the first MAC, and both are the first count value.

Wherein, the second confirmation information used when the terminal generates the sixth MAC is the same confirmation information as the first confirmation information used when the AUSF generates the fourth MAC, for example, it may be the same 1-bit information.

Wherein, the second confirmation information may be generated by the terminal, or when the terminal needs to generate the sixth MAC, the terminal directly uses the second confirmation information as an input for calculating the sixth MAC, that is, the second confirmation information may not be generated, but It is to directly use the second confirmation information.

It should be noted that, after receiving the fifth MAC, the terminal may trigger the terminal to calculate the sixth MAC, and use the sixth MAC to check the fifth MAC. Alternatively, when the terminal determines in the above step 301 that the confirmation indication is to be carried in the first request, the terminal can calculate and save the sixth MAC before sending the first MAC, and after receiving the fifth MAC, The fifth MAC is verified using the sixth MAC.

As an implementation method, when the fifth MAC verification succeeds, the terminal stores the second confirmation information. When the fifth MAC check fails, the terminal discards the second confirmation information and/or reduces the priority of the PLMN where the terminal is located.

According to the above solution, the terminal actively reports the parameter update type supported by the terminal to the network side, so that the network side can send corresponding parameters to the terminal according to the parameter update type reported by the terminal, that is, send to the terminal the parameter corresponding to the parameter update type supported by the terminal, The network side is prevented from sending parameters corresponding to parameter update types not supported by the terminal to the terminal, thereby reducing waste of resources. Moreover, when the terminal sends the parameter update type supported by the terminal to the network side, the parameter update type is also protected by generating a MAC to ensure that the network side can successfully receive the parameter update type supported by the terminal.

FIG. 4 is a wireless communication method provided by the embodiment of the present application. The difference between this method and the above-mentioned method in FIG. 3 is:

In the method in Fig. 3, UDM checks whether the second MAC matches the third MAC according to the second parameter update type: UDM sends the second parameter update type and the second MAC to AUSF, and AUSF updates according to the second parameter Type and Kausf generate the third MAC, and then AUSF judges whether the third MAC is the same as the second MAC, and generates a MAC verification result, and the MAC verification result is that the second MAC matches the third MAC or the second MAC does not match the third MAC. match, and then the AUSF sends the MAC check result to the UDM. Therefore, the UDM acquires whether the second MAC matches the third MAC according to the MAC verification result.

In the method in Fig. 4, UDM checks whether the second MAC matches the third MAC according to the second parameter update type: UDM sends the second parameter update type to AUSF, which is generated by AUSF according to the second parameter update type and Kausf The third MAC, the AUSF sends the third MAC to the UDM, and then the UDM checks whether the second MAC matches the third MAC, that is, determines whether the third MAC is the same as the second MAC. When the third MAC is the same as the second MAC, the second MAC matches the third MAC, and when the third MAC is different from the second MAC, the second MAC does not match the third MAC.

The method of Figure 4 includes the following steps:

Step 401 to step 402, same as step 301 to step 302, can refer to the foregoing description.

In step 403, the UDM sends a third request to the AUSF. Correspondingly, the AUSF receives the third request.

The third request includes SUPI and the second parameter update type.

Wherein, when the second request includes the second count value, the third request also includes the second count value. When the second request includes the confirmation indication, the third request also includes the confirmation indication.

The second request may be a UPU protection request or a UPU data type verification request.

Wherein, the function of SUPI can refer to the description in step 303 .

In step 404, the AUSF generates a third MAC.

Wherein, for the method for the AUSF to generate the third MAC, reference may be made to the description in step 304 .

In step 405, the AUSF sends a third response to the UDM. Correspondingly, the UDM receives the third response.

The third response is a response to the third request.

The third response includes the third MAC.

Step 406 is the same as step 307, and reference may be made to the foregoing description.

Step 407, when the result of the MAC verification is that the verification of the second MAC is successful, the UDM sends indication information to the AUSF, which is used to indicate that the second MAC matches the third MAC, or is used to indicate that the verification of the second MAC is successful.

In step 408, the AUSF generates a fourth MAC.

When the AUSF receives the indication information from the UDM, and the above-mentioned third request contains an acknowledgment indication, the AUSF executes step 408, and when the AUSF does not receive the indication information from the UDM, or the above-mentioned third request does not contain an acknowledgment indication, then AUSF does not perform this step 408 .

For the method for the AUSF to generate the fourth MAC, reference may be made to the description in step 305 .

In step 409, the AUSF sends the fourth MAC to the UDM. Correspondingly, the UDM receives the fourth MAC.

This step is optional. If step 408 is executed, then step 409 is executed.

Step 410 to step 412, same as step 308 to step 310, can refer to the foregoing description.

Figure 5 is a wireless communication method provided by the embodiment of the present application. The main difference between this method and the method in Figure 3 is that in the method in Figure 3, the terminal can judge whether the UDM is successfully received by checking the received fifth MAC. The first parameter update type, that is, the UDM explicitly informs the terminal whether the first parameter update type is successfully received; in the method in Figure 5, when the UDM successfully receives the first parameter update type, it will not send the second Four MAC, but the terminal judges whether the UDM is successful by judging whether the parameter corresponding to the first parameter update type is received in the subsequent UE parameter update (UE parameter update, UPU) process or roaming processing (Steering of roaming, SoR) process The first parameter update type is received, that is, the UDM implicitly informs the terminal whether the first parameter update type has been successfully received.

The method includes the following steps:

Step 501 to step 506, same as step 301 to step 304, step 306 to step 307, can refer to the foregoing description.

It should be noted that during the process from step 501 to step 506, none of the first request, second request, and third request carried an acknowledgment indication, AUSF did not calculate the fourth MAC, and the third response did not include the fourth MAC. MAC. That is, during the interaction process between the terminal and the UDM, the UDM does not need to send the fourth MAC to the terminal.

