WO2023000139A1 - 传输凭证的方法、装置、通信设备及存储介质 - Google Patents

传输凭证的方法、装置、通信设备及存储介质 Download PDF

Info

Publication number
WO2023000139A1
WO2023000139A1 PCT/CN2021/107150 CN2021107150W WO2023000139A1 WO 2023000139 A1 WO2023000139 A1 WO 2023000139A1 CN 2021107150 W CN2021107150 W CN 2021107150W WO 2023000139 A1 WO2023000139 A1 WO 2023000139A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
pdu session
dnn
request message
information
Prior art date
Application number
PCT/CN2021/107150
Other languages
English (en)
French (fr)
Inventor
洪伟
Original Assignee
北京小米移动软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京小米移动软件有限公司 filed Critical 北京小米移动软件有限公司
Priority to CN202180002207.0A priority Critical patent/CN115868188A/zh
Priority to PCT/CN2021/107150 priority patent/WO2023000139A1/zh
Publication of WO2023000139A1 publication Critical patent/WO2023000139A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security

Definitions

  • the present disclosure relates to the technical field of wireless communication but is not limited to the technical field of wireless communication, and in particular relates to a method, device, communication device and storage medium for transmitting vouchers.
  • NPN non-public networks
  • SNPN Stand-alone NPN
  • This credential is used for primary authentication, so that the terminal can access the desired SNPN after passing the authentication.
  • the terminal should be allowed to access the login network before providing credentials to the terminal.
  • Credentials are different from ordinary user service flows transmitted on the user plane. Credentials are highly sensitive data and need to be protected securely. Otherwise, the terminal will not be authenticated to access the desired SNPN or may be tricked into accessing a malicious SNPN.
  • a protection mechanism to ensure the security of credential transmission.
  • the embodiment of the present disclosure discloses a method, device, communication device and storage medium for transmitting vouchers.
  • a method for transmitting credentials wherein the method is executed by a terminal, and the method includes:
  • the first indication information is used to indicate: request to activate or not activate the user plane security protection operation of the wireless data bearer DRB of the terminal; the DRB is at least used to carry the terminal to access the independent non-public network SNPN Credentials required.
  • a method for transmitting credentials is provided, wherein the method is performed by a base station, and the method includes:
  • the first indication information is used to indicate: request to activate or not activate the user plane security protection operation of the wireless data bearer DRB of the terminal; the DRB is at least used to carry the credentials required for the terminal to access the SNPN .
  • a method for transmitting credentials wherein the method is executed by a first core network device, and the method includes:
  • the registration type of the registration request message is set to a predetermined registration type; the predetermined registration type is used to indicate that the registration request message is used for the terminal to log into the ONN to obtain the credentials required for the terminal to access the SNPN .
  • a method for transmitting credentials wherein the method is performed by a second core network device, and the method includes:
  • the PDU session establishment request message includes at least DNN information, wherein the DNN information is used to indicate the DNN that obtains the credential required for the terminal to access the SNPN.
  • a device for transmitting credentials wherein the device includes:
  • a receiving module configured to receive the first indication information sent by the base station
  • the first indication information is used to indicate: request to activate or not activate the user plane security protection operation of the wireless data bearer DRB of the terminal; the DRB is at least used to bear the credential required by the terminal to access the SNPN.
  • a device for transmitting credentials wherein the device includes:
  • a sending module configured to send the first indication information to the terminal
  • the first indication information is used to indicate: request to activate or not activate the user plane security protection operation of the wireless data bearer DRB of the terminal; the DRB is at least used to carry the credentials required for the terminal to access the SNPN .
  • a device for transmitting credentials wherein the device includes:
  • a receiving module configured to receive a registration request message sent by the base station
  • the registration type of the registration request message is set to a predetermined registration type; the predetermined registration type is used to indicate that the registration request message is used for the terminal to log into the ONN to obtain the credentials required for the terminal to access the SNPN.
  • a device for transmitting credentials wherein the device includes:
  • a receiving module configured to receive a PDU session establishment request message sent by the first core network device
  • the PDU session establishment request message includes at least DNN information, wherein the DNN information is used to indicate the DNN that obtains the credential required for the terminal to access the SNPN.
  • a communication device includes:
  • the processor is configured to implement the method described in any embodiment of the present disclosure when running the executable instruction.
  • a computer storage medium stores a computer executable program, and when the executable program is executed by a processor, the method described in any embodiment of the present disclosure is implemented.
  • the first indication information sent by the base station is received; wherein the first indication information is used to indicate: request to activate or not activate the user plane security protection operation of the radio data bearer DRB of the terminal;
  • the DRB is at least used to carry the credential required for the terminal to access the independent non-public network SNPN.
  • the terminal after the terminal receives the first indication information sent by the base station, it can activate the user plane security protection operation of the DRB of the terminal based on the first indication information or deactivate the user plane security protection operation of the DRB of the terminal In this way, the reliability of using the DRB to transmit the SNPN credential can be improved to ensure the security of credential transmission.
  • Fig. 1 is a schematic structural diagram of a wireless communication system according to an exemplary embodiment.
  • Fig. 2 is a schematic diagram showing a network architecture according to an exemplary embodiment.
  • Fig. 3 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 4 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 5 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 6 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 7 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 8 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 9 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 10 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 11 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 12 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 13 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 14 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 15 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 16 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 17 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 18 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 19 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 20 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 21 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 22 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 23 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 24 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 25 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 26 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 27 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 28 is a schematic flowchart of a method for transmitting vouchers according to an exemplary embodiment.
  • Fig. 29 is a schematic diagram of a device for transmitting vouchers according to an exemplary embodiment.
  • Fig. 30 is a schematic diagram of a device for transmitting vouchers according to an exemplary embodiment.
  • Fig. 31 is a schematic diagram of a device for transmitting vouchers according to an exemplary embodiment.
  • Fig. 32 is a schematic diagram of a device for transmitting vouchers according to an exemplary embodiment.
  • Fig. 33 is a schematic structural diagram of a terminal according to an exemplary embodiment.
  • Fig. 34 is a block diagram of a base station according to an exemplary embodiment.
  • first, second, third, etc. may use the terms first, second, third, etc. to describe various information, the information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of the embodiments of the present disclosure, first information may also be called second information, and similarly, second information may also be called first information. Depending on the context, the word “if” as used herein may be interpreted as “at” or "when” or "in response to a determination.”
  • the term “greater than” or “less than” is used herein when characterizing a size relationship. However, those skilled in the art can understand that the term “greater than” also covers the meaning of “greater than or equal to”, and “less than” also covers the meaning of "less than or equal to”.
  • FIG. 1 shows a schematic structural diagram of a wireless communication system provided by an embodiment of the present disclosure.
  • the wireless communication system is a communication system based on mobile communication technology, and the wireless communication system may include: several user equipments 110 and several base stations 120 .
  • the user equipment 110 may be a device that provides voice and/or data connectivity to the user.
  • the user equipment 110 can communicate with one or more core networks via a radio access network (Radio Access Network, RAN), and the user equipment 110 can be an Internet of Things user equipment, such as a sensor device, a mobile phone, and a computer with an Internet of Things user equipment , for example, may be a fixed, portable, pocket, hand-held, computer built-in, or vehicle-mounted device.
  • RAN Radio Access Network
  • Station For example, Station (Station, STA), subscriber unit (subscriber unit), subscriber station (subscriber station), mobile station (mobile station), mobile station (mobile), remote station (remote station), access point, remote user equipment (remote terminal), access user equipment (access terminal), user device (user terminal), user agent (user agent), user equipment (user device), or user equipment (user equipment).
  • the user equipment 110 may also be equipment of an unmanned aerial vehicle.
  • the user equipment 110 may also be a vehicle-mounted device, for example, a trip computer with a wireless communication function, or a wireless user device connected externally to the trip computer.
  • the user equipment 110 may also be a roadside device, for example, may be a street lamp, a signal lamp, or other roadside devices with a wireless communication function.
  • the base station 120 may be a network side device in a wireless communication system.
  • the wireless communication system may be a fourth generation mobile communication technology (the 4th generation mobile communication, 4G) system, also known as a Long Term Evolution (LTE) system; or, the wireless communication system may also be a 5G system, Also known as new air interface system or 5G NR system.
  • the wireless communication system may also be a next-generation system of the 5G system.
  • the access network in the 5G system can be called NG-RAN (New Generation-Radio Access Network, New Generation Radio Access Network).
  • the base station 120 may be an evolved base station (eNB) adopted in a 4G system.
  • the base station 120 may also be a base station (gNB) adopting a centralized distributed architecture in the 5G system.
  • eNB evolved base station
  • gNB base station
  • the base station 120 adopts a centralized distributed architecture it generally includes a centralized unit (central unit, CU) and at least two distributed units (distributed unit, DU).
  • the centralized unit is provided with a packet data convergence protocol (Packet Data Convergence Protocol, PDCP) layer, radio link layer control protocol (Radio Link Control, RLC) layer, media access control (Media Access Control, MAC) layer protocol stack;
  • PDCP Packet Data Convergence Protocol
  • RLC Radio Link Control
  • MAC media access control
  • a physical (Physical, PHY) layer protocol stack is set in the unit, and the embodiment of the present disclosure does not limit the specific implementation manner of the base station 120 .
  • a wireless connection may be established between the base station 120 and the user equipment 110 through a wireless air interface.
  • the wireless air interface is a wireless air interface based on the fourth-generation mobile communication network technology (4G) standard; or, the wireless air interface is a wireless air interface based on the fifth-generation mobile communication network technology (5G) standard, such as
  • the wireless air interface is a new air interface; alternatively, the wireless air interface may also be a wireless air interface based on a technical standard of a next-generation mobile communication network based on 5G.
  • an E2E (End to End, end-to-end) connection may also be established between user equipment 110.
  • V2V vehicle to vehicle, vehicle-to-vehicle
  • V2I vehicle to Infrastructure, vehicle-to-roadside equipment
  • V2P vehicle to pedestrian, vehicle-to-person communication in vehicle to everything (V2X) communication Wait for the scene.
  • the above user equipment may be regarded as the terminal equipment in the following embodiments.
  • the foregoing wireless communication system may further include a network management device 130 .
  • the network management device 130 may be a core network device in a wireless communication system, for example, the network management device 130 may be a Mobility Management Entity (Mobility Management Entity) in an evolved packet core network (Evolved Packet Core, EPC), MME).
  • the network management device can also be other core network devices, such as Serving GateWay (SGW), Public Data Network Gateway (Public Data Network GateWay, PGW), policy and charging rule functional unit (Policy and Charging Rules Function, PCRF) or Home Subscriber Server (Home Subscriber Server, HSS), etc.
  • SGW Serving GateWay
  • PGW Public Data Network Gateway
  • PCRF Policy and Charging Rules Function
  • HSS Home Subscriber Server
  • the embodiments of the present disclosure list a plurality of implementation manners to clearly illustrate the technical solutions of the embodiments of the present disclosure.
  • those skilled in the art can understand that the multiple embodiments provided by the embodiments of the present disclosure can be executed independently, or combined with the methods of other embodiments in the embodiments of the present disclosure, and can also be executed alone or in combination It is then executed together with some methods in other related technologies; this is not limited in the embodiment of the present disclosure.
  • this embodiment shows a network architecture. Based on the network architecture, a terminal can first log in to the network.
  • the credential distribution server can connect and pre-configure the credential to the terminal through the user plane connection.
  • both the terminal and the base station in the Onboarding Network support access layer security, and protect the Uu interface after the terminal is successfully online.
  • ONN Onboarding Network
  • activation of user plane connection security protection is not mandatory on the Uu interface, which leads to the risk of exposing credentials to threats during remote configuration of credentials over user plane connections.
  • the user plane connection security of the Uu interface is activated based on the security policy information sent by the core network, and is activated by the unified data management (UDM, Unified Data Management) or session management function (SMF, Session Management Function) according to the terminal request specific service settings.
  • UDM Unified Data Management
  • SMF Session Management Function
  • SMF determines the user plane security execution information of the PDU session based on the following information when the protocol data unit (PDU, Protocol Data Unit) session is established:
  • the signed user plane security policy information is part of the signed information received from UDM;
  • the user plane security policy information indicates whether user plane security protection should be activated on the Uu interface for all data radio bearers (DRB, Data Radio Bearer) belonging to the PDU session. Used to activate user plane encryption and/or user plane integrity protection for all DRBs belonging to a PDU session.
  • DRB Data Radio Bearer
  • the base station uses radio resource control (RRC, Radio Resource Control) signaling to activate the user plane security protection of each DRB . If the policy indicates "not required” then the establishment of the PDU session shall proceed without protection. If the policy indicates "recommendation", the base station can independently decide whether to activate user plane security protection. However, when the policy indicates "required” or "not required", the base station cannot override the received user plane security policy information.
  • RRC Radio Resource Control
  • the user plane security protection is implemented continuously on the Uu interface by using the DRB addition procedure of the RRC connection reconfiguration procedure.
  • the base station determines to activate the user plane security protection on Uu based on the user plane security policy information, it includes an indication of user plane security protection activation in the RRC connection reconfiguration request. Then, the terminal implements the same user plane security protection based on the activation indication sent by the base station.
  • the terminal selects a login network ONN to log in and obtain the credentials required to access the SNPN
  • the selected ONN may not be the home network of the terminal. Therefore, the UDM in the ONN may not contain the user plane security policy information that the terminal has signed. This leaves only the option of locally configuring user plane security policy information by the SMF.
  • how the SMF determines the security policy information transmitted by the user plane of the SNPN credential has not been defined yet, and remains to be studied.
  • the SMF and the base station are network nodes in the ONN, which are different from the network nodes in the SNPN that the terminal requests to access, the SMF and the base station in the ONN may not be trusted by the SNPN and the terminal to correctly implement the security policy used to protect the SNPN credentials . Especially in the case of fake or faulty base stations, the base station may ignore the security policy received from the SMF and deactivate the user plane security protection on the Uu interface. In related technologies, the terminal is only allowed to follow the activation instruction sent by the base station to implement user plane security protection. The terminal cannot check whether the received security activation indication matches the security requirements of the requested PDU session.
  • the base station when it is necessary to establish a user plane PDU session transmission credential, the base station will send an activation indication for activating the user plane security protection operation to the terminal (it should be noted that, under normal circumstances, in order to ensure the credential transmission Security, if the base station is a trusted base station, the base station will definitely send activation instructions according to the SMF security policy to activate the terminal to perform security protection operations. It will definitely not send activation instructions that do not comply with the SMF security policy). After the terminal receives the activation instruction, the terminal will establish a user plane PDU session and perform user plane security protection operations to realize secure transmission of credentials.
