WO2022237693A1 - Nswo业务的认证方法、设备和存储介质 - Google Patents

Nswo业务的认证方法、设备和存储介质 Download PDF

Info

Publication number
WO2022237693A1
WO2022237693A1 PCT/CN2022/091523 CN2022091523W WO2022237693A1 WO 2022237693 A1 WO2022237693 A1 WO 2022237693A1 CN 2022091523 W CN2022091523 W CN 2022091523W WO 2022237693 A1 WO2022237693 A1 WO 2022237693A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
nswo
service
key
request message
Prior art date
Application number
PCT/CN2022/091523
Other languages
English (en)
French (fr)
Inventor
张博
李飞
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to JP2023568581A priority Critical patent/JP2024517897A/ja
Priority to EP22806659.3A priority patent/EP4336879A1/en
Publication of WO2022237693A1 publication Critical patent/WO2022237693A1/zh
Priority to US18/502,799 priority patent/US20240073685A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H04L9/0841—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols
    • H04L9/0844—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/40—Security arrangements using identity modules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/72—Subscriber identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/75—Temporary identity

Definitions

  • the embodiment of the present application relates to the field of communication technologies, and in particular to an authentication method, device and storage medium for NSWO services.
  • the third generation partnership project (3rd generation partnership project, 3GPP) introduced the non-seamless WLAN offload (NSWO) service.
  • the service data can be distributed through the access network (access network, AN) device and directly connected to the Internet.
  • the AN device Before the terminal device executes the NSWO service, the AN device, the 3GPP authentication, authorization and accounting (authentication, authorization and accounting, AAA) server, and the home subscriber server (home subscriber server, HSS) need to complete the authentication of the terminal device. It can be understood that the AN device completes the authentication of the terminal device by means of the operator. After the operator authenticates the terminal device successfully, the AN device will provide the NSWO service for the terminal device.
  • the fifth generation communication system (5G) network will also support NSWO services.
  • the equipment of 5G network and 4G network may be different, for example, 5G network may not have 3GPP AAA server.
  • the authentication algorithms supported by the 5G network and the 4G network are also different. Therefore, how to realize the authentication of terminal equipment for NSWO services in the 5G network needs to be solved urgently.
  • Embodiments of the present application provide an authentication method, device, and storage medium for NSWO services, which can implement authentication of terminal equipment for NSWO services in networks such as 5G.
  • an authentication method for NSWO services including: after the terminal device determines to perform the NSWO service, sending SUCI to the access network device; receiving the third authentication request message sent by the NSWO network element through the access network device, The third authentication request message is the authentication request message corresponding to the EAP AKA' authentication algorithm; use the EAP AKA' authentication algorithm to perform authentication verification on the network; after the authentication verification is successful, send the fourth authentication to the NSWO network element through the access network device request message.
  • the NSWO service authentication method provided in the first aspect can be applied to terminal equipment or UE.
  • the network elements involved in the complete NSWO service authentication process include UE, AN equipment, NSWO network elements, AUSF and UDM.
  • the UE determines to perform the NSWO service, it starts an authentication process for the NSWO service.
  • the authentication process it is determined to adopt the EAP AKA’ authentication method, which avoids the authentication failure caused by choosing the 5G AKA authentication method, and realizes the authentication for NSWO services in 5G and other networks.
  • the SUPI type included in the SUCI is used to indicate the authentication for the NSWO service; and/or, the SUCI includes service indication information, and the service indication information is used to indicate the authentication for the NSWO service.
  • the AN device, the NSWO network element, the AUSF or the UDM can directly determine and execute the authentication for the NSWO service according to the SUCI.
  • the method before receiving the third authentication request message sent by the NSWO network element through the access network device, the method further includes: sending the first NSWO indication information to the access network device, the first NSWO indication information is used to indicate Get certified for NSWO business.
  • the AN device, the NSWO network element, the AUSF or the UDM may directly determine to execute the authentication for the NSWO service according to the first NSWO indication information.
  • the first NSWO indication information and the SUCI are in one message.
  • the first NSWO indication information and the SUCI are carried in one message, which saves the number of air interface messages.
  • one of the following is also included: calculating the key CK' and the key IK', and then deleting the key CK' and the key IK'; calculating the key CK 'and the key IK', and do not calculate the key K AUSF according to the key CK' and the key IK', and then delete the key CK' and the key IK'; calculate the key CK' and the key IK', and according to The key CK' and the key IK' calculate the key K AUSF , and then delete the key CK' and the key IK', and delete the key K AUSF , or do not replace the key K AUSF locally stored in the terminal device; or, After the authentication verification succeeds, the key CK' and the key IK' are not calculated.
  • the UE after the UE successfully authenticates and verifies the network, it may not calculate the key CK' and the key IK', or, the calculated key CK' and the key IK' or the key K AUSF Delete, or not replace the locally existing key K AUSF with the newly generated key K AUSF after calculating the key K AUSF , so as to avoid affecting the existing key structure of the UE.
  • the method before the terminal device determines to perform the NSWO service, the method further includes: receiving second NSWO indication information sent by the access network device, where the second NSWO indication information is used to indicate that the access network device supports the NSWO service; According to the second NSWO indication information, it is determined to perform authentication based on the 5G key, or to perform authentication based on the SIM, or to perform authentication based on the key of the user's first authentication.
  • the AN device notifies the UE that the AN device supports the NSWO service by sending the second NSWO indication information to the UE, so as to implement authentication for the NSWO service.
  • sending the SUCI to the access network device may include: sending a connection establishment request message to the access network device, where the connection establishment request message includes the SUCI and the first NSWO indication information.
  • the UE after the UE determines to perform the NSWO service, it accesses the AN to establish a connection.
  • the SUCI and the first NSWO indication information are carried in the connection establishment request message at the same time, the authentication process for the NSWO service is started, and the number of air interface messages is saved.
  • sending the SUCI to the access network device may include: receiving a first request message sent by the access network device; sending a first response message to the access network device, where the first response message includes the first NSWO Instructions and SUCI.
  • the AN device sends a first request message to the UE to trigger the UE to perform EAP authentication.
  • the UE determines to receive the first request message after performing the NSWO service, determines to perform EAP authentication, and determines to perform authentication for the NSWO service.
  • the second aspect provides an authentication method for NSWO services, including: receiving SUCI sent by terminal equipment; determining the address of the NSWO network element according to the SUCI; sending a second request message to the NSWO network element according to the address of the NSWO network element, the second The request message includes SUCI; receive the third authentication request message sent by the NSWO network element, the third authentication request message is an authentication request message corresponding to the EAP AKA' authentication algorithm; send the third authentication request message to the terminal device; receive the third authentication request message sent by the terminal device Four authentication request message; send the fourth authentication request message to the NSWO network element.
  • the authentication method for the NSWO service provided in the second aspect can be applied to AN equipment.
  • the network elements involved in the complete NSWO service authentication process include UE, AN equipment, NSWO network elements, AUSF and UDM.
  • EAP AKA EAP AKA’ authentication method, which avoids the authentication failure caused by choosing the 5G AKA authentication method, and realizes the authentication for NSWO services in 5G and other networks.
  • the SUPI type included in the SUCI is used to indicate the authentication for the NSWO service; and/or, the SUCI includes service indication information, and the service indication information is used to indicate the authentication for the NSWO service.
  • the method before determining the address of the NSWO network element according to the SUCI, the method further includes: receiving first NSWO indication information sent by the terminal device, where the first NSWO indication information is used to indicate authentication for the NSWO service.
  • the first NSWO indication information and the SUCI are in one message.
  • the second request message further includes the first NSWO indication information.
  • the NSWO network element, AUSF or UDM may directly determine to execute the authentication for the NSWO service according to the first NSWO indication information.
  • the second request message further includes third NSWO indication information, and the third NSWO indication information is used to instruct authentication for the NSWO service.
  • the NSWO network element, AUSF or UDM may directly determine to execute the authentication for the NSWO service according to the third NSWO indication information.
  • the method before receiving the SUCI sent by the terminal device, the method further includes: sending second NSWO indication information to the terminal device, where the second NSWO indication information is used to indicate that the access network device supports the NSWO service.
  • the second request message further includes an access network identifier of the access network device.
  • the access network identifier can be used by the NSWO network element to send the first identification information of the AN device to the AUSF, so that the final UDM can use it when calculating the EAP AKA' authentication vector.
  • determining the address of the NSWO network element according to the SUCI includes: obtaining the target network identifier and/or target routing identifier from the SUCI; according to the mapping between the network identifier and/or routing identifier and the address of the NSWO network element relationship, to obtain the address of the NSWO network element corresponding to the target network ID and/or the target routing ID.
  • determining the address of the NSWO network element according to the SUCI includes: obtaining the target network identifier and/or the target routing identifier from the SUCI; sending the target network identifier and/or the target routing identifier to the first address management network element ; Receive the address of the NSWO network element sent by the first address management network element.
  • receiving the SUCI sent by the terminal device includes: receiving a connection establishment request message sent by the terminal device, where the connection establishment request message includes the SUCI and the first NSWO indication information.
  • receiving the SUCI sent by the terminal device includes: sending a first request message to the terminal device, and receiving a first response message sent by the terminal device, where the first response message includes the first NSWO indication information and the SUCI.
  • a method for authenticating a NSWO service including: receiving a second request message sent by an access network device, the second request message including the SUCI of the terminal device; determining to perform authentication for the NSWO service according to the second request message ; Send the first authentication request message to AUSF, the first authentication request message includes SUCI; receive the first authentication response message sent by AUSF, the first authentication response message is the corresponding authentication response message of EAP AKA' authentication algorithm; according to the first authentication response The message sends the third authentication request message to the access network device, and the third authentication request message is the authentication request message corresponding to the EAP AKA' authentication algorithm; receives the fourth authentication request message sent by the access network device; sends the authentication request message according to the fourth authentication request message AUSF sends a fifth authentication request message.
  • the authentication method for NSWO services provided by the third aspect can be applied to NSWO network elements.
  • the network elements involved in the complete NSWO service authentication process include UE, AN equipment, NSWO network elements, AUSF and UDM.
  • the EAP AKA’ authentication method it is determined to adopt the EAP AKA’ authentication method, which avoids the authentication failure caused by choosing the 5G AKA authentication method, and realizes the authentication for NSWO services in 5G and other networks.
  • determining to perform authentication for the NSWO service according to the second request message includes at least one of the following situations: determining to perform authentication for the NSWO service according to the NSWO indication information included in the second request message; Determine the authentication for the NSWO service according to the SUCI; determine the address or the access network identifier of the access network device according to the second request message, after determining that the access network device supports the NSWO service according to the address or the access network identifier of the access network device , to confirm the certification for NSWO business.
  • the SUPI type included in the SUCI is used to indicate the authentication for the NSWO service; and/or, the SUCI includes service indication information, and the service indication information is used to indicate the authentication for the NSWO service.
  • the first authentication request message further includes fourth NSWO indication information, and the fourth NSWO indication information is used to instruct authentication for the NSWO service.
  • the AUSF or UDM may directly determine to perform authentication for the NSWO service according to the fourth NSWO indication information.
  • the first authentication request message further includes one of the following: the access network identifier of the access network device carried in the second request message; the service corresponding to the access network identifier of the access network device Network name; the access network identifier determined according to the relevant information of the access network equipment; the preset access network identifier, used to indicate the authentication for NSWO services; the preset service network name, used to indicate the authentication for NSWO services .
  • the second authentication request message further includes second identification information of the access network device, and the access network device is the access network device connected to the terminal device; the second identification information includes: the first information or the second identification information The first identification information carried in an authentication request message; if the first identification information carried in the first authentication request message is the access network identification of the access network device, then the first information is the service network name corresponding to the access network identification ; If the first authentication request message does not carry the first identification information, the first information is the default access network identification or the default service network name; the default access network identification or the default service network name are used to indicate the Accreditation for NSWO businesses.
  • the first authentication request message is an authentication service request message for UE authentication
  • the first authentication response message is an authentication service response message for UE authentication
  • both the first authentication request message and the first authentication response message are messages corresponding to the newly added AUSF service, and the newly added AUSF service is used to instruct the execution of authentication for the NSWO service.
  • the AUSF may directly determine to execute the authentication for the NSWO service according to the newly added AUSF service.
  • an authentication method for NSWO services including: receiving a first authentication request message sent by a NSWO network element, where the first authentication request message includes SUCI; determining to perform authentication for the NSWO service according to the first authentication request message; Send the second authentication request message to UDM, the second authentication request message includes SUCI; Receive the second authentication response message sent by UDM, the second authentication response message includes the second EAP AKA 'authentication vector; send to NSWO network according to the second authentication response message The element sends the first authentication response message, and the first authentication response message is the authentication response message corresponding to the EAP AKA' authentication algorithm; receives the fifth authentication request message sent by the NSWO network element; performs authentication for the terminal device according to the fifth authentication request message.
  • the authentication method for the NSWO service provided in the fourth aspect can be applied to AUSF.
  • the network elements involved in the complete NSWO service authentication process include UE, AN equipment, NSWO network elements, AUSF and UDM.
  • EAP AKA EAP AKA’ authentication method, which avoids the authentication failure caused by choosing the 5G AKA authentication method, and realizes the authentication for NSWO services in 5G and other networks.
  • determining to perform authentication for the NSWO service according to the first authentication request message includes at least one of the following situations: determining to perform authentication for the NSWO service according to the NSWO indication information included in the first authentication request message Authentication; the NSWO indication information is used to indicate the authentication for the NSWO business; when it is determined that the first authentication request message is the request message corresponding to the newly added authentication server function AUSF service, it is determined to perform the authentication for the NSWO business, and the new AUSF service is used According to the instruction to perform authentication for NSWO services; determine the authentication for NSWO services according to SUCI; determine the type or address of the NSWO network element according to the first authentication request message, and determine that the NSWO network element supports the NSWO service according to the type or address of the NSWO network element After that, it is determined to carry out the certification for NSWO business.
  • the SUPI type included in the SUCI is used to indicate the authentication for the NSWO service; and/or, the SUCI includes service indication information, and the service indication information is used to indicate the authentication for the NSWO service.
  • the second authentication request message further includes fifth NSWO indication information, where the fifth NSWO indication information is used to instruct authentication for the NSWO service.
  • the UDM can directly determine to execute the authentication for the NSWO service.
  • the second authentication request message after determining to perform authentication for the NSWO service according to the first authentication request message, it also includes: determining to use the EAP AKA' authentication algorithm; correspondingly, the second authentication request message also includes algorithm indication information, and the algorithm indication Information used to indicate EAP AKA' authentication.
  • the UDM can directly determine the use of the EAP AKA' authentication algorithm, which simplifies the processing of the UDM.
  • the first authentication request message further includes first identification information of the access network device, where the access network device is an access network device connected to the terminal device; the first identification information includes one of the following: The access network identifier of the access network device; the service network name corresponding to the access network identifier of the access network device; the preset access network identifier, used to indicate the authentication for the NSWO service; the preset service network name, used for Indicates authentication for NSWO services.
  • the first identification information can be used by the AUSF to send the second identification information of the AN device to the UDM, so that the UDM can use it when calculating the EAP AKA' authentication vector.
  • the second authentication request message further includes second identification information of the access network device, and the access network device is the access network device connected to the terminal device; the second identification information includes: the first information or the second identification information The first identification information carried in an authentication request message; if the first identification information carried in the first authentication request message is the access network identification of the access network device, then the first information is the service network name corresponding to the access network identification ; If the first authentication request message does not carry the first identification information, the first information is the default access network identification or the default service network name; the default access network identification or the default service network name are used to indicate the Accreditation for NSWO businesses.
  • the second identification information can be used for subsequent UDM calculation of the EAP-AKA' authentication vector.
  • the first authentication request message is an authentication service request message for UE authentication
  • the first authentication response message is an authentication service response message for UE authentication
  • both the first authentication request message and the first authentication response message are messages corresponding to the newly added AUSF service, and the newly added AUSF service is used to instruct the execution of authentication for the NSWO service.
  • the second authentication request message is a service request message for UE authentication
  • the second authentication response message is a service response message for UE authentication
  • both the second authentication request message and the second authentication response message are messages corresponding to the newly added UDM service, and the newly added UDM service is used to instruct the execution of authentication for the NSWO service.
  • the UDM can directly determine to execute the authentication for the NSWO service according to the newly added UDM service.
  • the second authentication response message also includes the SUPI of the terminal device; the method further includes: after the terminal device is successfully authenticated according to the fifth authentication request message, sending the first NSWO authentication result to the UDM, and the first The NSWO authentication result includes SUPI, and/or the access network identifier of the access network device, and/or the service network name corresponding to the access network identifier, and the access network device is the access network device connected to the terminal device.
  • the AUSF after the AUSF determines that the UE is successfully authenticated for the NSWO service, it can notify the UDM of the successfully authenticated UE and/or the AN device that the successfully authenticated UE accesses, so that the UDM can perform authentication on the successfully authenticated UE and/or The AN device successfully accessed by the UE will record it, so as to complete the billing for the UE or AN device later.
  • the first NSWO authentication result further includes authentication indication information, and the authentication indication information is used to indicate that the terminal device is successfully authenticated for the NSWO service.
  • the first NSWO authentication result is included in the UE authentication result confirmation message.
  • the second EAP AKA' authentication vector does not include the key CK' and the key IK', and the first authentication response message includes the second EAP AKA' authentication vector.
  • the second EAP AKA' authentication vector includes the key CK' and the key IK'
  • the first authentication response message includes the second EAP AKA' authentication vector
  • the second EAP AKA' authentication vector includes the key CK' and the key IK', and sends the first authentication response message to the NSWO network element according to the second authentication response message, including: deleting the second EAP AKA 'Key CK' and key IK' in the authentication vector; send a first authentication response message to the NSWO network element, and the first authentication response message includes the second EAP AKA' authentication vector after the key is deleted.
  • AUSF deletes the key CK' and key IK' in the second EAP AKA' authentication vector, which avoids the newly generated key CK' and key IK' in the authentication process for NSWO services from affecting the current state. There are associated keys that have been generated during the authentication process.
  • after performing authentication on the terminal device according to the fifth authentication request message and after receiving the key CK' and the key IK' further include: not based on the key CK' and the key IK' calculates the key K AUSF ; or, calculates the key K AUSF based on the key CK' and the key IK', without replacing the locally stored key K AUSF in AUSF.
  • the AUSF does not calculate the new key K AUSF or does not replace it after calculating the new key K AUSF , which will not cause the newly generated key K AUSF to affect the relevant keys generated in the current authentication process of the AUSF.
  • the method further includes: deleting the key CK′ and the key IK′; and/or deleting the key K AUSF .
  • AUSF deletes the newly generated keys during the authentication process for NSWO services, which prevents the newly generated keys from affecting the related keys generated during the existing authentication process of AUSF.
  • the method further includes: if the terminal device is successfully authenticated according to the fifth authentication request message, sending a second NSWO authentication result to the billing NF, where the second NSWO authentication result includes the SUPI of the terminal device , and/or the access network identifier of the access network device, and/or the service network name corresponding to the access network identifier, SUPI is included in the second authentication response message, and the access network device is the access network device connected to the terminal device .
  • the AUSF after the AUSF determines that the UE has successfully authenticated the NSWO service, it can notify the charging NF of the successfully authenticated UE and/or the AN device that the successfully authenticated UE accesses, so that the charging NF can subsequently complete the authentication for the UE or the AN device. Billing.
  • an authentication method for NSWO services including: receiving a second authentication request message sent by AUSF, the second authentication request message including SUCI; calculating SUPI according to SUCI; determining to use EAP AKA according to the second authentication request message 'Authentication method; obtain the first EAP AKA' authentication vector according to SUPI; send a second authentication response message to AUSF, and the second authentication response message includes the second EAP AKA' authentication vector.
  • the authentication method for the NSWO service provided in the fifth aspect can be applied to UDM.
  • the network elements involved in the complete NSWO service authentication process include UE, AN equipment, NSWO network elements, AUSF and UDM.
  • UDM decided to adopt the EAP AKA’ authentication method, which avoided the authentication failure caused by choosing the 5G AKA authentication method, and realized the authentication for NSWO services in 5G and other networks.
  • determining to adopt the EAP AKA' authentication method according to the second authentication request message includes at least one of the following situations: when determining that the second authentication request message is a request message corresponding to a newly added UDM service, determining Perform authentication for NSWO services, and add UDM services to indicate authentication for NSWO services; determine the use of EAP AKA' authentication methods according to the second information in the second authentication request message, wherein the second information includes at least one of the following One: the second information is NSWO indication information, and the NSWO indication information is used to indicate the authentication for the NSWO business; the second information is SUCI, and the SUCI is used to indicate the authentication for the NSWO business; the second information is the algorithm indication information, and the algorithm The instruction information is used to instruct to perform EAP AKA' authentication.
  • the SUPI type included in the SUCI is used to indicate the authentication for the NSWO service; and/or, the SUCI includes service indication information, and the service indication information is used to indicate the authentication for the NSWO service.
  • the second EAP AKA' authentication vector does not include the key CK' and the key IK'.
  • the second authentication request message further includes second identification information of the access network device, and the access network device is the access network device connected to the terminal device; the second identification information includes: the first information or the second identification information The first identification information carried in an authentication request message; the first authentication request message is a message sent by an NSWO network element to AUSF; if the first identification information carried in the first authentication request message is the access network identification of the access network device , the first information is the service network name corresponding to the access network identifier; if the first authentication request message does not carry the first identification information, the first information is the preset access network identifier or the preset service network name; the preset Both the access network identifier and the default service network name are used to indicate the authentication for the NSWO service.
  • the second authentication request message is a service request message for UE authentication
  • the second authentication response message is a service response message for UE authentication
  • both the second authentication request message and the second authentication response message are messages corresponding to the newly added UDM service, and the newly added UDM service is used to instruct the execution of authentication for the NSWO service.
  • the UDM can directly determine to execute the authentication for the NSWO service according to the newly added UDM service.
  • the method further includes: receiving the first NSWO authentication result sent by the AUSF, the first NSWO authentication result includes SUPI, and/or the access network identifier of the access network device, and/or the access network identifier
  • the corresponding service network name, the access network device is the access network device connected to the terminal device, and the first NSWO authentication result is used to indicate that the terminal device is successfully authenticated for the NSWO service.
  • the first NSWO authentication result further includes authentication indication information, and the authentication indication information is used to indicate that the terminal device is successfully authenticated for the NSWO service.
  • the first NSWO authentication result is included in the UE authentication result confirmation message.
  • an apparatus including: a unit or means for performing each step in any one of the above aspects.
  • a communication device in a seventh aspect, includes a processor, a memory, and a transceiver; the transceiver is used to communicate with other devices, and the processor is used to read instructions in the memory and make the communication device execute any of the above-mentioned aspects according to the instructions. Methods.
  • a program is provided, which is used to execute the method provided in any one of the above aspects when executed by a processor.
  • a computer-readable storage medium is provided, and instructions are stored in the computer-readable storage medium, and when the instructions are run on a computer or a processor, the method provided in any one of the above aspects is implemented.
  • a program product in a tenth aspect, includes a computer program, the computer program is stored in a readable storage medium, and at least one processor of a device can read the computer program from the readable storage medium , the at least one processor executes the computer program so that the device implements the method provided in any aspect above.
  • Fig. 1 is a kind of architectural diagram of the 4G network that the embodiment of the present application provides;
  • FIG. 2 is an architectural diagram of a 5G network provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of messages involved in the NSWO service authentication method provided by the embodiment of the present application.
  • Fig. 4 is a message interaction diagram of the authentication method of the NSWO service provided by the embodiment of the present application.
  • Fig. 5 is another message interaction diagram of the authentication method of the NSWO service provided by the embodiment of the present application.
  • FIG. 6 is another message interaction diagram of the NSWO service authentication method provided by the embodiment of the present application.
  • FIG. 7 is another message interaction diagram of the NSWO service authentication method provided by the embodiment of the present application.
  • FIG. 8 is another message interaction diagram of the NSWO service authentication method provided by the embodiment of the present application.
  • FIG. 9 is another message interaction diagram of the NSWO service authentication method provided by the embodiment of the present application.
  • FIG. 10 is another message interaction diagram of the NSWO service authentication method provided by the embodiment of the present application.
  • Fig. 11 is another message interaction diagram of the NSWO service authentication method provided by the embodiment of the present application.
  • FIG. 12 is another message interaction diagram of the NSWO service authentication method provided by the embodiment of the present application.
  • Figure 13 is another message interaction diagram of the NSWO service authentication method provided by the embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 15 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the authentication method for the NSWO service provided in the embodiment of this application is applicable to the authentication process when the terminal device in the 5G network performs the NSWO service.
  • the NSWO service, 4G network architecture and 5G network architecture are described.
  • the 3GPP organization defines a series of standard documents and network architecture in order to realize the interoperability function between the 3GPP network and the wireless local area network (WLAN).
  • WLAN wireless local area network
  • 3GPP AAA related equipment is introduced to realize access control and authentication based on 3GPP network, so that user equipment (UE) can access packet switching through WLAN network Domain (packet switching domain, PS) business.
  • UE user equipment
  • FIG. 1 is an architectural diagram of a 4G network provided by an embodiment of the present application.
  • 4G networks include: non-3GPP networks (non-3GPP networks), visited public land mobile network (VPLMN) and local public land mobile network (home public land mobile network, HPLMN).
  • the non-3GPP network includes: UE, trusted non-3GPP access network (trusted non-3GPP access network) equipment and untrusted non-3GPP access network (untrusted non-3GPP access network) equipment.
  • VPLMN includes: 3GPP AAA proxy (3GPP AAA proxy).
  • the HPLMN includes: a 3GPP AAA server and a home subscriber server (HSS). See Table 1 for the functional description of each device.
  • the 4G network supports NSWO services.
  • the NSWO service means that the data of the PS service performed by the UE can be offloaded by the AN device and directly connected to the Internet (internet).
  • the UE and the network side need to complete the authentication for the NSWO service.
  • UE authentication can be completed through trusted non-3GPP access network equipment, 3GPP AAA proxy, 3GPP AAA server and HSS; or, can be completed through untrusted non-3GPP access network equipment, 3GPP AAA proxy, The 3GPP AAA server and the HSS complete the authentication of the UE. If the UE is successfully authenticated, the HSS and 3GPP AAA server will send the authentication result indicating successful authentication to the AN device, so that the AN device performs NSWO services for the UE.
  • the AN device allocates an Internet protocol (internet protocol, IP) address of the external network to the UE, so that the UE can connect to the Internet.
  • IP Internet protocol
  • the above authentication process can be understood as: the AN device completes the authentication of the UE by means of the operator. After the operator successfully authenticates the UE and determines that the UE is a legal user of the operator, the AN device will provide the UE with NSWO services.
  • the key used in the authentication process is the key used by the UE in the 3GPP network access authentication, for example, the key stored in the universal subscriber identity module (USIM).
  • Authentication algorithms include extensible authentication protocol/authentication and key agreement (extensible authentication protocol-authentication and key agreement, EAP-AKA) authentication algorithm and EAP-AKA' authentication algorithm.
  • FIG. 2 is an architectural diagram of a 5G network provided in an embodiment of the present application.
  • the 5G network includes: UE, AN equipment, NSWO network element, authentication server function (authentication server function, AUSF) and unified data management (unified data management, UDM). See Table 2 for the functional description of each device.
  • the equipment of 5G network and 4G network may be different.
  • the authentication algorithms supported by the 5G network and the 4G network are also different.
  • the 4G network supports the EAP-AKA authentication algorithm and the EAP-AKA’ authentication algorithm
  • the 5G network supports the EAP-AKA’ authentication algorithm and the 5G AKA authentication algorithm.
  • the 5G AKA authentication algorithm is not suitable for access authentication of existing AN devices in the NSWO business scenario. Therefore, the embodiment of the present application provides an authentication process applicable to a UE performing NSWO services in a 5G network.
  • FIG. 3 is a message interaction diagram of the NSWO service authentication method provided by the embodiment of the present application. It should be noted that FIG. 3 does not limit the name of the interaction message. As shown in Figure 3, the messages involved include:
  • the authentication for the NSWO service can be initiated by the UE.
  • the UE may initiate authentication for the NSWO service.
  • the AN device may trigger the UE to start authentication for the NSWO service.
  • the message for the UE to start the authentication phase may include at least one of a connection establishment request message, a first request message, a first response message or a broadcast message. Details will be described later with reference to FIGS. 6 to 9 .
  • the message sent by the AN device to the NSWO network element is used to request authentication for the NSWO service, including the subscription concealed identifier (SUCI) of the UE.
  • SUCI subscription concealed identifier
  • the second request message may be an AAA message.
  • the first authentication request message and the first authentication response message are a pair of interaction messages between the NSWO network element and the AUSF.
  • the first authentication request message and the first authentication response message are respectively a request message and a response message corresponding to the AUSF service.
  • the AUSF service is an existing service.
  • the existing AUSF service is an authentication service (Nausf_UEAuthentication_Authenticate) for UE authentication.
  • the first authentication request message is an authentication service request message (Nausf_UEAuthentication_Authenticate request) for UE authentication
  • the first authentication response message is an authentication service response message (Nausf_UEAuthentication_Authenticate response) for UE authentication.
  • the AUSF service may be a newly added service, and the newly added AUSF service is used to instruct the authentication for the NSWO service.
  • the embodiment of the present application does not limit the name of the newly added AUSF service, the name of the request message and the name of the response message in the newly added AUSF service.
  • the name of the newly added AUSF service may be UE authentication NSWO authentication service (Nausf_UEAuthentication_NSWO_Authenticate).
  • the first authentication request message may be called a UE-authentication NSWO authentication service request message (Nausf_UEAuthentication_NSWO_Authenticate request)
  • the first authentication response message may be called a UE-authentication NSWO authentication service response message (Nausf_UEAuthentication_NSWO_Authenticate response).
  • the second authentication request message and the second authentication response message are a pair of interaction messages between the AUSF and the UDM.
  • the second authentication request message and the second authentication response message are request messages and response messages corresponding to the UDM service, respectively.
  • the UDM service is an existing service.
  • an existing UDM service is UE Authentication Get Service (Nudm_UEAuthentication_Get).
  • the second authentication request message is a UE authentication service request message (Nudm_UEAuthentication_Get request)
  • the second authentication response message is a UE authentication service response message (Nudm_UEAuthentication_Get response).
  • the UDM service may be a newly added service, and the newly added UDM service is used to indicate the authentication for the NSWO service.
  • the embodiment of the present application does not limit the name of the newly added UDM service, the name of the request message and the name of the response message in the newly added UDM service.
  • the name of the newly added UDM service may be UE authentication NSWO authentication service (Nudm_UEAuthentication_NSWO_Authenticate).
  • the second authentication request message may be called a UE authenticated NSWO authentication service request message (Nudm_UEAuthentication_NSWO_Authenticate request)
  • the second authentication response message may be called a UE authenticated NSWO get service authentication message (Nudm_UEAuthentication_NSWO_Authenticate response).