Step 507, the AMF sends a first response to the terminal. Correspondingly, the terminal receives the first response.

When the first request is a registration request, the first response is a registration acceptance. When the first request is an uplink NAS transport message, the first response is a downlink NAS transport (DL NAS transport) message.

Step 508, UDM decides to perform UPU or SoR.

In step 509, the UDM sends a first notification message to the AMF. Correspondingly, the AMF receives the first notification message.

The first notification message may be a Nudm_SDM_Notification message.

Wherein, when the UDM saves the received second parameter update type in the above step 506, the first notification message may include parameters corresponding to the second parameter update type. Since in this case, the second parameter update type is the same as the first parameter update type, it can also be understood that the first notification message includes parameters corresponding to the first parameter update type.

Step 510, the AMF sends a second notification message to the terminal. Correspondingly, the terminal receives the second notification message.

The second notification message may be a downlink NAS transport (DL NAS transport) message.

When the first notification message includes the parameter corresponding to the first parameter update type, the second notification message carries the parameter corresponding to the first parameter update type.

The terminal may determine whether the UDM has received the first parameter update type according to whether the second notification message includes a parameter corresponding to the first parameter update type. Wherein, when the second notification message contains the parameters corresponding to the first parameter update type, it is determined that the UDM has successfully received the first parameter update type; when the second notification message does not contain the parameters corresponding to the first parameter update type, then it is determined that the UDM The first parameter update type was not successfully received.

Wherein, when it is determined that the UDM has not successfully received the first parameter update type, the terminal may lower the priority of the PLMN where the terminal is located.

According to the above solution, the terminal actively reports the parameter update type supported by the terminal to the network side, so that the network side can send corresponding parameters to the terminal according to the parameter update type reported by the terminal, that is, send to the terminal the parameter corresponding to the parameter update type supported by the terminal, The network side is prevented from sending parameters corresponding to parameter update types not supported by the terminal to the terminal, thereby reducing waste of resources. Moreover, when the terminal sends the parameter update type supported by the terminal to the network side, the parameter update type is also protected by generating a MAC to ensure that the network side can successfully receive the parameter update type supported by the terminal. In addition, the terminal implicitly judges whether the previously sent first parameter update type has been safely transmitted to the UDM according to the subsequent UPU or SoR process, and then judges whether the service network has tampered with or discarded the first parameter update type, so that It saves extra MAC calculation and transmission, and reduces the signaling and calculation overhead of the terminal and the network.

Figure 6 is a wireless communication method provided by the embodiment of the present application. The main difference between this method and the method in Figure 4 is that in the method in Figure 4, the terminal can judge whether the UDM is successfully received by checking the received fifth MAC. The first parameter update type, that is, the UDM explicitly informs the terminal whether the first parameter update type is successfully received; in the method in Figure 6, when the UDM successfully receives the first parameter update type, it will not send the second Four MAC, but the terminal judges whether the UDM has successfully received the first parameter update type by judging whether the parameter corresponding to the first parameter update type is received in the subsequent UPU process or SoR process, that is, the UDM informs the terminal implicitly Whether the first parameter update type was successfully received. The method includes the following steps:

Step 601 to step 606, same as step 401 to step 406, can refer to the foregoing description.

It should be noted that, during the process from step 601 to step 606, none of the first request, the second request, and the third request carries an acknowledgment indication.

Step 607 to step 610, same as step 507 to step 510, can refer to the foregoing description.

In order to solve the problem that the network side cannot judge whether it is necessary to update the parameters corresponding to the new parameter update type to the terminal, the implementation of this application also provides a solution. Referring to FIG. 7, it is a wireless communication method provided by the embodiment of this application. The method includes the following steps:

Step 701, the terminal sends a registration request to the AMF. Correspondingly, the AMF receives the registration request.

The registration request includes a subscription concealed identifier (SUCI).

Among them, the implementation methods of SUCI include but are not limited to the following methods 1 and 2:

Method 1: Encrypt the SUPI and the parameter update type supported by the terminal to obtain the SUCI.

For example, the parameter update type supported by the terminal and SUPI are spliced first to obtain spliced information, and then the concatenated information is encrypted to obtain an output part (output) of SUCI. Wherein, the splicing information may be expressed as "SUPI||parameter update type supported by the terminal", or as "parameter update type supported by the terminal||SUPI". Where "||" is a splicing symbol.

Method 2, splicing the parameter update type, MAC and SUPI ciphertext supported by the terminal to obtain the SUCI.

Wherein, the MAC is calculated by using the UDM public key and the parameter update type supported by the terminal. This MAC is used to prevent the parameter update type supported by the terminal from being tampered with during transmission. For example, SUCI can contain any of the following information:

1) "Parameter update type supported by the terminal||SUPI ciphertext||MAC";

2) "Parameter update type supported by the terminal||MAC||SUPI ciphertext";

3) "SUPI ciphertext||MAC||terminal support parameter update type";

4) "SUPI ciphertext||parameter update type supported by the terminal||MAC";

5) "MAC||terminal supported parameter update type||SUPI ciphertext";

6) "MAC||SUPI ciphertext||parameter update type supported by the terminal".

As an implementation method, when one or more of the conditions 1 to 5 described in the above step 301 is satisfied, the SUCI is carried in the registration request.

It should be noted that, if this solution is applied to the initial registration scenario, the registration request can be carried in a security mode completion message, and the security mode completion message can provide security protection for the registration request.

In step 702, the AMF sends an authentication request to the AUSF. Correspondingly, the AUSF receives the authentication request.

SUCI is included in the authentication request. The authentication request is used to authenticate the terminal indicated by the SUCI.

In step 703, the AUSF sends an authentication request to the UDM. Correspondingly, UDM receives the authentication request.

SUCI is included in the authentication request. The authentication request is used to request to acquire authentication parameters of the terminal indicated by the SUCI.

In step 704, the UDM decrypts the SUCI to obtain the parameter update type supported by the terminal.