  • an inactivation instruction may be sent to the terminal to inactivate the user plane security protection operation.
  • the terminal should follow the activation indication sent by the base station to activate the user plane security protection operation according to the existing mechanism, so as to establish the user plane PDU session and not perform the user plane security protection operation (if according to the trusted base station's Indicates that the user plane security protection operation should be performed here, which is equivalent to being tampered with).
  • the trusted base station's Indicates that the user plane security protection operation should be performed here, which is equivalent to being tampered with.
  • the terminal will determine whether to establish a PDU session and whether to perform a user plane security protection operation according to the received instruction, that is, if the received instruction is an activation instruction to activate the user plane security protection operation, the terminal will establish a PDU session and execute the user plane security protection operation.
  • Security protection operation if the received instruction is an activation instruction not to activate the user plane security protection operation, the terminal will reject the RRC connection reconfiguration message, that is, the establishment of the PDU session fails (because the terminal has received an inactivation instruction, indicating that the base station has failed , or is attacked by a bogus base station, or the network does not allow the establishment of a PDU session. In this case, not establishing a PDU session can effectively avoid the risk of credential being stolen).
  • the terminal accepts the RRC connection reconfiguration message, it will establish the user plane PDU session for transmitting credentials, and use the user plane PDU session to transmit credentials. If the terminal rejects the RRC connection reconfiguration message, the user plane PDU session for transferring credentials will not be established.
  • a method for transmitting credentials is provided in this embodiment, wherein the method is executed by a terminal, and the method includes:
  • Step 31 receiving the first indication information sent by the base station
  • the first indication information is used to indicate: request to activate or deactivate the user plane security protection operation of the terminal's wireless data bearer DRB; the DRB is at least used to bear the credentials required for the terminal to access the independent non-public network SNPN.
  • the terminal may be, but not limited to, a mobile phone, a tablet computer, a wearable device, a vehicle terminal, a road side unit (RSU, Road Side Unit), a smart home terminal, an industrial sensing device and/or a medical device, etc.
  • a mobile phone a tablet computer
  • a wearable device a vehicle terminal
  • a road side unit RSU, Road Side Unit
  • smart home terminal an industrial sensing device and/or a medical device, etc.
  • the base stations involved in the present disclosure may be various types of base stations, for example, base stations of third-generation mobile communication (3G) networks, base stations of fourth-generation mobile communication (4G) networks, base stations of fifth-generation mobile communication (5G ) network base station or other evolved base stations.
  • the base station may be a base station registered in the network ONN.
  • the user plane security protection operation includes: integrity protection and/or encryption.
  • the user plane security protection operation of the DRB of the terminal may be to perform integrity protection and/or encryption for credentials carried by the DRB required for the terminal to access the SNPN.
  • the RRC connection reconfiguration message carrying the first indication information sent by the base station may be received.
  • the base station may send the RRC connection reconfiguration message to the terminal after the RRC security protection is activated.
  • the RRC connection reconfiguration message is sent to the terminal after RRC encryption and RRC integrity protection are activated.
  • the RRC connection reconfiguration message carrying the first indication information sent by the base station may be received.
  • the first indication information may be sent for a certain DRB.
  • the first indication information may include an indication of user plane integrity protection and/or an indication of user plane encryption.
  • an RRC connection reconfiguration message carrying first indication information sent by the base station is received, where the first indication information indicates that a user plane security protection operation of the DRB of the terminal is requested to be activated.
  • the terminal Based on the first indication information, for each DRB, the terminal will start uplink user plane integrity protection and downlink user plane verification; and/or, based on the first indication information, for each DRB, the terminal will start uplink user plane encryption and downlink user plane User plane decryption.
  • an RRC connection reconfiguration message carrying first indication information sent by the base station is received, where the first indication information indicates that the user plane security protection operation of the DRB of the terminal is requested to be deactivated.
  • the terminal will reject the RRC connection reconfiguration message.
  • the terminal's rejection of the RRC connection reconfiguration message may be: based on the first indication information, for each DRB, the terminal will not start uplink user plane integrity protection and downlink user plane verification; and, based on the first indication information, for each DRB DRB, the terminal will not start uplink user plane encryption and downlink user plane decryption.
  • the integrity protection of the user plane may be integrity protection for credentials carried on the DRB.
  • User plane encryption may be encryption for credentials carried on the DRB. In this way, it can ensure that the certificate is not illegally stolen, and the transmission security of the certificate can be ensured. It should be noted that: the integrity protection of the user plane may also be the integrity protection for other types of data carried on the DRB except credentials. User plane encryption may also be encryption for other types of data other than certificates carried on the DRB, which is not limited here.
  • the terminal after receiving the RRC connection reconfiguration message, the terminal will verify the RRC connection reconfiguration message. In response to unsuccessful verification, the terminal ignores the RRC connection reconfiguration message. In response to successful verification, the terminal performs corresponding operations based on the indication of the first indication information in the RRC connection reconfiguration message.
  • the RRC connection reconfiguration message carrying the first indication information sent by the base station is received; the RRC connection reconfiguration message is verified to obtain a verification result. If the verification result indicates that the verification is successful, it is determined whether to activate the user plane security protection operation of the DRB of the terminal according to the first indication information.
  • the RRC connection reconfiguration message may be rejected in response to the first indication information indicating that the user plane security protection operation of the DRB of the terminal is requested to be deactivated; or, in response to the first indication information indicating that the user plane security protection of the DRB of the terminal is requested to be activated Operation, perform user plane security protection operations.
  • the terminal may send an RRC connection reconfiguration complete message to the base station.
  • the RRC connection reconfiguration complete message is used to indicate that the user plane security protection operation of the DRB of the activated terminal has been completed.
  • the terminal before the base station logging into the network ONN sends the first indication information to the terminal, the terminal sends the second indication information to the base station during the establishment of the RRC connection, wherein the second indication information is used to indicate: established The RRC connection is used for the terminal to log in to the ONN; after receiving the second indication information, the base station will select an access and mobility management function (AMF, Access Control And Mobility Management Function) entity that supports the terminal to log in to the ONN.
  • AMF Access Control And Mobility Management Function
  • the AMF entity is configured with AMF login configuration data; the AMF login configuration data includes: digital data network DNN information used to obtain credentials and/or information that restricts terminals from only requesting to obtain credentials.
  • the base station after the base station selects the AMF entity, when the terminal needs to register with the ONN, it will send a registration request message to the base station.
  • the registration type of the registration request message is set as a predetermined registration type; the predetermined registration type is used to indicate that the registration request message is used to log into the ONN to obtain credentials.
  • the predetermined registration type is a registration type of "login to SNPN".
  • the base station After receiving the registration request message, the base station will send the registration request message to the AMF.
  • the AMF After receiving the registration request message, the AMF will start a procedure for performing identity verification of the terminal to the authentication service function (AUSF, Authentication Server Function) entity in the ONN.
  • the AMF login configuration data may limit the terminal to only request distribution of SNPN credentials on the user plane.
  • starting the PDU session establishment procedure may be sending a first PDU session establishment request message to the base station in the ONN, wherein the first PDU session establishment request message includes digital data network DNN information for obtaining SNPN credentials.
  • the terminal may be pre-configured with DNN information, wherein the providing server providing the SNPN credential is located in the DNN indicated by the DNN information, or the DNN information is provided by the ONN during the login process. terminal.
  • the trigger for the terminal to start the PDU session establishment procedure to retrieve the SNPN credential depends on the terminal, for example, starting the PDU session establishment procedure according to the information input by the user to the terminal.
  • the base station After receiving the first PDU session establishment request message sent by the terminal, the base station will send the first PDU session establishment request message to the AMF.
  • the AMF after the AMF receives the first PDU session establishment request message sent by the base station, it will determine the DNN based on the DNN information in the first PDU session establishment request message and the DNN information in the AMF login configuration data. DNN to determine whether the terminal requests to establish a PDU session for obtaining credentials. In one embodiment, the PDU session establishment request message is rejected in response to a mismatch between the DNN determined based on the DNN information in the first PDU session establishment request message and the DNN determined based on the DNN information in the AMF login configuration data.
  • a session management function (SMF) connected to the DNN is selected.
  • Session Management Function Session Management Function
  • a second PDU session establishment request message after selecting the SMF entity connected to the DNN, a second PDU session establishment request message will be sent to the SMF entity, wherein the second PDU session establishment request message includes the information of the DNN and the PDU created for obtaining credentials Creation instructions for the session.
  • the SMF entity After the SMF entity receives the second PDU session establishment request message, it will configure the security policy information of the PDU session to be created to indicate the first target state according to the creation indication information, wherein the first The target state is the state indicating the security protection of the user plane.
  • the first target state may be a "required" state where security protection needs to be performed on the DRB of the terminal.
  • a third PDU session establishment request message after connecting to the SMF entity of the DNN, a third PDU session establishment request message will be sent to the SMF, wherein the third PDU session establishment request message includes the information of the DNN and does not include the Instructions for creating a PDU session.
  • the SMF entity After the SMF entity receives the third PDU session establishment request message, it will determine the security policy of the PDU session according to the DNN determined based on the DNN information in the third PDU session establishment request message and the DNN determined based on the DNN information configured in the SMF information.
  • the PDU session to be created for obtaining credentials The security policy information is configured to indicate the first target state.
  • the to-be-created The security policy information of the PDU session is configured to indicate the second target state, wherein the first target state is a state indicating user plane security protection.
  • the first indication information sent by the base station is received; wherein, the first indication information is used to indicate: request to activate or deactivate the user plane security protection operation of the wireless data bearer DRB of the terminal; the DRB is at least used for carrying Credentials required for a terminal to access the independent non-public network SNPN.
  • the terminal can activate or deactivate the user plane security protection operation of the DRB of the terminal based on the first indication information, so that the use of DRB transmits the reliability of the SNPN certificate to ensure the security of the certificate transmission.
  • a method for transmitting vouchers is provided in this embodiment, wherein the method is executed by a terminal, and the method includes:
  • Step 41 Receive an RRC connection reconfiguration message carrying first indication information sent by the base station.
  • the RRC connection reconfiguration message carrying the first indication information sent by the base station may be received.
  • the base station may send the RRC connection reconfiguration message to the terminal after the RRC security protection is activated.
  • the RRC connection reconfiguration message is sent to the terminal after RRC encryption and RRC integrity protection are activated.
  • the RRC connection reconfiguration message carrying the first indication information sent by the base station may be received.
  • the first indication information may be sent for a certain DRB.
  • the first indication information may include an indication of user plane integrity protection and/or an indication of user plane encryption.
  • an RRC connection reconfiguration message carrying first indication information sent by the base station is received, where the first indication information indicates that a user plane security protection operation of the DRB of the terminal is requested to be activated.
  • the terminal will start uplink user plane integrity protection and downlink user plane verification for each DRB based on the first indication information; and/or, the terminal will start the uplink user plane for each DRB based on the first indication information.
  • plane encryption and downlink user plane decryption is
  • a method for transmitting vouchers is provided in this embodiment, wherein the method is executed by a terminal, and the method includes:
  • Step 51 verify the RRC connection reconfiguration message, and obtain the verification result.
  • the terminal in response to the unsuccessful verification of the RRC connection reconfiguration message, ignores the RRC connection reconfiguration message. In response to successful verification of the RRC connection reconfiguration message, the terminal determines related operations according to the first indication information in the RRC connection reconfiguration message. Here, if the verification result indicates that the verification is successful, the terminal determines whether to activate the user plane security protection operation of the DRB of the terminal according to the first indication information. In one embodiment, the RRC connection reconfiguration message is rejected in response to the first indication information indicating that the user plane security protection operation of the DRB of the terminal is requested to be deactivated. In another embodiment, the user plane security protection operation is performed in response to the first indication information indicating that activation of the user plane security protection operation of the DRB of the terminal is requested.
  • a method for transmitting credentials is provided in this embodiment, wherein the method is executed by a terminal, and the method includes:
  • Step 61 Responding to the first indication information indicating that the user plane security protection operation of the DRB of the terminal is not activated, rejecting the RRC connection reconfiguration message;
  • the terminal in response to rejecting the RRC connection reconfiguration message, the terminal will not establish a PDU session for credential transmission and will not perform user plane security protection operations.
  • performing the user plane security protection operation may be performing the user plane security protection operation based on the generated user plane integrity protection key K UPint and user plane encryption key K UPenc .
  • this embodiment provides a method for transmitting vouchers, wherein the method is executed by a terminal, and the method includes:
  • Step 71 Send an RRC connection reconfiguration complete message to the base station.
  • the RRC connection reconfiguration message carrying the first indication information sent by the base station is received; the RRC connection reconfiguration message is verified to obtain a verification result. If the verification result indicates that the verification is successful, it is determined whether to activate the user plane security protection operation of the DRB of the terminal according to the first indication information.
  • the RRC connection reconfiguration message may be rejected in response to the first indication information indicating that the user plane security protection operation of the DRB of the terminal is requested to be deactivated; or, in response to the first indication information indicating that the user plane security protection of the DRB of the terminal is requested to be activated Operation, perform user plane security protection operations.
  • the terminal may send an RRC connection reconfiguration complete message to the base station.
  • the RRC connection reconfiguration complete message is used to indicate that the user plane security protection operation of the DRB of the activated terminal has been completed.
  • this embodiment provides a method for transmitting vouchers, wherein the method is executed by a terminal, and the method includes:
  • Step 81 during the establishment of the RRC connection, send second indication information to the base station logging into the ONN network, wherein the second indication information is used to indicate that the established RRC connection is used for the terminal to log into the ONN.
  • the terminal before the base station logging into the network ONN sends the first indication information to the terminal, the terminal sends the second indication information to the base station during the establishment of the RRC connection, wherein the second indication information is used to indicate: established The RRC connection is used for the terminal to log in to the ONN; after receiving the second indication information, the base station will select an access and mobility management function (AMF, Access Control And Mobility Management Function) entity that supports the terminal to log in to the ONN.
  • AMF Access Control And Mobility Management Function
  • the AMF entity is configured with AMF login configuration data; the AMF login configuration data includes: digital data network DNN information used to obtain credentials and/or information that restricts terminals from only requesting to obtain credentials.