  • the third authentication request message and the fourth authentication request message are authentication-related messages transmitted between the UE and the NSWO network element through the AN device, and are used for the UE to perform authentication verification on the network.
  • the message sent by the NSWO network element to the AUSF is used for the AUSF to perform authentication verification on the UE.
  • the AUSF sends the first message to the NSWO network element, which carries the EAP authentication result.
  • the NSWO network element sends the second message to the AN device, which carries the EAP authentication result.
  • the EAP authentication result is used to notify the AN device of authentication success or authentication failure.
  • the embodiment of the present application does not limit the content included in the first message and the second message, and does not limit the implementation manner of the EAP authentication result. It can be related messages in the existing EAP-AKA' authentication process.
  • the AN device can perform NSWO service operations. For example, an IP address for accessing the external network is assigned to the UE.
  • the AN device sends a NSWO service indication message to the UE.
  • the NSWO service indication message may include at least one of the following: IP address, NSWO authorization indication, or authentication success indication.
  • the AN device sends a rejection message to the UE, which is used to indicate rejection of the UE's request to use the NSWO service.
  • the embodiment of the present application does not limit the contents of the NSWO service indication message and the rejection message, which may be related messages in the existing EAP-AKA' authentication process.
  • the UE's real identity can be called SUPI, which is similar to the International Mobile Subscriber Identity (IMSI).
  • IMSI International Mobile Subscriber Identity
  • SUPI does not appear on the air interface, which refers to the wireless interface between the UE and the network device.
  • SUCI is the ciphertext obtained by encrypting and encapsulating SUPI with a key for the UE, which can be transmitted over the air interface.
  • the network device can decrypt the SUCI to obtain the SUPI, thereby determining the identity of the UE.
  • the SUCI is in a network access identifier (network access identifier, NAI) format.
  • NAI network access identifier
  • the SUCI may be an existing SUCI generated according to the SUPI, for example, the SUCI used in a 5G network.
  • the SUCI is used to indicate the authentication for the NSWO service.
  • the AN device, the NSWO network element, the AUSF or the UDM can determine to execute the authentication for the NSWO service according to the SUCI.
  • the SUPI type included in the SUCI is used to indicate the authentication for the NSWO service.
  • the types of SUPI can be found in Table 3. When the type of SUPI is 4-7, it is a reserved type.
  • a new SUPI type can be defined for the NSWO service, and the authentication for the NSWO service can be performed through the newly defined SUPI type indication.
  • the value of the newly defined SUPI type can be any value from 4 to 7.
  • Types of SUPI describe 0 IMSI 1 Network specific identifier (network specific identifier, NSI) 2 Global line identifier (global line identifier, GLI) 3 Global cable identifier (global cable identifier, GCI) 4-7 reserve
  • SUCI in NAI form is: typoX.rid678.schid1.hnkey27.ecckey ⁇ ECC ephemeral public key>.cip ⁇ encryption of user17>.mac ⁇ MAC tag value>@example.com).
  • the value of X can be any value from 4 to 7.
  • the SUCI includes service indication information, and the service indication information is used to indicate the authentication for the NSWO service.
  • an example of SUCI in NAI form is: type0.NSWOIndication.rid678.schid1.hnkey27.ecckey ⁇ ECC ephemeral public key>.cip ⁇ encryption of user17>.mac ⁇ MAC tag value>@example.com).
  • the NSWO indication is service indication information.
  • the NSWO indication information is used to indicate the authentication for the NSWO service.
  • the NSWO indication information may be carried in at least one of the following messages in FIG. 3 : a message in the UE startup authentication phase, a second request message, a first authentication request message or a second authentication request message.
  • the NSWO indication information can be further refined, including:
  • the first NSWO indication information is the NSWO indication information generated by the UE and sent to the AN device during the UE startup authentication phase.
  • the second NSWO indication information is the NSWO indication information generated by the AN device and sent to the UE during the UE startup authentication phase, and is used to notify the UE that the AN device supports the NSWO service.
  • the third NSWO indication information is the NSWO indication information added by the AN device in the second request message.
  • the fourth NSWO indication information is the NSWO indication information added by the NSWO network element in the first authentication request message.
  • the fifth NSWO indication information is the NSWO indication information added by the AUSF in the second authentication request message.
  • UDM After UDM receives the second authentication request message, if it determines to adopt the EAP-AKA' authentication algorithm, it calculates the EAP-AKA' authentication vector, which is called the first EAP AKA' authentication vector (RAND, AUTN, XRES, CK', IK') .
  • the first EAP AKA' authentication vector includes a key CK' and a key IK'.
  • the UDM sends a second authentication response message to the AUSF, and the second authentication response message includes a second EAP AKA' authentication vector.
  • the second EAP AKA' authentication vector is the first EAP AKA' authentication vector.
  • the second EAP AKA' authentication vector is the part after deleting the key CK' and the key IK' in the first EAP AKA' authentication vector, ie (RAND, AUTN, XRES).
  • the AN device has the same meaning as the AN.
  • the access network identifier (AN ID) and the serving network name (serving network name) may be equivalent.
  • Fig. 4 is a message interaction diagram of the NSWO service authentication method provided by the embodiment of the present application.
  • the NSWO service authentication method provided in this embodiment involves UE, AN equipment, NSWO network element, AUSF and UDM as execution subjects.
  • the authentication method of the NSWO service provided by this embodiment may include:
  • Step 1 After the UE determines to perform the NSWO service, the UE sends SUCI to the AN device. Correspondingly, the AN device receives the SUCI sent by the UE.
  • This step relates to the UE-initiated authentication phase in FIG. 3 .
  • the SUCI can refer to the above description, and will not be repeated here.
  • the UE sends the SUCI to the AN device, and starts the authentication process for the NSWO service.
  • the UE may also send the first NSWO indication information to the AN device, where the first NSWO indication information is used to indicate authentication for the NSWO service.
  • the AN device may also receive the first NSWO indication information sent by the UE.
  • the AN device determines that authentication for the NSWO service is required according to the first NSWO indication information, so as to distinguish different authentication processes.
  • the first NSWO indication information and the SUCI may be in different messages; or, the first NSWO indication information and the SUCI may be in one message.
  • the first NSWO indication information and the SUCI are simultaneously sent through one message, or the first NSWO indication information and the SUCI are sent through different messages, thereby improving the diversity of message flows.
  • the number of air interface messages is reduced.
  • the message type may be an EAP message.
  • Step 2 The AN device determines the address of the NSWO network element according to the SUCI.
  • the AN device After receiving the SUCI sent by the UE, if the AN device determines to perform authentication for the NSWO service, it determines the address of the NSWO network element according to the SUCI.
  • the AN device determines to perform authentication for the NSWO service.
  • the AN device supports the NSWO service by default, it determines that authentication for the NSWO service needs to be performed when receiving the SUCI sent by the UE.
  • the SUCI indicates to perform the authentication for the NSWO service, it is determined to perform the authentication for the NSWO service.
  • the AN device also receives the first NSWO indication information, it determines to perform authentication for the NSWO service according to the first NSWO indication information.
  • the AN device determines the address of the NSWO network element according to the SUCI.
  • it may include:
  • the AN device obtains the target network identifier and/or the target route identifier from the SUCI.
  • the target network identifier is the identifier of the home network where the UE is located, for example, a mobile country code (mobile country code, MCC) and a mobile network code (mobile network code, MNC).
  • the target routing ID (routing ID) is used to further select UE authentication-related network elements, such as the selection of AUSF and/or UDM.
  • the AN device obtains the address of the NSWO network element corresponding to the target network ID and/or the target routing ID according to the mapping relationship between the network ID and/or the routing ID and the address of the NSWO network element.
  • the AN device may locally store the mapping relationship between the network identifier and/or route identifier and the NSWO network element address.
  • the mapping relationship between the network identifier and/or routing identifier and the NSWO network element address may include at least one of the following: the mapping relationship between the network identifier and the NSWO network element address, the relationship between the routing identifier and the NSWO network element address or the mapping relationship between network identifiers, route identifiers, and NSWO network element addresses. Simple to implement.
  • the AN device determines the address of the NSWO network element according to the SUCI. In another implementation, it may include:
  • the AN device obtains the target network identifier and/or the target route identifier from the SUCI.
  • the AN device sends the target network identifier and/or the target route identifier to the first address management network element.
  • the AN device receives the address of the NSWO network element sent by the first address management network element.
  • the AN device may not locally store the mapping relationship between the network identifier and/or route identifier and the NSWO network element address.
  • the address of the NSWO network element is obtained from the first address management network element by sending the target network identifier and/or the target route identifier to the first address management network element.
  • this embodiment does not limit the name of the first address management network element.
  • the first address management network element may locally store the mapping relationship between the network identifier and/or route identifier and the address of the NSWO network element.
  • Step 3 The AN device sends a second request message to the NSWO network element according to the address of the NSWO network element, and the second request message includes the SUCI.
  • the NSWO network element receives the second request message sent by the AN device.
  • the second request message may also include NSWO indication information.
  • the NSWO indication information may include at least one of the following: first NSWO indication information or third NSWO indication information. That is, the NSWO indication information is the first NSWO indication information; or, the NSWO indication information is the third NSWO indication information; or, the NSWO indication information includes the first NSWO indication information and the third NSWO indication information.
  • first NSWO indication information and the third NSWO indication information reference may be made to the above description of this application, and details are not repeated here.
  • the UE sends an EAP-RSP message to the AN device, which carries SUCI.
  • the EAP-RSP message may or may not include the first NSWO indication information.
  • the AN device may add third NSWO indication information outside the EAP-RSP message.
  • the NSWO network element determines that authentication for the NSWO service is required according to the NSWO indication information, which is convenient for distinguishing different authentication procedures.
  • the second request message may also include an access network identifier (AN ID) of the AN device.
  • AN ID is used for the subsequent NSWO network element to send the first identification information of the AN device to the AUSF, see step 5 for details.
  • Step 4 the NSWO network element determines to perform authentication for the NSWO service according to the second request message.
  • the AN device supports the NSWO service by default, and it may be determined to perform authentication for the NSWO service when receiving the second request message from the AN device.
  • the NSWO network element supports the NSWO service by default, and it may be determined to perform authentication for the NSWO service when receiving the second request message from the AN device.
  • it may be determined to perform authentication for the NSWO service according to the NSWO indication information included in the second request message.
  • the NSWO indication information included in the second request message reference may be made to the relevant description in step 3, which will not be repeated here.
  • the authentication for the NSWO service may be determined according to the SUCI.
  • the SUCI is used to indicate the authentication for the NSWO service.
  • the address or access network identifier of the AN device may be determined according to the second request message, and after determining that the AN device supports the NSWO service according to the address or access network identifier of the AN device, it is determined to perform Accreditation for NSWO businesses.
  • the NSWO network element transparently transmits the second request message, and may determine to perform authentication for the NSWO service when receiving the second request message from the AN device.
  • Step 5 The NSWO network element sends a first authentication request message to the AUSF, and the first authentication request message includes SUCI.
  • the AUSF receives the first authentication request message sent by the NSWO network element.
  • the NSWO network element may determine the address of the AUSF according to the SUCI, and the NSWO network element sends the first authentication request message to the AUSF according to the address of the AUSF.
  • the NSWO network element determines the address of the AUSF according to the SUCI.
  • it may include:
  • the NSWO network element obtains the target network identifier and/or the target route identifier from the SUCI.
  • the target network identifier can refer to the relevant description in step 2.
  • Target routing ID (routing ID) is used to determine the address of AUSF or UDM.
  • the NSWO network element obtains the address of the AUSF corresponding to the target network ID and/or the target routing ID according to the mapping relationship between the network ID and/or the routing ID and the AUSF address.
  • the NSWO network element may locally store the mapping relationship between the network identifier and/or route identifier and the AUSF address.
  • the mapping relationship between the network identifier and/or the routing identifier and the AUSF address may include at least one of the following: a mapping relationship between the network identifier and the AUSF address, a mapping relationship between the routing identifier and the AUSF address, or , the mapping relationship between the network identifier, the routing identifier and the AUSF address. Simple to implement.
  • the NSWO network element determines the address of the AUSF according to the SUCI.
  • it may include:
  • the NSWO network element obtains the target network identifier and/or the target route identifier from the SUCI.
  • the NSWO network element sends the target network identifier and/or the target route identifier to the second address management network element.
  • the NSWO network element receives the address of the AUSF sent by the second address management network element.
  • the NSWO network element may not locally store the mapping relationship between the network identifier and/or route identifier and the AUSF address.
  • the address of the AUSF is obtained from the second address management network element by sending the target network identifier and/or the target route identifier to the second address management network element.
  • this embodiment does not limit the name of the second address management network element.
  • the second address management network element may locally store the mapping relationship between the network identifier and/or route identifier and the AUSF address.
  • the first authentication request message may also include NSWO indication information.
  • the NSWO indication information may include at least one of the following: first NSWO indication information or fourth NSWO indication information. That is, the NSWO indication information is the first NSWO indication information; or, the NSWO indication information is the fourth NSWO indication information; or, the NSWO indication information includes the first NSWO indication information and the fourth NSWO indication information.
  • first NSWO indication information and the fourth NSWO indication information reference may be made to the above description in this application, and details are not repeated here.
  • the AUSF determines that authentication for the NSWO service is required according to the NSWO indication information, which is convenient for distinguishing different authentication procedures.
  • the first authentication request message may also include first identification information of the AN device.
  • the first identification information is used for the subsequent AUSF to send the second identification information of the AN device to the UDM, see step 7 for details.
  • the first identification information may be one of the following:
  • the access network identifier (AN ID) of the AN device carried in the second request message.
  • the NSWO network element sends the AN ID sent by the AN device to the AUSF.
  • the serving network name (serving network name) corresponding to the access network identifier of the AN device.
  • the NSWO network element can convert the obtained AN ID into a serving network name and send it to AUSF.
  • the access network identifier determined according to the relevant information of the AN device The access network identifier determined according to the relevant information of the AN device.
  • the NSWO network element locally stores relevant information of the AN device, determines the access network identifier through the relevant information, and sends it to the AUSF. This embodiment does not limit the specific content of the relevant information.
  • the preset access network identifier is used to indicate the authentication for the NSWO service.
  • the preset service network name is used to indicate the authentication for the NSWO service.
  • the first authentication request message may be a request message corresponding to an existing AUSF service, and reference may be made to the above description of this application, which will not be repeated here.
  • the first authentication request message includes information for instructing the AUSF to perform authentication for the NSWO service.
  • the information may include at least one of SUCI or NSWO indication information.
  • the first authentication request message may be a request message corresponding to the newly added AUSF service, which may refer to the above description of this application, and will not be repeated here.
  • the newly added AUSF service directly instructs the AUSF to perform authentication for the NSWO service.
  • the first authentication request message may not include information for instructing the AUSF to perform authentication for the NSWO service.
  • the first authentication request message does not include NSWO indication information
  • the SUCI may be the SUCI used in the existing 5G network.
  • the first authentication request message may also include information for instructing the AUSF to perform authentication for the NSWO service.
  • the information may include at least one of SUCI or NSWO indication information.
  • Step 6 The AUSF determines to perform authentication for the NSWO service according to the first authentication request message.
  • the NSWO network element supports the NSWO service by default, and it may be determined to perform authentication for the NSWO service when receiving the first authentication request message from the NSWO network element.
  • the AUSF supports the NSWO service by default, and it may be determined to perform authentication for the NSWO service when receiving the first authentication request message from the NSWO network element.
  • it may be determined to perform authentication for the NSWO service according to the NSWO indication information included in the first authentication request message.
  • the NSWO indication information included in the first authentication request message reference may be made to the relevant description in step 5, which will not be repeated here.
  • the authentication for the NSWO service may be determined according to the SUCI.
  • SUCI is used to indicate authentication for NSWO services.
  • the AUSF determines to perform authentication for the NSWO service.
  • the type or address of the NSWO network element may be determined according to the first authentication request message. After determining that the NSWO network element supports the NSWO service according to the type or address of the NSWO network element, it is determined that the NSWO network element supports the NSWO service. Business certification.
  • Step 7 The AUSF sends a second authentication request message to the UDM, where the second authentication request message includes the SUCI.
  • the UDM receives the second authentication request message sent by the AUSF.
  • the AUSF may send a second authentication request message to the UDM.
  • the second authentication request message may also include NSWO indication information.
  • the NSWO indication information may include at least one of the following: first NSWO indication information or fifth NSWO indication information. That is, the NSWO indication information is the first NSWO indication information; or, the NSWO indication information is the fifth NSWO indication information; or, the NSWO indication information includes the first NSWO indication information and the fifth NSWO indication information.
  • first NSWO indication information and the fifth NSWO indication information reference may be made to the above description in this application, and details are not repeated here.
  • the UDM determines that authentication for the NSWO service is required according to the NSWO indication information, which is convenient for distinguishing different authentication procedures.
  • the second authentication request message may also include second identification information of the AN device, where the AN device is the AN device connected to the UE.
  • the second identification information can be used for the subsequent UDM to calculate the first EAP-AKA' authentication vector, see step 10 for details.
  • the second identification information may be one of the following:
  • the first identification information carried in the first authentication request message For details, please refer to the relevant description in step 5, which will not be repeated here.
  • the AUSF directly sends the first identification information sent by the NSWO network element to the UDM.
  • the first identification information carried in the first authentication request message is the access network identification of the AN device
  • the first information is the serving network name (serving network name) corresponding to the access network identification. name).
  • the first identification information sent by the NSWO network element to the AUSF is the access network identification (AN ID), and the AUSF can convert the obtained AN ID into a serving network name and send it to the UDM.
  • the first authentication request message does not carry the first identification information
  • the first information is a preset access network identifier or a preset service network name. Both the default access network identifier and the default service network name are used to indicate the authentication for the NSWO service.
  • the second authentication request message may be a request message corresponding to an existing UDM service, and reference may be made to the above description of this application, and details are not repeated here.
  • the second authentication request message includes information for instructing the UDM to perform authentication for the NSWO service.
  • the information may include at least one of SUCI or NSWO indication information.
  • the second authentication request message may be a request message corresponding to a newly added UDM service, which may refer to the above description of this application, and will not be repeated here.
  • the newly added UDM service directly instructs the UDM to perform authentication for the NSWO service.
  • the second authentication request message may not include information for instructing the UDM to perform authentication for the NSWO service.
  • the second authentication request message does not include NSWO indication information
  • the SUCI may be the SUCI used in the existing 5G network.
  • the second authentication request message may also include information for instructing the UDM to perform authentication for the NSWO service.
  • the information may include at least one of SUCI or NSWO indication information.
  • Step 8 The UDM calculates the SUPI according to the SUCI.
  • This step may adopt an existing implementation manner, and no specific description is given.
  • Step 9 The UDM determines to adopt the EAP AKA' authentication method according to the second authentication request message.
  • the AUSF supports the NSWO service by default, and it may be determined to perform authentication for the NSWO service when receiving the second authentication request message from the AUSF.
  • the second authentication request message when it is determined that the second authentication request message is a request message corresponding to the newly added UDM service, it is determined to perform authentication for the NSWO service, and the newly added UDM service is used to indicate that the authentication for the NSWO service is performed. certified.
  • the second authentication request message is Nudm_UEAuthentication_NSWO_Authenticate request
  • the UDM determines to perform authentication for the NSWO service.
  • the UDM may determine to adopt the EAP AKA' authentication method according to the second information in the second authentication request message.
  • the second information includes at least one of the following:
  • the second information is NSWO indication information
  • the NSWO indication information is used to indicate the authentication for the NSWO service.
  • the NSWO indication information included in the second authentication request message reference may be made to the relevant description in step 7, which will not be repeated here.
  • the second information is SUCI, and the SUCI is used to indicate the authentication for the NSWO service.
  • the UDM determines that the UE wants to use the NSWO service, the UDM determines the subscription data of the UE according to the SUPI, and checks whether the UE is allowed to use the NSWO service according to the subscription data. If it is allowed, continue to execute; otherwise, the UDM sends a rejection message to the AUSF, and then the AUSF sends a rejection message to the NSWO network element, and then the NSWO network element sends a rejection message to the AN device.
  • the rejection message carries an indication that the UE is not authorized to use the NSWO service.
  • the AN device rejects the UE's NSWO service request, or notifies the UE that it is not allowed to use the NSWO service, or is not allowed to use the NSWO service in the network corresponding to the AN ID or serving network name.
  • UDM determines that UE wants to use NSWO service
  • UDM determines UE subscription data according to SUPI
  • UDM determines UE subscription data according to SUPI
  • the rejection message carries an indication that the UE is not authorized to use the NSWO service in the network corresponding to the AN ID or serving network name.
  • the AN device rejects the UE's NSWO service request, or notifies the UE that it is not allowed to use the NSWO service, or is not allowed to use the NSWO service in the network corresponding to the AN ID or serving network name.
  • Step 10 UDM obtains the first EAP AKA' authentication vector (RAND, AUTN, XRES, CK', IK') according to SUPI.
  • the UDM determines to adopt the EAP AKA' authentication method, it can obtain the EAP AKA' authentication vector according to the identification information of the SUPI and the AN device, which is called the first EAP AKA' authentication vector.
  • the AN device is specifically the AN device accessed by the UE.
  • the first EAP AKA' authentication vector includes a key CK' and a key IK'.
  • the identification information of the AN device used when the UDM calculates the first EAP AKA' authentication vector can be one of the following:
  • the second authentication request message does not carry the second identification information of the AN device, it is a preset access network identification or a service network identification.
  • the preset access network identifier or preset service network identifier is used to indicate the authentication for the NSWO service.
  • the second authentication request message does not carry the second identification information of the AN device, it is a preset service network name or a preset service network name.
  • the default service network name or the default service network name is used to indicate the authentication for the NSWO service.
  • Step 11 The UDM sends a second authentication response message to the AUSF, and the second authentication response message includes the second EAP AKA' authentication vector.
  • the AUSF receives the second authentication response message sent by the UDM.
  • the second EAP AKA' authentication vector is the part (RAND, AUTN, XRES) after deleting the key CK' and the key IK' from the first EAP AKA' authentication vector. That is, the second EAP AKA' authentication vector does not include the key CK' and the key IK'.
  • the UE when the UE performs the NSWO service, it needs to perform authentication for the NSWO service.
  • the UE When the UE performs non-NSWO services, it can perform other authentication procedures, for example, the authentication procedure based on the SIM card.
  • the UE By removing the key CK' and key IK' in the first EAP AKA' authentication vector, it is avoided that the newly generated key CK' and key IK' in the authentication process for NSWO services affect the existing authentication process
  • the relevant key generated by the UE or the AUSF ensures that the authentication process provided by this embodiment is applicable to the authentication of the NSWO service.
  • the second authentication response message may also include SUPI.
  • Step 12 AUSF sends the first authentication response message to the NSWO network element according to the second authentication response message, and the first authentication response message is the authentication response message corresponding to the EAP AKA' authentication algorithm.
  • the NSWO network element receives the first authentication response message sent by the AUSF.
  • the AUSF may execute the existing EAP-AKA' authentication process, and send the first authentication response message to the NSWO network element, which may include RAND and AUTN, which will not be specifically described in this embodiment.
  • the first authentication response message does not include the key CK' and the key IK'.
  • the first authentication response message may include Extensible Authentication Protocol/Authentication and Key Agreement Challenge (EAP/AKA-challenge).
  • EAP/AKA-challenge Extensible Authentication Protocol/Authentication and Key Agreement Challenge
  • the NSWO network element sends a third authentication request message to the UE through the AN device according to the first authentication response message.
  • the third authentication request message is an authentication request message corresponding to the EAP AKA' authentication algorithm, which may include RAND and AUTN.
  • the UE receives the third authentication request message sent by the NSWO network element through the AN device.
  • the NSWO network element may execute the existing EAP-AKA' authentication process, and send the third authentication request message to the UE, which is not specifically described in this embodiment.
  • the third authentication request message may include the EAP/AKA-challenge (RAND, AUTN) sent by the AUSF.
  • RAND EAP/AKA-challenge
  • AUTN EAP/AKA-challenge
  • Step 14 the UE uses the EAP AKA' authentication algorithm to perform authentication verification on the network. For example, check whether the MAC in AUTN is correct based on RAND; for example, check whether the freshness of SQN calculated according to RAND and AUTN is satisfied.
  • the verification of RAND and AUTN belongs to the prior art and is not limited.
  • the UE can execute the existing EAP-AKA' authentication process, and use the EAP AKA' authentication algorithm to perform authentication verification on the network. This embodiment does not describe in detail.
  • Step 15 After the authentication verification is successful, the UE sends the calculated RES to the NSWO network element through the AN device, including the RES. Correspondingly, the NSWO network element receives the fourth authentication request message sent by the UE through the AN device.
  • a further optional implementation method includes: the UE is divided into two parts, the USIM and the ME.
  • the ME can be understood as the part of the UE that does not include the USIM.
  • the USIM will perform the security verification of RAND and AUTN. When the USIM verification is successful, the USIM will calculate CK, IK and RES, and send CK, IK and RES to ME. After that, ME will perform corresponding operations for CK, IK and RES, such as calculating CK' and IK' based on CK and IK.
  • the UE can execute the existing EAP-AKA' authentication process, and send the fourth authentication request message to the NSWO network element, which includes the RES, which is not specifically described in this embodiment.
  • the fourth authentication request message may include EAP/AKA-challenge.
  • the UE may also include one of the following:
  • the UE or ME calculates the key CK' and the key IK', and then deletes the key CK' and the key IK'.
  • the UE calculates the key CK' and the key IK', but deletes them later, it avoids that the newly generated key CK' and the key IK' during the authentication process for NSWO services affect the UE's existing authentication process
  • the relevant key generated in the above ensures that the authentication process provided by this embodiment is applicable to the authentication of NSWO services.
  • the UE or ME calculates the key CK' and the key IK' without calculating the key K AUSF according to the key CK' and the key IK', and then deletes the key CK' and the key IK'.
  • the UE calculates the key CK' and the key IK', it does not calculate the key K AUSF , and deletes the key CK' and the key IK', avoiding new
  • the generated key CK' and key IK' affect related keys generated in the UE's current authentication process.
  • the UE or ME calculates the key CK' and the key IK', and calculates the key K AUSF according to the key CK' and the key IK', and then deletes the key CK' and the key IK', and deletes the key K AUSF .
  • the UE calculates the key CK', the key IK' and the key K AUSF , but then deletes them all, avoiding the newly generated key CK' and key IK' during the authentication process for the NSWO service Affects the relevant keys generated in the UE's existing authentication process.
  • the UE or ME calculates the key CK' and the key IK', and calculates the key K AUSF according to the key CK' and the key IK', and then deletes the key CK' and the key IK', and does not send the key locally to the UE
  • the stored key K AUSF is replaced.
  • the UE calculated the key CK', the key IK' and the key K AUSF , but then deleted the key CK' and the key IK'.
  • the key K AUSF is newly generated, it does not replace the locally stored key K AUSF of the UE. It can be understood that the newly generated key K AUSF is not used, so the newly generated key will not affect the current UE.
  • UE or ME does not calculate key CK' and key IK'.
  • the UE does not calculate the key CK' and key IK', which avoids the newly generated key CK' and key IK' in the authentication process for NSWO services from affecting the correlation generated in the UE's existing authentication process. key.
  • the ME sends the K AUSF to the USIM to replace the old K AUSF stored in the USIM card.
  • the ME After the ME determines that it is the authentication of the NSWO service, it sends the RAND and AUTN to the USIM card while sending the authentication instruction to the USIM card.
  • the authentication indication is optionally used to indicate that the USIM card does not need to send CK and IK after the verification is successful, or indicates that the USIM is an authentication-only service, etc.
  • the USIM verification When the USIM verification is successful, the USIM will only calculate the RES according to the authentication instruction, and send the RES to the ME. Either the USIM will not calculate CK and IK according to this authentication indication, or even if it calculates CK and IK, it will not send CK and IK to ME. At this time, ME cannot obtain CK and IK, and will not calculate CK' and IK' based on CK and IK.
  • ME sends RAND and AUTN to USIM card, USIM executes normally, and sends CK, IK and RES to ME.
  • the ME is authenticated according to the NSWO service.
  • the ME can discard, delete, or not use the CK and IK, for example, calculate CK' and IK' based on the CK and IK. It is avoided that the newly generated key CK and key IK in the authentication process for the NSWO service affect the relevant keys generated in the UE's existing authentication process, ensuring that the authentication process provided by this embodiment is applicable to the authentication of the NSWO service.
  • Step 16 the NSWO network element sends a fifth authentication request message to the AUSF according to the fourth authentication request message.
  • the AUSF receives the fifth authentication request message sent by the NSWO network element.
  • the NSWO network element can execute the existing EAP-AKA' authentication process, and send the fifth authentication request message to the AUSF, which is not specifically described in this embodiment.
  • the fifth authentication request message may include the EAP/AKA-challenge sent by the UE.
  • the fifth authentication request message may be Nausf_UEAuthentication_Authenticate request.
  • step 17 the AUSF performs authentication for the UE according to the fifth authentication request message. Such as checking whether RES and XRES are equal. If they are equal, the verification succeeds; otherwise, the verification fails.
  • the AUSF can execute the existing EAP-AKA' authentication process to perform authentication for the UE, which is not specifically described in this embodiment.
  • Step 18 AUSF sends the first message to the NSWO network element after authentication verification.
  • the NSWO network element receives the first message sent by the AUSF.
  • the first message includes the result of the authentication check.
  • Step 19 the NSWO network element sends the second message to the AN device according to the first message.
  • the AN device receives the second message sent by the NSWO network element.
  • Step 20 if the authentication verification is successful, the AN device sends an NSWO service indication message to the UE. It is also possible for the AN device to perform operations corresponding to the NSWO service after confirming that the authentication is successful.
  • Step 21 If the authentication verification fails, the AN device sends a rejection message to the UE.
  • steps 17 to 21 are steps in the existing EAP-AKA' authentication process, and related information can be found in the above description of this application, and will not be repeated here.
  • this embodiment provides an authentication process applicable to UE performing NSWO services in a 5G network, and the network elements involved include UE, AN equipment, NSWO network elements, AUSF and UDM. Among them, after UDM determines to perform authentication for NSWO services, it determines to adopt the EAP AKA' authentication method, which avoids the authentication failure caused by choosing the 5G AKA authentication method.
  • UDM deletes the key CK' and key IK' in the EAP AKA' authentication vector after calculating the EAP AKA' authentication vector using the EAP AKA' authentication method, and then sends it to AUSF, avoiding the authentication process for NSWO services
  • the newly generated key CK' and key IK' affect the relevant keys already generated by the UE or AUSF in the existing authentication process, and avoid affecting the existing key structure of the UE or AUSF.
  • the UE may not calculate the key CK' and the key IK', or delete the calculated key CK', the key IK' or the key K AUSF , or , after the key K AUSF is calculated, the newly generated key K AUSF is not replaced with the local existing key K AUSF , so as to avoid affecting the existing key structure of the UE.
  • Fig. 5 is another message interaction diagram of the NSWO service authentication method provided by the embodiment of the present application.
  • the NSWO service authentication method provided in this embodiment involves UE, AN equipment, NSWO network element, AUSF and UDM as execution subjects.
  • the difference between this embodiment and the embodiment shown in FIG. 4 is that the UDM sends the complete EAP AKA' authentication vector to the AUSF after calculating the EAP AKA' authentication vector in the EAP AKA' authentication manner.
  • the AUSF or the UE can use the newly generated key CK', key IK' or key K AUSF during the authentication process for the NSWO service.
  • the AUSF or the UE may not use the newly generated key CK′, key IK′ or key K AUSF .
  • the authentication method of the NSWO service provided by this embodiment may include:
  • Step 1 After the UE determines to perform the NSWO service, the UE sends SUCI to the AN device. Correspondingly, the AN device receives the SUCI sent by the UE.
  • Step 2 The AN device determines the address of the NSWO network element according to the SUCI.
  • Step 3 The AN device sends a second request message to the NSWO network element according to the address of the NSWO network element, and the second request message includes the SUCI.
  • the NSWO network element receives the second request message sent by the AN device.
  • Step 4 the NSWO network element determines to perform authentication for the NSWO service according to the second request message.
  • Step 5 The NSWO network element sends a first authentication request message to the AUSF, and the first authentication request message includes SUCI.
  • the AUSF receives the first authentication request message sent by the NSWO network element.
  • Step 6 The AUSF determines to perform authentication for the NSWO service according to the first authentication request message.
  • steps 1 to 6 may refer to the embodiment shown in FIG. 4 , which will not be repeated here.
  • step 107 the AUSF sends a second authentication request message to the UDM, where the second authentication request message includes the SUCI.
  • the UDM receives the second authentication request message sent by the AUSF.
  • the AUSF may send a second authentication request message to the UDM.
  • the second authentication request message may also include NSWO indication information.
  • the NSWO indication information may include at least one of the following: first NSWO indication information or fifth NSWO indication information. That is, the NSWO indication information is the first NSWO indication information; or, the NSWO indication information is the fifth NSWO indication information; or, the NSWO indication information includes the first NSWO indication information and the fifth NSWO indication information.
  • first NSWO indication information and the fifth NSWO indication information reference may be made to the above description in this application, and details are not repeated here.
  • the UDM determines that authentication for the NSWO service is required according to the NSWO indication information, which is convenient for distinguishing different authentication procedures.