Wherein, if the SUCI is generated according to method 1, the UDM decrypts the SUCI to obtain the parameter update type supported by the terminal.

If the SUCI is generated according to method 2, the UDM can obtain the plaintext information of the parameter update type supported by the terminal from the SUCI, and then verify the MAC according to the parameter update type supported by the terminal. If the verification is successful, it indicates the parameters supported by the terminal The update type has not been tampered with during transmission, so the UDM can successfully obtain the parameter update type supported by the terminal sent by the terminal.

In step 705, the UDM saves the received parameter update type supported by the terminal.

According to the above solution, by protecting the parameter update type supported by the terminal in the sent SUCI, the existing IE and process can be reused and the parameter update type supported by the terminal can be safely sent to UDM, avoiding the impact on the existing system process The transformation reduces the signaling overhead of the terminal and the network.

In order to solve the problem that the network side cannot judge whether it is necessary to update the parameters corresponding to the new parameter update type to the terminal, the implementation of this application also provides a solution. Referring to FIG. 8, it is a wireless communication method provided by the embodiment of this application. This method is applied in the SOR process. The method is to notify the terminal to report the parameter update type supported by the terminal in the SOR process.

The method includes the following steps:

In step 801, the UDM sends a first request to the AUSF, and the AUSF receives the first request accordingly.

Optionally, the first request may be a Nausf_SoRProtection message.

Wherein, the UDM supports a new parameter update type, and the UDM needs to obtain the new parameter update type supported by the terminal. If the UDM has no SoR parameters to be sent to the terminal, the UDM can also initiate a SoR process with an empty payload because it needs to obtain the parameter update type supported by the terminal. If the UDM needs to update SoR parameters, optionally, the payload part carries corresponding roaming parameters.

The new parameter update type here refers to other parameter update types except SoR parameter update. For example, the new parameter update type supported by UDM is SoR-CMCI. Among them, the full name of CMCI is connected mode control information (connected mode control information). For another example, the UDM supports other parameter update types besides the routing indication update data and the default configuration network slice selection auxiliary information update data.

The SoR parameter update here refers to that the UDM sends the updated SoR parameter to the terminal, and the SoR parameter may be a list of access technologies/PLMN IDs. For example, the list contains: 4G/PLMN ID 1, 4G/PLMN ID 2, 5G/PLMN ID 1, 5G/PLMN ID 2.

The first request includes SUPI, and the SUPI is used to identify a terminal. The AUSF can obtain the Kausf corresponding to the SUPI according to the SUPI.

Optionally, the first request also includes a new parameter update type supported by UDM.

In step 802, the AUSF acquires first information.

The first information may be SoRheader.

The first information includes a first indication, and the first indication is used to indicate that the terminal needs to use newly added parameters to calculate the MAC returned by the terminal side, or indicate that UDM supports a new parameter update type, or indicate that the terminal sends a supported parameter update type. New parameters refer to parameters other than ACK, such as the SoR header returned by the terminal and/or new parameter update types.

As an implementation method, the first information is sent to the AUSF after the UDM is generated.

As another implementation method, the first information is generated by the AUSF. For example, if the first request includes a new parameter update type supported by UDM, the AUSF generates a first indication according to the new parameter update type supported by UDM, and then generates first information according to the first indication.

Step 803, AUSF generates a first MAC according to Kausf, first information and a first count value.

Among them, the Kausf corresponds to SUPI. This Kausf is the same Kausf used in the terminal.

In step 804, the AUSF sends a first response to the UDM, and the UDM receives the first response accordingly.

Optionally, the first response may be a Nausf_SoRProtection Response message.

The first response includes a first MAC, first information, and a first count value.

In step 805, the UDM sends the first message to the AMF, and the AMF receives the first message accordingly.

Optionally, the first message may be a Nudm_SDM_Notification message.

The first message may be a subscription data management acquisition response or a subscription data management notification.

The first message includes a first MAC, first information and a first count value.

Step 806, the AMF sends the second message to the terminal, and the terminal receives the second message accordingly.

The second message may be a registration accept message or a downlink NAS transmission message.

The second message includes the first MAC, the first information and the first count value.

Wherein, what the UDM sends is the first MAC, the first information and the first count value, and what the terminal receives is the second MAC, the second information and the second count value. Under normal circumstances, the second MAC received by the terminal is the same as the first MAC sent by UDM, the second information received by the terminal is the same as the first message sent by UDM, and the second count value received by the terminal is the same as the first MAC sent by UDM. A count of the same value. However, when the network is not secure enough, the above information sent by UDM may be tampered with, causing the second MAC received by the terminal to be different from the first MAC sent by UDM, and the second message received by the terminal is different from the first message sent by UDM. It may be different, and the second count value received by the terminal may be different from the first count value sent by the UDM.

Step 807, the terminal checks the second MAC according to the second count value, the second information and Kausf.

Wherein, the terminal generates the third MAC according to the second count value, the second information and Kausf. When the third MAC is the same as the second MAC, indicating that the first information has not been tampered with during transmission, the second MAC is verified successfully, that is, it is determined that the second MAC received by the terminal is the same as the first MAC sent by the AMF, and the terminal The received second information is the same as the first information sent by the AMF, and the second count value received by the terminal is the same as the first count value sent by the AMF. When the third MAC is different from the second MAC, it indicates that the first information may be tampered with during transmission, that is, the second information may be different from the first information, and the verification of the second MAC fails.

Step 808, if the second MAC verification is successful, when the terminal supports a new parameter update type, trigger generation of a fourth MAC according to Kausf, the first parameter update type and the third count value according to the first indication.

The first parameter update type, for example, may be a supported UE parameters update data set types list (supported UE parameters update data set types list), or other than routing indication update data and default configuration network slice selection auxiliary information update data Updated list of supported terminal parameters for dataset types.