  • this embodiment provides a method for transmitting vouchers, wherein the method is executed by a terminal, and the method includes:
  • Step 91 in response to the terminal starting to register with the ONN, sending a registration request message to the base station;
  • the registration type of the registration request message is set as a predetermined registration type; the predetermined registration type is used to indicate that the registration request message is used to log into the ONN to obtain credentials.
  • the base station after the base station selects the AMF entity, when the terminal needs to register with the ONN, it will send a registration request message to the base station.
  • the registration type of the registration request message is set as a predetermined registration type; the predetermined registration type is used to indicate that the registration request message is used to log into the ONN to obtain credentials.
  • the predetermined registration type is a registration type of "login to SNPN".
  • the base station After receiving the registration request message, the base station will send the registration request message to the AMF.
  • the AMF After receiving the registration request message, the AMF will start a procedure for performing identity verification of the terminal to the authentication service function (AUSF, Authentication Server Function) entity in the ONN.
  • the AMF login configuration data may limit the terminal network to only request distribution of SNPN credentials on the user plane.
  • this embodiment provides a method for transmitting vouchers, wherein the method is executed by a terminal, and the method includes:
  • Step 101 In response to the terminal successfully logging into the ONN and needing to receive credentials through the ONN, start the PDU session establishment procedure.
  • starting the PDU session establishment procedure may be sending a first PDU session establishment request message to the base station in the ONN, wherein the first PDU session establishment request message includes digital data network DNN information for obtaining SNPN credentials.
  • the terminal may be pre-configured with DNN information, wherein the providing server providing the SNPN credential is located in the DNN indicated by the DNN information, or the DNN information is provided by the ONN during the login process. terminal.
  • the trigger for the terminal to start the PDU session establishment procedure to retrieve the SNPN credential depends on the terminal, for example, starting the PDU session establishment procedure according to the information input by the user into the terminal.
  • the base station After receiving the first PDU session establishment request message sent by the terminal, the base station will send the first PDU session establishment request message to the AMF.
  • this embodiment provides a method for transmitting vouchers, wherein the method is executed by a terminal, and the method includes:
  • Step 111 Send a first PDU session establishment request message to the base station in the ONN, wherein the first PDU session establishment request message includes digital data network DNN information for obtaining credentials.
  • the base station after receiving the first PDU session establishment request message sent by the terminal, the base station sends the first PDU session establishment request message to the AMF.
  • the AMF After the AMF receives the first PDU session establishment request message sent by the base station, it will determine whether the terminal is Request to establish a PDU session for obtaining credentials.
  • the PDU session establishment request message is rejected in response to a mismatch between the DNN determined based on the DNN information in the first PDU session establishment request message and the DNN determined based on the DNN information in the AMF login configuration data.
  • a session management function entity connected to the DNN is selected in response to the DNN determined based on the DNN information in the first PDU session establishment request message matching the DNN determined based on the DNN information in the AMF login configuration data.
  • this embodiment provides a method for transmitting vouchers, wherein the method is performed by a base station, and the method includes:
  • Step 121 Receive security policy information sent by the second core network device
  • Step 122 sending to the terminal first indication information determined based on the security policy information
  • the first indication information is used to indicate: request to activate or deactivate the user plane security protection operation of the wireless data bearer DRB of the terminal; the DRB is at least used to bear the credential required by the terminal to access the SNPN.
  • the terminal may be, but not limited to, a mobile phone, a tablet computer, a wearable device, a vehicle terminal, a Road Side Unit (RSU, Road Side Unit), a smart home terminal, an industrial sensor device and/or a medical device, etc.
  • a mobile phone a tablet computer
  • a wearable device a vehicle terminal
  • a Road Side Unit Road Side Unit
  • smart home terminal an industrial sensor device and/or a medical device, etc.
  • the base stations involved in the present disclosure may be various types of base stations, for example, base stations of third-generation mobile communication (3G) networks, base stations of fourth-generation mobile communication (4G) networks, base stations of fifth-generation mobile communication (5G ) network base station or other evolved base stations.
  • the base station may be a base station registered in the network ONN.
  • the user plane security protection operation includes: integrity protection and/or encryption.
  • the user plane security protection operation of the DRB of the terminal may be to perform integrity protection and/or encryption for credentials carried by the DRB required for the terminal to access the SNPN.
  • the RRC connection reconfiguration message carrying the first indication information sent by the base station may be received.
  • the base station may send the RRC connection reconfiguration message to the terminal after the RRC security protection is activated.
  • the RRC connection reconfiguration message is sent to the terminal after RRC encryption and RRC integrity protection are activated.
  • the RRC connection reconfiguration message carrying the first indication information sent by the base station may be received.
  • the first indication information may be sent for a certain DRB.
  • the first indication information may include an indication of user plane integrity protection and/or an indication of user plane encryption.
  • an RRC connection reconfiguration message carrying first indication information sent by the base station is received, where the first indication information indicates that a user plane security protection operation of the DRB of the terminal is requested to be activated.
  • the terminal Based on the first indication information, for each DRB, the terminal will start uplink user plane integrity protection and downlink user plane verification; and/or, based on the first indication information for each DRB, the terminal will start uplink user plane encryption and downlink user plane Surface decryption.
  • an RRC connection reconfiguration message carrying first indication information sent by the base station is received, where the first indication information indicates that the user plane security protection operation of the DRB of the terminal is requested to be deactivated.
  • the terminal will reject the RRC connection reconfiguration message.
  • the terminal's rejection of the RRC connection reconfiguration message may be: based on the first indication information, for each DRB, the terminal will not start uplink user plane integrity protection and downlink user plane verification; and, based on the first indication information, for each DRB DRB, the terminal will not start uplink user plane encryption and downlink user plane decryption.
  • the integrity protection of the user plane may be integrity protection for credentials carried on the DRB.
  • User plane encryption may be encryption for credentials carried on the DRB. In this way, it can ensure that the credentials are illegally stolen and the transmission security of the credentials can be ensured. It should be noted that: the integrity protection of the user plane may also be the integrity protection for other types of data carried on the DRB except credentials. User plane encryption may also be encryption for other types of data other than certificates carried on the DRB, which is not limited here.
  • the terminal after receiving the RRC connection reconfiguration message, the terminal will verify the RRC connection reconfiguration message. In response to unsuccessful authentication, the terminal ignores the RRC connection reconfiguration message. In response to successful verification, the terminal performs corresponding operations based on the indication of the first indication information in the RRC connection reconfiguration message.
  • the RRC connection reconfiguration message carrying the first indication information sent by the base station is received; the RRC connection reconfiguration message is verified to obtain a verification result. If the verification result indicates that the verification is successful, it is determined whether to activate the user plane security protection operation of the DRB of the terminal according to the first indication information.
  • the RRC connection reconfiguration message may be rejected in response to the first indication information indicating that the user plane security protection operation of the DRB of the terminal is requested to be deactivated; or, in response to the first indication information indicating that the user plane security protection of the DRB of the terminal is requested to be activated Operation, perform user plane security protection operations.
  • the terminal may send an RRC connection reconfiguration complete message to the base station.
  • the RRC connection reconfiguration complete message is used to indicate that the user plane security protection operation of the DRB of the activated terminal has been completed.
  • the terminal before the base station logging into the network ONN sends the first indication information to the terminal, the terminal sends the second indication information to the base station during the establishment of the RRC connection, wherein the second indication information is used to indicate: established The RRC connection is used for the terminal to log in to the ONN; after receiving the second indication information, the base station will select an access and mobility management function (AMF, Access Control And Mobility Management Function) entity that supports the terminal to log in to the ONN.
  • AMF Access Control And Mobility Management Function
  • the AMF entity is configured with AMF login configuration data; the AMF login configuration data includes: digital data network DNN information used to obtain credentials and/or information that restricts terminals from only requesting to obtain credentials.
  • the base station after the base station selects the AMF entity, when the terminal needs to register with the ONN, it will send a registration request message to the base station.
  • the registration type of the registration request message is set as a predetermined registration type; the predetermined registration type is used to indicate that the registration request message is used to log into the ONN to obtain credentials.
  • the predetermined registration type is a registration type of "login to SNPN".
  • the base station After receiving the registration request message, the base station will send the registration request message to the AMF.
  • the AMF After receiving the registration request message, the AMF will start a procedure for performing identity verification of the terminal to the authentication service function (AUSF, Authentication Server Function) entity in the ONN.
  • the AMF login configuration data may limit the terminal network to only request distribution of SNPN credentials on the user plane.
  • starting the PDU session establishment procedure may be sending a first PDU session establishment request message to the base station in the ONN, wherein the first PDU session establishment request message includes digital data network DNN information for obtaining SNPN credentials.
  • the terminal may be pre-configured with DNN information, wherein the providing server providing the SNPN credential is located in the DNN indicated by the DNN information, or the DNN information is provided by the ONN during the login process. terminal.
  • the trigger for the terminal to start the PDU session establishment procedure to retrieve the SNPN credential depends on the terminal, for example, starting the PDU session establishment procedure according to the information input by the user into the terminal.
  • the base station After receiving the first PDU session establishment request message sent by the terminal, the base station will send the first PDU session establishment request message to the AMF.
  • the AMF after the AMF receives the first PDU session establishment request message sent by the base station, it will determine the DNN based on the DNN information in the first PDU session establishment request message and the DNN information in the AMF login configuration data. DNN to determine whether the terminal requests to establish a PDU session for obtaining credentials. In one embodiment, the PDU session establishment request message is rejected in response to a mismatch between the DNN determined based on the DNN information in the first PDU session establishment request message and the DNN determined based on the DNN information in the AMF login configuration data.
  • a session management function (SMF) connected to the DNN is selected.
  • Session Management Function Session Management Function
  • a second PDU session establishment request message after selecting the SMF entity connected to the DNN, a second PDU session establishment request message will be sent to the SMF entity, wherein the second PDU session establishment request message includes the information of the DNN and the PDU created for obtaining credentials Creation instructions for the session.
  • the SMF entity After the SMF entity receives the second PDU session establishment request message, it will configure the security policy information of the PDU session to be created to indicate the first target state according to the creation indication information, wherein the first The target state is the state indicating the security protection of the user plane.
  • the first target state may be a "required" state where security protection needs to be performed on the DRB of the terminal.
  • a third PDU session establishment request message after connecting to the SMF entity of the DNN, a third PDU session establishment request message will be sent to the SMF, wherein the third PDU session establishment request message includes the information of the DNN and does not include the Instructions for creating a PDU session.
  • the SMF entity After the SMF entity receives the third PDU session establishment request message, it will determine the security policy of the PDU session according to the DNN determined based on the DNN information in the third PDU session establishment request message and the DNN determined based on the DNN information configured in the SMF information.
  • the PDU session to be created for obtaining credentials The security policy information is configured to indicate the first target state.
  • the to-be-created The security policy information of the PDU session is configured to indicate the second target state, wherein the first target state is a state indicating user plane security protection.
  • this embodiment provides a method for transmitting vouchers, wherein the method is performed by a base station, and the method includes:
  • Step 131 Send an RRC connection reconfiguration message carrying the first indication information to the terminal.
  • an RRC connection reconfiguration message carrying the first indication information may be sent to the terminal.
  • the base station may send the RRC connection reconfiguration message to the terminal after the RRC security protection is activated.
  • the RRC connection reconfiguration message is sent to the terminal after RRC encryption and RRC integrity protection are activated.
  • an RRC connection reconfiguration message carrying the first indication information may be sent to the terminal.
  • the first indication information may be sent for a certain DRB.
  • the first indication information may include an indication of user plane integrity protection and/or an indication of user plane encryption.
  • an RRC connection reconfiguration message carrying first indication information is sent to the terminal, where the first indication information indicates that a user plane security protection operation of the DRB of the terminal is requested to be activated.
  • the terminal will start uplink user plane integrity protection and downlink user plane verification for each DRB based on the first indication information; and/or, the terminal will start the uplink user plane for each DRB based on the first indication information.
  • plane encryption and downlink user plane decryption is
  • this embodiment provides a method for transmitting vouchers, wherein the method is performed by a base station, and the method includes:
  • Step 141 In response to sending an RRC connection reconfiguration message to the terminal, start the user plane security protection operation of the DRB of the base station.
  • the integrity protection of the user plane may be integrity protection for credentials carried on the DRB.
  • User plane encryption may be encryption for credentials carried on the DRB. In this way, it can ensure that the credentials are illegally stolen and the transmission security of the credentials can be ensured. It should be noted that: the integrity protection of the user plane may also be the integrity protection for other types of data carried on the DRB except credentials. User plane encryption may also be encryption for other types of data other than certificates carried on the DRB, which is not limited here.
  • this embodiment provides a method for transmitting vouchers, wherein the method is performed by a base station, and the method includes:
  • Step 151 Receive second indication information sent by the terminal during the establishment of the RRC connection, wherein the second indication information is used to indicate that the established RRC connection is used for the terminal to log into the ONN.
  • the terminal before the base station logging into the network ONN sends the first indication information to the terminal, the terminal sends the second indication information to the base station during the establishment of the RRC connection, wherein the second indication information is used to indicate: established The RRC connection is used for the terminal to log in to the ONN; after receiving the second indication information, the base station will select an access and mobility management function (AMF, Access Control And Mobility Management Function) entity that supports the terminal to log in to the ONN.
  • AMF Access Control And Mobility Management Function
  • the AMF entity is configured with AMF login configuration data; the AMF login configuration data includes: digital data network DNN information used to obtain credentials and/or information that restricts terminals from only requesting to obtain credentials.
  • this embodiment provides a method for transmitting vouchers, wherein the method is performed by a base station, and the method includes:
  • Step 161 in response to receiving the second indication information, determine the first core network device used to support the terminal to log into the ONN;
  • the first core network device is configured with AMF login configuration data;
  • the AMF login configuration data includes: digital data network DNN information used to obtain credentials and/or information that restricts terminals from only requesting to obtain credentials.
  • the first core network device may be an AMF.
  • the base station after receiving the registration request message, the base station sends the registration request message to the AMF.
  • the AMF After receiving the registration request message, the AMF will start the procedure of terminal identity verification to the AUSF entity in the ONN.
  • the AMF login configuration data may indicate that the terminal network is only used for allocation or issuance of the user plane SNPN credential.
  • this embodiment provides a method for transmitting vouchers, wherein the method is performed by a base station, and the method includes:
  • Step 171 receiving the registration request message sent by the terminal
  • the registration type of the registration request message is set as a predetermined registration type; the predetermined registration type is used to indicate that the registration request message is used to log into the ONN to obtain credentials.