  • the second authentication request message may also include second identification information of the AN device, where the AN device is the AN device connected to the UE.
  • the second identification information can be used for the subsequent UDM to calculate the first EAP-AKA' authentication vector.
  • the second identification information may be one of the following:
  • the first identification information carried in the first authentication request message For details, please refer to the relevant description in step 5, which will not be repeated here.
  • the AUSF directly sends the first identification information sent by the NSWO network element to the UDM.
  • the first identification information carried in the first authentication request message is the access network identification of the AN device
  • the first information is the serving network name (serving network name) corresponding to the access network identification. name).
  • the first identification information sent by the NSWO network element to the AUSF is the access network identification (AN ID), and the AUSF can convert the obtained AN ID into a serving network name and send it to the UDM.
  • the first authentication request message does not carry the first identification information
  • the first information is a preset access network identifier or a preset service network name. Both the default access network identifier and the default service network name are used to indicate the authentication for the NSWO service.
  • the second authentication request message may be a request message corresponding to an existing UDM service, and reference may be made to the above description of this application, and details are not repeated here.
  • the second authentication request message includes information for instructing the UDM to perform authentication for the NSWO service.
  • the information may include at least one of SUCI or NSWO indication information.
  • the AUSF after the AUSF determines to perform the authentication for the NSWO service, it also determines to adopt the EAP AKA' authentication algorithm.
  • the second authentication request message also includes algorithm indication information, which is used to indicate to perform EAP AKA' authentication.
  • the UDM can directly determine the EAP AKA' authentication method, which simplifies the processing complexity of the UDM in selecting the authentication algorithm.
  • the second authentication request message may be a request message corresponding to a newly added UDM service, which may refer to the above description of this application, and will not be repeated here.
  • the newly added UDM service directly instructs the UDM to perform authentication for the NSWO service.
  • the second authentication request message may not include information for instructing the UDM to perform authentication for the NSWO service.
  • the second authentication request message does not include NSWO indication information
  • the SUCI may be the SUCI used in the existing 5G network.
  • the second authentication request message may also include information for instructing the UDM to perform authentication for the NSWO service.
  • the information may include at least one of SUCI or NSWO indication information.
  • the second authentication request message may include algorithm indication information, or may not include algorithm indication information.
  • Step 8 The UDM calculates the SUPI according to the SUCI.
  • Step 109 The UDM determines to adopt the EAP AKA' authentication method according to the second authentication request message.
  • the AUSF supports the NSWO service by default, and it may be determined to perform authentication for the NSWO service when receiving the second authentication request message from the AUSF.
  • the second authentication request message when it is determined that the second authentication request message is a request message corresponding to the newly added UDM service, it is determined to perform authentication for the NSWO service, and the newly added UDM service is used to indicate that the authentication for the NSWO service is performed. certified.
  • the second authentication request message is Nudm_UEAuthentication_NSWO_Authenticate request
  • the UDM determines to perform authentication for the NSWO service.
  • the UDM may determine to adopt the EAP AKA' authentication method according to the second information in the second authentication request message.
  • the second information includes at least one of the following:
  • the second information is NSWO indication information
  • the NSWO indication information is used to indicate the authentication for the NSWO service.
  • the NSWO indication information included in the second authentication request message reference may be made to the relevant description in step 7, which will not be repeated here.
  • the second information is SUCI, and the SUCI is used to indicate the authentication for the NSWO service.
  • the second information is algorithm indication information, and the algorithm indication information is used to instruct EAP AKA' authentication.
  • the UDM determines that the UE wants to use the NSWO service, the UDM determines the subscription data of the UE according to the SUPI, and checks whether the UE is allowed to use the NSWO service according to the subscription data. If it is allowed, continue to execute; otherwise, the UDM sends a rejection message to the AUSF, and then the AUSF sends a rejection message to the NSWO network element, and then the NSWO network element sends a rejection message to the AN device.
  • the rejection message carries an indication that the UE is not authorized to use the NSWO service.
  • the AN device rejects the UE's NSWO service request, or notifies the UE that it is not allowed to use the NSWO service, or is not allowed to use the NSWO service in the network corresponding to the AN ID or serving network name.
  • UDM determines that UE wants to use NSWO service
  • UDM determines UE subscription data according to SUPI
  • UDM determines UE subscription data according to SUPI
  • the rejection message carries an indication that the UE is not authorized to use the NSWO service in the network corresponding to the AN ID or serving network name.
  • the AN device rejects the UE's NSWO service request, or notifies the UE that it is not allowed to use the NSWO service, or is not allowed to use the NSWO service in the network corresponding to the AN ID or serving network name.
  • Step 10 UDM obtains the first EAP AKA' authentication vector (RAND, AUTN, XRES, CK', IK') according to SUPI.
  • Step 111 the UDM sends a second authentication response message to the AUSF, and the second authentication response message includes the second EAP AKA' authentication vector.
  • the AUSF receives the second authentication response message sent by the UDM.
  • the second EAP AKA' authentication vector is the first EAP AKA' authentication vector
  • the second EAP AKA' authentication vector includes a key CK' and a key IK'.
  • AUSF can use the newly generated key CK' and key IK' during the authentication process for NSWO services, which improves the use of keys Way flexibility.
  • the second authentication response message may also include SUPI.
  • Step 112 AUSF sends a first authentication response message to the NSWO network element according to the second authentication response message, and the first authentication response message is an authentication response message corresponding to the EAP AKA' authentication algorithm.
  • the NSWO network element receives the first authentication response message sent by the AUSF.
  • the AUSF may execute the existing EAP-AKA' authentication process, and send the first authentication response message to the NSWO network element, which is not specifically described in this embodiment.
  • the second EAP AKA' authentication vector carried in the second authentication response message received by the AUSF is a complete EAP AKA' authentication vector, including the key CK' and the key IK'.
  • the first authentication response message is sent to the NSWO network element according to the second authentication response message, which may include RAND, AUTN.
  • AUSF deletes the key CK' and key IK' in the second EAP AKA' authentication vector, which avoids the newly generated key CK' and key IK' in the authentication process for NSWO services from affecting the current state.
  • the first authentication response message may include EAP/AKA-challenge (RAND, AUTN).
  • Step 13 The NSWO network element sends a third authentication request message to the UE through the AN device according to the first authentication response message, and the third authentication request message is an authentication request message corresponding to the EAP AKA' authentication algorithm.
  • the UE receives the third authentication request message sent by the NSWO network element through the AN device.
  • Step 14 the UE uses the EAP AKA' authentication algorithm to perform authentication verification on the network. For example, check whether the MAC in AUTN is correct based on RAND; for example, check whether the freshness of SQN calculated according to RAND and AUTN is satisfied.
  • the verification of RAND and AUTN belongs to the prior art and is not limited.
  • Step 15 after the authentication verification is successful, the UE sends the RES obtained through calculation to the NSWO network element through the AN device to send a fourth authentication request message.
  • the RES is included.
  • the NSWO network element receives the fourth authentication request message sent by the UE through the AN device.
  • a further optional implementation method includes: the UE is divided into two parts, the USIM and the ME.
  • the ME can be understood as the part of the UE that does not include the USIM.
  • the USIM will perform the security verification of RAND and AUTN. When the USIM verification is successful, the USIM will calculate CK, IK and RES, and send CK, IK and RES to ME. After that, ME will perform corresponding operations for CK, IK and RES, such as calculating CK' and IK' based on CK and IK.
  • steps 13 to 15 may refer to the embodiment shown in FIG. 4 , which will not be repeated here.
  • the UE, USIM or ME may also include one of the following:
  • the UE or ME calculates the key CK' and the key IK', and then deletes the key CK' and the key IK'.
  • the UE calculates the key CK' and the key IK', but deletes them later, it avoids that the newly generated key CK' and the key IK' during the authentication process for NSWO services affect the UE's existing authentication process
  • the relevant key generated in the above ensures that the authentication process provided by this embodiment is applicable to the authentication of NSWO services.
  • the UE or ME calculates the key CK' and the key IK' without calculating the key K AUSF according to the key CK' and the key IK', and then deletes the key CK' and the key IK'.
  • the UE calculates the key CK' and the key IK', it does not calculate the key K AUSF , and deletes the key CK' and the key IK', avoiding new
  • the generated key CK' and key IK' affect related keys generated in the UE's current authentication process.
  • the UE or ME calculates the key CK' and the key IK', and calculates the key K AUSF according to the key CK' and the key IK', and then deletes the key CK' and the key IK', and deletes the key K AUSF .
  • the UE calculates the key CK', the key IK' and the key K AUSF , but then deletes them all, avoiding the newly generated key CK' and key IK' during the authentication process for the NSWO service Affects the relevant keys generated in the UE's existing authentication process.
  • the UE or ME calculates the key CK' and the key IK', and calculates the key K AUSF according to the key CK' and the key IK', and then deletes the key CK' and the key IK', and does not send the key locally to the UE
  • the stored key K AUSF is replaced.
  • the UE calculated the key CK', the key IK' and the key K AUSF , but then deleted the key CK' and the key IK'.
  • the key K AUSF is newly generated, it does not replace the locally stored key K AUSF of the UE. It can be understood that the newly generated key K AUSF is not used, so the newly generated key will not affect the current UE.
  • UE or ME does not calculate key CK' and key IK'.
  • the UE does not calculate the key CK' and key IK', which avoids the newly generated key CK' and key IK' in the authentication process for NSWO services from affecting the correlation generated in the UE's existing authentication process. key.
  • the UE or ME calculates the key CK' and the key IK', and calculates the key K AUSF according to the key CK' and the key IK', and then replaces the key K AUSF stored locally by the UE.
  • the UE calculates the key CK', the key IK' and the key K AUSF , and replaces the locally stored key K AUSF with the new key K AUSF The generated key K AUSF .
  • the UE can use the newly generated key K AUSF .
  • the ME sends the K AUSF to the USIM to replace the old K AUSF stored in the USIM card.
  • the ME After the ME determines that it is the authentication of the NSWO service, it sends the RAND and AUTN to the USIM card and at the same time sends the authentication instruction to the USIM card.
  • the authentication indication is optionally used to indicate that the USIM card does not need to send CK and IK after the verification is successful, or indicates that the USIM is an authentication-only service, etc.
  • the USIM verification When the USIM verification is successful, the USIM will only calculate the RES according to the authentication instruction, and send the RES to the ME. Either the USIM will not calculate CK and IK according to this authentication indication, or even if it calculates CK and IK, it will not send CK and IK to ME. At this time, ME cannot obtain CK and IK, and will not calculate CK' and IK' based on CK and IK.
  • ME sends RAND and AUTN to USIM card, USIM executes normally, and sends CK, IK and RES to ME.
  • the ME is authenticated according to the NSWO service.
  • the ME can discard or delete the CK and IK, or do not perform any other additional applications. It is avoided that the newly generated key CK and key IK in the authentication process for the NSWO service affect the relevant keys generated in the UE's existing authentication process, ensuring that the authentication process provided by this embodiment is applicable to the authentication of the NSWO service.
  • Step 16 the NSWO network element sends a fifth authentication request message to the AUSF according to the fourth authentication request message.
  • the AUSF receives the fifth authentication request message sent by the NSWO network element.
  • step 17 the AUSF performs authentication for the UE according to the fifth authentication request message. Such as checking whether RES and XRES are equal. If they are equal, the verification succeeds; otherwise, the verification fails.
  • Step 18 AUSF sends the first message to the NSWO network element after authentication verification.
  • the NSWO network element receives the first message sent by the AUSF.
  • the first message includes the result of the authentication check.
  • steps 16 to 18 may refer to the embodiment shown in FIG. 4 , which will not be repeated here.
  • the first authentication response message includes the second EAP AKA' authentication vector carried in the second authentication response message, that is, the AUSF does not delete the key CK' and key IK received from the UDM ', after the AUSF determines that the authentication verification is successful in step 18, it may also include one of the following:
  • AUSF does not calculate the key K AUSF based on the key CK' and the key IK'. In this implementation, AUSF does not calculate a new key K AUSF based on the new key CK' and key IK', which prevents the newly generated key K AUSF from affecting the existing authentication of AUSF during the authentication process for NSWO services The associated key that has been generated in the process.
  • the AUSF calculates the key K AUSF based on the key CK' and the key IK', and does not replace the locally stored key K AUSF of the AUSF.
  • AUSF calculates a new key K AUSF based on the new key CK' and key IK', it does not replace the locally stored key K AUSF in AUSF, which can be understood as not using
  • the newly generated key K AUSF in the authentication process for the NSWO service will not cause the newly generated key K AUSF to affect the related keys generated in the existing authentication process of AUSF.
  • At least one of the following may also be included:
  • the AUSF deletes the key CK' and the key IK'.
  • AUSF deletes the key CK' and key IK' received during the authentication process for NSWO services, avoiding the newly generated key CK' and key IK' from affecting AUSF's existing authentication process Generated relative key.
  • (2) AUSF deletes the generated key K AUSF .
  • the AUSF deletes the newly generated key K AUSF during the authentication process for the NSWO service, which prevents the newly generated key K AUSF from affecting the related keys generated in the current authentication process of the AUSF.
  • Step 19 the NSWO network element sends the second message to the AN device according to the first message.
  • the AN device receives the second message sent by the NSWO network element.
  • Step 20 if the authentication verification is successful, the AN device sends an NSWO service indication message to the UE. It is also possible for the AN to perform operations corresponding to the NSWO service after confirming that the authentication is successful.
  • Step 21 If the authentication verification fails, the AN device sends a rejection message to the UE.
  • steps 19 to 21 may refer to the embodiment shown in FIG. 4 , which will not be repeated here.
  • this embodiment provides an authentication process applicable to UE performing NSWO services in a 5G network, and the network elements involved include UE, AN equipment, NSWO network elements, AUSF and UDM.
  • UDM determines to adopt the EAP AKA' authentication method, which avoids the authentication failure caused by choosing the 5G AKA authentication method.
  • UDM sends the complete EAP AKA' authentication vector to AUSF after using the EAP AKA' authentication method to calculate the EAP AKA' authentication vector, which reduces the changes to the UDM processing method, reduces the impact on UDM, and provides future It is possible for AUSF or UE to use newly generated key CK', key IK' or key K during the authentication process for NSWO services to AUSF.
  • the UE may not calculate the key CK' and the key IK', or delete the calculated key CK' and the key IK' or the key Kausf, or, After the key K AUSF is calculated, the newly generated key K AUSF is not replaced with the local existing key K AUSF to avoid affecting the existing key structure of the UE.
  • the UE After the UE successfully authenticates and verifies the network, it calculates the key K AUSF and replaces the local existing key K AUSF , and may use a new key K AUSF .
  • AUSF after AUSF receives the key CK' and the key IK' from UDM, it can delete the calculated key K AUSF , or, after calculating the key Kausf, do not replace the newly generated key K AUSF with the local existing
  • the key K of AUSF is used to avoid affecting the existing key structure of AUSF.
  • the AUSF calculates the key K AUSF and replaces the local existing key K AUSF , and a new key K AUSF can be used.
  • yet another embodiment of the present application provides a specific implementation manner of UE starting the authentication phase shown in FIG. 3 to FIG. 5 .
  • FIG. 6 is another message interaction diagram of the NSWO service authentication method provided in the embodiment of the present application.
  • the UE sends the SUCI to the AN device, which may include:
  • the UE sends a first connection establishment request message to the AN device, where the first connection establishment request message includes SUCI and first NSWO indication information.
  • the AN device receives the first connection establishment request message sent by the UE.
  • the first connection establishment request message may be an EAP message.
  • the SUCI may be an existing SUCI generated according to the SUPI, for example, the SUCI used in the 5G network.
  • SUCI may indicate to perform authentication for NSWO services.
  • the first NSWO indication information may be carried in the EAP message, or may be carried outside the EAP message.
  • the UE after the UE determines to perform the NSWO service, it accesses the AN to establish a connection.
  • the SUCI and the first NSWO indication information are carried in the first connection establishment request message at the same time, and the authentication process for the NSWO service is started, which saves the number of air interface messages.
  • FIG. 7 is another message interaction diagram of the NSWO service authentication method provided in the embodiment of the present application.
  • the UE sends the SUCI to the AN device, which may include:
  • the AN device sends a first request message to the UE.
  • the UE receives the first request message sent by the AN device.
  • the UE sends a first response message to the AN device, where the first response message includes first NSWO indication information and SUCI.
  • the AN device receives the first response message sent by the UE.
  • the AN device sends a first request message to the UE to trigger the UE to perform EAP authentication.
  • the UE determines to receive the first request message after performing the NSWO service, determines to perform EAP authentication, and determines to perform authentication for the NSWO service.
  • the first request message and the first response message may be EAP messages.
  • the first request message is an extensible authentication protocol request/identity verification message (EAP-REQ/Identity).
  • the first response message is an Extensible Authentication Protocol Response message (EAP-RSP).
  • the SUCI may be an existing SUCI generated according to the SUPI, for example, the SUCI used in the 5G network.
  • SUCI may indicate to perform authentication for NSWO services.
  • the first NSWO indication information may be carried in the EAP message, or may be carried outside the EAP message.
  • S701 can also include:
  • the UE sends a second connection establishment request message to the AN device.
  • the AN device receives the second connection establishment request message sent by the UE.
  • the second connection establishment request message may be an EAP message.
  • the second connection establishment request message may include the first NSWO indication information.
  • the UE makes the AN device determine that authentication for the NSWO service needs to be performed by carrying the first NSWO indication information in the second connection establishment request message, so that the AN device triggers the UE to perform EAP authentication.
  • FIG. 8 is another message interaction diagram of the NSWO service authentication method provided in the embodiment of the present application.
  • the UE sends the SUCI to the AN device, which may include:
  • the UE sends a third connection establishment request message to the AN device, where the third connection establishment request message includes SUCI, and the SUCI is used to indicate authentication for the NSWO service.
  • the AN device receives the third connection establishment request message sent by the UE.
  • the third connection establishment request message may be an EAP message.
  • the UE after the UE determines to perform the NSWO service, it accesses the AN to establish a connection.
  • the third connection establishment request message carries the SUCI for instructing the authentication for the NSWO service to start the authentication process for the NSWO service, which saves the number of air interface messages.
  • FIG. 9 is another message interaction diagram of the NSWO service authentication method provided in the embodiment of the present application.
  • the NSWO service authentication method provided by this embodiment may also include before the above step 1:
  • the AN device sends second NSWO indication information to the UE, where the second NSWO indication information is used to instruct the AN device to support the NSWO service.
  • the UE receives the second NSWO indication information sent by the AN device.
  • the UE determines to perform authentication based on the 5G key, or to perform authentication based on the SIM, or to perform authentication based on the key of the user's first authentication.
  • the AN device notifies the UE that the AN device supports the NSWO service by sending the second NSWO indication information to the UE, so as to implement authentication for the NSWO service.
  • the second NSWO indication information may be carried in the message sent by the AN device to the UE, and this embodiment does not limit the type and name of the message.
  • the message may be a broadcast message sent by the AN device.
  • the message may be the first request message in S701 above.
  • FIG. 10 is another message interaction diagram of the NSWO service authentication method provided by the embodiment of the present application.
  • the authentication method for the NSWO service provided by this embodiment after the above step 21, may also include:
  • Step 22 After the AUSF successfully authenticates the UE according to the fifth authentication request message, it sends the first NSWO authentication result to the UDM.
  • SUPI, and/or the access network identifier of the access network device, and/or the service network name corresponding to the access network identifier can also be sent at the same time, the SUPI is included in the second authentication response message, and the access network device An access network device connected to a terminal.
  • the SUPI may not be sent, but the association ID or URI and other information used to identify the UE may be sent.
  • the UDM receives the first NSWO authentication result sent by the AUSF.
  • Step 23 The UDM determines and records that the UE corresponding to the SUPI has successfully authenticated to the NSWO service.
  • the first NSWO authentication result is used to indicate that the UE is successfully authenticated for the NSWO service.
  • different UEs can be distinguished by SUPI or associated ID or URI, and different access network devices can be distinguished by the access network identifier or service network name of the access network device.
  • the AUSF may send the first NSWO authentication result to the UDM, and notify the UDM of the successfully authenticated UE and/or the AN device accessed by the successfully authenticated UE.
  • the UDM records the successfully authenticated UE and/or the AN device accessed by the successfully authenticated UE, so as to complete charging for the UE or the AN device subsequently.
  • the first NSWO authentication result may also include authentication indication information, and the authentication indication information is used to indicate that the terminal is successfully authenticated for the NSWO service.
  • the UDM can clearly determine that the UE corresponding to the SUPI is successfully authenticated for the NSWO service.
  • the first NSWO authentication result may be carried in a message sent by the AUSF to the UDM.
  • This embodiment does not limit the type and name of the message.
  • the message may be a message corresponding to the newly added UDM service.
  • the name of the newly added UDM service and the name of the message corresponding to the newly added UDM service are not limited.
  • the UDM may directly determine according to the newly added UDM service that this is a service for notifying the SUPI of successful authentication, and determine that the SUPI corresponds to the successful authentication of the UE for the NSWO service.
  • the message may be a message corresponding to an existing UDM service.
  • the message corresponding to the existing UDM service is a UE authentication result confirmation message (Nudm_UEAuthentication_ResultConfirmation).
  • FIG. 11 is another message interaction diagram of the NSWO service authentication method provided by the embodiment of the present application.
  • the authentication method for the NSWO service provided by this embodiment after the above step 21, may also include:
  • Step 24 After the AUSF successfully authenticates the UE according to the fifth authentication request message, it sends the second NSWO authentication result to the charging network function (network function, NF).
  • the second NSWO authentication result includes SUPI, and/or the access network identifier of the access network device, and/or the service network name corresponding to the access network identifier, SUPI is included in the second authentication response message, and the access network device is a terminal Connected access network equipment.
  • the SUPI may not be sent, but information used to identify the UE, such as an association ID or URI, may be sent.
  • the charging NF receives the second NSWO authentication result sent by the AUSF.
  • Step 25 The charging NF determines and records that the UE corresponding to the SUPI has successfully authenticated to the NSWO service.
  • the principle of the second NSWO authentication result is similar to that of the first NSWO authentication result in the embodiment shown in FIG.
  • the difference between this embodiment and the embodiment shown in FIG. 10 is that the message carrying the second NSWO authentication result sent by the AUSF to the charging NF may be different, and the type and name of the message carrying the second NSWO authentication result are different in this embodiment. Do limited.
  • another embodiment of the present application provides an authentication method for NSWO services.
  • the AUSF and the UE will not delete the newly generated key K AUSF in the authentication process for the NSWO service, and may use the newly generated key K AUSF .
  • the AUSF information is updated, and relevant network elements (eg UDM, AMF, etc.) need to update the locally stored AUSF information, that is, update to the AUSF information corresponding to NSWO service-related authentication.
  • FIG. 12 is another message interaction diagram of the NSWO service authentication method provided in the embodiment of the present application.
  • the execution subjects involve UDM and AMF.
  • it may also include:
  • Step 26 After the UDM determines that the EAP-AKA' authentication is successful, it updates the AUSF information.
  • the AUSF information may include AUSF group (AUSF group) information or AUSF instance ID (AUSF instance ID) and other information used to identify the AUSF.
  • AUSF group AUSF group
  • AUSF instance ID AUSF instance ID
  • step 27 the UDM sends a first notification message to the AMF.
  • the first notification message includes AUSF information and UE identification information.
  • the AMF receives the first notification message sent by the UDM.
  • Step 28 the AMF determines the UE context (UE context) according to the identification information of the UE, and replaces the AUSF information in the UE context with the AUSF information in the first notification message.
  • the identification information of the UE is used to uniquely distinguish different UEs.
  • the identification information of the UE may include one of the following:
  • callback uri corresponding to SUPI (callback uri);
  • the first notification message is a message corresponding to an existing UDM service, and this embodiment does not limit the name of the existing UDM service and the name of the message corresponding to the existing UDM service.
  • the first notification message is an SDM notification message (Numd_SDM_notification).
  • the UDM is used to notify the AMF to update the locally stored AUSF information, thereby completing the update of the AUSF information.
  • FIG. 13 is another message interaction diagram of the NSWO service authentication method provided in the embodiment of the present application.
  • AUSF and AMF are involved in execution. After the above step 22, it may also include:
  • the AUSF sends a second notification message to the AMF.
  • the second notification message includes AUSF information and UE identification information.
  • the AMF receives the second notification message sent by the AUSF.
  • Step 30 the AMF determines the UE context (UE context) according to the identification information of the UE, and replaces the AUSF information in the UE context with the AUSF information in the second notification message.
  • the identification information of the UE is used to uniquely distinguish different UEs.
  • the identification information of the UE may include one of the following:
  • callback uri corresponding to SUPI (callback uri);
  • the second notification message is a message corresponding to an existing AUSF service, and this embodiment does not limit the name of the existing AUSF service and the name of the message corresponding to the existing AUSF service.
  • the second notification message is an SDM notification message (Nausf_SDM_notification).
  • the AMF is notified by the AUSF to update the locally stored AUSF information, thereby completing the update of the AUSF information.
  • the embodiment of the present application also provides an authentication method for the NSWO service, which is applied in a scenario where the UE needs to perform the authentication for the NSWO service again after completing the authentication for the NSWO service for the first time. For example, after the UE registers to the 5G network, the UE shares the key with the AUSF.
  • MAC message authentication code
  • HMAC represents hashed-based message authentication
  • HMAC-SHA256() represents an encryption function
  • the freshness parameter may be a calculator, or a parameter such as a serial number used to reflect the freshness of the message.
  • the NSWO indication is used to indicate the authentication for the NSWO service.
  • UE sends SUCI, NSWO indication, MAC and fresh parameters to AN device.
  • the AN device determines the NSWO network element according to the SUCI, and sends the SUCI, NSWO indication, MAC and fresh parameters to the NSWO network element.
  • the NSWO network element determines the UDM according to the SUCI, and sends the SUCI, NSWO indication, MAC and fresh parameters to the UDM.
  • UDM decrypts SUCI to obtain SUPI, and obtains corresponding AUSF information and AUSF address according to SUPI.
  • the UDM verifies the correctness of the MAC and obtains the verification result.
  • the UDM verifies the correctness of the MAC, which may include:
  • UDM sends SUPI, NSWO indication, MAC and fresh parameters to AUSF.
  • AUSF determines the key K AUSF according to SUPI, and uses the key K AUSF , NSWO indication and fresh parameters to check whether the received MAC is correct.
  • the UDM verifies the correctness of the MAC, which may include:
  • UDM sends SUPI, NSWO indication and fresh parameters to AUSF.
  • AUSF calculates MAC' in the same way and sends MAC' to UDM.
  • UDM checks whether MAC is equal to MAC'.
  • the UDM sends the verification result to the NSWO network element.
  • the UE shares the key Knasint with the AMF, and the authentication method for the NSWO service may include:
  • UE sends SUCI, NSWO indication, MAC and fresh parameters to AN device.
  • 5G globally unique temporary UE identity 5G globally unique temporary UE identity, 5G-GUTI.
  • the AN device determines the NSWO network element according to the SUCI, and sends the SUCI, NSWO indication, MAC and fresh parameters to the NSWO network element.
  • the AN device also receives the 5G-GUTI, and the AN can determine the AMF through the 5G-GUTI, go to step 307.
  • the NSWO network element determines the UDM according to the SUCI, and sends the SUCI, NSWO indication, MAC and fresh parameters to the UDM.
  • the NSWO network element can determine the AMF through the 5G-GUTI, go to step 308.
  • the UDM decrypts the SUCI to obtain the SUPI, and obtains the corresponding AMF information and AMF address according to the SUPI.
  • the UDM verifies the correctness of the MAC and obtains the verification result.
  • the UDM verifies the correctness of the MAC, which may include:
  • UDM sends SUPI (or callback uri and/or correlation id), NSWO indication, MAC and fresh parameters to AMF.
  • AMF determines Knasint according to SUPI (or callback uri and/or correlation id), and uses Knasint, NSWO indication and fresh parameters to check whether the received MAC is correct.
  • the UDM verifies the correctness of the MAC, which may include:
  • UDM sends SUPI (or callback uri and/or correlation id), NSWO indication and fresh parameter to AMF.
  • AMF calculates MAC' in the same way and sends MAC' to UDM.
  • UDM checks whether MAC is equal to MAC'.
  • the UDM sends the verification result to the NSWO network element.
  • Step 19 to Step 21 in the foregoing embodiments of the present application.
  • the AN device sends the 5G-GUTI, NSWO indication, MAC and fresh parameters to the AMF.
  • AMF determines Knasint according to SUPI (or callback uri and/or correlation id), and uses Knasint, NSWO indication and fresh parameters to check whether the received MAC is correct.
  • AMF sends the verification result to AN. For subsequent actions of the AN, reference may be made to the previous embodiments.
  • the NSWO network element sends the 5G-GUTI, NSWO indication, MAC and fresh parameters to the AMF.
  • AMF determines Knasint according to SUPI (or callback uri and/or correlation id), and uses Knasint, NSWO indication and fresh parameters to check whether the received MAC is correct.
  • the AMF sends the verification result to the NSWO network element. For subsequent actions of NSWO network elements, reference may be made to the previous embodiments.
  • the embodiment of the present application also provides an authentication method for NSWO services, which is applied to a scenario where a 5G network includes a UE, an AN device, an AAA network element, an AUSF, and a UDM.
  • the embodiment shown in FIG. 4 can be reused, the UDM directly removes the CK' and IK', and sends the authentication vector for removing the CK' and IK' to the AUSF. AUSF then sends the authentication vector with CK' and IK' removed to the AAA network element. Afterwards, the UE performs mutual authentication with the AAA network element. The actions of the subsequent AAA network elements are consistent with those of the AUSF in the embodiment shown in FIG. 4 . Afterwards, the AAA network element sends the authentication result to the AN. For the actions of the subsequent AN, reference may be made to the previous embodiments.
  • the embodiment shown in FIG. 5 can be reused.
  • UDM sends the complete authentication vector to AUSF.
  • AUSF receives the complete authentication vector from UDM, it deletes CK' and IK' and then sends it to the AAA network element.
  • the UE performs mutual authentication with the AAA network element.
  • the actions of the subsequent AAA network elements are consistent with those of the AUSF in the embodiment shown in FIG. 5 .
  • the AAA network element sends the authentication result to the AN.
  • the embodiment of the present application also provides an authentication method for NSWO services, which is applied to a scenario where a 5G network includes a UE, an AN device, an AAA network element, and a UDM.
  • the AN device can be directly routed to the AAA network element, or firstly routed to the AAAproxy and then routed to the AAA network element through the AAAproxy. Afterwards, the AAA network element can obtain the authentication vector from the UDM. At this time, both the functions of the NSWO network element and the AUSF can be implemented by the AAA network element.
  • the AAA network element can obtain the key excluding CK' and IK' from UDM, and perform the corresponding operation of AUSF; or, after obtaining the key of CK' and IK', delete it and other operations, the specific operation can be reused in this application In the above embodiment, the AUSF processes the key.
  • the authentication method for the NSWO service provided in the embodiment of the present application is not limited to the authentication of the NSWO service, and is also applicable to the authentication of other services. It can be understood that this application describes the authentication method and process by taking NSWO business as an example.
  • the NSWO network element can be replaced by the service authentication network element, and the service authentication network element participates in the authentication of the UE; if the authentication is successful, the service authentication network element receives the authentication result from the AUSF and sends the result to the AN.
  • the operations of other keys are similar to the operations of CK', IK' or K AUSF above.
  • the operations performed by the AN according to the authentication result are not limited.
  • each device involved in the present application includes corresponding hardware and/or software modules for performing each function.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software drives hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions in combination with the embodiments for each specific application, but such implementation should not be regarded as exceeding the scope of the present application.
  • each functional module of each device may be divided according to the above method example.
  • each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module.
  • the division of modules in the embodiment of the present application is schematic, and is only a logical function division, and there may be other division methods in actual implementation.
  • the names of the modules in the embodiments of the present application are illustrative, and the names of the modules are not limited during actual implementation.
  • FIG. 14 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the communication device may include: a sending module 1402 , a receiving module 1403 and a processing module 1401 .
  • the receiving module 1403 is configured to receive data.
  • the processing module 1401 is configured to execute other steps to realize the NSWO service authentication method provided by the above method embodiment.
  • FIG. 15 is another schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the communication device may be a terminal device, AN device, NSWO network element, AUSF or UDM.
  • the communication device may include: a processor 1501 , a receiver 1502 , a transmitter 1503 , a memory 1504 and a bus 1505 .
  • the processor 1501 includes one or more processing cores, and the processor 1501 executes applications of various functions and information processing by running software programs and modules.
  • the receiver 1502 and the transmitter 1503 can be implemented as a communication component, and the communication component can be a baseband chip.
  • the memory 1504 is connected to the processor 1501 through a bus 1505 .
  • the memory 1504 may be used to store at least one program instruction, and the processor 1501 may be used to execute the at least one program instruction, so as to implement the technical solutions of the foregoing embodiments. Its implementation principle and technical effect are similar to those of the related embodiments of the method above, and will not be repeated here.
  • the processor may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or Execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application.
  • a general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the methods disclosed in connection with the embodiments of the present application may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.
  • the memory may be a non-volatile memory, such as a hard disk (hard disk drive, HDD) or a solid-state drive (solid-state drive, SSD), etc., and may also be a volatile memory (volatile memory), such as Random access memory (RAM).
  • a memory is, but is not limited to, any medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer.
  • the memory in the embodiment of the present application may also be a circuit or any other device capable of implementing a storage function, and is used for storing program instructions and/or data.
  • An embodiment of the present application provides a computer program product.
  • the computer program product runs on a device, the device executes the technical solutions in the foregoing embodiments. Its implementation principle and technical effect are similar to those of the above-mentioned related embodiments, and will not be repeated here.
  • An embodiment of the present application provides a computer-readable storage medium, on which program instructions are stored, and when the program instructions are executed by a device, the device executes the technical solutions of the foregoing embodiments. Its implementation principle and technical effect are similar to those of the above-mentioned related embodiments, and will not be repeated here.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例适用于通信技术领域，提供了一种NSWO业务的认证方法、设备和存储介质，适用于5G网络。NSWO业务的认证方法包括：在UE确定进行NSWO业务后，向AN设备发送SUCI；AN设备向NSWO网元发送第二请求消息；NSWO网元确定进行针对NSWO业务的认证后，向AUSF发送第一认证请求消息。AUSF确定进行针对NSWO业务的认证后，向UDM发送第二认证请求消息。UDM确定采用EAP AKA'认证方式。之后，UDM、AUSF、NSWO网元、AN设备和UE依次完成基于EAP AKA'认证的认证流程，从而在5G网络中实现了针对NSWO业务的认证。