Specifically, according to the first indication in the second information, the trigger terminal uses Kausf as a key, takes the first parameter update type and the third count value as inputs, and generates a fourth MAC. Optionally, when generating the fourth MAC, the third information is also used as input, and the third information may be the SoR header generated by the terminal. Wherein, the third count value is different from the aforementioned second count value.

Wherein, the first parameter update type refers to a parameter update type supported by the terminal.

Wherein, optionally, the third information includes a second indication, and the second indication is used to indicate that new parameters need to be used to calculate the MAC on the AUSF side, or indicate that the terminal supports a new parameter update type, or indicate that the terminal sends a new The parameter update type for .

Step 809, the terminal sends the third message to the AMF, and the AMF receives the third message accordingly.

The third message may be a registration completion message or an uplink NAS transmission message.

The third message includes the first parameter update type, the fourth MAC, the third information and the third count value.

In step 810, the AMF sends a fourth message to the UDM, and the UDM receives the fourth message accordingly.

The fourth message includes a second parameter update type, a fifth MAC, fourth information and a fourth count value.

The fourth message may be a Nudm_SDM_Info message.

Wherein, the terminal sends the first parameter update type, the fourth MAC, the third information and the third count value, while the UDM receives the second parameter update type, the fifth MAC, the fourth information and the fourth count value. Under normal circumstances, the second parameter update type received by UDM is the same as the first parameter update type sent by the terminal, the fifth MAC received by UDM is the same as the fourth MAC sent by the terminal, and the fourth message received by UDM is the same as the terminal The third information sent is the same, and the fourth count value received by the UDM is the same as the third count value sent by the terminal. However, when the network is not secure enough, the above information sent by the terminal may be tampered with, causing the second parameter update type received by UDM to be different from the first parameter update type sent by the terminal, and the fifth MAC received by UDM is the same as that sent by the terminal. The fourth MAC may be different, the fourth information received by the UDM may be different from the third information sent by the terminal, and the fourth count value received by the UDM may be different from the third count value sent by the terminal.

In step 811, the UDM sends a fifth message to the AUSF, and the AUSF receives the fifth message accordingly. As an implementation, the UDM sends the fifth message to the AUSF according to the second indication in the fourth message or according to the new parameter update type carried in the fourth message, which carries the second parameter update type, the fifth MAC and the fourth count value. Optionally, the fifth message also carries fourth information.

If the UDM acquires the MAC of the response from the terminal side in step 804, optionally, the UDM may ignore or delete the MAC according to the second indication or according to the new parameter update type carried in the fourth message.

Step 812, AUSF checks the fifth MAC according to the second parameter update type, the fourth count value and Kausf.

Wherein, the AUSF generates the sixth MAC according to the update type of the second parameter, the fourth count value and Kausf. When the sixth MAC is the same as the fifth MAC, the verification of the fifth MAC is successful, that is, it is determined that the fifth MAC received by the UDM is the same as the fourth MAC sent by the terminal, and the second parameter update type received by the UDM is the same as that sent by the terminal. The first parameter update type is the same, and the fourth count value received by the AMF is the same as the third count value sent by the terminal. When the sixth MAC is different from the fifth MAC, it indicates that the first parameter update type may be tampered with during transmission, that is, the second parameter update type may be different from the first parameter update type, and the verification of the fifth MAC fails.

Optionally, when the fifth message includes the fourth information, in this step, the AUSF checks the fifth MAC according to the second parameter update type, the fourth count value, the fourth information and Kausf.

Checking the fifth MAC here may also be described as: checking the second parameter update type, or as: checking whether the second parameter update type matches the fifth MAC.

In step 813, the AUSF sends the MAC check result to the UDM. Correspondingly, the UDM receives the MAC check result.

The result of the MAC check is that the fifth MAC check succeeds or the fifth MAC check fails.

The MAC verification result here may also be described as: the result of verifying the second parameter update type, or as: the result of verifying whether the second parameter update type matches the fifth MAC.

Step 814, when the MAC verification result is that the fifth MAC verification is successful, the UDM saves the received second parameter update type; when the MAC verification result is that the fifth MAC verification fails, the UDM discards the received second parameter Update the type and/or reduce the priority of the PLMN where the terminal is located.

As another alternative implementation method, the fifth MAC in the above step 811 does not carry the fifth MAC, and the above step 812 is modified to: AUSF generates the sixth MAC according to the second parameter update type, the fourth count value and Kasuf , the above step 813 is modified to: AUSF sends the sixth MAC to UDM, and a step is added between step 813 and step 814: UDM checks the fifth MAC according to the sixth MAC. Wherein, when the sixth MAC is the same as the fifth MAC, the result of the MAC verification is that the verification of the fifth MAC is successful; when the sixth MAC is different from the fifth MAC, the result of the MAC verification is that the verification of the fifth MAC fails.

According to the above solution, the parameter update type supported by the terminal is carried in the SoR process, so that the existing process can be reused to the greatest extent, the signaling overhead of the terminal and the network side is reduced, and the purpose of transmitting the parameter update type supported by the terminal to the network is also achieved.

It should be noted that, as another implementation method, in the above step 808, the third counter value used by the terminal when generating the fourth MAC is the same as the second counter value received in step 807. Correspondingly, in step 812, the fourth count value used when checking the fifth MAC is the same as the first count value. Under normal circumstances, the first count value, the second count value, the second count value and the fourth count value are all the same count value. In this method, optionally, after performing step 803, the AUSF saves the used first count value. Optionally, after step 804, the UDM saves the received first count value. Optionally, when the UDM receives the fourth count value, it may determine whether the fourth count value is the same as the first count value. If they are the same, it indicates that the received fourth count value is fresh, then perform step 811 and subsequent steps. If not, the fourth message is discarded, and subsequent steps are stopped. Optionally, before performing step 812, the AUSF may further determine whether the fourth count value is the same as the first count value. If they are the same, it indicates that the received fourth count value is fresh, then perform step 812 and subsequent steps. If not, the fifth message is discarded and subsequent steps are stopped. Of course, as another implementation method, if the third counter value used when the terminal generates the fourth MAC in step 808 is the same as the second counter value received in step 807, then the third message does not carry the first The third count value, correspondingly, the fourth message does not carry the fourth count value, so the count value used when checking the fifth MAC in step 812 is the first count value. As another implementation method, if the UDM saves the first count value after step 804, after the UDM performs the above verification action, even if it does not receive the fourth count value in the fourth message, the saved first count value can also be saved. The count value is carried in the fifth message, so the count value used when checking the fifth MAC in step 812 is the first count value. As another implementation method, if the fifth message does not carry the fourth count value, AUSF can directly use the stored first count value, so that the count value used when checking the fifth MAC in step 812 is the first count value value.