  • the base station after the base station selects the AMF entity, when the terminal needs to register with the ONN, it will send a registration request message to the base station.
  • the registration type of the registration request message is set as a predetermined registration type; the predetermined registration type is used to indicate that the registration request message is used to log into the ONN to obtain credentials.
  • the predetermined registration type is a registration type of "login to SNPN".
  • the base station also sends the registration request message to the session management function AMF.
  • this embodiment provides a method for transmitting vouchers, wherein the method is performed by a base station, and the method includes:
  • Step 181 Receive the first PDU session establishment request message sent by the terminal, wherein the first PDU session establishment request message includes DNN information for obtaining credentials.
  • starting the PDU session establishment procedure may be sending a first PDU session establishment request message to the base station in the ONN, wherein the first PDU session establishment request message includes digital data network DNN information for obtaining credentials.
  • the terminal may be pre-configured with DNN information, wherein the providing server providing the SNPN credential is located in the DNN indicated by the DNN information, or the DNN information is provided by the ONN during the login process. terminal.
  • the trigger for the terminal to start the PDU session establishment procedure to retrieve the SNPN credential depends on the terminal, for example, starting the PDU session establishment procedure according to the information input by the user to the terminal.
  • the base station After receiving the first PDU session establishment request message sent by the terminal, the base station will send the first PDU session establishment request message to the AMF.
  • the base station will also send the first PDU session establishment request message to the AMF.
  • this embodiment provides a method for transmitting credentials, wherein the method is executed by a first core network device, and the method includes:
  • Step 191 receiving the registration request message sent by the base station
  • the registration type of the registration request message is set as a predetermined registration type; the predetermined registration type is used to indicate that the registration request message is used for the terminal to log into the ONN to obtain credentials required for logging into the SNPN.
  • the first core network device may be an AMF entity.
  • the AMF after receiving the registration request message, the AMF will start a procedure of verifying the identity of the terminal to the authentication service functional entity in the ONN.
  • the AMF login configuration data may limit the terminal network to only request distribution of SNPN credentials on the user plane.
  • this embodiment provides a method for transmitting credentials, wherein the method is performed by the first core network device, and the method includes:
  • Step 201 Receive a first PDU session establishment request message sent by a base station, wherein the first PDU session establishment request message includes DNN information for obtaining an SNPN credential.
  • the first core network device may be an AMF entity.
  • starting the PDU session establishment procedure may be sending a first PDU session establishment request message to the base station in the ONN, wherein the first PDU session establishment request message includes digital data network DNN information for obtaining credentials.
  • the terminal may be pre-configured with DNN information, wherein the providing server providing the SNPN credential is located in the DNN indicated by the DNN information, or the DNN information is provided by the ONN during the login process. terminal.
  • the trigger for the terminal to start the PDU session establishment procedure to retrieve the SNPN credential depends on the terminal, for example, starting the PDU session establishment procedure according to the information input by the user to the terminal.
  • the base station After receiving the first PDU session establishment request message sent by the terminal, the base station will send the first PDU session establishment request message to the AMF.
  • this embodiment provides a method for transmitting credentials, wherein the method is executed by the first core network device, and the method includes:
  • Step 211 according to the DNN determined based on the DNN information in the first PDU session establishment request message and the DNN determined based on the DNN information in the AMF login configuration data, determine whether the terminal requests to establish a PDU session for obtaining credentials.
  • the first core network device may be an AMF entity.
  • the PDU session establishment request message in response to a mismatch between the DNN determined based on the DNN information in the first PDU session establishment request message and the DNN determined based on the DNN information in the AMF login configuration data, is rejected; or, in response to The DNN determined based on the DNN information in the first PDU session establishment request message matches the DNN determined based on the DNN information in the AMF login configuration data, and determines the session management function SMF entity connected to the DNN.
  • this embodiment provides a method for transmitting credentials, wherein the method is performed by a first core network device, and the method includes:
  • Step 221 in response to a mismatch between the DNN determined based on the DNN information in the first PDU session establishment request message and the DNN determined based on the DNN information in the AMF login configuration data, rejecting the PDU session establishment request message;
  • the first core network device may be an AMF entity; here, the second core network device may be an SMF entity.
  • rejecting the PDU session establishment request message may be not performing other operations in response to the PDU session establishment request message.
  • this embodiment provides a method for transmitting credentials, wherein the method is executed by a first core network device, and the method includes:
  • Step 231 In response to determining the second core network device, send a second PDU session establishment request message to the second core network device, wherein the second PDU session establishment request message includes the information of the DNN and the Instructions for creating a PDU session for credentials.
  • the first core network device may be an AMF entity; the second core network device may be an SMF.
  • a second PDU session establishment request message after selecting the SMF entity connected to the DNN, a second PDU session establishment request message will be sent to the SMF entity, wherein the second PDU session establishment request message includes the information of the DNN and the PDU created for obtaining credentials Creation instructions for the session.
  • the SMF entity After the SMF entity receives the second PDU session establishment request message, it will configure the security policy information of the PDU session to be created to indicate the first target state according to the creation indication information, wherein the first The target state is the state indicating the security protection of the user plane.
  • the first target state may be a "required" state where security protection needs to be performed on the DRB of the terminal.
  • this embodiment provides a method for transmitting credentials, wherein the method is performed by a first core network device, and the method includes:
  • Step 241 In response to determining the second core network device, send a third PDU session establishment request message to the second core network device, wherein the third PDU session establishment request message includes DNN information and does not include the PDU created for obtaining credentials Creation instructions for the session.
  • the first core network device may be an AMF entity; the second core network device may be an SMF,
  • a third PDU session establishment request message after connecting to the SMF entity of the DNN, a third PDU session establishment request message will be sent to the SMF, wherein the third PDU session establishment request message includes the information of the DNN and does not include the PDU created for obtaining credentials. Creation instructions for the session.
  • the SMF entity After the SMF entity receives the third PDU session establishment request message, it will determine the security policy of the PDU session according to the DNN determined based on the DNN information in the third PDU session establishment request message and the DNN determined based on the DNN information configured in the SMF information.
  • the PDU session to be created for obtaining credentials The security policy information is configured to indicate the first target state.
  • the to-be-created The security policy information of the PDU session is configured to indicate the second target state, wherein the first target state is a state indicating user plane security protection.
  • this embodiment provides a method for transmitting credentials, wherein the method is performed by a second core network device, and the method includes:
  • Step 251 Receive a PDU session establishment request message sent by the first core network device, wherein the PDU session establishment request message includes at least DNN information, wherein the DNN information is used to indicate the credentials required for obtaining the terminal access to the SNPN DNN;
  • Step 252 Determine the security policy information of the PDU session according to the session establishment request message
  • Step 253 Send the security policy information to the base station.
  • the second core network device may be an SMF entity; the first core network device may be an AMF entity.
  • the PDU session establishment request message may be the second PDU session establishment request message or the third PDU session establishment request message.
  • the second PDU session establishment request message includes the information of the DNN and creation instruction information for creating a PDU session for obtaining credentials.
  • the third PDU session establishment request message includes the information of the DNN and does not include creation instruction information for creating a PDU session for obtaining credentials.
  • this embodiment provides a method for transmitting credentials, wherein the method is performed by a second core network device, and the method includes:
  • Step 261. configure the security policy information of the PDU session to be created for obtaining credentials to indicate a first target state, wherein the first target state is a state indicating user plane security protection.
  • the second core network device may be an SMF entity.
  • the SMF entity After the SMF entity receives the second PDU session establishment request message, it will configure the security policy information of the PDU session to be created to indicate the first target state according to the creation indication information, wherein the first The target state is the state indicating the security protection of the user plane.
  • the first target state may be a "required" state where security protection needs to be performed on the DRB of the terminal.
  • this embodiment provides a method for transmitting credentials, wherein the method is executed by a second core network device, and the method includes:
  • Step 271 Determine the security policy information of the PDU session according to the DNN determined based on the DNN information in the third PDU session establishment request message and the DNN determined based on the DNN information configured in the second core network device.
  • the second core network device may be an SMF entity.
  • the SMF entity After the SMF entity receives the third PDU session establishment request message, it will determine the security policy of the PDU session according to the DNN determined based on the DNN information in the third PDU session establishment request message and the DNN determined based on the DNN information configured in the SMF information.
  • the PDU session in response to the DNN determined based on the DNN information in the third PDU session establishment request message matching the DNN determined based on the DNN information configured in the SMF, the PDU session to be created for obtaining credentials
  • the security policy information is configured to indicate the first target state.
  • the to-be-created The security policy information of the PDU session is configured to indicate the second target state, wherein the first target state is a state indicating user plane security protection.
  • this embodiment provides a method for transmitting credentials, wherein the method is performed by a second core network device, and the method includes:
  • Step 281 In response to the DNN determined based on the DNN information in the third PDU session establishment request message matching the DNN determined based on the DNN information configured in the second core network device, set the PDU session to be created for obtaining credentials
  • the security policy information is configured to indicate the first target state
  • the security policy information of the PDU session In response to a mismatch between the DNN determined based on the DNN information in the third PDU session establishment request message and the DNN determined based on the DNN information configured in the second core network device, the security policy information of the PDU session to be created for obtaining credentials It is configured to indicate a second target state, where the first target state is a state indicating user plane security protection.
  • the second core network device may be an SMF entity.
  • the DNN indicated by the DNN information in the third PDU session establishment request message is the same as the DNN indicated by the DNN information configured in the SMF, and it is determined that the DNN matches.
  • the DNN indicated by the DNN information in the third PDU session establishment request message is different from the DNN indicated by the DNN information configured in the SMF, and it is determined that the DNNs do not match.
  • the second target state is a state in which the user plane security policy information determined by the SMF according to the requested specific service is set to indicate a state corresponding to a specific option, and may be a state in which user plane security protection is required or not required.
  • this embodiment provides a device for transmitting vouchers, wherein the device includes:
  • a receiving module 291, configured to receive first indication information sent by the base station
  • the first indication information is used to indicate: request to activate or deactivate the user plane security protection operation of the terminal's wireless data bearer DRB; the DRB is at least used to bear the credential required by the terminal to access the SNPN.
  • this embodiment provides a device for transmitting vouchers, wherein the device includes:
  • a receiving module 301 configured to receive security policy information sent by the second core network device
  • a sending module 302 configured to send to the terminal first indication information determined based on the security policy information
  • the first indication information is used to indicate: request to activate or deactivate the user plane security protection operation of the terminal's wireless data bearer DRB; the DRB is at least used to bear the credential required by the terminal to access the SNPN.
  • this embodiment provides a device for transmitting vouchers, wherein the device includes:
  • the registration type of the registration request message is set as a predetermined registration type; the predetermined registration type is used to indicate that the registration request message is used for the terminal to log into the ONN to obtain the credentials required for the terminal to access the SNPN.
  • this embodiment provides a device for transmitting vouchers, wherein the device includes:
  • the receiving module 321 is configured to receive a PDU session establishment request message sent by the first core network device, wherein the PDU session establishment request message includes at least DNN information, wherein the DNN information is used to indicate the information required to obtain the terminal to access the SNPN.
  • the DNN of the credential is configured to indicate the information required to obtain the terminal to access the SNPN.
  • the sending module 323 is configured to send the security policy information to the base station.
  • An embodiment of the present disclosure provides a communication device, which includes:
  • memory for storing processor-executable instructions
  • the processor is configured to implement the method applied to any embodiment of the present disclosure when executing the executable instructions.
  • the processor may include various types of storage media, which are non-transitory computer storage media, and can continue to memorize and store information thereon after the communication device is powered off.
  • the processor can be connected to the memory through a bus or the like, and is used to read the executable program stored in the memory.
  • An embodiment of the present disclosure further provides a computer storage medium, wherein the computer storage medium stores a computer executable program, and when the executable program is executed by a processor, the method of any embodiment of the present disclosure is implemented.
  • an embodiment of the present disclosure provides a structure of a terminal.
  • this embodiment provides a terminal 800, which specifically can be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc. .
  • the terminal 800 may include one or more of the following components: a processing component 802, a memory 804, a power supply component 806, a multimedia component 808, an audio component 810, an input/output (I/O) interface 812, a sensor component 814, and communication component 816 .
  • the processing component 802 generally controls the overall operations of the terminal 800, such as operations associated with display, telephone calls, data communications, camera operations, and recording operations.
  • the processing component 802 may include one or more processors 820 to execute instructions to complete all or part of the steps of the above method. Additionally, processing component 802 may include one or more modules that facilitate interaction between processing component 802 and other components. For example, processing component 802 may include a multimedia module to facilitate interaction between multimedia component 808 and processing component 802 .
  • the memory 804 is configured to store various types of data to support operations at the device 800 . Examples of such data include instructions for any application or method operating on the terminal 800, contact data, phonebook data, messages, pictures, videos, etc.
  • the memory 804 can be implemented by any type of volatile or non-volatile storage device or their combination, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Magnetic Memory, Flash Memory, Magnetic or Optical Disk.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read-only memory
  • EPROM erasable Programmable Read Only Memory
  • PROM Programmable Read Only Memory
  • ROM Read Only Memory
  • Magnetic Memory Flash Memory
  • Magnetic or Optical Disk Magnetic Disk
  • the power supply component 806 provides power to various components of the terminal 800 .
  • Power components 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for terminal 800 .
  • the multimedia component 808 includes a screen providing an output interface between the terminal 800 and the user.
  • the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user.
  • the touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensor may not only sense a boundary of a touch or a swipe action, but also detect duration and pressure associated with the touch or swipe operation.
  • the multimedia component 808 includes a front camera and/or a rear camera. When the device 800 is in an operation mode, such as a shooting mode or a video mode, the front camera and/or the rear camera can receive external multimedia data. Each front camera and rear camera can be a fixed optical lens system or have focal length and optical zoom capability.
  • the audio component 810 is configured to output and/or input audio signals.
  • the audio component 810 includes a microphone (MIC), which is configured to receive an external audio signal when the terminal 800 is in an operation mode, such as a call mode, a recording mode and a voice recognition mode. Received audio signals may be further stored in memory 804 or sent via communication component 816 .
  • the audio component 810 also includes a speaker for outputting audio signals.
  • the I/O interface 812 provides an interface between the processing component 802 and a peripheral interface module, which may be a keyboard, a click wheel, a button, and the like. These buttons may include, but are not limited to: a home button, volume buttons, start button, and lock button.
  • the sensor component 814 includes one or more sensors for providing various aspects of a state assessment of the terminal 800 .