Description

NSWO业务的认证方法、设备和存储介质
本申请要求于2021年05月08日提交国家知识产权局、申请号为202110502550.3、申请名称为“NSWO业务的认证方法、设备和存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术领域，尤其涉及一种NSWO业务的认证方法、设备和存储介质。
背景技术
在第四代通信系统(4G)网络中，第三代合作伙伴计划(3rd generation partnership project，3GPP)引入了有缝无线局域网分流业务(non-seamless WLAN offload，NSWO)。终端设备执行NSWO业务时，业务数据可以通过接入网(access network，AN)设备分流，直接接入因特网。
终端设备执行NSWO业务之前，AN设备、3GPP认证、授权和计费(authentication，authorization and accounting，AAA)服务器，以及归属签约用户服务器(home subscriber server，HSS)需要完成对终端设备的认证。可以理解为，AN设备借助运营商完成了对终端设备的认证。当运营商认证终端设备成功之后，AN设备才会为终端设备提供NSWO的业务。
随着通信技术的发展，第五代通信系统(5G)网络也将支持NSWO业务。5G网络和4G网络的设备可能不同，例如，5G网络可能没有3GPP AAA server。而且，5G网络和4G网络支持的认证算法也不同。因此，在5G网络中如何实现终端设备针对NSWO业务的认证，亟需解决。
发明内容
本申请实施例提供一种NSWO业务的认证方法、设备和存储介质，能够在5G等网络中实现终端设备针对NSWO业务的认证。
第一方面，提供了一种NSWO业务的认证方法，包括：在终端设备确定进行NSWO业务后，向接入网设备发送SUCI；接收NSWO网元通过接入网设备发送的第三认证请求消息，第三认证请求消息为EAP AKA'认证算法对应的认证请求消息；使用EAP AKA'认证算法对网络进行认证校验；在认证校验成功后，通过接入网设备向NSWO网元发送第四认证请求消息。
第一方面提供的NSWO业务的认证方法，可以应用于终端设备或UE。完整的NSWO业务认证流程涉及的网元包括UE、AN设备、NSWO网元、AUSF和UDM。UE确定进行NSWO业务后启动针对NSWO业务的认证流程。在认证过程中，确定采用EAP AKA’认证方式，避免了如果选择5G AKA认证方式而导致的认证失败，实现了在5G等网络中针对NSWO业务的认证。
一种可能的实现方式中，SUCI中包括的SUPI的类型用于指示进行针对NSWO业务的认证；和/或，SUCI包括业务指示信息，业务指示信息用于指示进行针对NSWO业务的认证。
在该实现方式中，AN设备、NSWO网元、AUSF或UDM可以根据SUCI直接确定执行针对NSWO业务的认证。
一种可能的实现方式中，接收NSWO网元通过接入网设备发送的第三认证请求消息之前，方法还包括：向接入网设备发送第一NSWO指示信息，第一NSWO指示信息用于指示进行针对NSWO业务的认证。
在该实现方式中，AN设备、NSWO网元、AUSF或UDM可以根据第一NSWO指示信息直接确定执行针对NSWO业务的认证。
一种可能的实现方式中，第一NSWO指示信息和SUCI在一条消息中。
在该实现方式中，将第一NSWO指示信息和SUCI携带在一条消息中，节省了空口消息数量。
一种可能的实现方式中，在认证校验成功后，还包括下列中的一项：计算密钥CK’和密钥IK’，之后删除密钥CK’和密钥IK’；计算密钥CK’和密钥IK’，且不根据密钥CK’和密钥IK’计算密钥K AUSF，之后删除密钥CK’和密钥IK’；计算密钥CK’和密钥IK’，且根据密钥CK’和密钥IK’计算密钥K AUSF，之后删除密钥CK’和密钥IK’，且删除密钥K AUSF，或不对终端设备本地存储的密钥K AUSF进行替换；或者，在认证校验成功后，不计算密钥CK’和密钥IK’。
在该实现方式中，UE在对网络进行认证校验成功后，可以不计算密钥CK’和密钥IK’，或者，将计算得到的密钥CK’和密钥IK’或密钥K AUSF删除，或者，计算密钥K AUSF后不将新生成的密钥K AUSF替换本地已有的密钥K AUSF，避免影响UE的现有密钥架构。
一种可能的实现方式中，在终端设备确定进行NSWO业务之前，方法还包括：接收接入网设备发送的第二NSWO指示信息，第二NSWO指示信息用于指示接入网设备支持NSWO业务；根据第二NSWO指示信息，确定进行基于5G密钥的认证，或进行基于SIM的认证，或进行基于用户首次认证的密钥进行认证。
在该实现方式中，AN设备通过向UE发送第二NSWO指示信息，向UE通知AN设备支持NSWO业务，可以实现针对NSWO业务的认证。
一种可能的实现方式中，向接入网设备发送SUCI，可以包括：向接入网设备发送连接建立请求消息，连接建立请求消息包括SUCI和第一NSWO指示信息。
在该实现方式中，UE确定进行NSWO业务后，接入AN建立连接。在连接建立请求消息中同时携带SUCI和第一NSWO指示信息，启动针对NSWO业务的认证流程，节省了空口消息数量。
一种可能的实现方式中，向接入网设备发送SUCI，可以包括：接收接入网设备发送的第一请求消息；向接入网设备发送第一响应消息，第一响应消息包括第一NSWO指示信息和SUCI。
在该实现方式中，AN设备向UE发送第一请求消息，触发UE进行EAP认证。UE确定进行NSWO业务之后接收到第一请求消息，确定执行EAP认证，且确定执行针对NSWO业务的认证。
第二方面，提供了一种NSWO业务的认证方法，包括：接收终端设备发送的SUCI；根据SUCI确定NSWO网元的地址；根据NSWO网元的地址向NSWO网元发送第二请求消息，第二请求消息包括SUCI；接收NSWO网元发送的第三认证请求消息，第三认证请求消息为EAP AKA’认证算法对应的认证请求消息；向终端设备发送第三认证请求消息；接收终端设备发送的第四认证请求消息；向NSWO网元发送第四认证请求消息。
第二方面提供的NSWO业务的认证方法，可以应用于AN设备。完整的NSWO业务认证流程涉及的网元包括UE、AN设备、NSWO网元、AUSF和UDM。在针对NSWO业务的认证流程中，确定采用EAP AKA’认证方式，避免了如果选择5G AKA认证方式而导致的认证失败，实现了在5G等网络中针对NSWO业务的认证。
一种可能的实现方式中，SUCI中包括的SUPI的类型用于指示进行针对NSWO业务的认证；和/或，SUCI包括业务指示信息，业务指示信息用于指示进行针对NSWO业务的认证。
一种可能的实现方式中，根据SUCI确定NSWO网元的地址之前，还包括：接收终端设备发送的第一NSWO指示信息，第一NSWO指示信息用于指示进行针对NSWO业务的认证。
一种可能的实现方式中，第一NSWO指示信息和SUCI在一条消息中。
一种可能的实现方式中，第二请求消息还包括第一NSWO指示信息。
在该实现方式中，NSWO网元、AUSF或UDM可以根据第一NSWO指示信息直接确定执行针对NSWO业务的认证。
一种可能的实现方式中，第二请求消息还包括第三NSWO指示信息，第三NSWO指示信息用于指示进行针对NSWO业务的认证。
在该实现方式中，NSWO网元、AUSF或UDM可以根据第三NSWO指示信息直接确定执行针对NSWO业务的认证。
一种可能的实现方式中，接收终端设备发送的SUCI之前，还包括：向终端设备发送第二NSWO指示信息，第二NSWO指示信息用于指示接入网设备支持NSWO业务。
一种可能的实现方式中，第二请求消息还包括接入网设备的接入网标识。
在该实现方式中，接入网标识可以用于NSWO网元向AUSF发送AN设备的第一标识信息，以便最终UDM计算EAP AKA’认证向量时使用。
一种可能的实现方式中，根据SUCI确定NSWO网元的地址，包括：从SUCI中获取目标网络标识和/或目标路由标识；根据网络标识和/或路由标识与NSWO网元地址之间的映射关系，获取目标网络标识和/或目标路由标识对应的NSWO网元的地址。
一种可能的实现方式中，根据SUCI确定NSWO网元的地址，包括：从SUCI中获取目标网络标识和/或目标路由标识；向第一地址管理网元发送目标网络标识和/或目标路由标识；接收第一地址管理网元发送的NSWO网元的地址。
一种可能的实现方式中，接收终端设备发送的SUCI，包括：接收终端设备发送的连接建立请求消息，连接建立请求消息包括SUCI和第一NSWO指示信息。
一种可能的实现方式中，接收终端设备发送的SUCI，包括：向终端设备发送第一请求消息，接收终端设备发送的第一响应消息，第一响应消息包括第一NSWO指示信息和SUCI。
第三方面，提供了一种NSWO业务的认证方法，包括：接收接入网设备发送的第二请求消息，第二请求消息包括终端设备的SUCI；根据第二请求消息确定进行针对NSWO业务的认证；向AUSF发送第一认证请求消息，第一认证请求消息包括SUCI；接收AUSF发送的第一认证响应消息，第一认证响应消息为EAP AKA’认证算法对应的认证响应消息；根据第一认证响应消息向接入网设备发送第三认证请求消息，第三认证请求消息为EAP AKA’认证算法对应的认证请求消息；接收接入网设备发送的第四认证请求消息；根据第四认证请求消息向AUSF发送第五认证请求消息。
第三方面提供的NSWO业务的认证方法，可以应用于NSWO网元。完整的NSWO业务认证流程涉及的网元包括UE、AN设备、NSWO网元、AUSF和UDM。在针对NSWO业务的认证流程中，确定采用EAP AKA’认证方式，避免了如果选择5G AKA认证方式而导致的认证失败，实现了在5G等网络中针对NSWO业务的认证。
一种可能的实现方式中，根据第二请求消息确定进行针对NSWO业务的认证，包括下列中的至少一种情况：根据第二请求消息中包括的NSWO指示信息，确定进行针对NSWO业务的认证；根据SUCI确定进行针对NSWO业务的认证；根据第二请求消息确定接入网设备的地址或接入网标识，在根据接入网设备的地址或接入网标识确定接入网设备支持NSWO业务后，确定进行针对NSWO业务的认证。
一种可能的实现方式中，SUCI中包括的SUPI的类型用于指示进行针对NSWO业务的认证；和/或，SUCI包括业务指示信息，业务指示信息用于指示进行针对NSWO业务的认证。
一种可能的实现方式中，第一认证请求消息还包括第四NSWO指示信息，第四NSWO指示信息用于指示进行针对NSWO业务的认证。
在该实现方式中，AUSF或UDM可以根据第四NSWO指示信息直接确定执行针对NSWO业务的认证。
一种可能的实现方式中，第一认证请求消息还包括下列中的一项：第二请求消息中携带的接入网设备的接入网标识；接入网设备的接入网标识对应的服务网络名称；根据接入网设备的相关信息确定的接入网标识；预设接入网标识，用于指示进行针对NSWO业务的认证；预设服务网络名称，用于指示进行针对NSWO业务的认证。
一种可能的实现方式中，第二认证请求消息还包括接入网设备的第二标识信息，接入网设备为终端设备连接的接入网设备；第二标识信息包括：第一信息或第一认证请求消息中携带的第一标识信息；若第一认证请求消息中携带的第一标识信息为接入网设备的接入网标识，则第一信息为接入网标识对应的服务网络名称；若第一认证请求消息中未携带第一标识信息，则第一信息为预设接入网标识或预设服务网络名称；预设接入网标识或预设服务网络名称均用于指示进行针对NSWO业务的认证。
一种可能的实现方式中，第一认证请求消息为UE认证的认证服务请求消息，第一认证响应消息为UE认证的认证服务响应消息。
一种可能的实现方式中，第一认证请求消息和第一认证响应消息均为新增AUSF服务对应的消息，新增AUSF服务用于指示执行针对NSWO业务的认证。
在该实现方式中，AUSF可以直接根据新增AUSF服务确定执行针对NSWO业务的认证。
第四方面，提供了一种NSWO业务的认证方法，包括：接收NSWO网元发送的第一认证请求消息，第一认证请求消息包括SUCI；根据第一认证请求消息确定进行针对NSWO业务的认证；向UDM发送第二认证请求消息，第二认证请求消息包括SUCI；接收UDM发送的第二认证响应消息，第二认证响应消息包括第二EAP AKA’认证向量；根据第二认证响应消息向NSWO网元发送第一认证响应消息，第一认证响应消息为EAP AKA’认证算法对应的认证响应消息；接收NSWO网元发送的第五认证请求消息；根据第五认证请求消息进行针对终端设备的认证。
第四方面提供的NSWO业务的认证方法，可以应用于AUSF。完整的NSWO业务认证流程涉及的网元包括UE、AN设备、NSWO网元、AUSF和UDM。在针对NSWO业务的认证流程中，确定采用EAP AKA’认证方式，避免了如果选择5G AKA认证方式而导致的认证失败，实现了在5G等网络中针对NSWO业务的认证。
一种可能的实现方式中，根据第一认证请求消息确定进行针对NSWO业务的认证，包括下列中的至少一种情况：根据第一认证请求消息中包括的NSWO指示信息，确定进行针对NSWO业务的认证；NSWO指示信息用于指示进行针对NSWO业务的认证；在确定第一认证请求消息为新增鉴权服务器功能AUSF服务对应的请求消息时，确定进行针对NSWO业务的认证，新增AUSF服务用于指示进行针对NSWO业务的认证；根据SUCI确定进行针对NSWO业务的认证；根据第一认证请求消息确定NSWO网元的类型或地址，在根据NSWO网元的类型或地址确定NSWO网元支持NSWO业务后，确定进行针对NSWO业务的认证。
一种可能的实现方式中，SUCI中包括的SUPI的类型用于指示进行针对NSWO业务的认证；和/或，SUCI包括业务指示信息，业务指示信息用于指示进行针对NSWO业务的认证。
一种可能的实现方式中，第二认证请求消息还包括第五NSWO指示信息，第五NSWO指示信息用于指示进行针对NSWO业务的认证。
在该实现方式中，通过在第二认证请求消息中携带第五NSWO指示信息，UDM可以直接确定执行针对NSWO业务的认证。
一种可能的实现方式中，根据第一认证请求消息确定进行针对NSWO业务的认证之后，还包括：确定采用EAP AKA’认证算法；相应的，第二认证请求消息还包括算法指示信息，算法指示信息用于指示进行EAP AKA’认证。
在该实现方式中，通过在第二认证请求消息中携带算法指示信息，UDM可以直接确定采用EAP AKA’认证算法，简化了UDM的处理。
一种可能的实现方式中，第一认证请求消息还包括接入网设备的第一标识信息，接入网设备为终端设备连接的接入网设备；第一标识信息包括下列中的一项：接入网设备的接入网标识；接入网设备的接入网标识对应的服务网络名称；预设接入网标识，用于指示进行针对NSWO业务的认证；预设服务网络名称，用于指示进行针对NSWO业务的认证。
在该实现方式中，第一标识信息可以用于AUSF向UDM发送AN设备的第二标识信息，以便最终UDM计算EAP AKA’认证向量时使用。
一种可能的实现方式中，第二认证请求消息还包括接入网设备的第二标识信息，接入网设备为终端设备连接的接入网设备；第二标识信息包括：第一信息或第一认证请求消息 中携带的第一标识信息；若第一认证请求消息中携带的第一标识信息为接入网设备的接入网标识，则第一信息为接入网标识对应的服务网络名称；若第一认证请求消息中未携带第一标识信息，则第一信息为预设接入网标识或预设服务网络名称；预设接入网标识或预设服务网络名称均用于指示进行针对NSWO业务的认证。
在该实现方式中，第二标识信息可以用于后续UDM计算EAP-AKA’认证向量时使用。
一种可能的实现方式中，第一认证请求消息为UE认证的认证服务请求消息，第一认证响应消息为UE认证的认证服务响应消息。
一种可能的实现方式中，第一认证请求消息和第一认证响应消息均为新增AUSF服务对应的消息，新增AUSF服务用于指示执行针对NSWO业务的认证。
一种可能的实现方式中，第二认证请求消息为UE认证的得到服务请求消息，第二认证响应消息为UE认证的得到服务响应消息。
一种可能的实现方式中，第二认证请求消息和第二认证响应消息均为新增UDM服务对应的消息，新增UDM服务用于指示执行针对NSWO业务的认证。
在该实现方式中，UDM可以直接根据新增UDM服务确定执行针对NSWO业务的认证。
一种可能的实现方式中，第二认证响应消息还包括终端设备的SUPI；方法还包括：根据第五认证请求消息进行针对终端设备的认证成功后，向UDM发送第一NSWO认证结果，第一NSWO认证结果包括SUPI，和/或接入网设备的接入网标识，和/或接入网标识对应的服务网络名称，接入网设备为终端设备连接的接入网设备。
在该实现方式中，在AUSF确定UE针对NSWO业务认证成功之后，可以向UDM通知认证成功的UE和/或认证成功UE接入的AN设备，从而，UDM可以对认证成功的UE和/或认证成功UE接入的AN设备进行记录，以便后续针对UE或AN设备完成计费。
一种可能的实现方式中，第一NSWO认证结果还包括认证指示信息，认证指示信息用于指示终端设备针对NSWO业务的认证成功。
一种可能的实现方式中，第一NSWO认证结果包含在UE认证结果确认消息中。
一种可能的实现方式中，第二EAP AKA’认证向量不包括密钥CK’和密钥IK’，第一认证响应消息包括第二EAP AKA’认证向量。
一种可能的实现方式中，第二EAP AKA’认证向量包括密钥CK’和密钥IK’，第一认证响应消息包括第二EAP AKA’认证向量。
一种可能的实现方式中，第二EAP AKA’认证向量包括密钥CK’和密钥IK’，根据第二认证响应消息向NSWO网元发送第一认证响应消息，包括：删除第二EAP AKA’认证向量中的密钥CK’和密钥IK’；向NSWO网元发送第一认证响应消息，第一认证响应消息包括删除密钥后的第二EAP AKA’认证向量。
在该实现方式中，AUSF删除第二EAP AKA’认证向量中的密钥CK’和密钥IK’，避免了针对NSWO业务进行认证过程中新生成的密钥CK’和密钥IK’影响现有认证流程中已生成的相关密钥。
一种可能的实现方式中，在根据第五认证请求消息进行针对终端设备的认证之后，且在收到密钥CK’和密钥IK’后，还包括：不基于密钥CK’和密钥IK’计算密钥K AUSF；或者，基于密钥CK’和密钥IK’计算密钥K AUSF，且不对AUSF本地已存储的密钥K AUSF进行替换。
在该实现方式中，AUSF不计算新密钥K AUSF或者计算新密钥K AUSF后不进行替换，不会导致新生成的密钥K AUSF影响AUSF现有认证流程中生成的相关密钥。
一种可能的实现方式中，方法还包括：删除密钥CK’和密钥IK’；和/或删除密钥K AUSF。
在该实现方式中，AUSF删除了针对NSWO业务进行认证过程中新生成的密钥，避免了新生成的密钥影响AUSF现有认证流程中生成的相关密钥。
一种可能的实现方式中，方法还包括：若根据第五认证请求消息进行针对终端设备的认证成功后，则向计费NF发送第二NSWO认证结果，第二NSWO认证结果包括终端设备的SUPI，和/或接入网设备的接入网标识，和/或接入网标识对应的服务网络名称，SUPI包括在第二认证响应消息中，接入网设备为终端设备连接的接入网设备。
在该实现方式中，在AUSF确定UE针对NSWO业务认证成功之后，可以向计费NF通知认证成功的UE和/或认证成功UE接入的AN设备，以便计费NF后续针对UE或AN设备完成计费。
第五方面，提供了一种NSWO业务的认证方法，包括：接收AUSF发送的第二认证请求消息，第二认证请求消息包括SUCI；根据SUCI计算得到SUPI；根据第二认证请求消息确定采用EAP AKA’认证方式；根据SUPI得到第一EAP AKA’认证向量；向AUSF发送第二认证响应消息，第二认证响应消息包括第二EAP AKA’认证向量。
第五方面提供的NSWO业务的认证方法，可以应用于UDM。完整的NSWO业务认证流程涉及的网元包括UE、AN设备、NSWO网元、AUSF和UDM。在针对NSWO业务的认证流程中，UDM确定采用EAP AKA’认证方式，避免了如果选择5G AKA认证方式而导致的认证失败，实现了在5G等网络中针对NSWO业务的认证。
一种可能的实现方式中，根据第二认证请求消息确定采用EAP AKA’认证方式，包括下列中的至少一种情况：在确定第二认证请求消息为新增UDM服务对应的请求消息时，确定进行针对NSWO业务的认证，新增UDM服务用于指示进行针对NSWO业务的认证；根据第二认证请求消息中的第二信息确定采用EAP AKA’认证方式，其中，第二信息包括下列中的至少一种：第二信息为NSWO指示信息，NSWO指示信息用于指示进行针对NSWO业务的认证；第二信息为SUCI，SUCI用于指示进行针对NSWO业务的认证；第二信息为算法指示信息，算法指示信息用于指示进行EAP AKA’认证。
一种可能的实现方式中，SUCI中包括的SUPI的类型用于指示进行针对NSWO业务的认证；和/或，SUCI包括业务指示信息，业务指示信息用于指示进行针对NSWO业务的认证。
一种可能的实现方式中，第二EAP AKA’认证向量不包括密钥CK’和密钥IK’。
在该实现方式中，通过将密钥CK’和密钥IK’移除，不发送给AUSF，避免了针对NSWO业务进行认证过程中新生成的密钥CK’和密钥IK’影响现有认证流程中UE或AUSF已生成的相关密钥。
一种可能的实现方式中，第二认证请求消息还包括接入网设备的第二标识信息，接入网设备为终端设备连接的接入网设备；第二标识信息包括：第一信息或第一认证请求消息中携带的第一标识信息；第一认证请求消息为NSWO网元发送给AUSF的消息；若第一认证请求消息中携带的第一标识信息为接入网设备的接入网标识，则第一信息为接入网标识对应的服务网络名称；若第一认证请求消息中未携带第一标识信息，则第一信息为预设 接入网标识或预设服务网络名称；预设接入网标识或预设服务网络名称均用于指示进行针对NSWO业务的认证。
一种可能的实现方式中，第二认证请求消息为UE认证的得到服务请求消息，第二认证响应消息为UE认证的得到服务响应消息。
一种可能的实现方式中，第二认证请求消息和第二认证响应消息均为新增UDM服务对应的消息，新增UDM服务用于指示执行针对NSWO业务的认证。
在该实现方式中，UDM可以直接根据新增UDM服务确定执行针对NSWO业务的认证。
一种可能的实现方式中，方法还包括：接收AUSF发送的第一NSWO认证结果，第一NSWO认证结果包括SUPI，和/或接入网设备的接入网标识，和/或接入网标识对应的服务网络名称，接入网设备为终端设备连接的接入网设备，第一NSWO认证结果用于指示终端设备针对NSWO业务的认证成功。
一种可能的实现方式中，第一NSWO认证结果还包括认证指示信息，认证指示信息用于指示终端设备针对NSWO业务的认证成功。
一种可能的实现方式中，第一NSWO认证结果包含在UE认证结果确认消息中。
第六方面，提供一种装置，包括：用于执行以上任一方面中各个步骤的单元或手段(means)。
第七方面，提供一种通信装置，通信装置包括处理器、存储器和收发器；收发器用于和其他设备通信，处理器用于读取存储器中的指令并根据指令使得通信装置执行以上任一方面提供的方法。
第八方面，提供一种程序，该程序在被处理器执行时用于执行以上任一方面提供的方法。
第九方面，提供一种计算机可读存储介质，计算机可读存储介质中存储有指令，当指令在计算机或处理器上运行时，实现以上任一方面提供的方法。
第十方面，提供一种程序产品，所述程序产品包括计算机程序，所述计算机程序存储在可读存储介质中，设备的至少一个处理器可以从所述可读存储介质读取所述计算机程序，所述至少一个处理器执行所述计算机程序使得该设备实施以上任一方面提供的方法。
附图说明
图1为本申请实施例提供的4G网络的一种架构图；
图2为本申请实施例提供的5G网络的一种架构图；
图3为本申请实施例提供的NSWO业务的认证方法中涉及的消息示意图；
图4为本申请实施例提供的NSWO业务的认证方法的一种消息交互图；
图5为本申请实施例提供的NSWO业务的认证方法的另一种消息交互图；
图6为本申请实施例提供的NSWO业务的认证方法的又一种消息交互图；
图7为本申请实施例提供的NSWO业务的认证方法的又一种消息交互图；
图8为本申请实施例提供的NSWO业务的认证方法的又一种消息交互图；
图9为本申请实施例提供的NSWO业务的认证方法的又一种消息交互图；
图10为本申请实施例提供的NSWO业务的认证方法的又一种消息交互图；
图11为本申请实施例提供的NSWO业务的认证方法的又一种消息交互图；
图12为本申请实施例提供的NSWO业务的认证方法的又一种消息交互图；
图13为本申请实施例提供的NSWO业务的认证方法的又一种消息交互图；
图14为本申请实施例提供的通信装置的一种结构示意图；
图15为本申请实施例提供的通信设备的一种结构示意图。
具体实施方式
下面结合附图描述本申请实施例。
本申请实施例可以相互结合，对于相同或相似的概念或过程可能在某些实施例中不再赘述。本申请实施例中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
本申请实施例提供的NSWO业务的认证方法，适用于5G网络中终端设备进行NSWO业务时的认证流程。首先，对NSWO业务、4G网络架构和5G网络构架进行说明。
3GPP组织为了实现3GPP网络和无线局域网(wireless local area network，WLAN)的互操作功能，定义了一系列标准文件和网络架构。在不改变现有3GPP网络和WLAN网络架构的前提下引入了3GPP AAA相关设备，实现了基于3GPP网络的接入控制和认证，从而，用户设备(user equipment，UE)可以通过WLAN网络访问分组交换域(packet switching domain，PS)业务。
示例性的，图1为本申请实施例提供的4G网络的一种架构图。如图1所示，4G网络包括：非3GPP网络(non-3GPP networks)、拜访公用陆地移动网(visited public land mobile network，VPLMN)和本地公用陆地移动网(home public land mobile network，HPLMN)。非3GPP网络包括：UE、可信非3GPP接入网(trusted non-3GPP access network)设备和非可信非3GPP接入网(untrusted non-3GPP access network)设备。VPLMN包括：3GPP AAA代理(3GPP AAA proxy)。HPLMN包括：3GPP AAA服务器和归属签约用户服务器(home subscriber server，HSS)。各个设备的功能描述参见表1。
表1
Figure PCTCN2022091523-appb-000001
需要说明，本申请实施例对4G网络包括的其他设备不做限定。
4G网络支持NSWO业务。示例性的，如图1中的虚线所示，NSWO业务是指UE进行PS业务的数据可以通过AN设备分流，直接接入因特网(internet)。
AN设备在确定是否为UE执行NSWO业务之前，UE和网络侧需要完成针对NSWO业务的认证。如图1所示，可以通过可信非3GPP接入网设备、3GPP AAA代理、3GPP AAA服务器和HSS完成对UE的认证；或者，可以通过非可信非3GPP接入网设备、3GPP AAA代理、3GPP AAA服务器和HSS完成对UE的认证。如果对UE的认证成功，HSS和3GPP AAA server将用于指示认证成功的认证结果发送给AN设备，从而AN设备为UE执行NSWO业务。例如，AN设备为UE分配外网的网络之间互连协议(internet protocol，IP)地址，使得UE可以连接因特网。上述认证过程可以理解为：AN设备借助运营商完成了对于UE的认证。当运营商认证UE成功之后，确定UE为运营商的合法用户，AN设备才会为UE提供NSWO业务。
目前，在4G网络中，认证过程基于的密钥为UE在3GPP网络接入认证时使用的密钥，例如，全球用户标识模块(universal subscriber identity module，USIM)内保存的密钥。认证算法包括可扩展认证协议/认证和密钥协商(extensible authentication protocol-authentication and key agreement，EAP-AKA)认证算法和EAP-AKA’认证算法。
随着通信技术的发展，5G网络也将支持NSWO业务。示例性的，图2为本申请实施例提供的5G网络的一种架构图。
如图2所示，5G网络包括：UE、AN设备、NSWO网元、鉴权服务器功能(authentication server function，AUSF)和统一数据管理(unified data management，UDM)。各个设备的功能描述参见表2。
表2
Figure PCTCN2022091523-appb-000002
需要说明，本申请实施例对5G网络包括的其他设备不做限定。
可见，5G网络和4G网络的设备可能不同。例如，如图1和图2所示，5G网络中可能没有3GPP AAA服务器。而且，5G网络和4G网络支持的认证算法也不同。4G网络支持EAP-AKA认证算法和EAP-AKA’认证算法，5G网络支持EAP-AKA’认证算法和5G AKA认证算法。5G AKA认证算法不适用于NSWO业务场景下现有AN设备的接入认证。因此，本申请实施例提供了一种适用于5G网络中UE进行NSWO业务时的认证流程。
本申请实施例提供的NSWO业务的认证方法，涉及的网元较多，网元间交互的消息较多。为了便于理解，对各个网元之间的交互消息进行简单说明。示例性的，图3为本申请实施例提供的NSWO业务的认证方法的一种消息交互图。需要说明，图3并不对交互消息的名称形成限定。如图3所示，涉及的消息包括：
1、UE启动认证阶段中的消息
在UE启动认证阶段，UE与AN设备需要确定相互支持NSWO业务。可选的，可以由UE启动针对NSWO业务的认证。例如，UE确定进行NSWO业务时，可以发起针对NSWO业务的认证。可选的，可以由AN设备触发UE启动针对NSWO业务的认证。
UE启动认证阶段的消息可以包括连接建立请求消息、第一请求消息、第一响应消息或广播消息中的至少一个。后续通过图6～图9进行详细说明。
2、第二请求消息
AN设备向NSWO网元发送的消息，用于请求针对NSWO业务的认证，其中包括UE的订阅隐藏标识符(subscription concealed identifier，SUCI)。
可选的，第二请求消息可以为AAA消息。
3、第一认证请求消息、第一认证响应消息
第一认证请求消息和第一认证响应消息为NSWO网元与AUSF之间的一对交互消息。第一认证请求消息和第一认证响应消息分别为AUSF服务对应的请求消息和响应消息。
可选的，AUSF服务为已有服务。例如，已有AUSF服务为UE认证的认证服务(Nausf_UEAuthentication_Authenticate)。第一认证请求消息为UE认证的认证服务请求消息(Nausf_UEAuthentication_Authenticate request)，第一认证响应消息为UE认证的认证服务响应消息(Nausf_UEAuthentication_Authenticate response)。
可选的，AUSF服务可以为新增服务，新增AUSF服务用于指示进行针对NSWO业务的认证。本申请实施例对新增AUSF服务的名称、新增AUSF服务中请求消息和响应消息的名称不做限定。例如，新增AUSF服务的名称可以为UE认证的NSWO认证服务(Nausf_UEAuthentication_NSWO_Authenticate)。第一认证请求消息可以称为UE认证的NSWO认证服务请求消息(Nausf_UEAuthentication_NSWO_Authenticate request)，第一认证响应消息可以称为UE认证的NSWO认证服务响应消息(Nausf_UEAuthentication_NSWO_Authenticate response)。
4、第二认证请求消息、第二认证响应消息
第二认证请求消息和第二认证响应消息为AUSF与UDM之间的一对交互消息。第二认证请求消息和第二认证响应消息分别为UDM服务对应的请求消息和响应消息。
可选的，UDM服务为已有服务。例如，已有UDM服务为UE认证的得到服务(Nudm_UEAuthentication_Get)。第二认证请求消息为UE认证的得到服务请求消息 (Nudm_UEAuthentication_Get request)，第二认证响应消息为UE认证的得到服务响应消息(Nudm_UEAuthentication_Get response)。
可选的，UDM服务可以为新增服务，新增UDM服务用于指示进行针对NSWO业务的认证。本申请实施例对新增UDM服务的名称、新增UDM服务中请求消息和响应消息的名称不做限定。例如，新增UDM服务的名称可以为UE认证的NSWO认证服务(Nudm_UEAuthentication_NSWO_Authenticate)。第二认证请求消息可以称为UE认证的NSWO认证服务请求消息(Nudm_UEAuthentication_NSWO_Authenticate request)，第二认证响应消息可以称为UE认证的NSWO得到服务认证消息(Nudm_UEAuthentication_NSWO_Authenticate response)。
5、第三认证请求消息、第四认证请求消息
第三认证请求消息和第四认证请求消息为UE与NSWO网元之间通过AN设备传输的认证相关消息，用于UE对网络进行认证校验。
6、第五认证请求消息
NSWO网元向AUSF发送的消息，用于AUSF对UE进行认证校验。
7、第一消息、第二消息
AUSF向NSWO网元发送第一消息，其中携带EAP认证结果。NSWO网元向AN设备发送第二消息，其中携带EAP认证结果。EAP认证结果用于向AN设备通知认证成功或者认证失败。
需要说明，本申请实施例对第一消息和第二消息包括的内容不做限定，对EAP认证结果的实现方式不做限定。可以为现有EAP-AKA’认证流程中的相关消息。
8、NSWO业务指示消息、拒绝消息
如果EAP认证结果指示认证成功，AN设备可以执行NSWO业务的操作。例如，为UE分配访问外网的IP地址。AN设备向UE发送NSWO业务指示消息。可选的，NSWO业务指示消息可以包括下列中的至少一项：IP地址、NSWO授权指示或认证成功指示。
如果EAP认证结果指示认证失败，AN设备向UE发送拒绝消息，用于指示拒绝UE使用NSWO业务的请求。
需要说明，本申请实施例对NSWO业务指示消息和拒绝消息包括的内容不做限定，可以为现有EAP-AKA’认证流程中的相关消息。
下面，对本申请实施例涉及的概念进行说明。
1、订阅永久标识符(subscription permanent identifier，SUPI)
在5G网络中，UE的真实身份可以称为SUPI，类似于国际移动用户标识(international mobile subscriber identity，IMSI)。通常，SUPI不会出现在空口上，空口是指UE与网络设备之间的无线接口。
2、SUCI
SUCI为UE采用密钥对SUPI加密并且封装后得到的密文，可以在空口传输。相应的，网络设备可以对SUCI进行解密获得SUPI，从而确定UE的身份。
可选的，SUCI为网络访问标识符(network access identifier，NAI)格式。
可选的，在一种实现方式中，SUCI可以为现有的根据SUPI生成的SUCI，例如，5G 网络中使用的SUCI。
可选的，在另一种实现方式中，SUCI用于指示进行针对NSWO业务的认证。在该实现方式中，AN设备、NSWO网元、AUSF或UDM可以根据SUCI确定执行针对NSWO业务的认证。