In the above-mentioned embodiment of the method in FIG. 8 , in the SoR process, the terminal is notified to report the parameter update type supported by the terminal. As another implementation method, in the UPU process, the terminal may also be notified of the type of parameter update supported by the terminal. In this case, the specific implementation process is similar to the above-mentioned method embodiment in FIG. 8, the main difference is:

1) The above-mentioned first request may be a Nausf_UPUProtection message, and the new parameter update type supported by UDM refers to other parameter update types except routing indication update data and default configuration NSSAI update data.

2) The above first information may be UPF header.

3) The above-mentioned first response may be a Nausf_UPUProtection Response message.

3) The above third information may be UPU header.

It can be understood that, in order to realize the functions in the foregoing embodiments, the AUSF, UDM, AMF and the terminal include corresponding hardware structures and/or software modules for performing respective functions. Those skilled in the art should easily realize that the present application can be implemented in the form of hardware or a combination of hardware and computer software with reference to the units and method steps of the examples described in the embodiments disclosed in the present application. Whether a certain function is executed by hardware or computer software drives the hardware depends on the specific application scenario and design constraints of the technical solution.

FIG. 9 and FIG. 10 are schematic structural diagrams of possible communication devices provided by the embodiments of the present application. These communication devices can be used to implement the functions of the terminal, AMF, UDM or AUSF in the above method embodiments, and therefore can also realize the beneficial effects of the above method embodiments. In the embodiment of the present application, the communication device may be a terminal, AMF, UDM or AUSF, and may also be a module (such as a chip) applied to the terminal, AMF, UDM or AUSF.

As shown in FIG. 9 , a communication device 900 includes a processing unit 910 and a transceiver unit 920 . The communication device 900 is configured to realize the functions of the terminal, AMF, UDM or AUSF in the method embodiments shown in FIGS. 3 to 6 above.

When the communication device 900 is used to implement the terminal functions in the method embodiments shown in FIGS. 3 to 6: the processing unit 910 is configured to generate a first message authentication code MAC according to the first parameter update type and Kausf, so The first parameter update type is a parameter update type supported by the terminal, and the Kausf is a key between the terminal and an authentication network element; the transceiver unit 920 is configured to send the first parameter update to a mobility management network element A parameter update type and the first MAC.

In a possible implementation method, the transceiver unit 920 is further configured to receive a fifth MAC from the mobility management network element. The fifth MAC is generated according to the first confirmation information and the Kausf, and the fifth MAC is generated according to the first confirmation information and the Kausf. The confirmation information is used to indicate that the data management network element has successfully received the first parameter update type; the processing unit 910 is further configured to verify the fifth MAC according to the second confirmation information and the Kausf.

In a possible implementation method, the processing unit 910 is further configured to save the acknowledgment information when the fifth MAC verification succeeds; or, discard the second acknowledgment when the fifth MAC verification fails information and/or reduce the priority of the public land mobile network PLMN where the terminal is located.

In a possible implementation method, the transceiver unit 920 is further configured to receive a downlink message from the mobility management network element after sending the first parameter update type and the first MAC to the mobility management network element A non-access stratum transmission message; the processing unit 910 is further configured to determine that the data management network element has successfully received the first parameter update type when the downlink non-access stratum transmission message contains a parameter corresponding to the first parameter update type A parameter update type; or, when the downlink non-access stratum transmission message does not include the parameter corresponding to the first parameter update type, lower the priority of the PLMN where the terminal is located.

In a possible implementation method, the processing unit 910 is further configured to include one or more of the following before generating the first MAC according to the first parameter update type and Kausf:

determining that a new Universal Subscriber Identity Module USIM is inserted in said terminal;

Determining that the first parameter update type includes other parameter update types except routing indication update data and default configuration NSSAI update data;

determining that the terminal is turned on;

determining that the first parameter update type has not been sent;

It is determined that no response to the first parameter update type has been received.

In a possible implementation method, the transceiving unit 920 is specifically configured to send a registration request message to the mobility management network element, where the registration request message includes the first parameter update type and the first MAC; Or, sending an uplink non-access stratum transmission message to the mobility management network element, where the uplink non-access stratum transmission message includes the first parameter update type and the first MAC.

When the communication device 900 is used to implement the UDM function in the method embodiments shown in FIGS. 3 to 6: the transceiver unit 920 is configured to receive the second parameter update type and the second message authentication code MAC from the terminal; process The unit 910 is configured to check whether the second MAC matches a third MAC according to the second parameter update type, and the third MAC is generated according to the second parameter update type and Kausf; wherein, the The Kausf is the key between the terminal and the authentication network element.

In a possible implementation method, the processing unit 910 is specifically configured to send the second parameter update type to the authentication network element through the transceiver unit 920; the third MAC; checking whether the second MAC matches the third MAC.

In a possible implementation method, the processing unit 910 is specifically configured to send the second parameter update type and the second MAC to the authentication network element through the transceiver unit 920; A MAC verification result of the authentication network element, where the MAC verification result is that the second MAC matches the third MAC or the second MAC does not match the third MAC.