  • the sensor component 814 can detect the open/closed state of the device 800, the relative positioning of components, such as the display and the keypad of the terminal 800, the sensor component 814 can also detect the terminal 800 or a change in the position of a component of the terminal 800, and the user The presence or absence of contact with the terminal 800, the terminal 800 orientation or acceleration/deceleration and the temperature change of the terminal 800.
  • Sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects in the absence of any physical contact.
  • Sensor assembly 814 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications.
  • the sensor component 814 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor or a temperature sensor.
  • the communication component 816 is configured to facilitate wired or wireless communication between the terminal 800 and other devices.
  • the terminal 800 can access a wireless network based on communication standards, such as Wi-Fi, 2G or 3G, or a combination thereof.
  • the communication component 816 receives broadcast signals or broadcast related information from an external broadcast management system via a broadcast channel.
  • the communication component 816 also includes a near field communication (NFC) module to facilitate short-range communication.
  • NFC near field communication
  • the NFC module may be implemented based on Radio Frequency Identification (RFID) technology, Infrared Data Association (IrDA) technology, Ultra Wide Band (UWB) technology, Bluetooth (BT) technology and other technologies.
  • RFID Radio Frequency Identification
  • IrDA Infrared Data Association
  • UWB Ultra Wide Band
  • Bluetooth Bluetooth
  • terminal 800 may be programmed by one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable A gate array (FPGA), controller, microcontroller, microprocessor or other electronic component implementation for performing the methods described above.
  • ASICs application specific integrated circuits
  • DSPs digital signal processors
  • DSPDs digital signal processing devices
  • PLDs programmable logic devices
  • FPGA field programmable A gate array
  • controller microcontroller, microprocessor or other electronic component implementation for performing the methods described above.
  • non-transitory computer-readable storage medium including instructions, such as the memory 804 including instructions, which can be executed by the processor 820 of the terminal 800 to complete the above method.
  • the non-transitory computer readable storage medium may be ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, optical data storage device, and the like.
  • an embodiment of the present disclosure shows a structure of a base station.
  • the base station 900 may be provided as a network side device.
  • base station 900 includes processing component 922 , which further includes one or more processors, and a memory resource represented by memory 932 for storing instructions executable by processing component 922 , such as application programs.
  • the application program stored in memory 932 may include one or more modules each corresponding to a set of instructions.
  • the processing component 922 is configured to execute instructions, so as to perform any of the aforementioned methods applied to the base station.
  • Base station 900 may also include a power component 926 configured to perform power management of base station 900, a wired or wireless network interface 950 configured to connect base station 900 to a network, and an input-output (I/O) interface 958.
  • the base station 900 can operate based on an operating system stored in the memory 932, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM or similar.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本公开实施例提供了一种传输凭证的方法，其中，该方法由终端执行，该方法包括：接收基站发送的第一指示信息；其中，第一指示信息，用于指示：请求激活或者不激活终端的无线数据承载DRB的用户面安全保护操作；DRB至少用于承载终端接入独立非公共网络SNPN所需的凭证。

Description

传输凭证的方法、装置、通信设备及存储介质 技术领域
本公开涉及无线通信技术领域但不限于无线通信技术领域，尤其涉及一种传输凭证的方法、装置、通信设备及存储介质。
背景技术
为了增强对终端接入非公共网络(NPN，Non-Public Networks)的支持，需要向终端提供独立组网的非公共网络(SNPN，Stand-alone NPN)凭证。该凭证用于主认证，以使得终端在认证通过后能够访问期望的SNPN。这里，在向终端提供凭证之前应该允许终端接入登录网络。凭证与在用户面传输的普通用户服务流不同，凭证是高度敏感的数据，需要对凭证进行安全保护。否则，终端将无法通过身份验证以访问所期望的SNPN或者可能会被欺骗至接入恶意的SNPN。相关技术中，为了确保凭证传输的安全，需要引入确保凭证传输安全的保护机制。
发明内容
本公开实施例公开了一种传输凭证的方法、装置、通信设备及存储介质。
根据本公开实施例的第一方面，提供一种传输凭证的方法，其中，所述方法由终端执行，所述方法包括：
接收基站发送的第一指示信息；
其中，所述第一指示信息，用于指示：请求激活或者不激活所述终端的无线数据承载DRB的用户面安全保护操作；所述DRB至少用于承载所述终端接入独立非公共网络SNPN所需的凭证。
根据本公开实施例的第二方面，提供一种传输凭证的方法，其中，所述方法由基站执行，所述方法包括：
向终端发送第一指示信息；
其中，所述第一指示信息，用于指示：请求激活或者不激活所述终端的无线数据承载DRB的用户面安全保护操作；所述DRB至少用于承载所述终端接入SNPN所需的凭证。
根据本公开实施例的第三方面，提供一种传输凭证的方法，其中，所述方法由第一核心网设备执行，所述方法包括：
接收基站发送的注册请求消息；
其中，所述注册请求消息的注册类型被设置为预定注册类型；所述预定注册类型，用于指示所述注册请求消息用于终端登录所述ONN以获取所述终端接入SNPN所需的凭证。
根据本公开实施例的第四方面，提供一种传输凭证的方法，其中，所述方法由第二核心网设备执行，所述方法包括：
接收第一核心网设备发送的PDU会话建立请求消息；
其中，所述PDU会话建立请求消息，至少包括DNN的信息，其中，所述DNN的信息，用于指示获取终端接入SNPN所需的凭证的DNN。
根据本公开实施例的第五方面，提供一种传输凭证的装置，其中，所述装置包括：
接收模块，用于接收基站发送的第一指示信息；
其中，所述第一指示信息，用于指示：请求激活或者不激活所述终端的无线数据承载DRB的用户面安全保护操作；所述DRB至少用于承载终端接入SNPN所需的凭证。
根据本公开实施例的第六方面，提供一种传输凭证的装置，其中，所述装置包括：
发送模块，用于向终端发送第一指示信息；
其中，所述第一指示信息，用于指示：请求激活或者不激活所述终端的无线数据承载DRB的用户面安全保护操作；所述DRB至少用于承载所述终端接入SNPN所需的凭证。
根据本公开实施例的第七方面，提供一种传输凭证的装置，其中，所述装置包括：
接收模块，用于接收基站发送的注册请求消息；
其中，所述注册请求消息的注册类型被设置为预定注册类型；所述预定注册类型，用于指示所述注册请求消息用于终端登录ONN以获取所述终端接入SNPN所需的凭证。
根据本公开实施例的第八方面，提供一种传输凭证的装置，其中，所述装置包括：
接收模块，用于接收第一核心网设备发送的PDU会话建立请求消息；
其中，所述PDU会话建立请求消息，至少包括DNN的信息，其中，所述DNN的信息，用于指示获取终端接入SNPN所需的凭证的DNN。
根据本公开实施例的第九方面，提供一种通信设备，所述通信设备，包括：
处理器；
用于存储所述处理器可执行指令的存储器；
其中，所述处理器被配置为：用于运行所述可执行指令时，实现本公开任意实施例所述的方法。
根据本公开实施例的第十方面，提供一种计算机存储介质，所述计算机存储介质存储有计算机可执行程序，所述可执行程序被处理器执行时实现本公开任意实施例所述的方法。
在本公开实施例中，接收基站发送的第一指示信息；其中，所述第一指示信息，用于指示：请求激活或者不激活所述终端的无线数据承载DRB的用户面安全保护操作；所述DRB至少用于承载所述终端接入独立非公共网络SNPN所需的凭证。这里，终端在接收到基站发送的第一指示信息后，就可以基于所述第一指示信息激活所述终端的DRB的用户面安全保护操作或者不激活所述终端的DRB的用户面安全保护操作，如此，可以提升利用所述DRB传输SNPN的凭证的可靠性，确保凭证的传输安全。
附图说明
图1是根据一示例性实施例示出的一种无线通信系统的结构示意图。
图2是根据一示例性实施例示出的一种网络架构的示意图。
图3是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图4是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图5是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图6是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图7是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图8是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图9是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图10是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图11是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图12是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图13是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图14是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图15是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图16是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图17是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图18是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图19是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图20是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图21是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图22是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图23是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图24是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图25是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图26是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图27是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图28是根据一示例性实施例示出的一种传输凭证方法的流程示意图。
图29是根据一示例性实施例示出的一种传输凭证装置的示意图。
图30是根据一示例性实施例示出的一种传输凭证装置的示意图。