可选的，SUCI中包括的SUPI的类型用于指示进行针对NSWO业务的认证。
目前，SUPI的类型可以参见表3。SUPI的类型取值为4-7时为预留类型。在该实现方式中，针对NSWO业务可以定义一种新的SUPI类型，通过新定义的SUPI的类型指示进行针对NSWO业务的认证。可选的，新定义的SUPI的类型的取值可以为4到7中的任一数值。
表3
SUPI的类型 描述
0 IMSI
1 网络特定标识符(network specific identifier，NSI)
2 全局行标识符(global line identifier，GLI)
3 全局电缆标识符(global cable identifier，GCI)
4-7 预留
例如：定义typeX用来指示NSWO业务。一个NAI形式的SUCI的示例为：typoX.rid678.schid1.hnkey27.ecckey<ECC ephemeral public key>.cip<encryption of user17>.mac<MAC tag value>@example.com)。可选的，X的取值可以为4到7中的任一数值。
可选的，SUCI包括业务指示信息，业务指示信息用于指示进行针对NSWO业务的认证。
通过示例进行说明。例如，一个NAI形式的SUCI的示例为：type0.NSWO指示.rid678.schid1.hnkey27.ecckey<ECC ephemeral public key>.cip<encryption of user17>.mac<MAC tag value>@example.com)。其中，NSWO指示即为业务指示信息。
3、NSWO指示信息
NSWO指示信息用于指示进行针对NSWO业务的认证。可选的，NSWO指示信息可以携带在图3中下列至少一个消息中：UE启动认证阶段中的消息、第二请求消息、第一认证请求消息或第二认证请求消息。
在通信过程中，设备A接收到消息后，可以将该消息发送给设备B。可选的，设备A可以不对消息进行处理，将消息透传至设备B。可选的，设备A可以对消息进行处理，将处理后的消息发送至设备B。根据不同设备的处理方式，NSWO指示信息可以进一步细化，包括：
第一NSWO指示信息，在UE启动认证阶段由UE生成且发送给AN设备的NSWO指示信息。
第二NSWO指示信息，在UE启动认证阶段由AN设备生成且发送给UE的NSWO指示信息，用于向UE通知AN设备支持NSWO业务。
第三NSWO指示信息，AN设备在第二请求消息中添加的NSWO指示信息。
第四NSWO指示信息，NSWO网元在第一认证请求消息中添加的NSWO指示信息。
第五NSWO指示信息，AUSF在第二认证请求消息中添加的NSWO指示信息。
4、第一EAP AKA’认证向量和第二EAP AKA’认证向量
UDM接收第二认证请求消息后，如果确定采用EAP-AKA’认证算法，则计算EAP-AKA’认证向量，称为第一EAP AKA’认证向量(RAND,AUTN,XRES,CK’,IK’)。第一EAP AKA’认证向量包括密钥CK’和密钥IK’。
UDM向AUSF发送第二认证响应消息，第二认证响应消息包括第二EAP AKA’认证向量。可选的，第二EAP AKA’认证向量为第一EAP AKA’认证向量。可选的，第二EAP AKA’认证向量为第一EAP AKA’认证向量中删除密钥CK’和密钥IK’后的部分，即(RAND,AUTN,XRES)。
下面通过具体的实施例对本申请的技术方案进行详细说明。下面的实施例可以相互结合，对于相同或相似的概念或过程可能在某些实施例中不再赘述。
为了便于理解，本申请各实施例中相同的步骤采用相同的步骤编号。
需要说明，AN设备与AN具有相同含义。
需要说明，本申请各实施例中接入网标识(AN ID)与服务网络名称(serving network name)可以等同。
图4为本申请实施例提供的NSWO业务的认证方法的一种消息交互图。本实施例提供的NSWO业务的认证方法，执行主体涉及UE、AN设备、NSWO网元、AUSF和UDM。如图4所示，本实施例提供的NSWO业务的认证方法，可以包括：
步骤1、在UE确定进行NSWO业务后，UE向AN设备发送SUCI。相应的，AN设备接收UE发送的SUCI。
本步骤涉及图3中的UE启动认证阶段。其中，SUCI可以参见上面描述，此处不再赘述。UE向AN设备发送SUCI，启动了针对NSWO业务的认证流程。
可选的，UE还可以向AN设备发送第一NSWO指示信息，第一NSWO指示信息用于指示进行针对NSWO业务的认证。相应的，AN设备还可以接收UE发送的第一NSWO指示信息。
通过发送第一NSWO指示信息，使得AN设备根据第一NSWO指示信息确定需要进行针对NSWO业务的认证，便于区分不同的认证流程。
可选的，第一NSWO指示信息和SUCI可以分别在不同的消息中；或者，第一NSWO指示信息和SUCI可以在一条消息中。
通过一条消息同时发送第一NSWO指示信息和SUCI，或者通过不同的消息分别发送第一NSWO指示信息和SUCI，提高了消息流程的多样性。当通过一条消息同时发送第一NSWO指示信息和SUCI时，减少了空口消息数量。
需要说明，本实施例对携带SUCI和/或第一NSWO指示信息的消息类型和消息名称不做限定。例如，消息类型可以为EAP消息。
步骤2、AN设备根据SUCI确定NSWO网元的地址。
具体的，AN设备接收UE发送的SUCI后，若确定执行针对NSWO业务的认证，则根据SUCI确定NSWO网元的地址。
其中，AN设备确定执行针对NSWO业务的认证，可选的，在一种实现方式中，若AN设备默认支持NSWO业务，则接收UE发送的SUCI时确定需要执行针对NSWO业务的认证。可选的，在另一种实现方式中，若SUCI指示进行针对NSWO业务的认证，则确定执行针对NSWO业务的认证。可选的，在又一种实现方式中，若AN设备还接收到第一NSWO指示信息，则根据第一NSWO指示信息确定执行针对NSWO业务的认证。
可选的，AN设备根据SUCI确定NSWO网元的地址，在一种实现方式中，可以包括：
AN设备从SUCI中获取目标网络标识和/或目标路由标识。其中，目标网络标识为UE所在归属网络的标识，例如，移动国家码(mobile country code，MCC)和移动网络码(mobile network code，MNC)。目标路由标识(routing ID)用于进一步选择UE认证相关网元，例如AUSF和/或UDM的选择。
AN设备根据网络标识和/或路由标识与NSWO网元地址之间的映射关系，获取目标网络标识和/或目标路由标识对应的NSWO网元的地址。
在该实现方式中，AN设备本地可以存储网络标识和/或路由标识与NSWO网元地址之间的映射关系。可选的，网络标识和/或路由标识与NSWO网元地址之间的映射关系可以包括下列中至少一项：网络标识与NSWO网元地址之间的映射关系，路由标识与NSWO网元地址之间的映射关系，或者，网络标识、路由标识与NSWO网元地址三者之间的映射关系。实现简单。
可选的，AN设备根据SUCI确定NSWO网元的地址，在另一种实现方式中，可以包括：
AN设备从SUCI中获取目标网络标识和/或目标路由标识。
AN设备向第一地址管理网元发送目标网络标识和/或目标路由标识。
AN设备接收第一地址管理网元发送的NSWO网元的地址。
在该实现方式中，AN设备本地可以不用存储网络标识和/或路由标识与NSWO网元地址之间的映射关系。通过向第一地址管理网元发送目标网络标识和/或目标路由标识，从第一地址管理网元获取NSWO网元的地址。其中，本实施例对第一地址管理网元的名称不做限定。可选的，第一地址管理网元本地可以存储网络标识和/或路由标识与NSWO网元地址之间的映射关系。
步骤3、AN设备根据NSWO网元的地址向NSWO网元发送第二请求消息，第二请求消息包括SUCI。相应的，NSWO网元接收AN设备发送的第二请求消息。
可选的，第二请求消息还可以包括NSWO指示信息。可选的，NSWO指示信息可以包括下列至少一个：第一NSWO指示信息或第三NSWO指示信息。即，NSWO指示信息为第一NSWO指示信息；或者，NSWO指示信息为第三NSWO指示信息；或者，NSWO指示信息包括第一NSWO指示信息和第三NSWO指示信息。第一NSWO指示信息和第三NSWO指示信息可以参见本申请上面描述，此处不再赘述。例如，UE向AN设备发送EAP-RSP消息，其中携带SUCI。EAP-RSP消息中可以包括第一NSWO指示信息，也可以不包括第一NSWO指示信息。AN设备接收到EAP-RSP消息后，可以在EAP-RSP消息之外添加第三NSWO指示信息。
通过在第二请求消息中携带NSWO指示信息，使得NSWO网元根据NSWO指示信息确定需要进行针对NSWO业务的认证，便于区分不同的认证流程。
可选的，第二请求消息还可以包括AN设备的接入网标识(AN ID)。可选的，AN ID用于后续NSWO网元向AUSF发送AN设备的第一标识信息，详见步骤5。
步骤4、NSWO网元根据第二请求消息确定进行针对NSWO业务的认证。
可选的，在一种实现方式中，默认AN设备支持NSWO业务，当从AN设备接收第二请求消息时可以确定进行针对NSWO业务的认证。
可选的，在另一种实现方式中，默认NSWO网元支持NSWO业务，当从AN设备接收第二请求消息时可以确定进行针对NSWO业务的认证。
可选的，在又一种实现方式中，可以根据第二请求消息中包括的NSWO指示信息，确定进行针对NSWO业务的认证。其中，第二请求消息中包括的NSWO指示信息可以参见步骤3中的相关描述，此处不再赘述。
可选的，在又一种实现方式中，可以根据SUCI确定进行针对NSWO业务的认证。在该实现方式中，SUCI用于指示进行针对NSWO业务的认证。
可选的，在又一种实现方式中，可以根据第二请求消息确定AN设备的地址或接入网标识，在根据AN设备的地址或接入网标识确定AN设备支持NSWO业务后，确定进行针对NSWO业务的认证。
可选的，在又一种实现方式中，NSWO网元透传第二请求消息，当从AN设备接收第二请求消息时可以确定进行针对NSWO业务的认证。
步骤5、NSWO网元向AUSF发送第一认证请求消息，第一认证请求消息包括SUCI。相应的，AUSF接收NSWO网元发送的第一认证请求消息。
具体的，NSWO网元确定执行针对NSWO业务的认证后，可以根据SUCI确定AUSF的地址，NSWO网元根据AUSF的地址向AUSF发送第一认证请求消息。
可选的，NSWO网元根据SUCI确定AUSF的地址，在一种实现方式中，可以包括：
NSWO网元从SUCI中获取目标网络标识和/或目标路由标识。其中，目标网络标识可以参见步骤2中的相关描述。目标路由标识(routing ID)用于确定AUSF或UDM的地址。
NSWO网元根据网络标识和/或路由标识与AUSF地址之间的映射关系，获取目标网络标识和/或目标路由标识对应的AUSF的地址。
在该实现方式中，NSWO网元本地可以存储网络标识和/或路由标识与AUSF地址之间的映射关系。可选的，网络标识和/或路由标识与AUSF地址之间的映射关系可以包括下列中至少一项：网络标识与AUSF地址之间的映射关系，路由标识与AUSF地址之间的映射关系，或者，网络标识、路由标识与AUSF地址三者之间的映射关系。实现简单。
可选的，NSWO网元根据SUCI确定AUSF的地址，在另一种实现方式中，可以包括：
NSWO网元从SUCI中获取目标网络标识和/或目标路由标识。
NSWO网元向第二地址管理网元发送目标网络标识和/或目标路由标识。
NSWO网元接收第二地址管理网元发送的AUSF的地址。
在该实现方式中，NSWO网元本地可以不用存储网络标识和/或路由标识与AUSF地址之间的映射关系。通过向第二地址管理网元发送目标网络标识和/或目标路由标识，从第二地址管理网元获取AUSF的地址。其中，本实施例对第二地址管理网元的名称不做限定。可选的，第二地址管理网元本地可以存储网络标识和/或路由标识与AUSF地址之间的映射关系。
可选的，第一认证请求消息还可以包括NSWO指示信息。可选的，NSWO指示信息可以包括下列至少一个：第一NSWO指示信息或第四NSWO指示信息。即，NSWO指示信息为第一NSWO指示信息；或者，NSWO指示信息为第四NSWO指示信息；或者，NSWO指示信息包括第一NSWO指示信息和第四NSWO指示信息。第一NSWO指示信息和第四NSWO指示信息可以参见本申请上面描述，此处不再赘述。
通过在第一认证请求消息中携带NSWO指示信息，使得AUSF根据NSWO指示信息确定需要进行针对NSWO业务的认证，便于区分不同的认证流程。
可选的，第一认证请求消息还可以包括AN设备的第一标识信息。第一标识信息用于后续AUSF向UDM发送AN设备的第二标识信息，详见步骤7。
可选的，第一标识信息可以为下列中的一项：
(1)第二请求消息中携带的AN设备的接入网标识(AN ID)。在该实现方式中，NSWO网元将AN设备发送的AN ID发送给AUSF。
(2)AN设备的接入网标识对应的服务网络名称(serving network name)。在该实现方式中，NSWO网元可以将获得的AN ID转换为serving network name后发送给AUSF。
(3)根据AN设备的相关信息确定的接入网标识。在该实现方式中，NSWO网元本地存储有AN设备的相关信息，通过相关信息确定接入网标识后发送给AUSF。本实施例对相关信息的具体内容不做限定。
(4)预设接入网标识，用于指示进行针对NSWO业务的认证。
(5)预设服务网络名称，用于指示进行针对NSWO业务的认证。
可选的，第一认证请求消息可以为已有AUSF服务对应的请求消息，可以参见本申请上面描述，此处不再赘述。在该实现方式中，第一认证请求消息包括用于指示AUSF进行针对NSWO业务的认证的信息。可选的，该信息可以包括SUCI或NSWO指示信息中的至少一个。
可选的，第一认证请求消息可以为新增AUSF服务对应的请求消息，可以参见本申请上面描述，此处不再赘述。在该实现方式中，新增AUSF服务直接指示AUSF进行针对NSWO业务的认证。可选的，第一认证请求消息可以不包括用于指示AUSF进行针对NSWO业务的认证的信息。例如，第一认证请求消息不包括NSWO指示信息，且SUCI可以为现有5G网络中使用的SUCI。可选的，第一认证请求消息也可以包括用于指示AUSF进行针对NSWO业务的认证的信息。可选的，该信息可以包括SUCI或NSWO指示信息中的至少一个。
步骤6、AUSF根据第一认证请求消息确定进行针对NSWO业务的认证。
可选的，在一种实现方式中，默认NSWO网元支持NSWO业务，当从NSWO网元接收第一认证请求消息时可以确定进行针对NSWO业务的认证。
可选的，在另一种实现方式中，默认AUSF支持NSWO业务，当从NSWO网元接收第一认证请求消息时可以确定进行针对NSWO业务的认证。
可选的，在又一种实现方式中，可以根据第一认证请求消息中包括的NSWO指示信息，确定进行针对NSWO业务的认证。其中，第一认证请求消息中包括的NSWO指示信息可以参见步骤5中的相关描述，此处不再赘述。
可选的，在又一种实现方式中，可以根据SUCI确定进行针对NSWO业务的认证。在 该实现方式中，SUCI用于指示进行针对NSWO业务的认证。
可选的，在又一种实现方式中，在确定第一认证请求消息为新增AUSF服务对应的请求消息时，确定进行针对NSWO业务的认证，新增AUSF服务用于指示进行针对NSWO业务的认证。例如，第一认证请求消息为Nausf_UEAuthentication_NSWO_Authenticate request时，AUSF确定进行针对NSWO业务的认证。
可选的，在又一种实现方式中，可以根据第一认证请求消息确定NSWO网元的类型或地址，在根据NSWO网元的类型或地址确定NSWO网元支持NSWO业务后，确定进行针对NSWO业务的认证。
步骤7、AUSF向UDM发送第二认证请求消息，第二认证请求消息包括SUCI。相应的，UDM接收AUSF发送的第二认证请求消息。
具体的，AUSF确定执行针对NSWO业务的认证后，可以向UDM发送第二认证请求消息。
可选的，第二认证请求消息还可以包括NSWO指示信息。可选的，NSWO指示信息可以包括下列至少一个：第一NSWO指示信息或第五NSWO指示信息。即，NSWO指示信息为第一NSWO指示信息；或者，NSWO指示信息为第五NSWO指示信息；或者，NSWO指示信息包括第一NSWO指示信息和第五NSWO指示信息。第一NSWO指示信息和第五NSWO指示信息可以参见本申请上面描述，此处不再赘述。
通过在第二认证请求消息中携带NSWO指示信息，使得UDM根据NSWO指示信息确定需要进行针对NSWO业务的认证，便于区分不同的认证流程。
可选的，第二认证请求消息还可以包括AN设备的第二标识信息，该AN设备为UE连接的AN设备。第二标识信息可以用于后续UDM计算第一EAP-AKA’认证向量，详见步骤10。
可选的，第二标识信息可以为下列中的一项：
(1)第一认证请求消息中携带的第一标识信息。可以参见步骤5中的相关描述，此处不再赘述。在该实现方式中，AUSF将NSWO网元发送的第一标识信息直接发送给UDM。
(2)第一信息。
可选的，在一种实现方式中，若第一认证请求消息中携带的第一标识信息为AN设备的接入网标识，则第一信息为接入网标识对应的服务网络名称(serving network name)。在该实现方式中，NSWO网元发送给AUSF的第一标识信息为接入网标识(AN ID)，AUSF可以将获得的AN ID转换为serving network name后发送给UDM。
可选的，在另一种实现方式中，若第一认证请求消息中未携带第一标识信息，则第一信息为预设接入网标识或预设服务网络名称。预设接入网标识或预设服务网络名称均用于指示进行针对NSWO业务的认证。
可选的，第二认证请求消息可以为已有UDM服务对应的请求消息，可以参见本申请上面描述，此处不再赘述。在该实现方式中，第二认证请求消息包括用于指示UDM进行针对NSWO业务的认证的信息。可选的，该信息可以包括SUCI或NSWO指示信息中的至少一个。
可选的，第二认证请求消息可以为新增UDM服务对应的请求消息，可以参见本申请上面描述，此处不再赘述。在该实现方式中，新增UDM服务直接指示UDM进行针对NSWO 业务的认证。可选的，第二认证请求消息可以不包括用于指示UDM进行针对NSWO业务的认证的信息。例如，第二认证请求消息不包括NSWO指示信息，且SUCI可以为现有5G网络中使用的SUCI。可选的，第二认证请求消息也可以包括用于指示UDM进行针对NSWO业务的认证的信息。可选的，该信息可以包括SUCI或NSWO指示信息中的至少一个。
步骤8、UDM根据SUCI计算得到SUPI。
本步骤可以采用现有实现方式，不做具体说明。
步骤9、UDM根据第二认证请求消息确定采用EAP AKA’认证方式。
可选的，在一种实现方式中，默认AUSF支持NSWO业务，当从AUSF接收第二认证请求消息时可以确定进行针对NSWO业务的认证。
可选的，在另一种实现方式中，在确定第二认证请求消息为新增UDM服务对应的请求消息时，确定进行针对NSWO业务的认证，新增UDM服务用于指示进行针对NSWO业务的认证。例如，当第二认证请求消息为Nudm_UEAuthentication_NSWO_Authenticate request时，UDM确定进行针对NSWO业务的认证。
可选的，在又一种实现方式中，UDM可以根据第二认证请求消息中的第二信息确定采用EAP AKA’认证方式。其中，第二信息包括下列中的至少一种：
(1)第二信息为NSWO指示信息，NSWO指示信息用于指示进行针对NSWO业务的认证。其中，第二认证请求消息中包括的NSWO指示信息可以参见步骤7中的相关描述，此处不再赘述。
(2)第二信息为SUCI，SUCI用于指示进行针对NSWO业务的认证。
可见，在5G网络中对UE针对NSWO业务进行认证的场景中，由于AN设备支持EAP AKA认证方式和EAP AKA’认证方式，而5G网络支持EAP-AKA’认证方式和5G AKA认证方式，通过UDM确定采用EAP AKA’认证方式，避免了选择5G AKA认证方式时导致的认证失败，实现了5G网络中针对NSWO业务的认证流程。
可选的，UDM确定UE希望使用NSWO业务，UDM根据SUPI确定UE的订阅数据，根据订阅数据校验UE是否被允许使用NSWO业务。若允许，则继续执行；否则UDM发送拒绝消息至AUSF，再由AUSF发送拒绝消息至NSWO网元，之后NSWO网元发送拒绝消息至AN设备。拒绝消息携带指示，指示UE未被授权使用NSWO业务。根据此拒绝消息，AN设备拒绝UE的NSWO业务请求，或者通知UE不被允许使用NSWO业务，或者不被允许在此AN ID或serving network name对应的网络内使用NSWO业务。
可选的，UDM确定UE希望使用NSWO业务，UDM根据SUPI确定UE的订阅数据，根据订阅数据和AN ID或serving network name校验UE是否被允许在此AN ID或serving network name对应的网络内使用NSWO业务。若允许，则继续执行；否则UDM发送拒绝消息至AUSF，再由AUSF发送拒绝消息至NSWO网元，之后NSWO网元发送拒绝消息至AN设备。拒绝消息携带指示，指示UE未被授权在AN ID或serving network name对应的网络内使用NSWO业务。根据根据此拒绝消息，AN设备拒绝UE的NSWO业务请求，或者通知UE不被允许使用NSWO业务，或者不被允许在此AN ID或serving network name对应的网络内使用NSWO业务。
步骤10、UDM根据SUPI得到第一EAP AKA’认证向量(RAND,AUTN,XRES,CK',IK')。
具体的，UDM确定采用EAP AKA’认证方式后，可以根据SUPI和AN设备的标识信息得到EAP AKA’认证向量，称为第一EAP AKA’认证向量。AN设备具体为UE接入的AN设备。第一EAP AKA’认证向量包括密钥CK’和密钥IK’。
可选的，UDM计算第一EAP AKA’认证向量时使用的AN设备的标识信息，可以为下列中的一项：
(1)第二认证请求消息中携带的AN设备的第二标识信息，可以参见步骤7中的相关描述，此处不再赘述。
(2)若第二认证请求消息中未携带AN设备的第二标识信息，则为预设接入网标识或服务网络标识。预设接入网标识或预设服务网络标识用于指示进行针对NSWO业务的认证。
(3)若第二认证请求消息中未携带AN设备的第二标识信息，则为预设服务网络名称或预设服务网络名称。预设服务网络名称或预设服务网络名称用于指示进行针对NSWO业务的认证。
步骤11、UDM向AUSF发送第二认证响应消息，第二认证响应消息包括第二EAP AKA’认证向量。相应的，AUSF接收UDM发送的第二认证响应消息。
其中，第二EAP AKA’认证向量为第一EAP AKA’认证向量删除密钥CK’和密钥IK’后的部分(RAND,AUTN,XRES)。即，第二EAP AKA’认证向量不包括密钥CK’和密钥IK’。
具体的，UE进行NSWO业务时，需要进行针对NSWO业务的认证。UE进行非NSWO业务时，可以进行其他认证流程，例如，基于SIM卡的认证流程。通过将第一EAP AKA’认证向量中的密钥CK’和密钥IK’移除，避免了针对NSWO业务进行认证过程中新生成的密钥CK’和密钥IK’影响现有认证流程中UE或AUSF已生成的相关密钥，确保了本实施例提供的认证流程适用于NSWO业务的认证。
其中，第二认证响应消息可以参见本申请上面描述，此处不再赘述。
可选的，第二认证响应消息还可以包括SUPI。
步骤12、AUSF根据第二认证响应消息向NSWO网元发送第一认证响应消息，第一认证响应消息为EAP AKA’认证算法对应的认证响应消息。相应的，NSWO网元接收AUSF发送的第一认证响应消息。
具体的，AUSF可以执行现有的EAP-AKA’认证流程，向NSWO网元发送第一认证响应消息，可以包括RAND,AUTN，本实施例不做具体说明。其中，第一认证响应消息不包括密钥CK’和密钥IK’。
可选的，第一认证响应消息可以包括可扩展认证协议/认证和密钥协商挑战(EAP/AKA-challenge)。
其中，第一认证响应消息可以参见本申请上面描述，此处不再赘述。
步骤13、NSWO网元根据第一认证响应消息通过AN设备向UE发送第三认证请求消息，第三认证请求消息为EAP AKA’认证算法对应的认证请求消息，可以包括RAND,AUTN。
相应的，UE通过AN设备接收NSWO网元发送的第三认证请求消息。
具体的，NSWO网元可以执行现有的EAP-AKA’认证流程，向UE发送第三认证请求消息，本实施例不做具体说明。
可选的，第三认证请求消息可以包括AUSF发送的EAP/AKA-challenge(RAND,AUTN)。
步骤14、UE使用EAP AKA'认证算法对网络进行认证校验。如基于RAND校验AUTN内MAC是否正确；如校验根据RAND和AUTN计算的SQN的新鲜性是否满足。对于RAND和AUTN的校验属于现有技术，不做限制。
具体的，UE可以执行现有的EAP-AKA’认证流程，使用EAP AKA'认证算法对网络进行认证校验。本实施例不做具体说明。
步骤15、UE在认证校验成功后，计算得到的RES，通过AN设备向NSWO网元发送第四认证请求消息，其中包括RES。相应的，NSWO网元通过AN设备接收UE发送的第四认证请求消息。
更进一步可选的实现方式包括：UE内分为USIM和ME两部分。ME可以理解为UE中不包括USIM的部分。其中USIM会执行RAND和AUTN的安全校验，当USIM校验成功后，USIM会计算得到CK，IK和RES，并且发送CK，IK和RES至ME。之后ME会执行针对CK、IK和RES对应的操作，如基于CK和IK计算CK’和IK’。
具体的，UE可以执行现有的EAP-AKA’认证流程，向NSWO网元发送第四认证请求消息，其中包括RES，本实施例不做具体说明。
可选的，第四认证请求消息可以包括EAP/AKA-challenge。
可选的，UE在步骤15中确认认证校验成功后，还可以包括下列中的一项：
(1)UE或ME计算密钥CK’和密钥IK’，之后删除密钥CK’和密钥IK’。在该实现方式中，UE虽然计算密钥CK’和密钥IK’，但之后删除，避免了针对NSWO业务进行认证过程中新生成的密钥CK’和密钥IK’影响UE现有认证流程中生成的相关密钥，确保了本实施例提供的认证流程适用于NSWO业务的认证。
(2)UE或ME计算密钥CK’和密钥IK’，且不根据密钥CK’和密钥IK’计算密钥K AUSF，之后删除密钥CK’和密钥IK’。在该实现方式中，UE虽然计算密钥CK’和密钥IK’，但没有计算密钥K AUSF，而且删除了密钥CK’和密钥IK’，避免了针对NSWO业务进行认证过程中新生成的密钥CK’和密钥IK’影响UE现有认证流程中生成的相关密钥。
(3)UE或ME计算密钥CK’和密钥IK’，且根据密钥CK’和密钥IK’计算密钥K AUSF，之后删除密钥CK’和密钥IK’，且删除密钥K AUSF。在该实现方式中，UE计算了密钥CK’、密钥IK’和密钥K AUSF，但之后全部删除，避免了针对NSWO业务进行认证过程中新生成的密钥CK’和密钥IK’影响UE现有认证流程中生成的相关密钥。
(4)UE或ME计算密钥CK’和密钥IK’，且根据密钥CK’和密钥IK’计算密钥K AUSF，之后删除密钥CK’和密钥IK’，且不对UE本地存储的密钥K AUSF进行替换。在该实现方式中，UE计算了密钥CK’、密钥IK’和密钥K AUSF，但之后删除了密钥CK’和密钥IK’。虽然新生成了密钥K AUSF，但并没有对UE本地已存储的密钥K AUSF进行替换，可以理解为没有使用新生成的密钥K AUSF，因此不会导致新生成的密钥影响UE现有认证流程中生成的相关密钥。
(5)UE或ME不计算密钥CK’和密钥IK’。在该实现方式中，UE不计算密钥CK’和密钥IK’，避免了针对NSWO业务进行认证过程中新生成的密钥CK’和密钥IK’影响UE现有认证流程中生成的相关密钥。
可选的，ME发送K AUSF至USIM，替换USIM卡内保存的旧K AUSF。
(6)ME确定为NSWO业务的认证后，发送RAND和AUTN给USIM卡的同时还是 发送认证指示给USIM卡。认证指示可选的用来指示USIM卡在校验成功后，不需要发送CK和IK，或者指示USIM为仅认证的业务等。当USIM校验成功后，USIM根据此认证指示会仅计算RES，并发送RES至ME。或者USIM根据此认证指示不会计算CK和IK，或者即使计算了CK和IK，也不会发送CK和IK至ME。此时ME得不到CK和IK，也不会再根据CK和IK计算CK’和IK’。
(7)ME发送RAND和AUTN给USIM卡，USIM正常执行，并发送CK，IK和RES至ME。此时ME根据NSWO业务认证，可选的，ME可以将CK和IK丢弃，删除，或者不做额外的其他使用，例如基于CK和IK计算CK’和IK’。避免针对NSWO业务进行认证过程中新生成的密钥CK和密钥IK影响UE现有认证流程中生成的相关密钥，确保了本实施例提供的认证流程适用于NSWO业务的认证。
步骤16、NSWO网元根据第四认证请求消息向AUSF发送第五认证请求消息。相应的，AUSF接收NSWO网元发送的第五认证请求消息。
具体的，NSWO网元可以执行现有的EAP-AKA’认证流程，向AUSF发送第五认证请求消息，本实施例不做具体说明。
可选的，第五认证请求消息可以包括UE发送的EAP/AKA-challenge。
可选的，第五认证请求消息可以为Nausf_UEAuthentication_Authenticate request。
步骤17、AUSF根据第五认证请求消息进行针对UE的认证。如校验RES和XRES是否等同。如果等同，则校验成功；否则校验失败。
具体的，AUSF可以执行现有的EAP-AKA’认证流程，进行针对UE的认证，本实施例不做具体说明。
步骤18、AUSF在认证校验后，向NSWO网元发送第一消息。相应的，NSWO网元接收AUSF发送的第一消息。第一消息包括认证校验的结果。
步骤19、NSWO网元根据第一消息向AN设备发送第二消息。相应的，AN设备接收NSWO网元发送的第二消息。
步骤20、可选的，若认证校验成功，AN设备向UE发送NSWO业务指示消息。也可以为AN设备确认认证成功后，执行对应NSWO业务的操作。
步骤21、若认证校验失败，AN设备向UE发送拒绝消息。
其中，步骤17～步骤21为现有EAP-AKA’认证流程中的步骤，相关消息可以参见本申请上面描述，此处不再赘述。
可见，本实施例提供了一种适用于5G网络中UE进行NSWO业务时的认证流程，涉及的网元包括UE、AN设备、NSWO网元、AUSF和UDM。其中，UDM确定进行针对NSWO业务的认证后，确定采用EAP AKA’认证方式，避免了如果选择5G AKA认证方式而导致的认证失败。而且，UDM在采用EAP AKA’认证方式计算EAP AKA’认证向量后，将EAP AKA’认证向量中的密钥CK’和密钥IK’删除后再发送给AUSF，避免了针对NSWO业务进行认证过程中新生成的密钥CK’和密钥IK’影响现有认证流程中UE或AUSF已生成的相关密钥，避免影响UE或AUSF的现有密钥架构。进一步的，UE在对网络进行认证校验成功后，可以不计算密钥CK’和密钥IK’，或者，将计算得到的密钥CK’和密钥IK’或密钥K AUSF删除，或者，计算密钥K AUSF后不将新生成的密钥K AUSF替换本地已有的密钥K AUSF，避免影响UE的现有密钥架构。
图5为本申请实施例提供的NSWO业务的认证方法的另一种消息交互图。本实施例提供的NSWO业务的认证方法，执行主体涉及UE、AN设备、NSWO网元、AUSF和UDM。本实施例与图4所示实施例的区别在于：UDM在采用EAP AKA’认证方式计算EAP AKA’认证向量后，将完整的EAP AKA’认证向量发送给AUSF。这样，AUSF或UE可以使用针对NSWO业务进行认证过程中新生成的密钥CK’、密钥IK’或密钥K AUSF。当然，AUSF或UE也可以不使用新生成的密钥CK’、密钥IK’或密钥K AUSF。
如图5所示，本实施例提供的NSWO业务的认证方法，可以包括：
步骤1、在UE确定进行NSWO业务后，UE向AN设备发送SUCI。相应的，AN设备接收UE发送的SUCI。
步骤2、AN设备根据SUCI确定NSWO网元的地址。
步骤3、AN设备根据NSWO网元的地址向NSWO网元发送第二请求消息，第二请求消息包括SUCI。相应的，NSWO网元接收AN设备发送的第二请求消息。
步骤4、NSWO网元根据第二请求消息确定进行针对NSWO业务的认证。
步骤5、NSWO网元向AUSF发送第一认证请求消息，第一认证请求消息包括SUCI。相应的，AUSF接收NSWO网元发送的第一认证请求消息。
步骤6、AUSF根据第一认证请求消息确定进行针对NSWO业务的认证。
其中，步骤1～步骤6可以参见图4所示实施例，此处不再赘述。
步骤107、AUSF向UDM发送第二认证请求消息，第二认证请求消息包括SUCI。相应的，UDM接收AUSF发送的第二认证请求消息。
具体的，AUSF确定执行针对NSWO业务的认证后，可以向UDM发送第二认证请求消息。
可选的，第二认证请求消息还可以包括NSWO指示信息。可选的，NSWO指示信息可以包括下列至少一个：第一NSWO指示信息或第五NSWO指示信息。即，NSWO指示信息为第一NSWO指示信息；或者，NSWO指示信息为第五NSWO指示信息；或者，NSWO指示信息包括第一NSWO指示信息和第五NSWO指示信息。第一NSWO指示信息和第五NSWO指示信息可以参见本申请上面描述，此处不再赘述。
通过在第二认证请求消息中携带NSWO指示信息，使得UDM根据NSWO指示信息确定需要进行针对NSWO业务的认证，便于区分不同的认证流程。
可选的，第二认证请求消息还可以包括AN设备的第二标识信息，该AN设备为UE连接的AN设备。第二标识信息可以用于后续UDM计算第一EAP-AKA’认证向量。
可选的，第二标识信息可以为下列中的一项：
(1)第一认证请求消息中携带的第一标识信息。可以参见步骤5中的相关描述，此处不再赘述。在该实现方式中，AUSF将NSWO网元发送的第一标识信息直接发送给UDM。
(2)第一信息。
可选的，在一种实现方式中，若第一认证请求消息中携带的第一标识信息为AN设备的接入网标识，则第一信息为接入网标识对应的服务网络名称(serving network name)。在该实现方式中，NSWO网元发送给AUSF的第一标识信息为接入网标识(AN ID)，AUSF可以将获得的AN ID转换为serving network name后发送给UDM。
可选的，在另一种实现方式中，若第一认证请求消息中未携带第一标识信息，则第一信息为预设接入网标识或预设服务网络名称。预设接入网标识或预设服务网络名称均用于指示进行针对NSWO业务的认证。
可选的，第二认证请求消息可以为已有UDM服务对应的请求消息，可以参见本申请上面描述，此处不再赘述。此时，可选的，在一种实现方式中，第二认证请求消息包括用于指示UDM进行针对NSWO业务的认证的信息。可选的，该信息可以包括SUCI或NSWO指示信息中的至少一个。
可选的，在另一种实现方式中，AUSF确定进行针对NSWO业务的认证之后，还确定采用EAP AKA’认证算法。相应的，第二认证请求消息还包括算法指示信息，用于指示进行EAP AKA’认证。通过携带算法指示信息，使得UDM可以直接确定采用EAP AKA’认证方式，简化了UDM在选择认证算法上的处理复杂度。