In a possible implementation method, the transceiver unit 920 is further configured to receive a fourth MAC from the authentication network element, the fourth MAC is generated according to the first confirmation information and the Kausf, and the fourth MAC is generated according to the first confirmation information and the Kausf A confirmation message is used to indicate that the parameter update type supported by the terminal is successfully received; and the fourth MAC is sent to the terminal.

In a possible implementation method, the processing unit 910 is further configured to save the second parameter update type when the second MAC matches the third MAC; or, when the second MAC matches the third MAC, If the three MACs do not match, the second parameter update type is discarded, and/or the priority of the PLMN where the terminal is located is lowered.

When the communication device 900 is used to implement the AUSF function in the method embodiment shown in FIG. 3 or FIG. 5: the transceiver unit 920 is configured to receive the second parameter update type and the second message authentication code MAC from the data management network element; The processing unit 910 is configured to generate a third MAC according to the second parameter update type and Kausf, where the Kausf is a key between the terminal and the authentication network element; check whether the second MAC is consistent with the The third MAC matching; the transceiver unit 920 is further configured to send a MAC verification result to the data management network element, and the MAC verification result is that the second MAC matches the third MAC or the second MAC matches the second MAC The third MAC does not match.

In a possible implementation method, the processing unit 910 is further configured to generate the second MAC according to the first confirmation information and the Kausf when the MAC verification result is that the second MAC matches the third MAC. Four MAC, the first confirmation information is used to indicate that the data management network element has successfully received the parameter update type supported by the terminal; the transceiver unit 920 is also used to send the fourth MAC to the data management network element .

When the communication device 900 is used to implement the AUSF function in the method embodiment shown in FIG. 4 or FIG. 6: the transceiver unit 920 is used to receive the second parameter update type from the data management network element; the processing unit 910 is used to Generate a third message authentication code MAC according to the second parameter update type and Kausf, the Kausf is the key between the terminal and the authentication network element; the transceiver unit 920 is also used to send the data to the data management network sending the third MAC.

In a possible implementation method, the transceiving unit 920 is further configured to receive indication information from the data management network element, where the indication information is used to indicate that the second MAC matches the third MAC; the processing unit 910, It is also used to generate a fourth MAC according to the first confirmation information and the Kausf; wherein the first confirmation information is used to indicate that the data management network element has successfully received the parameter update type supported by the terminal; the transceiver unit 920 , further configured to send the fourth MAC to the data management network element.

More detailed descriptions about the processing unit 910 and the transceiver unit 920 can be directly obtained by referring to related descriptions in the method embodiments shown in FIG. 3 to FIG. 6 , and details are not repeated here.

As shown in FIG. 10 , a communication device 1000 includes a processor 1010 and an interface circuit 1020 . The processor 1010 and the interface circuit 1020 are coupled to each other. It can be understood that the interface circuit 1020 may be a transceiver or an input-output interface. Optionally, the communication device 1000 may further include a memory 1030 for storing instructions executed by the processor 1010 or storing input data required by the processor 1010 to execute the instructions or storing data generated by the processor 1010 after executing the instructions.

When the communication device 1000 is used to implement the methods shown in FIGS. 3 to 6 , the processor 1010 is used to implement the functions of the processing unit 910 , and the interface circuit 1120 is used to implement the functions of the transceiver unit 920 .

It can be understood that the processor in the embodiments of the present application can be a central processing unit (Central Processing Unit, CPU), and can also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application-specific integrated circuits (Application Specific Integrated Circuit, ASIC), Field Programmable Gate Array (Field Programmable Gate Array, FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. A general-purpose processor can be a microprocessor, or any conventional processor.

The method steps in the embodiments of the present application may be implemented by means of hardware, or may be implemented by means of a processor executing software instructions. Software instructions can be composed of corresponding software modules, and software modules can be stored in random access memory, flash memory, read-only memory, programmable read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only Memory, registers, hard disk, removable hard disk, CD-ROM or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium. Of course, the storage medium may also be a component of the processor. The processor and storage medium can be located in the ASIC.

In the above embodiments, all or part of them may be implemented by software, hardware, firmware or any combination thereof. When implemented using software, it may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on the computer, the processes or functions described in the embodiments of the present application are executed in whole or in part. The computer may be a general purpose computer, a special purpose computer, a computer network, a base station, a terminal or other programmable devices. The computer program or instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program or instructions may be downloaded from a website, computer, A server or data center transmits to another website site, computer, server or data center by wired or wireless means. The computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrating one or more available media. The available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it may also be an optical medium, such as a digital video disk; and it may also be a semiconductor medium, such as a solid state disk. The computer readable storage medium may be a volatile or a nonvolatile storage medium, or may include both volatile and nonvolatile types of storage media.

In each embodiment of the present application, if there is no special explanation and logical conflict, the terms and/or descriptions between different embodiments are consistent and can be referred to each other, and the technical features in different embodiments are based on their inherent Logical relationships can be combined to form new embodiments.

In this application, "at least one" means one or more, and "multiple" means two or more. "And/or" describes the association relationship of associated objects, indicating that there may be three types of relationships, for example, A and/or B, which can mean: A exists alone, A and B exist simultaneously, and B exists alone, where A, B can be singular or plural. In the text description of this application, the character "/" generally indicates that the contextual objects are an "or" relationship; in the formulas of this application, the character "/" indicates that the contextual objects are a "division" Relationship.

It can be understood that the various numbers involved in the embodiments of the present application are only for convenience of description, and are not used to limit the scope of the embodiments of the present application. The size of the serial numbers of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its functions and internal logic.