图31是根据一示例性实施例示出的一种传输凭证装置的示意图。
图32是根据一示例性实施例示出的一种传输凭证装置的示意图。
图33是根据一示例性实施例示出的一种终端的结构示意图。
图34是根据一示例性实施例示出的一种基站的框图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有 表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本公开实施例相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本公开实施例的一些方面相一致的装置和方法的例子。
在本公开实施例使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本公开实施例。在本公开实施例和所附权利要求书中所使用的单数形式的“一种”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本公开实施例可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本公开实施例范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
出于简洁和便于理解的目的，本文在表征大小关系时，所使用的术语为“大于”或“小于”。但对于本领域技术人员来说，可以理解：术语“大于”也涵盖了“大于等于”的含义，“小于”也涵盖了“小于等于”的含义。
请参考图1，其示出了本公开实施例提供的一种无线通信系统的结构示意图。如图1所示，无线通信系统是基于移动通信技术的通信系统，该无线通信系统可以包括：若干个用户设备110以及若干个基站120。
其中，用户设备110可以是指向用户提供语音和/或数据连通性的设备。用户设备110可以经无线接入网(Radio Access Network，RAN)与一个或多个核心网进行通信，用户设备110可以是物联网用户设备，如传感器设备、移动电话和具有物联网用户设备的计算机，例如，可以是固定式、便携式、袖珍式、手持式、计算机内置的或者车载的装置。例如，站(Station，STA)、订户单元(subscriber unit)、订户站(subscriber station)，移动站(mobile station)、移动台(mobile)、远程站(remote station)、接入点、远程用户设备(remote terminal)、接入用户设备(access terminal)、用户装置(user terminal)、用户代理(user agent)、用户设备(user device)、或用户设备(user equipment)。或者，用户设备110也可以是无人飞行器的设备。或者，用户设备110也可以是车载设备，比如，可以是具有无线通信功能的行车电脑，或者是外接行车电脑的无线用户设备。或者，用户设备110也可以是路边设备，比如，可以是具有无线通信功能的路灯、信号灯或者其它路边设备等。
基站120可以是无线通信系统中的网络侧设备。其中，该无线通信系统可以是第四代移动通信技术(the 4th generation mobile communication，4G)系统，又称长期演进(Long Term Evolution，LTE)系统；或者，该无线通信系统也可以是5G系统，又称新空口系统或5G NR系统。或者，该无线通信系统也可以是5G系统的再下一代系统。其中，5G系统中的接入网可以称为NG-RAN(New Generation-Radio Access Network，新一代无线接入网)。
其中，基站120可以是4G系统中采用的演进型基站(eNB)。或者，基站120也可以是5G系统中采用集中分布式架构的基站(gNB)。当基站120采用集中分布式架构时，通常包括集中单元(central unit，CU)和至少两个分布单元(distributed unit，DU)。集中单元中设置有分组数据汇聚协议(Packet Data  Convergence Protocol，PDCP)层、无线链路层控制协议(Radio Link Control，RLC)层、媒体访问控制(Media Access Control，MAC)层的协议栈；分布单元中设置有物理(Physical，PHY)层协议栈，本公开实施例对基站120的具体实现方式不加以限定。
基站120和用户设备110之间可以通过无线空口建立无线连接。在不同的实施方式中，该无线空口是基于第四代移动通信网络技术(4G)标准的无线空口；或者，该无线空口是基于第五代移动通信网络技术(5G)标准的无线空口，比如该无线空口是新空口；或者，该无线空口也可以是基于5G的更下一代移动通信网络技术标准的无线空口。
在一些实施例中，用户设备110之间还可以建立E2E(End to End，端到端)连接。比如车联网通信(vehicle to everything，V2X)中的V2V(vehicle to vehicle，车对车)通信、V2I(vehicle to Infrastructure，车对路边设备)通信和V2P(vehicle to pedestrian，车对人)通信等场景。
这里，上述用户设备可认为是下面实施例的终端设备。
在一些实施例中，上述无线通信系统还可以包含网络管理设备130。
若干个基站120分别与网络管理设备130相连。其中，网络管理设备130可以是无线通信系统中的核心网设备，比如，该网络管理设备130可以是演进的数据分组核心网(Evolved Packet Core，EPC)中的移动性管理实体(Mobility Management Entity，MME)。或者，该网络管理设备也可以是其它的核心网设备，比如服务网关(Serving GateWay，SGW)、公用数据网网关(Public Data Network GateWay，PGW)、策略与计费规则功能单元(Policy and Charging Rules Function，PCRF)或者归属签约用户服务器(Home Subscriber Server，HSS)等。对于网络管理设备130的实现形态，本公开实施例不做限定。
为了便于本领域内技术人员理解，本公开实施例列举了多个实施方式以对本公开实施例的技术方案进行清晰地说明。当然，本领域内技术人员可以理解，本公开实施例提供的多个实施例，可以被单独执行，也可以与本公开实施例中其他实施例的方法结合后一起被执行，还可以单独或结合后与其他相关技术中的一些方法一起被执行；本公开实施例并不对此作出限定。
为了更好地理解本公开实施例公开的技术方案，对凭证提供的应用场景进行说明：
请参见图2，本实施例中示出了一种网络架构，基于该网络架构，终端可以首先登录网络。凭证分发服务器就可以通过用户面连接预配置凭证给终端。
在一个实施例中，登录网络(ONN，Onboarding Network)中的终端和基站都支持接入层安全，在终端成功上线后保护Uu接口。但是，在Uu接口上不强制激活用户面连接安全保护，这导致在通过用户面连接进行远程配置凭证期间将凭证暴露给威胁的风险。
在一个实施例中，Uu接口的用户面连接安全是基于核心网发送的安全策略信息激活的，由统一数据管理(UDM，Unified Data Management)或者会话管理功能(SMF，Session Management Function)根据终端请求的特定服务设置。SMF在协议数据单元(PDU，Protocol Data Unit)会话建立时基于以下信息确定PDU会话的用户面安全执行信息：
签阅的用户面安全策略信息，是从UDM接收到的签阅信息的一部分；
在UDM不提供用户面安全策略信息时，使用SMF中本地配置的用户面安全策略信息。
在一个实施例中，用户面安全策略信息指示是否应在Uu接口为属于该PDU会话的所有数据无线承载(DRB，Data Radio Bearer)激活用户面安全保护。用于为属于PDU会话的所有DRB激活用户面加密和/或用户面完整性保护。
在一个实施例中，根据SMF提供的用户面安全策略信息，如果该安全策略信息指示“需要”，则基站使用无线资源控制(RRC，Radio Resource Control)信令激活每个DRB的用户面安全保护。如果该策略指示“不需要”则PDU会话的建立将在没有保护的情况下进行。如果该策略指示“建议”，则基站可以自主决定是否激活用户面安全保护。但是，当该策略指示“需要”或者“不需要”时，基站不能推翻接收到用户面安全策略信息。
在一个实施例中，通过使用RRC连接重新配置过程的DRB添加过程，在Uu接口上连续实施用户面安全保护。当基站基于用户面安全策略信息确定激活Uu上的用户面安全保护时，它在RRC连接重新配置请求中包含用户面安全保护激活的指示。然后，终端基于基站发送的激活指示来实施相同的用户面安全保护。
为了保护SNPN凭证远程供应，还有两个问题需要解决：
1、当终端选择一个登录网络ONN进行登录并获取接入SNPN所需凭证时，所选择的ONN可能不是终端的归属网络。因此，ONN中的UDM可能没有包含终端已签阅的用户面安全策略信息。这只剩下由SMF在本地配置用户面安全策略信息的选项。但是SMF如何确定SNPN凭证用户面传输的安全策略信息还没有定义，仍有待研究。
2、由于SMF和基站是ONN中的网络节点，与终端请求接入的SNPN中的网络节点不同，ONN中的SMF和基站可能不被SNPN和终端信任以正确执行用于保护SNPN凭证的安全策略。尤其是在存在假冒或者故障基站的情况下，基站可能会忽略从SMF接收到的安全策略并在Uu接口停用用户面安全保护。相关技术中，只允许终端遵循基站发送的激活指示来实施用户面安全保护。终端无法检查接收到的安全激活指示是否与请求的PDU会话的安全要求相匹配。
在一个场景实施例中，在需要建立用户面PDU会话传输凭证时，基站会向终端发送用于激活用户面安全保护操作的激活指示(需要说明的是，在正常情况下，为了确保凭证的传输安全，如果基站是可信基站，则基站一定会按照SMF的安全策略发送激活指示，以激活终端执行安全保护操作。肯定不会发送不符合SMF安全策略的激活指示)。终端在接收到该激活指示后，终端会建立用户面PDU会话且执行用户面安全保护操作，实现凭证的安全传输。
但是，在另一种场景实施例中，由于网络中不可避免地会存在不安全因素，例如，会出现假冒基站或者故障的基站(这里，统一描述为伪基站)，伪基站为了实现窃取凭证的目的，可能会向终端发送不激活用户面安全保护操作的非激活指示(伪指令)。终端在接收到该非激活指示后，按照现有机制应遵从基站发送的激活用户面安全保护操作的激活指示，从而建立用户面PDU会话且不执行用户面安全保护操作(如果按照可信基站的指示，这里原本应该是需要执行用户面安全保护操作的，相当于被篡改了)，此时，利用该用户面PDU会话传输凭证就没有了安全保证。也是相关技术存在的问题。
针对这种没有安全保障的情况，提出了本公开实施例的技术方案(这里，需要说明的是，终端需要 获得凭证时，终端是确定具有执行用户面安全保护操作的需求的，默认是需要激活用户面安全保护操作的)：
终端会根据接收到的指示，确定是否建立PDU会话和是否执行用户面安全保护操作，即，如果接收到的指示是激活用户面安全保护操作的激活指示，则终端会建立PDU会话并执行用户面安全保护操作；如果接收到的指示是不激活用户面安全保护操作的激活指示，则终端会拒绝RRC连接重配置消息，即建立PDU会话失败(因为终端接收到了不激活的指示，说明基站出现故障，或者受到了伪基站的攻击，或者，网络不允许建，此时，不建立PDU会话可以有效规避凭证被窃取的风险)。
这里，需要说明的是，如果终端接受RRC连接重配置消息，就会建立用于传输凭证的该用户面PDU会话，利用该用户面PDU会话传输凭证。如果终端拒绝RRC连接重配置消息，就不会建立用于传输凭证的该用户面PDU会话。
如图3所示，本实施例中提供一种传输凭证的方法，其中，该方法由终端执行，该方法包括：
步骤31、接收基站发送的第一指示信息；
其中，第一指示信息，用于指示：请求激活或者不激活终端的无线数据承载DRB的用户面安全保护操作；DRB至少用于承载终端接入独立非公共网络SNPN所需的凭证。
这里，该终端可以是但不限于是手机、平板电脑、可穿戴设备、车载终端、路侧单元(RSU，Road Side Unit)、智能家居终端、工业用传感设备和/或医疗设备等。
这里，本公开所涉及的基站，可以为各种类型的基站，例如，第三代移动通信(3G)网络的基站、第四代移动通信(4G)网络的基站、第五代移动通信(5G)网络的基站或其它演进型基站。这里，基站可以是登录网络ONN的基站。
在一个实施例中，用户面安全保护操作，包括：完整性保护和/或加密。终端的DRB的用户面安全保护操作可以是针对DRB承载的终端接入SNPN所需的凭证进行完整性保护和/或加密。
在一个实施例中，可以是接收基站发送的携带第一指示信息的RRC连接重配置消息。这里，可以是基站在RRC安全保护被激活后向终端发送该RRC连接重配置消息。在一个实施例中，在RRC加密和RRC完整性保护被激活后向终端发送该RRC连接重配置消息。
在一个实施例中，可以是接收基站发送的携带第一指示信息的RRC连接重配置消息。这里，第一指示信息可以是针对某一个DRB发送的。第一指示信息可以包含用户面完整性保护指示和/或用户面加密的指示。
在一个实施例中，接收基站发送的携带第一指示信息的RRC连接重配置消息，其中，第一指示信息指示请求激活终端的DRB的用户面安全保护操作。基于第一指示信息，针对每个DRB，终端会启动上行用户面完整性保护和下行用户面验证；和/或，基于第一指示信息，针对每个DRB，终端会启动上行用户面加密和下行用户面解密。
在一个实施例中，接收基站发送的携带第一指示信息的RRC连接重配置消息，其中，第一指示信息指示请求不激活终端的DRB的用户面安全保护操作。终端会拒绝该RRC连接重配置消息。这里，终端拒绝该RRC连接重配置消息可以是：基于第一指示信息，针对每个DRB，终端不会启动上行用户面完整性保护和下行用户面验证；且，基于第一指示信息，针对每个DRB，终端不会启动上行用户面 加密和下行用户面解密。
这里，用户面的完整性保护可以是针对DRB上承载的凭证的完整性保护。用户面加密可以是针对DRB上承载的凭证的加密。如此，能够确保凭证不被非法窃取，确保凭证的传输安全。需要说明的是：用户面的完整性保护也可以是针对DRB上承载的除凭证之外的其他类型数据的完整性保护。用户面加密也可以是针对DRB上承载的凭证之外的其他类型数据的加密，这里不做限定。
在一个实施例中，终端在接收到RRC连接重配置消息后，会对该RRC连接重配置消息进行验证。响应于验证不成功，终端会忽略该RRC连接重配置消息。响应于验证成功，终端会基于该RRC连接重配置消息中第一指示信息的指示执行对应操作。
在一个实施例中，接收基站发送的携带第一指示信息的RRC连接重配置消息；验证该RRC连接重配置消息，获得验证结果。如果验证结果指示验证成功，根据第一指示信息确定是否激活终端的DRB的用户面安全保护操作。这里，可以是响应于第一指示信息指示请求不激活终端的DRB的用户面安全保护操作，拒绝RRC连接重配置消息；或者，响应于第一指示信息指示请求激活终端的DRB的用户面安全保护操作，执行用户面安全保护操作。这里，在终端确定执行用户面安全保护操作后，可以向基站发送RRC连接重配置完成消息。这里，RRC连接重配置完成消息用于指示激活终端的DRB的用户面安全保护操作已经完成。
在一个实施例中，在登录网络ONN的基站向终端发送第一指示信息之前，终端在RRC连接建立过程中会向基站发送第二指示信息，其中，第二指示信息，用于指示：建立的RRC连接用于终端登录ONN；基站在接收到第二指示信息后，会选择用于支持终端登录ONN的接入和移动性管理功能(AMF，Access Control And Mobility Management Function)实体，这里，需要说明的是，AMF实体配置有AMF登录配置数据；AMF登录配置数据，包括：用于获取凭证的数字数据网DNN信息和/或限制终端只能请求获取凭证的信息。
在一个实施例中，在基站选择该AMF实体后，当终端需要注册至ONN时，会向基站发送注册请求消息。这里，注册请求消息的注册类型被设置为预定注册类型；预定注册类型，用于指示注册请求消息用于登录ONN以获取凭证。例如，预定注册类型为“登录SNPN”的注册类型。在基站接收到该注册请求消息后，会将该注册请求消息发送给AMF。AMF在接收到该注册请求消息后，会启动向ONN中的认证服务功能(AUSF，Authentication Server Function)实体进行终端的身份验证的程序。这里，AMF登录配置数据可以是限制终端在用户面只能请求SNPN凭证的分发。
在一个实施例中，在终端成功登录ONN后，如果终端需要从ONN通过用户面接收SNPN凭证。则会启动PDU会话建立程序。这里，启动PDU会话建立程序可以是向ONN中的基站发送第一PDU会话建立请求消息，其中，第一PDU会话建立请求消息包括用于获取SNPN凭证的数字数据网络DNN信息。这里，需要说明的是，在一个实施例中，可以是终端预先配置了DNN信息，其中，提供SNPN凭证的提供服务器位于该DNN信息指示的DNN中，或者DNN信息在登录过程中由ONN提供给终端。在一个实施例中，终端启动PDU会话建立程序以检索SNPN凭证的触发取决于终端，例如根据用户输入终端的信息启动PDU会话建立程序。在基站接收到终端发送的第一PDU会话建立请求消息后，会向AMF发送第一PDU会话建立请求消息。