可选的，第二认证请求消息可以为新增UDM服务对应的请求消息，可以参见本申请上面描述，此处不再赘述。在该实现方式中，新增UDM服务直接指示UDM进行针对NSWO业务的认证。可选的，第二认证请求消息可以不包括用于指示UDM进行针对NSWO业务的认证的信息。例如，第二认证请求消息不包括NSWO指示信息，且SUCI可以为现有5G网络中使用的SUCI。可选的，第二认证请求消息也可以包括用于指示UDM进行针对NSWO业务的认证的信息。可选的，该信息可以包括SUCI或NSWO指示信息中的至少一个。
可选的，AUSF确定进行针对NSWO业务的认证之后，还确定采用EAP AKA’认证算法。第二认证请求消息可以包括算法指示信息，也可以不包括算法指示信息。
步骤8、UDM根据SUCI计算得到SUPI。
可以参见图4所示实施例，此处不再赘述。
步骤109、UDM根据第二认证请求消息确定采用EAP AKA’认证方式。
可选的，在一种实现方式中，默认AUSF支持NSWO业务，当从AUSF接收第二认证请求消息时可以确定进行针对NSWO业务的认证。
可选的，在另一种实现方式中，在确定第二认证请求消息为新增UDM服务对应的请求消息时，确定进行针对NSWO业务的认证，新增UDM服务用于指示进行针对NSWO业务的认证。例如，当第二认证请求消息为Nudm_UEAuthentication_NSWO_Authenticate request时，UDM确定进行针对NSWO业务的认证。
可选的，在又一种实现方式中，UDM可以根据第二认证请求消息中的第二信息确定采用EAP AKA’认证方式。其中，第二信息包括下列中的至少一种：
(1)第二信息为NSWO指示信息，NSWO指示信息用于指示进行针对NSWO业务的认证。其中，第二认证请求消息中包括的NSWO指示信息可以参见步骤7中的相关描述，此处不再赘述。
(2)第二信息为SUCI，SUCI用于指示进行针对NSWO业务的认证。
(3)第二信息为算法指示信息，算法指示信息用于指示进行EAP AKA’认证。
可见，在5G网络中对UE针对NSWO业务进行认证的场景中，由于AN设备支持EAP AKA认证方式和EAP AKA’认证方式，而5G网络支持EAP-AKA’认证方式和5G AKA认证方式，通过UDM确定采用EAP AKA’认证方式，避免了选择5G AKA认证方式时导致 的认证失败，实现了5G网络中针对NSWO业务的认证流程。
可选的，UDM确定UE希望使用NSWO业务，UDM根据SUPI确定UE的订阅数据，根据订阅数据校验UE是否被允许使用NSWO业务。若允许，则继续执行；否则UDM发送拒绝消息至AUSF，再由AUSF发送拒绝消息至NSWO网元，之后NSWO网元发送拒绝消息至AN设备。拒绝消息携带指示，指示UE未被授权使用NSWO业务。根据此拒绝消息，AN设备拒绝UE的NSWO业务请求，或者通知UE不被允许使用NSWO业务，或者不被允许在此AN ID或serving network name对应的网络内使用NSWO业务。
可选的，UDM确定UE希望使用NSWO业务，UDM根据SUPI确定UE的订阅数据，根据订阅数据和AN ID或serving network name校验UE是否被允许在此AN ID或serving network name对应的网络内使用NSWO业务。若允许，则继续执行；否则UDM发送拒绝消息至AUSF，再由AUSF发送拒绝消息至NSWO网元，之后NSWO网元发送拒绝消息至AN设备。拒绝消息携带指示，指示UE未被授权在AN ID或serving network name对应的网络内使用NSWO业务。根据根据此拒绝消息，AN设备拒绝UE的NSWO业务请求，或者通知UE不被允许使用NSWO业务，或者不被允许在此AN ID或serving network name对应的网络内使用NSWO业务。
步骤10、UDM根据SUPI得到第一EAP AKA’认证向量(RAND,AUTN,XRES,CK',IK')。
可以参见图4所示实施例，此处不再赘述。
步骤111、UDM向AUSF发送第二认证响应消息，第二认证响应消息包括第二EAP AKA’认证向量。相应的，AUSF接收UDM发送的第二认证响应消息。
其中，第二EAP AKA’认证向量为第一EAP AKA’认证向量，第二EAP AKA’认证向量包括密钥CK’和密钥IK’。
通过将完整的EAP AKA’认证向量携带在第二认证响应消息中发送给AUSF，使得AUSF可以使用针对NSWO业务进行认证过程中新生成的密钥CK’和密钥IK’，提高了密钥使用方式的灵活性。
其中，第二认证响应消息可以参见本申请上面描述，此处不再赘述。
可选的，第二认证响应消息还可以包括SUPI。
步骤112、AUSF根据第二认证响应消息向NSWO网元发送第一认证响应消息，第一认证响应消息为EAP AKA’认证算法对应的认证响应消息。相应的，NSWO网元接收AUSF发送的第一认证响应消息。
具体的，AUSF可以执行现有的EAP-AKA’认证流程，向NSWO网元发送第一认证响应消息，本实施例不做具体说明。其中，AUSF接收到的第二认证响应消息中携带的第二EAP AKA’认证向量为完整的EAP AKA’认证向量，包括密钥CK’和密钥IK’。
可选的，在一种实现方式中，根据第二认证响应消息向NSWO网元发送第一认证响应消息，可以包括RAND,AUTN。
向NSWO网元发送第一认证响应消息，第一认证响应消息包括RAND,AUTN。
在该实现方式中，AUSF删除第二EAP AKA’认证向量中的密钥CK’和密钥IK’，避免了针对NSWO业务进行认证过程中新生成的密钥CK’和密钥IK’影响现有认证流程中UE已生成的相关密钥。
可选的，第一认证响应消息可以包括EAP/AKA-challenge(RAND,AUTN)。
其中，第一认证响应消息可以参见本申请上面描述，此处不再赘述。
步骤13、NSWO网元根据第一认证响应消息通过AN设备向UE发送第三认证请求消息，第三认证请求消息为EAP AKA’认证算法对应的认证请求消息。相应的，UE通过AN设备接收NSWO网元发送的第三认证请求消息。
步骤14、UE使用EAP AKA'认证算法对网络进行认证校验。如基于RAND校验AUTN内MAC是否正确；如校验根据RAND和AUTN计算的SQN的新鲜性是否满足。对于RAND和AUTN的校验属于现有技术，不做限制。
步骤15、UE在认证校验成功后，计算得到的RES，通过AN设备向NSWO网元发送第四认证请求消息。其中包括RES，相应的，NSWO网元通过AN设备接收UE发送的第四认证请求消息。
更进一步可选的实现方式包括：UE内分为USIM和ME两部分。ME可以理解为UE中不包括USIM的部分。其中USIM会执行RAND和AUTN的安全校验，当USIM校验成功后，USIM会计算得到CK，IK和RES，并且发送CK，IK和RES至ME。之后ME会执行针对CK、IK和RES对应的操作，如基于CK和IK计算CK’和IK’。
其中，步骤13～步骤15可以参见图4所示实施例，此处不再赘述。
可选的，UE、USIM或ME在步骤15中确定认证校验成功后，还可以包括下列中的一项：
(1)UE或ME计算密钥CK’和密钥IK’，之后删除密钥CK’和密钥IK’。在该实现方式中，UE虽然计算密钥CK’和密钥IK’，但之后删除，避免了针对NSWO业务进行认证过程中新生成的密钥CK’和密钥IK’影响UE现有认证流程中生成的相关密钥，确保了本实施例提供的认证流程适用于NSWO业务的认证。
(2)UE或ME计算密钥CK’和密钥IK’，且不根据密钥CK’和密钥IK’计算密钥K AUSF，之后删除密钥CK’和密钥IK’。在该实现方式中，UE虽然计算密钥CK’和密钥IK’，但没有计算密钥K AUSF，而且删除了密钥CK’和密钥IK’，避免了针对NSWO业务进行认证过程中新生成的密钥CK’和密钥IK’影响UE现有认证流程中生成的相关密钥。
(3)UE或ME计算密钥CK’和密钥IK’，且根据密钥CK’和密钥IK’计算密钥K AUSF，之后删除密钥CK’和密钥IK’，且删除密钥K AUSF。在该实现方式中，UE计算了密钥CK’、密钥IK’和密钥K AUSF，但之后全部删除，避免了针对NSWO业务进行认证过程中新生成的密钥CK’和密钥IK’影响UE现有认证流程中生成的相关密钥。
(4)UE或ME计算密钥CK’和密钥IK’，且根据密钥CK’和密钥IK’计算密钥K AUSF，之后删除密钥CK’和密钥IK’，且不对UE本地存储的密钥K AUSF进行替换。在该实现方式中，UE计算了密钥CK’、密钥IK’和密钥K AUSF，但之后删除了密钥CK’和密钥IK’。虽然新生成了密钥K AUSF，但并没有对UE本地已存储的密钥K AUSF进行替换，可以理解为没有使用新生成的密钥K AUSF，因此不会导致新生成的密钥影响UE现有认证流程中生成的相关密钥。
(5)UE或ME不计算密钥CK’和密钥IK’。在该实现方式中，UE不计算密钥CK’和密钥IK’，避免了针对NSWO业务进行认证过程中新生成的密钥CK’和密钥IK’影响UE现有认证流程中生成的相关密钥。
(6)UE或ME计算密钥CK’和密钥IK’，且根据密钥CK’和密钥IK’计算密钥K AUSF， 之后对UE本地存储的密钥K AUSF进行替换。在该实现方式中，UE计算了密钥CK’、密钥IK’和密钥K AUSF，并且对UE本地已存储的密钥K AUSF进行替换，将本地已存储的密钥K AUSF替换为新生成的密钥K AUSF。后续，UE可以使用新生成的密钥K AUSF。可选的，ME发送K AUSF至USIM，替换USIM卡内保存的旧K AUSF。
(7)ME确定为NSWO业务的认证后，发送RAND和AUTN给USIM卡的同时还是发送认证指示给USIM卡。认证指示可选的用来指示USIM卡在校验成功后，不需要发送CK和IK，或者指示USIM为仅认证的业务等。当USIM校验成功后，USIM根据此认证指示会仅计算RES，并发送RES至ME。或者USIM根据此认证指示不会计算CK和IK，或者即使计算了CK和IK，也不会发送CK和IK至ME。此时ME得不到CK和IK，也不会再根据CK和IK计算CK’和IK’。
(8)ME发送RAND和AUTN给USIM卡，USIM正常执行，并发送CK，IK和RES至ME。此时ME根据NSWO业务认证，可选的，ME可以将CK和IK丢弃，删除，或者不做额外的其他应用。避免针对NSWO业务进行认证过程中新生成的密钥CK和密钥IK影响UE现有认证流程中生成的相关密钥，确保了本实施例提供的认证流程适用于NSWO业务的认证。
步骤16、NSWO网元根据第四认证请求消息向AUSF发送第五认证请求消息。相应的，AUSF接收NSWO网元发送的第五认证请求消息。
步骤17、AUSF根据第五认证请求消息进行针对UE的认证。如校验RES和XRES是否等同。如果等同，则校验成功；否则校验失败。
步骤18、AUSF在认证校验后，向NSWO网元发送第一消息。相应的，NSWO网元接收AUSF发送的第一消息。第一消息包括认证校验的结果。
其中，步骤16～步骤18可以参见图4所示实施例，此处不再赘述。
可选的，若在步骤112中，第一认证响应消息包括第二认证响应消息中携带的第二EAP AKA’认证向量，即，AUSF没有删除从UDM接收到的密钥CK’和密钥IK’，AUSF在步骤18中确定认证校验成功后，还可以包括下列中的一项：
(1)AUSF不基于密钥CK’和密钥IK’计算密钥K AUSF。在该实现方式中，AUSF没有根据新的密钥CK’和密钥IK’计算得到新的密钥K AUSF，避免了针对NSWO业务进行认证过程中新生成的密钥K AUSF影响AUSF现有认证流程中已生成的相关密钥。
(2)AUSF基于密钥CK’和密钥IK’计算密钥K AUSF，且不对AUSF本地已存储的密钥K AUSF进行替换。在该实现方式中，虽然AUSF根据新的密钥CK’和密钥IK’计算得到新的密钥K AUSF，但并没有对AUSF本地已存储的密钥K AUSF进行替换，可以理解为没有使用针对NSWO业务进行认证过程中新生成的密钥K AUSF，因此不会导致新生成的密钥K AUSF影响AUSF现有认证流程中生成的相关密钥。
可选的，还可以包括下列中的至少一项：
(1)AUSF删除密钥CK’和密钥IK’。在该实现方式中，AUSF删除了针对NSWO业务进行认证过程中接收到的密钥CK’和密钥IK’，避免了新生成的密钥CK’和密钥IK’影响AUSF现有认证流程中生成的相关密钥。
(2)AUSF删除生成的密钥K AUSF。在该实现方式中，AUSF删除了针对NSWO业务进行认证过程中新生成的密钥K AUSF，避免了新生成的密钥K AUSF影响AUSF现有认证流 程中生成的相关密钥。
步骤19、NSWO网元根据第一消息向AN设备发送第二消息。相应的，AN设备接收NSWO网元发送的第二消息。
步骤20、可选的，若认证校验成功，AN设备向UE发送NSWO业务指示消息。也可以为AN确认认证成功后，执行对应NSWO业务的操作。
步骤21、若认证校验失败，AN设备向UE发送拒绝消息。
其中，步骤19～步骤21可以参见图4所示实施例，此处不再赘述。
可见，本实施例提供了一种适用于5G网络中UE进行NSWO业务时的认证流程，涉及的网元包括UE、AN设备、NSWO网元、AUSF和UDM。其中，UDM确定采用EAP AKA’认证方式，避免了如果选择5G AKA认证方式而导致的认证失败。而且，UDM在采用EAP AKA’认证方式计算EAP AKA’认证向量后，将完整的EAP AKA’认证向量发送给AUSF，减小了对UDM处理方式的改动，降低了对UDM的影响，而且为后续AUSF或UE使用针对NSWO业务进行认证过程中新生成的密钥CK’、密钥IK’或密钥K AUSF提供了可能。进一步的，UE在对网络进行认证校验成功后，可以不计算密钥CK’和密钥IK’，或者，将计算得到的密钥CK’和密钥IK’或密钥Kausf删除，或者，计算密钥K AUSF后不将新生成的密钥K AUSF替换本地已有的密钥K AUSF，避免影响UE的现有密钥架构。或者，UE在对网络进行认证校验成功后，计算密钥K AUSF且替换本地已有的密钥K AUSF，可以使用新的密钥K AUSF。进一步的，AUSF从UDM接收到密钥CK’和密钥IK’后，可以将计算得到的密钥K AUSF删除，或者，计算密钥Kausf后不将新生成的密钥K AUSF替换本地已有的密钥K AUSF，避免影响AUSF的现有密钥架构。或者，AUSF计算密钥K AUSF且替换本地已有的密钥K AUSF，可以使用新的密钥K AUSF。
可选的，在上述实施例的基础上，本申请又一实施例提供了图3～图5中UE启动认证阶段的具体实现方式。
可选的，在一种实现方式中，图6为本申请实施例提供的NSWO业务的认证方法的又一种消息交互图。如图6所示，上述步骤1中，UE向AN设备发送SUCI，可以包括：
S601、UE向AN设备发送第一连接建立请求消息，第一连接建立请求消息包括SUCI和第一NSWO指示信息。相应的，AN设备接收UE发送的第一连接建立请求消息。
可选的，第一连接建立请求消息可以为EAP消息。
可选的，SUCI可以为现有的根据SUPI生成的SUCI，例如，5G网络中使用的SUCI。
可选的，SUCI可以指示进行针对NSWO业务的认证。
可选的，第一NSWO指示信息可以在EAP消息中携带，也可以在EAP消息之外携带。
在该实现方式中，UE确定进行NSWO业务后，接入AN建立连接。在第一连接建立请求消息中同时携带SUCI和第一NSWO指示信息，启动针对NSWO业务的认证流程，节省了空口消息数量。
可选的，在另一种实现方式中，图7为本申请实施例提供的NSWO业务的认证方法的又一种消息交互图。如图7所示，上述步骤1中，UE向AN设备发送SUCI，可以包括：
S701、AN设备向UE发送第一请求消息。相应的，UE接收AN设备发送的第一请求消息。
S702、UE向AN设备发送第一响应消息，第一响应消息包括第一NSWO指示信息和SUCI。相应的，AN设备接收UE发送的第一响应消息。
在该实现方式中，AN设备向UE发送第一请求消息，触发UE进行EAP认证。UE确定进行NSWO业务之后接收到第一请求消息，确定执行EAP认证，且确定执行针对NSWO业务的认证。
可选的，第一请求消息和第一响应消息可以为EAP消息。例如，第一请求消息为可扩展认证协议请求/身份验证消息(EAP-REQ/Identity)。第一响应消息为可扩展认证协议响应消息(EAP-RSP)。
可选的，SUCI可以为现有的根据SUPI生成的SUCI，例如，5G网络中使用的SUCI。
可选的，SUCI可以指示进行针对NSWO业务的认证。
可选的，第一NSWO指示信息可以在EAP消息中携带，也可以在EAP消息之外携带。
可选的，S701之前还可以包括：
S703、UE向AN设备发送第二连接建立请求消息。相应的，AN设备接收UE发送的第二连接建立请求消息。
可选的，第二连接建立请求消息可以为EAP消息。
可选的，第二连接建立请求消息可以包括第一NSWO指示信息。具体的，UE通过在第二连接建立请求消息中携带第一NSWO指示信息，使得AN设备确定需要执行针对NSWO业务的认证，从而，AN设备触发UE进行EAP认证。
可选的，在又一种实现方式中，图8为本申请实施例提供的NSWO业务的认证方法的又一种消息交互图。如图8所示，上述步骤1中，UE向AN设备发送SUCI，可以包括：
S801、UE向AN设备发送第三连接建立请求消息，第三连接建立请求消息包括SUCI，SUCI用于指示进行针对NSWO业务的认证。相应的，AN设备接收UE发送的第三连接建立请求消息。
可选的，第三连接建立请求消息可以为EAP消息。
在该实现方式中，UE确定进行NSWO业务后，接入AN建立连接。在第三连接建立请求消息中携带用于指示进行针对NSWO业务的认证的SUCI，启动针对NSWO业务的认证流程，节省了空口消息数量。
可选的，图9为本申请实施例提供的NSWO业务的认证方法的又一种消息交互图。如图9所示，本实施例提供的NSWO业务的认证方法，在上述步骤1之前还可以包括：
S901、AN设备向UE发送第二NSWO指示信息，第二NSWO指示信息用于指示AN设备支持NSWO业务。相应的，UE接收AN设备发送的第二NSWO指示信息。
S902、UE根据第二NSWO指示信息，确定进行基于5G密钥的认证，或进行基于SIM的认证，或进行基于用户首次认证的密钥进行认证。
在该实现方式中，AN设备通过向UE发送第二NSWO指示信息，向UE通知AN设备支持NSWO业务，可以实现针对NSWO业务的认证。
其中，第二NSWO指示信息可以携带在AN设备向UE发送的消息中，本实施例对该消息的类型和名称不做限定。可选的，该消息可以为AN设备发送的广播消息。可选的，该消息可以为上述S701中的第一请求消息。
可选的，在上述实施例的基础上，图10为本申请实施例提供的NSWO业务的认证方法的又一种消息交互图。如图10所示，本实施例提供的NSWO业务的认证方法，在上述步骤21之后，还可以包括：
步骤22、AUSF根据第五认证请求消息进行针对UE的认证成功后，向UDM发送第一NSWO认证结果。
可选的，还可以同时发送SUPI，和/或接入网设备的接入网标识，和/或接入网标识对应的服务网络名称，SUPI包括在第二认证响应消息中，接入网设备为终端连接的接入网设备。
可选的，还可以不发送SUPI，但是发送关联ID或者URI等用来标识UE的信息。
相应的，UDM接收AUSF发送的第一NSWO认证结果。
步骤23、UDM确定并记录SUPI对应UE的针对NSWO业务的认证成功。
具体的，第一NSWO认证结果用于指示UE针对NSWO业务的认证成功。在UDM中，可以通过SUPI或者关联ID或者URI区分不同的UE，通过接入网设备的接入网标识或服务网络名称区分不同的接入网设备。在AUSF确定UE针对NSWO业务认证成功之后，可以向UDM发送第一NSWO认证结果，向UDM通知认证成功的UE和/或认证成功UE接入的AN设备。UDM对认证成功的UE和/或认证成功UE接入的AN设备进行记录，以便后续针对UE或AN设备完成计费。
可选的，第一NSWO认证结果还可以包括认证指示信息，认证指示信息用于指示终端针对NSWO业务的认证成功。
可见，通过认证指示信息，使得UDM可以明确确定SUPI对应UE的针对NSWO业务的认证成功。
可选的，第一NSWO认证结果可以携带在AUSF向UDM发送的消息中。本实施例对该消息的类型和名称不做限定。
可选的，该消息可以为新增UDM服务对应的消息，本实施例对新增UDM服务的名称和新增UDM服务对应的消息的名称不做限定。UDM可以根据该新增的UDM服务直接确定这是通知SUPI认证成功的服务，确定SUPI对应UE的针对NSWO业务的认证成功。
可选的，该消息可以为已有UDM服务对应的消息。例如，已有UDM服务对应的消息为UE认证结果确认消息(Nudm_UEAuthentication_ResultConfirmation)。
可选的，在上述实施例的基础上，图11为本申请实施例提供的NSWO业务的认证方法的又一种消息交互图。如图11所示，本实施例提供的NSWO业务的认证方法，在上述步骤21之后，还可以包括：
步骤24、AUSF根据第五认证请求消息进行针对UE的认证成功后，向计费网络功能(network function，NF)发送第二NSWO认证结果。第二NSWO认证结果包括SUPI，和/或接入网设备的接入网标识，和/或接入网标识对应的服务网络名称，SUPI包括在第二认证响应消息中，接入网设备为终端连接的接入网设备。可选的，还可能不发送SUPI，但是发送关联ID或者URI等用来标识UE的信息。
相应的，计费NF接收AUSF发送的第二NSWO认证结果。
步骤25、计费NF确定并记录SUPI对应UE的针对NSWO业务的认证成功。
其中，第二NSWO认证结果与图10所示实施例中的第一NSWO认证结果原理相似，可以参考相关描述，此处不再赘述。
其中，本实施例与图10所示实施例的区别在于，AUSF向计费NF发送携带第二NSWO认证结果的消息可能不同，本实施例对携带第二NSWO认证结果的消息的类型和名称不做限定。
可选的，在图10所示实施例的基础上，本申请又一实施例提供了一种NSWO业务的认证方法。在本实施例中，AUSF和UE不会删除在针对NSWO业务的认证流程中新生成的密钥K AUSF，可以使用新生成的密钥K AUSF。AUSF信息有更新，相关网元(例如：UDM、AMF等)需要更新本地存储的AUSF信息，即，更新为NSWO业务相关认证对应的AUSF信息。
可选的，在一种实现方式中，图12为本申请实施例提供的NSWO业务的认证方法的又一种消息交互图。如图12所示，本实施例提供的NSWO业务的认证方法，执行主体涉及UDM和AMF。在上述步骤23之后，还可以包括：
步骤26、UDM在确定EAP-AKA’认证成功后，更新AUSF信息。
可选的，AUSF信息可以包括AUSF组(AUSF group)信息或AUSF实例ID(AUSF instance ID)等用来标识AUSF的信息。
步骤27、UDM向AMF发送第一通知消息。第一通知消息包括AUSF信息和UE的标识信息。相应的，AMF接收UDM发送的第一通知消息。
步骤28、AMF根据UE的标识信息确定UE上下文(UE context)，并将UE上下文中的AUSF信息替换为第一通知消息中的AUSF信息。
其中，UE的标识信息用于唯一区分不同的UE。可选的，UE的标识信息可以包括下列中的一项：
SUPI；
SUPI对应的回调uri(callback uri)；
SUPI对应的相关标识(correlation id)。
可选的，第一通知消息为已有UDM服务对应的消息，本实施例对已有UDM服务的名称和已有UDM服务对应的消息的名称不做限定。例如，第一通知消息为SDM通知消息(Numd_SDM_notification)。
可见，在该实现方式中，通过UDM通知AMF更新本地存储的AUSF信息，从而完成AUSF信息的更新。
可选的，在另一种实现方式中，图13为本申请实施例提供的NSWO业务的认证方法的又一种消息交互图。如图13所示，本实施例提供的NSWO业务的认证方法，执行主体涉及AUSF和AMF。在上述步骤22之后，还可以包括：
步骤29、AUSF向AMF发送第二通知消息。第二通知消息包括AUSF信息和UE的标识信息。相应的，AMF接收AUSF发送的第二通知消息。
步骤30、AMF根据UE的标识信息确定UE上下文(UE context)，并将UE上下文中的AUSF信息替换为第二通知消息中的AUSF信息。
其中，UE的标识信息用于唯一区分不同的UE。可选的，UE的标识信息可以包括下 列中的一项：
SUPI；
SUPI对应的回调uri(callback uri)；
SUPI对应的相关标识(correlation id)；
SUPI对应的认证上下文标识(authentication context ID)；
SUPI对应的认证事件标识(authentication event ID)。
可选的，第二通知消息为已有AUSF服务对应的消息，本实施例对已有AUSF服务的名称和已有AUSF服务对应的消息的名称不做限定。例如，第二通知消息为SDM通知消息(Nausf_SDM_notification)。
可见，在该实现方式中，通过AUSF通知AMF更新本地存储的AUSF信息，从而完成AUSF信息的更新。
本申请实施例还提供了一种NSWO业务的认证方法，应用于当UE首次完成针对NSWO业务的认证后，需要再次进行针对NSWO业务的认证的场景中。例如，UE注册至5G网络后，UE与AUSF共享密钥后的场景。
可选的，在一种实现方式中，UE与AUSF共享密钥K AUSF，NSWO业务的认证方法可以包括：
201.UE基于密钥K AUSF计算消息鉴别码(message authentication code，MAC)＝HMAC-SHA256(密钥K AUSF，新鲜参数，NSWO指示)。
其中，HMAC表示基于哈希算法的消息验证码(hashed-based message authentication)，HMAC-SHA256()表示一种加密函数。
其中，新鲜参数可以为计算器，或者序列号等用于体现消息新鲜性的参数。
其中，NSWO指示用于指示进行针对NSWO业务的认证。
202.UE向AN设备发送SUCI、NSWO指示、MAC和新鲜参数。
203.AN设备根据SUCI确定NSWO网元，并向NSWO网元发送SUCI、NSWO指示、MAC和新鲜参数。
204.NSWO网元根据SUCI确定UDM，并向UDM发送SUCI、NSWO指示、MAC和新鲜参数。
205.UDM解密SUCI得到SUPI，根据SUPI获取对应的AUSF信息和AUSF地址。UDM对MAC的正确性进行校验，获得校验结果。
可选的，在一种实现方式中，UDM对MAC的正确性进行校验，可以包括：
UDM向AUSF发送SUPI、NSWO指示、MAC和新鲜参数。
AUSF根据SUPI确定密钥K AUSF，并采用密钥K AUSF、NSWO指示和新鲜参数校验接收到的MAC是否正确。
若MAC校验正确，则向UDM发送成功指示。
可选的，在另一种实现方式中，UDM对MAC的正确性进行校验，可以包括：
UDM向AUSF发送SUPI、NSWO指示和新鲜参数。
AUSF采用相同的方式计算MAC’，并向UDM发送MAC’。
UDM校验MAC与MAC’是否等同。
若等同，则确定MAC校验成功。
206.UDM向NSWO网元发送校验结果。
可以参考本申请上述实施例中的步骤19～步骤21。
可选的，在另一种实现方式中，UE与AMF共享密钥Knasint，NSWO业务的认证方法可以包括：
301.UE基于密钥Knasint计算MAC＝HMAC-SHA256(Knasint，新鲜参数，NSWO指示)。
其中，MAC、HMAC-SHA256()、新鲜参数和NSWO指示的含义可以参见上述步骤201中的描述，此处不再赘述。
302.UE向AN设备发送SUCI、NSWO指示、MAC和新鲜参数。
可选的，还可能发送5G全局唯一的临时UE标识(5G globally unique temporary UE identity，5G-GUTI)。
303.AN设备根据SUCI确定NSWO网元，并向NSWO网元发送SUCI、NSWO指示、MAC和新鲜参数。
可选的，若AN设备还接收到5G-GUTI，并且AN可以通过5G-GUTI确定AMF，则跳转至步骤307。
304.NSWO网元根据SUCI确定UDM，并向UDM发送SUCI、NSWO指示、MAC和新鲜参数。
可选的，若NSWO网元还接收到5G-GUTI，并且NSWO网元可以通过5G-GUTI确定AMF，则跳转至步骤308。
305.UDM解密SUCI得到SUPI，根据SUPI获取对应的AMF信息和AMF地址。UDM对MAC的正确性进行校验，获得校验结果。
可选的，在一种实现方式中，UDM对MAC的正确性进行校验，可以包括：
UDM向AMF发送SUPI(或者，callback uri和/或correlation id)、NSWO指示、MAC和新鲜参数。
AMF根据SUPI(或者，callback uri和/或correlation id)确定Knasint，并采用Knasint、NSWO指示和新鲜参数校验接收到的MAC是否正确。
若MAC校验正确，则向UDM发送成功指示。
可选的，在另一种实现方式中，UDM对MAC的正确性进行校验，可以包括：
UDM向AMF发送SUPI(或者，callback uri和/或correlation id)、NSWO指示和新鲜参数。
AMF采用相同的方式计算MAC’，并向UDM发送MAC’。
UDM校验MAC与MAC’是否等同。
若等同，则确定校验成功。
306.UDM向NSWO网元发送校验结果。
之后的动作可以参考本申请上述实施例中的步骤19～步骤21。
307.AN设备向AMF发送5G-GUTI、NSWO指示、MAC和新鲜参数。
AMF根据SUPI(或者，callback uri和/或correlation id)确定Knasint，并采用Knasint、 NSWO指示和新鲜参数校验接收到的MAC是否正确。AMF发送校验结果至AN。之后AN的动作可以参考之前实施例。
308.NSWO网元向AMF发送5G-GUTI、NSWO指示、MAC和新鲜参数。
AMF根据SUPI(或者，callback uri和/或correlation id)确定Knasint，并采用Knasint、NSWO指示和新鲜参数校验接收到的MAC是否正确。AMF发送校验结果至NSWO网元。之后NSWO网元的动作可以参考之前实施例。
本申请实施例还提供了一种NSWO业务的认证方法，应用于5G网络包括UE、AN设备、AAA网元、AUSF和UDM的场景。
可选的，可以重用图4所示的实施例，UDM直接将CK’和IK’移除，发送移除CK’和IK’的认证向量给AUSF。AUSF再发送移除CK’和IK’的认证向量给AAA网元。之后，UE与AAA网元执行双向认证。后续AAA网元的动作与图4所示实施例中AUSF的操作一致。之后AAA网元发送认证结果至AN。后续AN的动作可以参考之前的实施例。
可选的，可以重用图5所示的实施例。其中，UDM发送完整的认证向量给AUSF。AUSF从UDM接收到完整的认证向量后，删除CK’和IK’之后再发送给AAA网元。之后，UE与AAA网元执行双向认证。后续AAA网元的动作与图5所示实施例中AUSF的操作一致。之后AAA网元发送认证结果至AN。后续AN的动作可以参考之前的实施例。
本申请实施例还提供了一种NSWO业务的认证方法，应用于5G网络包括UE、AN设备、AAA网元和UDM的场景。
此时，AN设备可以直接路由到AAA网元，或者，先路由到AAAproxy后再通过AAAproxy路由到AAA网元。之后，AAA网元可以从UDM获得认证向量。此时，NSWO网元和AUSF的功能都可以由AAA网元来实现。AAA网元可以从UDM获得不包括CK’和IK’的密钥，执行AUSF对应的操作；或者，获得CK’和IK’的密钥后将其删除等操作，具体的操作可以复用本申请上述实施例中AUSF对于密钥的处理动作。
需要说明，本申请实施例提供的NSWO业务的认证方法，不仅仅限于对NSWO业务的认证，同样适用于其他业务的认证。可以理解为本申请以NSWO业务为例进行了认证方式和流程的描述。在其他业务的认证流程中，NSWO网元可以替换为业务认证网元，业务认证网元参与执行对于UE的认证；若认证成功，业务认证网元从AUSF接收认证结果，并发送结果至AN。其中关于其他密钥的操作，与上述CK’，IK’或者K AUSF等操作类似。另外，AN根据认证结果执行的操作也不做限制。
可以理解的是，本申请涉及的各个设备为了实现上述功能，其包含了执行各个功能相应的硬件和/或软件模块。结合本文中所公开的实施例描述的各示例的算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。本领域技术人员可以结合实施例对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对各个设备进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。需要说明的是，本申请实施例中模块的名称是示意性的，实际实现时对模块的名称不做限定。
在采用对应各个功能划分各个功能模块的情况下，图14为本申请实施例提供的通信装置的一种结构示意图。如图14所示，通信装置可以包括：发送模块1402、接收模块1403和处理模块1401。
发送模块1402，用于发送数据。
接收模块1403，用于接收数据。
处理模块1401，用于执行其他步骤，以实现上述方法实施例提供的NSWO业务的认证方法。
图15为本申请实施例提供的通信设备的另一种结构示意图。可选的，通信设备可以为终端设备、AN设备、NSWO网元、AUSF或UDM。如图15所示，通信设备可以包括：处理器1501、接收器1502、发射器1503、存储器1504和总线1505。处理器1501包括一个或者多个处理核心，处理器1501通过运行软件程序以及模块，从而执行各种功能的应用以及信息处理。接收器1502和发射器1503可以实现为一个通信组件，该通信组件可以是一块基带芯片。存储器1504通过总线1505和处理器1501相连。存储器1504可用于存储至少一个程序指令，处理器1501用于执行至少一个程序指令，以实现上述实施例的技术方案。其实现原理和技术效果与上述方法相关实施例类似，此处不再赘述。
在本申请实施例中，处理器可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
在本申请实施例中，存储器可以是非易失性存储器，比如硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)等，还可以是易失性存储器(volatile memory)，例如随机存取存储器(random access memory，RAM)。存储器是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何介质，但不限于此。本申请实施例中的存储器还可以是电路或者其它任意能够实现存储功能的装置，用于存储程序指令和/或数据。
本申请实施例提供一种计算机程序产品，当所述计算机程序产品在设备上运行时，使得所述设备执行上述实施例中的技术方案。其实现原理和技术效果与上述相关实施例类似，此处不再赘述。
本申请实施例提供一种计算机可读存储介质，其上存储有程序指令，所述程序指令被设备执行时，使得所述设备执行上述实施例的技术方案。其实现原理和技术效果与上述相关实施例类似，此处不再赘述。
综上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (65)