Claims

A wireless communication method applied to a terminal, characterized in that it includes:

Generate a first message authentication code according to the first parameter update type and Kausf, the first parameter update type is the parameter update type supported by the terminal, and the Kausf is the key between the terminal and the authentication network element ;

Sending the first parameter update type and the first message authentication code to a mobility management network element.
The method of claim 1, further comprising:

receiving a fifth message authentication code from the mobility management network element, the fifth message authentication code is generated according to the first confirmation information and the Kausf, and the first confirmation information is used to indicate that the data management network element successfully The first parameter update type is received;

Verifying the fifth message authentication code according to the second confirmation information and the Kausf.
The method of claim 2, further comprising:

When the verification of the fifth message authentication code is successful, save the second confirmation information; or,

When the verification of the fifth message authentication code fails, the second confirmation information is discarded and/or the priority of the public land mobile network PLMN where the terminal is located is reduced.
The method according to any one of claims 1 to 3, wherein after sending the first parameter update type and the first message authentication code to a mobility management network element, the method further comprises:

receiving a downlink non-access stratum transmission message from the mobility management network element;

When the downlink non-access stratum transmission message contains parameters corresponding to the first parameter update type, determine that the data management network element has successfully received the first parameter update type; or,

When the downlink non-access stratum transmission message does not include the parameter corresponding to the first parameter update type, lower the priority of the PLMN where the terminal is located.
The method according to any one of claims 1 to 4, wherein, before generating the first message authentication code according to the first parameter update type and Kausf, it also includes one or more of the following:

determining that a new Universal Subscriber Identity Module USIM is inserted in said terminal;

Determining that the first parameter update type includes other parameter update types except routing indication update data and default configuration NSSAI update data;

determining that the terminal is turned on;

determining that the first parameter update type has not been sent;

It is determined that no response to the first parameter update type has been received.
The method according to any one of claims 1 to 5, wherein the sending the first parameter update type and the first message authentication code to a mobility management network element comprises:

Sending a registration request message to the mobility management network element, where the registration request message includes the first parameter update type and the first message authentication code; or,

sending an uplink non-access stratum transmission message to the mobility management network element, where the uplink non-access stratum transmission message includes the first parameter update type and the first message authentication code.
The method according to any one of claims 1 to 6, wherein the first parameter update type includes one or more of the following:

Slice authentication credential update, protocol data unit PDU session authentication credential update.
A wireless communication method applied to a data management network element, characterized in that it includes:

receiving a second parameter update type and a second message authentication code from the terminal;

According to the second parameter update type, check whether the second message authentication code matches a third message authentication code, and the third message authentication code is generated according to the second parameter update type and Kausf; wherein, The Kausf is a key between the terminal and the authentication network element.
The method according to claim 8, wherein the checking whether the second message authentication code matches the third message authentication code according to the update type of the second parameter comprises:

sending the second parameter update type to the authentication network element;

receiving the third message authentication code from the authentication network element;

Checking whether the second message authentication code matches the third message authentication code.
The method according to claim 8, wherein the checking whether the second message authentication code matches the third message authentication code according to the update type of the second parameter comprises:

sending the second parameter update type and the second message authentication code to the authentication network element;

Receive a message authentication code verification result from the authentication network element, the message authentication code verification result is that the second message authentication code matches the third message authentication code or the second message authentication code matches the third message authentication code Message authentication codes do not match.
The method according to any one of claims 8 to 10, further comprising:

receiving a fourth message authentication code from the authentication network element, the fourth message authentication code is generated according to the first confirmation information and the Kausf, and the first confirmation information is used to indicate that the terminal is successfully received Supported parameter update types;

Send the fourth message authentication code to the terminal.
The method according to any one of claims 8 to 11, further comprising:

If the second message authentication code matches the third message authentication code, save the second parameter update type; or,

If the second message authentication code does not match the third message authentication code, the second parameter update type is discarded, and/or the priority of the PLMN where the terminal is located is lowered.
A wireless communication method applied to an authentication network element, characterized in that it includes:

receiving a second parameter update type and a second message authentication code from the data management network element;

Generate a third message authentication code according to the second parameter update type and Kausf, where Kausf is a key between the terminal and the authentication network element;

checking whether the second message authentication code matches the third message authentication code;

sending a message authentication code verification result to the data management network element, where the message authentication code verification result is that the second message authentication code matches the third message authentication code or that the second message authentication code matches the third message authentication code Authentication codes do not match.
The method of claim 13, further comprising:

When the verification result of the message authentication code is that the second message authentication code matches the third message authentication code, a fourth message authentication code is generated according to the first confirmation information and the Kausf, and the first confirmation The information is used to indicate that the data management network element has successfully received the parameter update type supported by the terminal;

Send the fourth message authentication code to the data management network element.
A wireless communication method applied to an authentication network element, characterized in that it includes:

receiving a second parameter update type from a data management network element;

Generate a third message authentication code according to the second parameter update type and Kausf, where Kausf is a key between the terminal and the authentication network element;

Send the third message authentication code to the data management network element.
The method of claim 15, further comprising:

receiving indication information from the data management network element, where the indication information is used to indicate that the second message authentication code matches a third message authentication code;

Generate a fourth message authentication code according to the first confirmation information and the Kausf; wherein the first confirmation information is used to indicate that the data management network element has successfully received the parameter update type supported by the terminal;

Send the fourth message authentication code to the data management network element.
A communication device, characterized by comprising:

A processing unit, configured to generate a first message authentication code according to a first parameter update type and a Kausf, where the first parameter update type is a parameter update type supported by the terminal, and the Kausf is a message between the terminal and an authentication network element the key;

A transceiver unit, configured to send the first parameter update type and the first message authentication code to a mobility management network element.
The device according to claim 17, wherein the transceiver unit is further configured to receive a fifth message authentication code from the mobility management network element, the fifth message authentication code is based on the first confirmation information and generated by the Kausf, the first confirmation information is used to indicate that the data management network element has successfully received the first parameter update type;

The processing unit is further configured to verify the fifth message authentication code according to the second confirmation information and the Kausf.
The device according to claim 18, wherein the processing unit is further configured to save the second confirmation information when the verification of the fifth message authentication code is successful; or, when the fifth message authentication code If the code verification fails, the second confirmation information is discarded and/or the priority of the public land mobile network PLMN where the terminal is located is lowered.
The device according to any one of claims 17 to 19, wherein the transceiver unit is further configured to send the first parameter update type and the first message authentication code to a mobility management network element Afterwards, receiving a downlink non-access stratum transmission message from the mobility management network element;