在一个实施例中，在AMF接收到基站发送的第一PDU会话建立请求消息后，会根据基于第一PDU会话建立请求消息中的DNN信息确定的DNN和基于AMF登录配置数据中的DNN信息确定的DNN，确定终端是否请求建立用于获取凭证的PDU会话。在一个实施例中，响应于基于第一PDU会话建立请求消息中的DNN信息确定的DNN和基于AMF登录配置数据中的DNN信息确定的DNN不匹配，拒绝PDU会话建立请求消息。在另一个实施例中，响应于基于第一PDU会话建立请求消息中的DNN信息确定的DNN和基于AMF登录配置数据中的DNN信息确定的DNN相匹配，选择连接至DNN的会话管理功能(SMF，Session Management Function)实体。
在一个实施例中，在选择连接至DNN的SMF实体后，会向SMF实体发送第二PDU会话建立请求消息，其中，第二PDU会话建立请求消息包括DNN的信息和创建用于获取凭证的PDU会话的创建指示信息。在SMF实体接收到该第二PDU会话建立请求消息后，会根据创建指示信息，将待创建的用于获取凭证的PDU会话的安全策略信息配置为指示第一目标状态，其中，所述第一目标状态，为指示进行用户面安全保护的状态。这里，第一目标状态，可以是需要对终端的DRB进行安全保护的“需要”状态。
在一个实施例中，在连接至DNN的SMF实体后，会向所述SMF发送第三PDU会话建立请求消息，其中，第三PDU会话建立请求消息包括DNN的信息且不包括创建用于获取凭证的PDU会话的创建指示信息。在SMF实体接收到该第三PDU会话建立请求消息后，会根据基于第三PDU会话建立请求消息中的DNN信息确定的DNN和基于SMF中配置的DNN信息确定的DNN，确定PDU会话的安全策略信息。在一个实施例中，可以是响应于基于第三PDU会话建立请求消息中的DNN信息确定的DNN和基于SMF中配置的DNN信息确定的DNN相匹配，将待创建的用于获取凭证的PDU会话的安全策略信息配置为指示第一目标状态。或者，在另一个实施例中，可以是响应于基于第三PDU会话建立请求消息中的DNN信息确定的DNN和基于SMF中配置的DNN信息确定的DNN不匹配，将待创建的用于获取凭证的PDU会话的安全策略信息配置为指示第二目标状态，其中，第一目标状态，为指示进行用户面安全保护的状态。
在本公开实施例中，接收基站发送的第一指示信息；其中，第一指示信息，用于指示：请求激活或者不激活终端的无线数据承载DRB的用户面安全保护操作；DRB至少用于承载终端接入独立非公共网络SNPN所需的凭证。这里，终端在接收到基站发送的第一指示信息后，就可以基于第一指示信息激活终端的DRB的用户面安全保护操作或者不激活终端的DRB的用户面安全保护操作，如此，可以提升利用DRB传输SNPN的凭证的可靠性，确保凭证的传输安全。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图4所示，本实施例中提供一种传输凭证的方法，其中，该方法由终端执行，该方法包括：
步骤41、接收基站发送的携带第一指示信息的RRC连接重配置消息。
在一个实施例中，可以是接收基站发送的携带第一指示信息的RRC连接重配置消息。这里，可以是基站在RRC安全保护被激活后向终端发送该RRC连接重配置消息。在一个实施例中，在RRC加密 和RRC完整性保护被激活后向终端发送该RRC连接重配置消息。
在一个实施例中，可以是接收基站发送的携带第一指示信息的RRC连接重配置消息。这里，第一指示信息可以是针对某一个DRB发送的。第一指示信息可以包含用户面完整性保护指示和/或用户面加密的指示。
在一个实施例中，接收基站发送的携带第一指示信息的RRC连接重配置消息，其中，第一指示信息指示请求激活终端的DRB的用户面安全保护操作。终端会基于第一指示信息，针对每个DRB，终端会启动上行用户面完整性保护和下行用户面验证；和/或，终端会基于第一指示信息，针对每个DRB，终端会启动上行用户面加密和下行用户面解密。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图5所示，本实施例中提供一种传输凭证的方法，其中，该方法由终端执行，该方法包括：
步骤51、验证RRC连接重配置消息，获得验证结果。
在一个实施例中，响应于RRC连接重配置消息验证不成功，则终端会忽略该RRC连接重配置消息。响应于RRC连接重配置消息验证成功，则终端会根据RRC连接重配置消息中的第一指示信息确定相关操作。这里，可以是如果验证结果指示验证成功，终端会根据第一指示信息确定是否激活终端的DRB的用户面安全保护操作。在一个实施例中，响应于第一指示信息指示请求不激活终端的DRB的用户面安全保护操作，拒绝RRC连接重配置消息。在另一个实施例中，响应于第一指示信息指示请求激活终端的DRB的用户面安全保护操作，执行用户面安全保护操作。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图6所示，本实施例中提供一种传输凭证的方法，其中，该方法由终端执行，该方法包括：
步骤61、响应于第一指示信息指示请求不激活终端的DRB的用户面安全保护操作，拒绝RRC连接重配置消息；
或者，
响应于第一指示信息指示请求激活终端的DRB的用户面安全保护操作，接受所述RRC连接重配置消息且执行用户面安全保护操作。
这里，响应于拒绝RRC连接重配置消息，终端不会建立用于凭证传输的PDU会话且不会执行用户面安全保护操作。
这里，执行用户面安全保护操作可以是基于产生的用户面完整性保护密钥K UPint和用户面加密密钥K UPenc执行用户面安全保护操作。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图7所示，本实施例中提供一种传输凭证的方法，其中，该方法由终端执行，该方法包括：
步骤71、向基站发送RRC连接重配置完成消息。
在一个实施例中，接收基站发送的携带第一指示信息的RRC连接重配置消息；验证该RRC连接重配置消息，获得验证结果。如果验证结果指示验证成功，根据第一指示信息确定是否激活终端的DRB的用户面安全保护操作。这里，可以是响应于第一指示信息指示请求不激活终端的DRB的用户面安全保护操作，拒绝RRC连接重配置消息；或者，响应于第一指示信息指示请求激活终端的DRB的用户面安全保护操作，执行用户面安全保护操作。这里，在终端确定执行用户面安全保护操作后，可以向基站发送RRC连接重配置完成消息。这里，RRC连接重配置完成消息用于指示激活终端的DRB的用户面安全保护操作已经完成。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图8所示，本实施例中提供一种传输凭证的方法，其中，该方法由终端执行，该方法包括：
步骤81、在RRC连接建立过程中向登录网络ONN的基站发送第二指示信息，其中，第二指示信息，用于指示：建立的RRC连接用于终端登录所述ONN。
在一个实施例中，在登录网络ONN的基站向终端发送第一指示信息之前，终端在RRC连接建立过程中会向基站发送第二指示信息，其中，第二指示信息，用于指示：建立的RRC连接用于终端登录ONN；基站在接收到第二指示信息后，会选择用于支持终端登录ONN的接入和移动性管理功能(AMF，Access Control And Mobility Management Function)实体，这里，需要说明的是，AMF实体配置有AMF登录配置数据；AMF登录配置数据，包括：用于获取凭证的数字数据网DNN信息和/或限制终端只能请求获取凭证的信息。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图9所示，本实施例中提供一种传输凭证的方法，其中，该方法由终端执行，该方法包括：
步骤91、响应于终端启动注册至所述ONN，向基站发送注册请求消息；
其中，注册请求消息的注册类型被设置为预定注册类型；预定注册类型，用于指示注册请求消息用于登录ONN以获取凭证。
在一个实施例中，在基站选择该AMF实体后，当终端需要注册至ONN时，会向基站发送注册请求消息。这里，注册请求消息的注册类型被设置为预定注册类型；预定注册类型，用于指示注册请求消息用于登录ONN以获取凭证。例如，预定注册类型为“登录SNPN”的注册类型。在基站接收到该注册请求消息后，会将该注册请求消息发送给AMF。AMF在接收到该注册请求消息后，会启动向ONN中的认证服务功能(AUSF，Authentication Server Function)实体进行终端的身份验证的程序。这里，AMF登录配置数据可以是限制终端网络在用户面只能请求SNPN凭证的分发。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以 与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图10所示，本实施例中提供一种传输凭证的方法，其中，该方法由终端执行，该方法包括：
步骤101、响应于终端登录ONN成功且需要通过ONN接收凭证，启动PDU会话建立程序。
在一个实施例中，在终端成功登录ONN后，如果终端需要从ONN用户面接收SNPN凭证。则会启动PDU会话建立程序。这里，启动PDU会话建立程序可以是向ONN中的基站发送第一PDU会话建立请求消息，其中，第一PDU会话建立请求消息包括用于获取SNPN凭证的数字数据网络DNN信息。这里，需要说明的是，在一个实施例中，可以是终端预先配置了DNN信息，其中，提供SNPN凭证的提供服务器位于该DNN信息指示的DNN中，或者DNN信息在登录过程中由ONN提供给终端。在一个实施例中，终端启动PDU会话建立程序以检索SNPN凭证的触发取决于终端，例如根据用户输入终端的信息启动PDU会话建立程序。在基站接收到终端发送的第一PDU会话建立请求消息后，会向AMF发送第一PDU会话建立请求消息。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图11所示，本实施例中提供一种传输凭证的方法，其中，该方法由终端执行，该方法包括：
步骤111、向ONN中的基站发送第一PDU会话建立请求消息，其中，第一PDU会话建立请求消息包括用于获取凭证的数字数据网络DNN信息。
在一个实施例中，在基站接收到终端发送的第一PDU会话建立请求消息后，会向AMF发送第一PDU会话建立请求消息。在AMF接收到基站发送的第一PDU会话建立请求消息后，会根据基于第一PDU会话建立请求消息中的DNN信息确定的DNN和基于AMF登录配置数据中的DNN信息确定的DNN，确定终端是否请求建立用于获取凭证的PDU会话。在一个实施例中，响应于基于第一PDU会话建立请求消息中的DNN信息确定的DNN和基于AMF登录配置数据中的DNN信息确定的DNN不匹配，拒绝PDU会话建立请求消息。在另一个实施例中，响应于基于第一PDU会话建立请求消息中的DNN信息确定的DNN和基于AMF登录配置数据中的DNN信息确定的DNN相匹配，选择连接至DNN的会话管理功能实体。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图12所示，本实施例中提供一种传输凭证的方法，其中，该方法由基站执行，该方法包括：
步骤121、接收第二核心网设备发送的安全策略信息；
步骤122、向终端发送基于所述安全策略信息确定的第一指示信息；
其中，第一指示信息，用于指示：请求激活或者不激活终端的无线数据承载DRB的用户面安全保护操作；所述DRB至少用于承载终端接入SNPN所需的凭证。
这里，该终端可以是但不限于是手机、平板电脑、可穿戴设备、车载终端、路侧单元(RSU，Road  Side Unit)、智能家居终端、工业用传感设备和/或医疗设备等。
这里，本公开所涉及的基站，可以为各种类型的基站，例如，第三代移动通信(3G)网络的基站、第四代移动通信(4G)网络的基站、第五代移动通信(5G)网络的基站或其它演进型基站。这里，基站可以是登录网络ONN的基站。
在一个实施例中，用户面安全保护操作，包括：完整性保护和/或加密。终端的DRB的用户面安全保护操作可以是针对DRB承载的终端接入SNPN所需的凭证进行完整性保护和/或加密。
在一个实施例中，可以是接收基站发送的携带第一指示信息的RRC连接重配置消息。这里，可以是基站在RRC安全保护被激活后向终端发送该RRC连接重配置消息。在一个实施例中，在RRC加密和RRC完整性保护被激活后向终端发送该RRC连接重配置消息。
在一个实施例中，可以是接收基站发送的携带第一指示信息的RRC连接重配置消息。这里，第一指示信息可以是针对某一个DRB发送的。第一指示信息可以包含用户面完整性保护指示和/或用户面加密的指示。
在一个实施例中，接收基站发送的携带第一指示信息的RRC连接重配置消息，其中，第一指示信息指示请求激活终端的DRB的用户面安全保护操作。基于第一指示信息，针对每个DRB，终端会启动上行用户面完整性保护和下行用户面验证；和/或，基于第一指示信息针对每个DRB，终端会启动上行用户面加密和下行用户面解密。
在一个实施例中，接收基站发送的携带第一指示信息的RRC连接重配置消息，其中，第一指示信息指示请求不激活终端的DRB的用户面安全保护操作。终端会拒绝该RRC连接重配置消息。这里，终端拒绝该RRC连接重配置消息可以是：基于第一指示信息，针对每个DRB，终端不会启动上行用户面完整性保护和下行用户面验证；且，基于第一指示信息，针对每个DRB，终端不会启动上行用户面加密和下行用户面解密。
这里，用户面的完整性保护可以是针对DRB上承载的凭证的完整性保护。用户面加密可以是针对DRB上承载的凭证的加密。如此，能够确保凭证被非法窃取，确保凭证的传输安全。需要说明的是：用户面的完整性保护也可以是针对DRB上承载的除凭证之外的其他类型数据的完整性保护。用户面加密也可以是针对DRB上承载的凭证之外的其他类型数据的加密，这里不做限定。
在一个实施例中，终端在接收到RRC连接重配置消息后，会对该RRC连接重配置消息进行验证。响应于验证不成功，终端会忽略该RRC连接重配置消息。响应于验证成功，终端会基于该RRC连接重配置消息中第一指示信息的指示执行对应操作。
在一个实施例中，接收基站发送的携带第一指示信息的RRC连接重配置消息；验证该RRC连接重配置消息，获得验证结果。如果验证结果指示验证成功，根据第一指示信息确定是否激活终端的DRB的用户面安全保护操作。这里，可以是响应于第一指示信息指示请求不激活终端的DRB的用户面安全保护操作，拒绝RRC连接重配置消息；或者，响应于第一指示信息指示请求激活终端的DRB的用户面安全保护操作，执行用户面安全保护操作。这里，在终端确定执行用户面安全保护操作后，可以向基站发送RRC连接重配置完成消息。这里，RRC连接重配置完成消息用于指示激活终端的DRB的用户面安全保护操作已经完成。
在一个实施例中，在登录网络ONN的基站向终端发送第一指示信息之前，终端在RRC连接建立过程中会向基站发送第二指示信息，其中，第二指示信息，用于指示：建立的RRC连接用于终端登录ONN；基站在接收到第二指示信息后，会选择用于支持终端登录ONN的接入和移动性管理功能(AMF，Access Control And Mobility Management Function)实体，这里，需要说明的是，AMF实体配置有AMF登录配置数据；AMF登录配置数据，包括：用于获取凭证的数字数据网DNN信息和/或限制终端只能请求获取凭证的信息。
在一个实施例中，在基站选择该AMF实体后，当终端需要注册至ONN时，会向基站发送注册请求消息。这里，注册请求消息的注册类型被设置为预定注册类型；预定注册类型，用于指示注册请求消息用于登录ONN以获取凭证。例如，预定注册类型为“登录SNPN”的注册类型。在基站接收到该注册请求消息后，会将该注册请求消息发送给AMF。AMF在接收到该注册请求消息后，会启动向ONN中的认证服务功能(AUSF，Authentication Server Function)实体进行终端的身份验证的程序。这里，AMF登录配置数据可以是限制终端网络在用户面只能请求SNPN凭证的分发。
在一个实施例中，在终端成功登录ONN后，如果终端需要从ONN接收SNPN凭证。则会启动PDU会话建立程序。这里，启动PDU会话建立程序可以是向ONN中的基站发送第一PDU会话建立请求消息，其中，第一PDU会话建立请求消息包括用于获取SNPN凭证的数字数据网络DNN信息。这里，需要说明的是，在一个实施例中，可以是终端预先配置了DNN信息，其中，提供SNPN凭证的提供服务器位于该DNN信息指示的DNN中，或者DNN信息在登录过程中由ONN提供给终端。在一个实施例中，终端启动PDU会话建立程序以检索SNPN凭证的触发取决于终端，例如根据用户输入终端的信息启动PDU会话建立程序。在基站接收到终端发送的第一PDU会话建立请求消息后，会向AMF发送第一PDU会话建立请求消息。
在一个实施例中，在AMF接收到基站发送的第一PDU会话建立请求消息后，会根据基于第一PDU会话建立请求消息中的DNN信息确定的DNN和基于AMF登录配置数据中的DNN信息确定的DNN，确定终端是否请求建立用于获取凭证的PDU会话。在一个实施例中，响应于基于第一PDU会话建立请求消息中的DNN信息确定的DNN和基于AMF登录配置数据中的DNN信息确定的DNN不匹配，拒绝PDU会话建立请求消息。在另一个实施例中，响应于基于第一PDU会话建立请求消息中的DNN信息确定的DNN和基于AMF登录配置数据中的DNN信息确定的DNN相匹配，选择连接至DNN的会话管理功能(SMF，Session Management Function)实体。