  1. 一种有缝无线局域网分流NSWO业务的认证方法，其特征在于，包括：
    接收NSWO网元发送的第一认证请求消息，所述第一认证请求消息包括订阅隐藏标识符SUCI；
    根据所述第一认证请求消息确定进行针对NSWO业务的认证；
    向统一数据管理UDM发送第二认证请求消息，所述第二认证请求消息包括所述SUCI；
    接收所述UDM发送的第二认证响应消息，所述第二认证响应消息包括第二可扩展认证协议认证和密钥协商EAP AKA’认证向量；
    根据所述第二认证响应消息向所述NSWO网元发送第一认证响应消息，所述第一认证响应消息为EAP AKA’认证算法对应的认证响应消息；
    接收所述NSWO网元发送的第五认证请求消息；
    根据所述第五认证请求消息进行针对终端设备的认证。
  2. 根据权利要求1所述的方法，其特征在于，所述根据所述第一认证请求消息确定进行针对NSWO业务的认证，包括下列中的至少一种情况：
    根据所述第一认证请求消息中包括的NSWO指示信息，确定进行针对所述NSWO业务的认证；所述NSWO指示信息用于指示进行针对所述NSWO业务的认证；
    在确定所述第一认证请求消息为新增鉴权服务器功能AUSF服务对应的请求消息时，确定进行针对所述NSWO业务的认证，所述新增AUSF服务用于指示进行针对所述NSWO业务的认证；
    根据所述SUCI确定进行针对所述NSWO业务的认证；
    根据所述第一认证请求消息确定所述NSWO网元的类型或地址，在根据所述NSWO网元的类型或地址确定所述NSWO网元支持所述NSWO业务后，确定进行针对NSWO业务的认证。
  3. 根据权利要求1所述的方法，其特征在于，
    所述SUCI中包括的订阅永久标识符SUPI的类型用于指示进行针对所述NSWO业务的认证；和/或，
    所述SUCI包括业务指示信息，所述业务指示信息用于指示进行针对所述NSWO业务的认证。
  4. 根据权利要求1-3中任一项所述的方法，其特征在于，所述第二认证请求消息还包括第五NSWO指示信息，所述第五NSWO指示信息用于指示进行针对所述NSWO业务的认证。
  5. 根据权利要求1-3中任一项所述的方法，其特征在于，所述根据所述第一认证请求消息确定进行针对NSWO业务的认证之后，还包括：
    确定采用EAP AKA’认证算法；
    相应的，所述第二认证请求消息还包括算法指示信息，所述算法指示信息用于指示进行EAP AKA’认证。
  6. 根据权利要求1-5中任一项所述的方法，其特征在于，所述第一认证请求消息还包括接入网设备的第一标识信息，所述接入网设备为所述终端设备连接的接入网设备；所述第一标识信息包括下列中的一项：
    所述接入网设备的接入网标识；
    所述接入网设备的接入网标识对应的服务网络名称；
    预设接入网标识，用于指示进行针对所述NSWO业务的认证；
    预设服务网络名称，用于指示进行针对所述NSWO业务的认证。
  7. 根据权利要求1-6中任一项所述的方法，其特征在于，所述第二认证请求消息还包括接入网设备的第二标识信息，所述接入网设备为所述终端设备连接的接入网设备；所述第二标识信息包括：
    第一信息或所述第一认证请求消息中携带的第一标识信息；
    若所述第一认证请求消息中携带的第一标识信息为所述接入网设备的接入网标识，则所述第一信息为所述接入网标识对应的服务网络名称；
    若所述第一认证请求消息中未携带所述第一标识信息，则所述第一信息为预设接入网标识或预设服务网络名称；所述预设接入网标识或所述预设服务网络名称均用于指示进行针对所述NSWO业务的认证。
  8. 根据权利要求1-7中任一项所述的方法，其特征在于，所述第一认证请求消息为用户设备UE认证的认证服务请求消息，所述第一认证响应消息为UE认证的认证服务响应消息。
  9. 根据权利要求1-8中任一项所述的方法，其特征在于，所述第二认证请求消息为用户设备UE认证的得到服务请求消息，所述第二认证响应消息为UE认证的得到服务响应消息。
  10. 根据权利要求1-9中任一项所述的方法，其特征在于，所述第二认证响应消息还包括所述终端设备的订阅永久标识符SUPI；所述方法还包括：
    根据所述第五认证请求消息进行针对终端设备的认证成功后，向所述UDM发送第一NSWO认证结果，所述第一NSWO认证结果包括所述SUPI，和/或接入网设备的接入网标识，和/或所述接入网标识对应的服务网络名称，所述接入网设备为所述终端设备连接的接入网设备。
  11. 根据权利要求10所述的方法，其特征在于，所述第一NSWO认证结果包含在用户设备UE认证结果确认消息中。
  12. 根据权利要求1-4、6-11中任一项所述的方法，其特征在于，所述第二EAP AKA’认证向量不包括密钥CK’和密钥IK’，所述第一认证响应消息包括所述第二EAP AKA’认证向量。
  13. 根据权利要求1-11中任一项所述的方法，其特征在于，所述第二EAP AKA’认证向量包括密钥CK’和密钥IK’，所述根据所述第二认证响应消息向所述NSWO网元发送第一认证响应消息，包括：
    删除所述第二EAP AKA’认证向量中的所述密钥CK’和所述密钥IK’；
    向所述NSWO网元发送所述第一认证响应消息，所述第一认证响应消息包括删除密钥后的所述第二EAP AKA’认证向量。
  14. 根据权利要求1-11中任一项所述的方法，其特征在于，在所述根据所述第五认证请求消息进行针对终端设备的认证之后，且在收到密钥CK’和密钥IK’后，还包括：
    不基于所述密钥CK’和所述密钥IK’计算密钥K AUSF；
    或者，基于所述密钥CK’和所述密钥IK’计算所述密钥K AUSF，且不对AUSF本地已存储的密钥K AUSF进行替换。
  15. 根据权利要求14所述的方法，其特征在于，所述方法还包括：
    删除所述密钥CK’和所述密钥IK’；和/或
    删除所述密钥K AUSF。
  16. 根据权利要求1-15中任一项所述的方法，其特征在于，所述方法还包括：
    若根据所述第五认证请求消息进行针对终端设备的认证成功后，则向计费网络功能NF发送第二NSWO认证结果，所述第二NSWO认证结果包括所述终端设备的订阅永久标识符SUPI，和/或接入网设备的接入网标识，和/或所述接入网标识对应的服务网络名称，所述SUPI包括在所述第二认证响应消息中，所述接入网设备为所述终端设备连接的接入网设备。
  17. 一种有缝无线局域网分流NSWO业务的认证方法，其特征在于，包括：
    接收鉴权服务器功能AUSF发送的第二认证请求消息，所述第二认证请求消息包括订阅隐藏标识符SUCI；
    根据所述SUCI计算得到订阅永久标识符SUPI；
    根据所述第二认证请求消息确定采用可扩展认证协议认证和密钥协商EAP AKA’认证方式；
    根据所述SUPI得到第一EAP AKA’认证向量；
    向所述AUSF发送第二认证响应消息，所述第二认证响应消息包括第二EAP AKA’认证向量。
  18. 根据权利要求17所述的方法，其特征在于，所述根据所述第二认证请求消息确定采用EAP AKA’认证方式，包括下列中的至少一种情况：
    在确定所述第二认证请求消息为新增统一数据管理UDM服务对应的请求消息时，确定进行针对所述NSWO业务的认证，所述新增UDM服务用于指示进行针对所述NSWO业务的认证；
    根据所述第二认证请求消息中的第二信息确定采用EAP AKA’认证方式，其中，所述第二信息包括下列中的至少一种：
    所述第二信息为NSWO指示信息，所述NSWO指示信息用于指示进行针对所述NSWO业务的认证；
    所述第二信息为所述SUCI，所述SUCI用于指示进行针对所述NSWO业务的认证；
    所述第二信息为算法指示信息，所述算法指示信息用于指示进行EAP AKA’认证。
  19. 根据权利要求17或18所述的方法，其特征在于，
    所述SUCI中包括的所述SUPI的类型用于指示进行针对所述NSWO业务的认证；和/或，
    所述SUCI包括业务指示信息，所述业务指示信息用于指示进行针对所述NSWO业务的认证。
  20. 根据权利要求17-19中任一项所述的方法，其特征在于，所述第二EAP AKA’认证向量不包括密钥CK’和密钥IK’。
  21. 根据权利要求17-20中任一项所述的方法，其特征在于，所述第二认证请求消息还包括接入网设备的第二标识信息，所述接入网设备为终端设备连接的接入网设备；所述第二标识信息用于计算所述第一EAP AKA’认证向量；
    所述第二标识信息包括：
    第一信息或第一认证请求消息中携带的第一标识信息；所述第一认证请求消息为NSWO网元发送给所述AUSF的消息；
    若所述第一认证请求消息中携带的所述第一标识信息为所述NSWO网元预设的接入网标识，则所述第二标识信息为所述NSWO网元预设的接入网标识；
    若所述第一认证请求消息中未携带所述第一标识信息，则所述第一信息为预设接入网标识或预设服务网络名称；所述预设接入网标识或所述预设服务网络名称均用于指示进行针对所述NSWO业务的认证。
  22. 根据权利要求17-21中任一项所述的方法，其特征在于，所述第二认证请求消息为用户设备UE认证的得到服务请求消息，所述第二认证响应消息为UE认证的得到服务响应消息。
  23. 根据权利要求17-22中任一项所述的方法，其特征在于，所述方法还包括：
    接收所述AUSF发送的第一NSWO认证结果，所述第一NSWO认证结果包括所述SUPI，和/或接入网设备的接入网标识，和/或所述接入网标识对应的服务网络名称，所述接入网设备为终端设备连接的接入网设备，所述第一NSWO认证结果用于指示所述终端设备针对所述NSWO业务的认证成功。
  24. 根据权利要求23所述的方法，其特征在于，所述第一NSWO认证结果包含在用户设备UE认证结果确认消息中。
  25. 一种有缝无线局域网分流NSWO业务的认证方法，其特征在于，包括：
    在终端设备确定进行NSWO业务后，向接入网设备发送订阅隐藏标识符SUCI；
    接收NSWO网元通过所述接入网设备发送的第三认证请求消息，所述第三认证请求消息为可扩展认证协议认证和密钥协商EAP AKA'认证算法对应的认证请求消息；
    使用EAP AKA'认证算法对网络进行认证校验；
    在认证校验成功后，通过所述接入网设备向所述NSWO网元发送第四认证请求消息。
  26. 根据权利要求25所述的方法，其特征在于，
    所述SUCI中包括的订阅永久标识符SUPI的类型用于指示进行针对所述NSWO业务的认证；和/或，
    所述SUCI包括业务指示信息，所述业务指示信息用于指示进行针对所述NSWO业务的认证。
  27. 根据权利要求25或26所述的方法，其特征在于，在认证校验成功后，所述方法还包括下列中的一项：
    计算密钥CK’和密钥IK’；
    计算密钥CK’和密钥IK’，且不根据所述密钥CK’和所述密钥IK’计算密钥K AUSF；
    计算密钥CK’和密钥IK’，且根据所述密钥CK’和所述密钥IK’计算密钥K AUSF，之后删除所述密钥K AUSF，或不对所述终端设备本地存储的密钥K AUSF进行替换；
    或者，在认证校验成功后，不计算密钥CK’和密钥IK’。
  28. 根据权利要求27所述的方法，其特征在于，在所述计算密钥CK’和密钥IK’之后，所述方法还包括：删除所述密钥CK’和所述密钥IK’。
  29. 根据权利要求25-28中任一项所述的方法，其特征在于，在所述终端设备确定进行NSWO业务之前，所述方法还包括：
    接收所述接入网设备发送的第二NSWO指示信息，所述第二NSWO指示信息用于指示所述接入网设备支持所述NSWO业务；
    根据所述第二NSWO指示信息，确定进行基于5G密钥的认证，或进行基于用户识别卡SIM的认证，或进行基于用户首次认证的密钥进行认证。
  30. 一种信息发送方法，其特征在于，包括：
    接入网设备从终端设备接收订阅隐藏标识符SUCI；所述SUCI包括有缝无线局域网分流NSWO指示，所述NSWO指示用于指示针对NSWO业务进行认证；
    所述接入网设备根据所述SUCI确定NSWO网元的地址；
    所述接入网设备根据所述NSWO网元的地址向所述NSWO网元发送请求消息，所述请求消息包括所述SUCI。
  31. 根据权利要求30所述的方法，其特征在于，所述接入网设备根据所述SUCI确定NSWO网元的地址之前，还包括：
    所述接入网设备根据所述SUCI中的所述NSWO指示，确定执行针对所述NSWO业务的认证。
  32. 一种鉴权服务器功能AUSF，其特征在于，包括：
    接收模块，用于接收有缝无线局域网分流NSWO网元发送的第一认证请求消息，所述第一认证请求消息包括订阅隐藏标识符SUCI；
    处理模块，用于根据所述第一认证请求消息确定进行针对NSWO业务的认证；
    发送模块，用于向统一数据管理UDM发送第二认证请求消息，所述第二认证请求消息包括所述SUCI；
    所述接收模块，还用于接收所述UDM发送的第二认证响应消息，所述第二认证响应消息包括第二可扩展认证协议认证和密钥协商EAP AKA’认证向量；
    所述发送模块，还用于根据所述第二认证响应消息向所述NSWO网元发送第一认证响应消息，所述第一认证响应消息为EAP AKA’认证算法对应的认证响应消息；
    所述接收模块，还用于接收所述NSWO网元发送的第五认证请求消息；
    所述处理模块，还用于根据所述第五认证请求消息进行针对终端设备的认证。
  33. 根据权利要求32所述的AUSF，其特征在于，所述处理模块用于执行下列中的至少一项：
    根据所述第一认证请求消息中包括的NSWO指示信息，确定进行针对所述NSWO业务的认证；所述NSWO指示信息用于指示进行针对所述NSWO业务的认证；
    在确定所述第一认证请求消息为新增AUSF服务对应的请求消息时，确定进行针对所述NSWO业务的认证，所述新增AUSF服务用于指示进行针对所述NSWO业务的认证；
    根据所述SUCI确定进行针对所述NSWO业务的认证；
    根据所述第一认证请求消息确定所述NSWO网元的类型或地址，在根据所述NSWO网元的类型或地址确定所述NSWO网元支持所述NSWO业务后，确定进行针对NSWO业务的认证。
  34. 根据权利要求32所述的AUSF，其特征在于，
    所述SUCI中包括的订阅永久标识符SUPI的类型用于指示进行针对所述NSWO业务的认证；和/或，
    所述SUCI包括业务指示信息，所述业务指示信息用于指示进行针对所述NSWO业务的认证。
  35. 根据权利要求32-34中任一项所述的AUSF，其特征在于，所述第二认证请求消息还包括第五NSWO指示信息，所述第五NSWO指示信息用于指示进行针对所述NSWO业务的认证。
  36. 根据权利要求32-34中任一项所述的AUSF，其特征在于，所述处理模块还用于：在根据所述第一认证请求消息确定进行针对NSWO业务的认证之后，确定采用EAP AKA’认证算法；
    相应的，所述第二认证请求消息还包括算法指示信息，所述算法指示信息用于指示进行EAP AKA’认证。
  37. 根据权利要求32-36中任一项所述的AUSF，其特征在于，所述第一认证请求消息还包括接入网设备的第一标识信息，所述接入网设备为所述终端设备连接的接入网设备；所述第一标识信息包括下列中的一项：
    所述接入网设备的接入网标识；
    所述接入网设备的接入网标识对应的服务网络名称；
    预设接入网标识，用于指示进行针对所述NSWO业务的认证；
    预设服务网络名称，用于指示进行针对所述NSWO业务的认证。
  38. 根据权利要求32-37中任一项所述的AUSF，其特征在于，所述第二认证请求消息还包括接入网设备的第二标识信息，所述接入网设备为所述终端设备连接的接入网设备；所述第二标识信息包括：
    第一信息或所述第一认证请求消息中携带的第一标识信息；
    若所述第一认证请求消息中携带的第一标识信息为所述接入网设备的接入网标识，则所述第一信息为所述接入网标识对应的服务网络名称；
    若所述第一认证请求消息中未携带所述第一标识信息，则所述第一信息为预设接入网标识或预设服务网络名称；所述预设接入网标识或所述预设服务网络名称均用于指示进行针对所述NSWO业务的认证。
  39. 根据权利要求32-38中任一项所述的AUSF，其特征在于，所述第一认证请求消息为用户设备UE认证的认证服务请求消息，所述第一认证响应消息为UE认证的认证服务响应消息。
  40. 根据权利要求32-39中任一项所述的AUSF，其特征在于，所述第二认证请求消息为用户设备UE认证的得到服务请求消息，所述第二认证响应消息为UE认证的得到服务响应消息。
  41. 根据权利要求32-40中任一项所述的AUSF，其特征在于，所述第二认证响应消息还包括所述终端设备的订阅永久标识符SUPI；所述发送模块还用于：
    在所述处理模块根据所述第五认证请求消息进行针对终端设备的认证成功后，向所述UDM发送第一NSWO认证结果，所述第一NSWO认证结果包括所述SUPI，和/或接入网设备的接入网标识，和/或所述接入网标识对应的服务网络名称，所述接入网设备为所述终端设备连接的接入网设备。
  42. 根据权利要求41所述的AUSF，其特征在于，所述第一NSWO认证结果包含在用户设备UE认证结果确认消息中。
  43. 根据权利要求32-35、37-42中任一项所述的AUSF，其特征在于，所述第二EAP AKA’认证向量不包括密钥CK’和密钥IK’，所述第一认证响应消息包括所述第二EAP AKA’认证向量。
  44. 根据权利要求32-42中任一项所述的AUSF，其特征在于，所述第二EAP AKA’认证向量包括密钥CK’和密钥IK’；
    所述处理模块，还用于删除所述第二EAP AKA’认证向量中的所述密钥CK’和所述密钥IK’；
    所述发送模块，用于向所述NSWO网元发送所述第一认证响应消息，所述第一认证响应消息包括删除密钥后的所述第二EAP AKA’认证向量。
  45. 根据权利要求32-42中任一项所述的AUSF，其特征在于，所述处理模块还用于：
    在根据所述第五认证请求消息进行针对终端设备的认证之后，且在收到密钥CK’和密钥IK’后，不基于所述密钥CK’和所述密钥IK’计算密钥K AUSF；或者，基于所述密钥CK’和所述密钥IK’计算所述密钥K AUSF，且不对AUSF本地已存储的密钥K AUSF进行替换。
  46. 根据权利要求44所述的AUSF，其特征在于，所述处理模块还用于：
    删除所述密钥CK’和所述密钥IK’；和/或
    删除所述密钥K AUSF。
  47. 根据权利要求32-46中任一项所述的AUSF，其特征在于，所述发送模块还用于：
    若所述处理模块根据所述第五认证请求消息进行针对终端设备的认证成功后，则向计费网络功能NF发送第二NSWO认证结果，所述第二NSWO认证结果包括所述终端设备的订阅永久标识符SUPI，和/或接入网设备的接入网标识，和/或所述接入网标识对应的服务网络名称，所述SUPI包括在所述第二认证响应消息中，所述接入网设备为所述终端设备连接的接入网设备。
  48. 一种统一数据管理UDM，其特征在于，包括：
    接收模块，用于接收鉴权服务器功能AUSF发送的第二认证请求消息，所述第二认证请求消息包括订阅隐藏标识符SUCI；
    处理模块，用于根据所述SUCI计算得到订阅永久标识符SUPI；根据所述第二认证请求消息确定采用可扩展认证协议认证和密钥协商EAP AKA’认证方式；根据所述SUPI得到第一EAP AKA’认证向量；
    发送模块，用于向所述AUSF发送第二认证响应消息，所述第二认证响应消息包括第二EAP AKA’认证向量。
  49. 根据权利要求48所述的UDM，其特征在于，所述处理模块用于执行下列中的至少一项：
    在确定所述第二认证请求消息为新增UDM服务对应的请求消息时，确定进行针对有缝无线局域网分流NSWO业务的认证，所述新增UDM服务用于指示进行针对所述NSWO业务的认证；
    根据所述第二认证请求消息中的第二信息确定采用EAP AKA’认证方式，其中，所述第二信息包括下列中的至少一种：
    所述第二信息为NSWO指示信息，所述NSWO指示信息用于指示进行针对所述NSWO业务的认证；
    所述第二信息为所述SUCI，所述SUCI用于指示进行针对所述NSWO业务的认证；
    所述第二信息为算法指示信息，所述算法指示信息用于指示进行EAP AKA’认证。
  50. 根据权利要求48或49所述的UDM，其特征在于，
    所述SUCI中包括的所述SUPI的类型用于指示进行针对NSWO业务的认证；和/或，
    所述SUCI包括业务指示信息，所述业务指示信息用于指示进行针对所述NSWO业务的认证。
  51. 根据权利要求48-50中任一项所述的UDM，其特征在于，所述第二EAP AKA’认证向量不包括密钥CK’和密钥IK’。
  52. 根据权利要求48-51中任一项所述的UDM，其特征在于，所述第二认证请求消息还包括接入网设备的第二标识信息，所述接入网设备为终端设备连接的接入网设备，所述第二标识信息用于计算所述第一EAP AKA’认证向量；
    所述第二标识信息包括：
    第一信息或第一认证请求消息中携带的第一标识信息；所述第一认证请求消息为NSWO网元发送给所述AUSF的消息；
    若所述第一认证请求消息中携带的所述第一标识信息为所述NSWO网元预设的接入网标识，则所述第二标识信息为所述NSWO网元预设的接入网标识；
    若所述第一认证请求消息中未携带所述第一标识信息，则所述第一信息为预设接入网标识或预设服务网络名称；所述预设接入网标识或所述预设服务网络名称均用于指示进行针对所述NSWO业务的认证。
  53. 根据权利要求48-52中任一项所述的UDM，其特征在于，所述第二认证请求消息为用户设备UE认证的得到服务请求消息，所述第二认证响应消息为UE认证的得到服务响应消息。
  54. 根据权利要求48-53中任一项所述的UDM，其特征在于，所述接收模块还用于：
    接收所述AUSF发送的第一NSWO认证结果，所述第一NSWO认证结果包括所述SUPI，和/或接入网设备的接入网标识，和/或所述接入网标识对应的服务网络名称，所述接入网设备为终端设备连接的接入网设备，所述第一NSWO认证结果用于指示所述终端设备针对所述NSWO业务的认证成功。
  55. 根据权利要求54所述的UDM，其特征在于，所述第一NSWO认证结果包含在用户设备UE认证结果确认消息中。
  56. 一种终端设备，其特征在于，包括：
    发送模块，用于在确定进行有缝无线局域网分流NSWO业务后，向接入网设备发送订阅隐藏标识符SUCI；
    接收模块，用于接收NSWO网元通过所述接入网设备发送的第三认证请求消息，所述第三认证请求消息为可扩展认证协议认证和密钥协商EAP AKA'认证算法对应的认证请求消息；
    处理模块，用于使用EAP AKA'认证算法对网络进行认证校验；
    所述发送模块，还用于在认证校验成功后，通过所述接入网设备向所述NSWO网元发送第四认证请求消息。
  57. 根据权利要求56所述的终端设备，其特征在于，
    所述SUCI中包括的订阅永久标识符SUPI的类型用于指示进行针对所述NSWO业务的认证；和/或，
    所述SUCI包括业务指示信息，所述业务指示信息用于指示进行针对所述NSWO业务的认证。
  58. 根据权利要求56或57所述的终端设备，其特征在于，在认证校验成功后，所述处理模块还用于执行下列中的一项：
    计算密钥CK’和密钥IK’；
    计算密钥CK’和密钥IK’，且不根据所述密钥CK’和所述密钥IK’计算密钥K AUSF；
    计算密钥CK’和密钥IK’，且根据所述密钥CK’和所述密钥IK’计算密钥K AUSF，之后删除所述密钥K AUSF，或不对所述终端设备本地存储的密钥K AUSF进行替换；
    或者，在认证校验成功后，不计算密钥CK’和密钥IK’。
  59. 根据权利要求58所述的终端设备，其特征在于，所述处理模块还用于：
    在计算密钥CK’和密钥IK’之后，删除所述密钥CK’和所述密钥IK’。
  60. 根据权利要求56-59中任一项所述的终端设备，其特征在于，
    所述接收模块，还用于在确定进行NSWO业务之前，接收所述接入网设备发送的第二NSWO指示信息，所述第二NSWO指示信息用于指示所述接入网设备支持所述NSWO业务；
    所述处理模块，还用于根据所述第二NSWO指示信息，确定进行基于5G密钥的认证，或进行基于用户识别卡SIM的认证，或进行基于用户首次认证的密钥进行认证。
  61. 一种接入网设备，其特征在于，包括：
    接收模块，用于从终端设备接收订阅隐藏标识符SUCI；所述SUCI包括有缝无线局域网分流NSWO指示，所述NSWO指示用于指示针对NSWO业务进行认证；
    处理模块，用于根据所述SUCI确定NSWO网元的地址；
    发送模块，用于根据所述NSWO网元的地址向所述NSWO网元发送请求消息，所述请求消息包括所述SUCI。
  62. 根据权利要求61所述的接入网设备，其特征在于，所述处理模块还用于：
    在根据所述SUCI确定NSWO网元的地址之前，根据所述SUCI中的所述NSWO指示，确定执行针对所述NSWO业务的认证。
  63. 一种网络设备，其特征在于，包括处理器、存储器和收发器；所述收发器用于和其他设备通信，所述处理器用于读取所述存储器中的指令并根据所述指令使得所述网络设备执行如权利要求1-16中任一项所述的方法，或者执行如权利要求17-24中任一项所述的方法，或者执行如权利要求30或31所述的方法。
  64. 一种终端设备，其特征在于，包括处理器、存储器和收发器；所述收发器用于和其他设备通信，所述处理器用于读取所述存储器中的指令并根据所述指令使得所述终端设备执行如权利要求25-29中任一项所述的方法。
  65. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机指令，当所述计算机指令在电子设备上运行时，使得所述电子设备执行如权利要求1-16中任一项所述的方法，或者执行如权利要求17-24中任一项所述的方法，或者执行如权利要求25-29中任一项所述的方法，或者执行如权利要求30或31所述的方法。
PCT/CN2022/091523 2021-05-08 2022-05-07 Nswo业务的认证方法、设备和存储介质 WO2022237693A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
JP2023568581A JP2024517897A (ja) 2021-05-08 2022-05-07 Ｎｓｗｏサービスの認証のための方法、デバイス、および記憶媒体
EP22806659.3A EP4336879A1 (en) 2021-05-08 2022-05-07 Method for authenticating nswo service, and device and storage medium
US18/502,799 US20240073685A1 (en) 2021-05-08 2023-11-06 Method for authentication for nswo service, device, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110502550.3A CN115396126A (zh) 2021-05-08 2021-05-08 Nswo业务的认证方法、设备和存储介质
CN202110502550.3 2021-05-08