The processing unit is further configured to determine that the data management network element has successfully received the first parameter update type when the downlink non-access stratum transmission message contains a parameter corresponding to the first parameter update type; or , when the downlink non-access stratum transmission message does not include the parameter corresponding to the first parameter update type, lowering the priority of the PLMN where the terminal is located.
The device according to any one of claims 17 to 20, wherein the processing unit is further configured to, before generating the first message authentication code according to the first parameter update type and Kausf, further include the following one or Multiple:

determining that a new Universal Subscriber Identity Module USIM is inserted in said terminal;

Determining that the first parameter update type includes other parameter update types except routing indication update data and default configuration NSSAI update data;

determining that the terminal is turned on;

determining that the first parameter update type has not been sent;

It is determined that no response to the first parameter update type has been received.
The device according to any one of claims 17 to 21, wherein the transceiver unit is specifically configured to send a registration request message to the mobility management network element, and the registration request message includes the first A parameter update type and the first message authentication code; or, sending an uplink non-access stratum transmission message to the mobility management network element, where the uplink non-access stratum transmission message includes the first parameter update type and the first message authentication code.
The device according to any one of claims 17 to 22, wherein the first parameter update type includes one or more of the following:

Slice authentication credential update, protocol data unit PDU session authentication credential update.
A communication device, characterized by comprising:

A transceiver unit, configured to receive the second parameter update type and the second message authentication code from the terminal;

A processing unit, configured to check whether the second message authentication code matches a third message authentication code according to the second parameter update type, and the third message authentication code is based on the second parameter update type and Kausf generated; wherein, the Kausf is a key between the terminal and the authentication network element.
The device according to claim 24, wherein the processing unit is specifically configured to send the second parameter update type to the authentication network element through the transceiver unit; the third message authentication code of the authentication network element; check whether the second message authentication code matches the third message authentication code.
The device according to claim 24, wherein the processing unit is specifically configured to send the second parameter update type and the second message authentication code to the authentication network element through the transceiver unit; The message authentication code check result from the authentication network element is received by the transceiver unit, and the message authentication code check result is that the second message authentication code matches the third message authentication code or the second message The authentication code does not match the third message authentication code.
The device according to any one of claims 24 to 26, wherein the transceiver unit is further configured to receive a fourth message authentication code from the authentication network element, the fourth message authentication code is Generated according to the first confirmation information and the Kausf, the first confirmation information is used to indicate that the parameter update type supported by the terminal is successfully received; and the fourth message authentication code is sent to the terminal.
The device according to any one of claims 24 to 27, wherein the processing unit is further configured to store the second message authentication code when the second message authentication code matches the third message authentication code. Two parameter update types; or, in the case that the second message authentication code does not match the third message authentication code, discarding the second parameter update type, and/or reducing the priority of the PLMN where the terminal is located.
A communication device, characterized by comprising:

A transceiver unit, configured to receive the second parameter update type and the second message authentication code from the data management network element;

A processing unit, configured to generate a third message authentication code according to the second parameter update type and Kausf, where Kausf is a key between the terminal and the authentication network element;

The processing unit is further configured to check whether the second message authentication code matches the third message authentication code;

The transceiver unit is further configured to send a message authentication code verification result to the data management network element, and the message authentication code verification result is that the second message authentication code matches the third message authentication code or the first message authentication code matches the second message authentication code. The second message authentication code does not match the third message authentication code.
The device according to claim 29, wherein the processing unit is further configured to, when the verification result of the message authentication code is that the second message authentication code matches the third message authentication code, according to The first confirmation information and the Kausf generate a fourth message authentication code, the first confirmation information is used to indicate that the data management network element has successfully received the parameter update type supported by the terminal; the transceiver unit also uses to send the fourth message authentication code to the data management network element.
A communication device applied to an authentication network element, characterized in that it includes:

A transceiver unit, configured to receive the second parameter update type from the data management network element;

A processing unit, configured to generate a third message authentication code according to the second parameter update type and Kausf, where Kausf is a key between the terminal and the authentication network element;

The transceiving unit is further configured to send the third message authentication code to the data management network element.
The device according to claim 31, wherein the transceiver unit is further configured to receive indication information from the data management network element, the indication information is used to indicate that the second message authentication code and the third message authentication code match;

The processing unit is further configured to generate a fourth message authentication code according to the first confirmation information and the Kausf; wherein the first confirmation information is used to indicate that the data management network element has successfully received the message supported by the terminal. Parameter update type;

The transceiving unit is further configured to send the fourth message authentication code to the data management network element.
A communication device, characterized in that it includes a processor and an interface circuit, the interface circuit is used to receive signals from other communication devices other than the communication device and transmit them to the processor or transfer signals from the processor The signal is sent to other communication devices other than the communication device, and the processor implements the method according to any one of claims 1 to 7 through a logic circuit or executes code instructions, or is used to realize the method according to any one of claims 1 to 7 The method described in any one of claims 8 to 12, or used to implement the method described in any one of claims 13 to 14, or used to implement the method described in claims 15 or 16.
A communication system, characterized by comprising a data management network element for performing the method according to any one of claims 8 to 12, and an authentication network element for performing the method according to claim 13 or 14 or, comprising a data management network element for performing the method according to any one of claims 8 to 12, and an authentication network element for performing the method according to claim 15 or 16.
A computer program product, characterized by comprising a computer program, and when the computer program is executed by a communication device, the method according to any one of claims 1 to 16 is realized.
A computer-readable storage medium, characterized in that computer programs or instructions are stored in the storage medium, and when the computer programs or instructions are executed by a communication device, the implementation of any one of claims 1 to 16 Methods.