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/502,799 Continuation US20240073685A1 (en) 2021-05-08 2023-11-06 Method for authentication for nswo service, device, and storage medium

Publications (1)

Publication Number Publication Date
WO2022237693A1 true WO2022237693A1 (zh) 2022-11-17

Family

ID=84028818

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/091523 WO2022237693A1 (zh) 2021-05-08 2022-05-07 Nswo业务的认证方法、设备和存储介质

Country Status (5)

Country Link
US (1) US20240073685A1 (zh)
EP (1) EP4336879A1 (zh)
JP (1) JP2024517897A (zh)
CN (1) CN115396126A (zh)
WO (1) WO2022237693A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117580038A (zh) * 2022-08-08 2024-02-20 中国电信股份有限公司 终端设备认证方法、系统及相关设备

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103517370A (zh) * 2012-06-29 2014-01-15 中兴通讯股份有限公司 消息处理方法及装置
CN104541547A (zh) * 2013-08-19 2015-04-22 华为技术有限公司 控制接入无线局域网的方法、装置、设备和系统
US20150296445A1 (en) * 2012-11-05 2015-10-15 Zte Corporation Method, device and system for managing packet data network type

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103517370A (zh) * 2012-06-29 2014-01-15 中兴通讯股份有限公司 消息处理方法及装置
US20150296445A1 (en) * 2012-11-05 2015-10-15 Zte Corporation Method, device and system for managing packet data network type
CN104541547A (zh) * 2013-08-19 2015-04-22 华为技术有限公司 控制接入无线局域网的方法、装置、设备和系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
NOKIA, ZTE, DEUTSCHE TELEKOM, HEWLETT PACKARD ENTERPRISE, ROGERS COMMUNICATION: "IMEI check for EPC access via trusted WLAN", 3GPP DRAFT; S2-162129 WAS1597_CR23402 ME CHECK S2A_V0 2, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. Sophia Antipolis France; 20160411 - 20160415, 16 April 2016 (2016-04-16), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051091955 *

Also Published As

Publication number Publication date
US20240073685A1 (en) 2024-02-29
CN115396126A (zh) 2022-11-25
EP4336879A1 (en) 2024-03-13
JP2024517897A (ja) 2024-04-23

Similar Documents

Publication Publication Date Title
US11463874B2 (en) User profile, policy, and PMIP key distribution in a wireless communication network
US11825303B2 (en) Method for performing verification by using shared key, method for performing verification by using public key and private key, and apparatus
US11496320B2 (en) Registration method and apparatus based on service-based architecture
US11888652B2 (en) VXLAN implementation method, network device, and communications system
US11974132B2 (en) Routing method, apparatus, and system
JP4687788B2 (ja) 無線アクセスシステムおよび無線アクセス方法
CN107835204B (zh) 配置文件策略规则的安全控制
AU2020200523B2 (en) Methods and arrangements for authenticating a communication device
US20100242100A1 (en) Network access authentication
US20240073685A1 (en) Method for authentication for nswo service, device, and storage medium
TWI828235B (zh) 用於使用使用者裝備識別符進行認證之方法、設備及電腦程式產品
TW202308363A (zh) 用於板載處理之使用者裝備與通訊網路間之認證技術
WO2021195816A1 (zh) 一种通信方法、装置及系统
WO2024093923A1 (zh) 通信方法和通信装置
WO2021219107A1 (zh) 切片认证授权管理方法、装置和系统
US20240179525A1 (en) Secure communication method and apparatus
WO2018036514A1 (zh) 消息发送方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22806659

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2023568581

Country of ref document: JP

WWE Wipo information: entry into national phase

Ref document number: 2022806659

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2022806659

Country of ref document: EP

Effective date: 20231202