在一个实施例中，在选择连接至DNN的SMF实体后，会向SMF实体发送第二PDU会话建立请求消息，其中，第二PDU会话建立请求消息包括DNN的信息和创建用于获取凭证的PDU会话的创建指示信息。在SMF实体接收到该第二PDU会话建立请求消息后，会根据创建指示信息，将待创建的用于获取凭证的PDU会话的安全策略信息配置为指示第一目标状态，其中，所述第一目标状态，为指示进行用户面安全保护的状态。这里，第一目标状态，可以是需要对终端的DRB进行安全保护的“需要”状态。
在一个实施例中，在连接至DNN的SMF实体后，会向所述SMF发送第三PDU会话建立请求消息，其中，第三PDU会话建立请求消息包括DNN的信息且不包括创建用于获取凭证的PDU会话的创 建指示信息。在SMF实体接收到该第三PDU会话建立请求消息后，会根据基于第三PDU会话建立请求消息中的DNN信息确定的DNN和基于SMF中配置的DNN信息确定的DNN，确定PDU会话的安全策略信息。在一个实施例中，可以是响应于基于第三PDU会话建立请求消息中的DNN信息确定的DNN和基于SMF中配置的DNN信息确定的DNN相匹配，将待创建的用于获取凭证的PDU会话的安全策略信息配置为指示第一目标状态。或者，在另一个实施例中，可以是响应于基于第三PDU会话建立请求消息中的DNN信息确定的DNN和基于SMF中配置的DNN信息确定的DNN不匹配，将待创建的用于获取凭证的PDU会话的安全策略信息配置为指示第二目标状态，其中，第一目标状态，为指示进行用户面安全保护的状态。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图13所示，本实施例中提供一种传输凭证的方法，其中，该方法由基站执行，该方法包括：
步骤131、向终端发送携带第一指示信息的RRC连接重配置消息。
在一个实施例中，可以是向终端发送携带第一指示信息的RRC连接重配置消息。这里，可以是基站在RRC安全保护被激活后向终端发送该RRC连接重配置消息。在一个实施例中，在RRC加密和RRC完整性保护被激活后向终端发送该RRC连接重配置消息。
在一个实施例中，可以是向终端发送携带第一指示信息的RRC连接重配置消息。这里，第一指示信息可以是针对某一个DRB发送的。第一指示信息可以包含用户面完整性保护指示和/或用户面加密的指示。
在一个实施例中，向终端发送携带第一指示信息的RRC连接重配置消息，其中，第一指示信息指示请求激活终端的DRB的用户面安全保护操作。终端会基于第一指示信息，针对每个DRB，终端会启动上行用户面完整性保护和下行用户面验证；和/或，终端会基于第一指示信息，针对每个DRB，终端会启动上行用户面加密和下行用户面解密。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图14所示，本实施例中提供一种传输凭证的方法，其中，该方法由基站执行，该方法包括：
步骤141、响应于向终端发送RRC连接重配置消息，启动基站的DRB的用户面安全保护操作。
在一个实施例中，用户面的完整性保护可以是针对DRB上承载的凭证的完整性保护。用户面加密可以是针对DRB上承载的凭证的加密。如此，能够确保凭证被非法窃取，确保凭证的传输安全。需要说明的是：用户面的完整性保护也可以是针对DRB上承载的除凭证之外的其他类型数据的完整性保护。用户面加密也可以是针对DRB上承载的凭证之外的其他类型数据的加密，这里不做限定。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图15所示，本实施例中提供一种传输凭证的方法，其中，该方法由基站执行，该方法包括：
步骤151、在RRC连接建立过程中接收终端发送的第二指示信息，其中，第二指示信息，用于指示：建立的RRC连接用于终端登录所述ONN。
在一个实施例中，在登录网络ONN的基站向终端发送第一指示信息之前，终端在RRC连接建立过程中会向基站发送第二指示信息，其中，第二指示信息，用于指示：建立的RRC连接用于终端登录ONN；基站在接收到第二指示信息后，会选择用于支持终端登录ONN的接入和移动性管理功能(AMF，Access Control And Mobility Management Function)实体，这里，需要说明的是，AMF实体配置有AMF登录配置数据；AMF登录配置数据，包括：用于获取凭证的数字数据网DNN信息和/或限制终端只能请求获取凭证的信息。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图16所示，本实施例中提供一种传输凭证的方法，其中，该方法由基站执行，该方法包括：
步骤161、响应于接收到第二指示信息，确定用于支持终端登录ONN的第一核心网设备；
其中，第一核心网设备配置有AMF登录配置数据；AMF登录配置数据，包括：用于获取凭证的数字数据网DNN信息和/或限制终端只能请求获取凭证的信息。
这里，第一核心网设备可以是AMF。
在一个实施例中，在基站接收到注册请求消息后，会将该注册请求消息发送给AMF。AMF在接收到该注册请求消息后，会启动向ONN中的AUSF实体进行终端的身份验证的程序。这里，AMF登录配置数据可以是指示限制终端网络只用于用户面SNPN凭证的分配或者发放。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图17所示，本实施例中提供一种传输凭证的方法，其中，该方法由基站执行，该方法包括：
步骤171、接收终端发送的注册请求消息；
其中，注册请求消息的注册类型被设置为预定注册类型；预定注册类型，用于指示注册请求消息用于登录ONN以获取凭证。
在一个实施例中，在基站选择该AMF实体后，当终端需要注册至ONN时，会向基站发送注册请求消息。这里，注册请求消息的注册类型被设置为预定注册类型；预定注册类型，用于指示注册请求消息用于登录ONN以获取凭证。例如，预定注册类型为“登录SNPN”的注册类型。
在一个实施例中，基站还会向会话管理功能AMF发送所述注册请求消息。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图18所示，本实施例中提供一种传输凭证的方法，其中，该方法由基站执行，该方法包括：
步骤181、接收终端发送的第一PDU会话建立请求消息，其中，第一PDU会话建立请求消息包括用于获取凭证的DNN信息。
在一个实施例中，在终端成功登录ONN后，如果终端需要从ONN接收SNPN凭证。则会启动PDU会话建立程序。这里，启动PDU会话建立程序可以是向ONN中的基站发送第一PDU会话建立请求消息，其中，第一PDU会话建立请求消息包括用于获取凭证的数字数据网络DNN信息。这里，需要说明的是，在一个实施例中，可以是终端预先配置了DNN信息，其中，提供SNPN凭证的提供服务器位于该DNN信息指示的DNN中，或者DNN信息在登录过程中由ONN提供给终端。在一个实施例中，终端启动PDU会话建立程序以检索SNPN凭证的触发取决于终端，例如根据用户输入终端的信息启动PDU会话建立程序。在基站接收到终端发送的第一PDU会话建立请求消息后，会向AMF发送第一PDU会话建立请求消息。
这里，基站还会向AMF发送第一PDU会话建立请求消息。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图19所示，本实施例中提供一种传输凭证的方法，其中，该方法由第一核心网设备执行，该方法包括：
步骤191、接收基站发送的注册请求消息；
其中，注册请求消息的注册类型被设置为预定注册类型；预定注册类型，用于指示注册请求消息用于终端登录ONN以获取登录SNPN所需的凭证。
这里，第一核心网设备可以是AMF实体。
在一个实施例中，AMF在接收到该注册请求消息后，会启动向ONN中的认证服务功能实体进行终端的身份验证的程序。这里，AMF登录配置数据可以是限制终端网络在用户面只能请求SNPN凭证的分发。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图20所示，本实施例中提供一种传输凭证的方法，其中，该方法由第一核心网设备执行，该方法包括：
步骤201、接收基站发送的第一PDU会话建立请求消息，其中，第一PDU会话建立请求消息包括用于获取SNPN凭证的DNN信息。
这里，第一核心网设备可以是AMF实体。
在一个实施例中，在终端成功登录ONN后，如果终端需要从ONN接收SNPN凭证。则会启动PDU会话建立程序。这里，启动PDU会话建立程序可以是向ONN中的基站发送第一PDU会话建立请求消息，其中，第一PDU会话建立请求消息包括用于获取凭证的数字数据网络DNN信息。这里，需要说明的是，在一个实施例中，可以是终端预先配置了DNN信息，其中，提供SNPN凭证的提供服务器 位于该DNN信息指示的DNN中，或者DNN信息在登录过程中由ONN提供给终端。在一个实施例中，终端启动PDU会话建立程序以检索SNPN凭证的触发取决于终端，例如根据用户输入终端的信息启动PDU会话建立程序。在基站接收到终端发送的第一PDU会话建立请求消息后，会向AMF发送第一PDU会话建立请求消息。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图21所示，本实施例中提供一种传输凭证的方法，其中，该方法由第一核心网设备执行，该方法包括：
步骤211、根据基于第一PDU会话建立请求消息中的DNN信息确定的DNN和基于AMF登录配置数据中的DNN信息确定的DNN，确定终端是否请求建立用于获取凭证的PDU会话。
这里，第一核心网设备可以是AMF实体。
在一个实施例中，响应于基于第一PDU会话建立请求消息中的DNN信息确定的DNN和基于AMF登录配置数据中的DNN信息确定的DNN不匹配，拒绝PDU会话建立请求消息；或者，响应于基于第一PDU会话建立请求消息中的DNN信息确定的DNN和基于AMF登录配置数据中的DNN信息确定的DNN相匹配，确定连接至DNN的会话管理功能SMF实体。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图22所示，本实施例中提供一种传输凭证的方法，其中，该方法由第一核心网设备执行，该方法包括：
步骤221、响应于基于第一PDU会话建立请求消息中的DNN信息确定的DNN和基于AMF登录配置数据中的DNN信息确定的DNN不匹配，拒绝PDU会话建立请求消息；
或者，
响应于基于第一PDU会话建立请求消息中的DNN信息确定的DNN和基于AMF登录配置数据中的DNN信息确定的DNN相匹配，确定连接至DNN的第二核心网设备。
这里，第一核心网设备可以是AMF实体；这里第二核心网设备可以是SMF实体。
在一个实施例中，拒绝PDU会话建立请求消息可以是不响应PDU会话建立请求消息执行其他操作。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图23所示，本实施例中提供一种传输凭证的方法，其中，该方法由第一核心网设备执行，该方法包括：
步骤231、响应于确定第二核心网设备，向所述第二核心网设备发送第二PDU会话建立请求消息，其中，所述第二PDU会话建立请求消息包括所述DNN的信息和创建用于获取凭证的PDU会话的创建 指示信息。
这里，第一核心网设备可以是AMF实体；第二核心网设备可以是SMF。
在一个实施例中，在选择连接至DNN的SMF实体后，会向SMF实体发送第二PDU会话建立请求消息，其中，第二PDU会话建立请求消息包括DNN的信息和创建用于获取凭证的PDU会话的创建指示信息。在SMF实体接收到该第二PDU会话建立请求消息后，会根据创建指示信息，将待创建的用于获取凭证的PDU会话的安全策略信息配置为指示第一目标状态，其中，所述第一目标状态，为指示进行用户面安全保护的状态。这里，第一目标状态，可以是需要对终端的DRB进行安全保护的“需要”状态。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图24所示，本实施例中提供一种传输凭证的方法，其中，该方法由第一核心网设备执行，该方法包括：
步骤241、响应于确定第二核心网设备，向第二核心网设备发送第三PDU会话建立请求消息，其中，第三PDU会话建立请求消息包括DNN的信息且不包括创建用于获取凭证的PDU会话的创建指示信息。
这里，第一核心网设备可以是AMF实体；第二核心网设备可以是SMF，
在一个实施例中，在连接至DNN的SMF实体后，会向SMF发送第三PDU会话建立请求消息，其中，第三PDU会话建立请求消息包括DNN的信息且不包括创建用于获取凭证的PDU会话的创建指示信息。在SMF实体接收到该第三PDU会话建立请求消息后，会根据基于第三PDU会话建立请求消息中的DNN信息确定的DNN和基于SMF中配置的DNN信息确定的DNN，确定PDU会话的安全策略信息。在一个实施例中，可以是响应于基于第三PDU会话建立请求消息中的DNN信息确定的DNN和基于SMF中配置的DNN信息确定的DNN相匹配，将待创建的用于获取凭证的PDU会话的安全策略信息配置为指示第一目标状态。或者，在另一个实施例中，可以是响应于基于第三PDU会话建立请求消息中的DNN信息确定的DNN和基于SMF中配置的DNN信息确定的DNN不匹配，将待创建的用于获取凭证的PDU会话的安全策略信息配置为指示第二目标状态，其中，第一目标状态，为指示进行用户面安全保护的状态。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图25所示，本实施例中提供一种传输凭证的方法，其中，该方法由第二核心网设备执行，该方法包括：
步骤251、接收第一核心网设备发送的PDU会话建立请求消息，其中，PDU会话建立请求消息，至少包括DNN的信息，其中，DNN的信息，用于指示获取终端接入SNPN所需的凭证的DNN；
步骤252、根据所述会话建立请求消息，确定所述PDU会话的安全策略信息；
步骤253、向基站发送所述安全策略信息。
这里，第二核心网设备可以为SMF实体；第一核心网设备可以是AMF实体。
在一个实施例中，PDU会话建立请求消息，可以是第二PDU会话建立请求消息也可以是第三PDU会话建立请求消息。其中，第二PDU会话建立请求消息包括DNN的信息和创建用于获取凭证的PDU会话的创建指示信息。其中，第三PDU会话建立请求消息包括DNN的信息且不包括创建用于获取凭证的PDU会话的创建指示信息。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图26所示，本实施例中提供一种传输凭证的方法，其中，该方法由第二核心网设备执行，该方法包括：
步骤261、根据创建指示信息，将待创建的用于获取凭证的PDU会话的安全策略信息配置为指示第一目标状态，其中，第一目标状态，为指示进行用户面安全保护的状态。
这里，第二核心网设备可以为SMF实体。
在SMF实体接收到该第二PDU会话建立请求消息后，会根据创建指示信息，将待创建的用于获取凭证的PDU会话的安全策略信息配置为指示第一目标状态，其中，所述第一目标状态，为指示进行用户面安全保护的状态。这里，第一目标状态，可以是需要对终端的DRB进行安全保护的“需要”状态。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图27所示，本实施例中提供一种传输凭证的方法，其中，该方法由第二核心网设备执行，该方法包括：
步骤271、根据基于第三PDU会话建立请求消息中的DNN信息确定的DNN和基于第二核心网设备中配置的DNN信息确定的DNN，确定PDU会话的安全策略信息。
这里，第二核心网设备可以为SMF实体。
在SMF实体接收到该第三PDU会话建立请求消息后，会根据基于第三PDU会话建立请求消息中的DNN信息确定的DNN和基于SMF中配置的DNN信息确定的DNN，确定PDU会话的安全策略信息。在一个实施例中，可以是响应于基于第三PDU会话建立请求消息中的DNN信息确定的DNN和基于SMF中配置的DNN信息确定的DNN相匹配，将待创建的用于获取凭证的PDU会话的安全策略信息配置为指示第一目标状态。或者，在另一个实施例中，可以是响应于基于第三PDU会话建立请求消息中的DNN信息确定的DNN和基于SMF中配置的DNN信息确定的DNN不匹配，将待创建的用于获取凭证的PDU会话的安全策略信息配置为指示第二目标状态，其中，第一目标状态，为指示进行用户面安全保护的状态。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图28所示，本实施例中提供一种传输凭证的方法，其中，该方法由第二核心网设备执行，该方法包括：
步骤281、响应于基于第三PDU会话建立请求消息中的DNN信息确定的DNN和基于第二核心网设备中配置的DNN信息确定的DNN相匹配，将待创建的用于获取凭证的PDU会话的安全策略信息配置为指示第一目标状态；
或者，
响应于基于第三PDU会话建立请求消息中的DNN信息确定的DNN和基于第二核心网设备中配置的DNN信息确定的DNN不匹配，将待创建的用于获取凭证的PDU会话的安全策略信息配置为指示第二目标状态，其中，第一目标状态，为指示进行用户面安全保护的状态。
这里，第二核心网设备可以为SMF实体。
在一个实施例中，第三PDU会话建立请求消息中的DNN信息指示的DNN与SMF中配置的DNN信息指示的DNN相同，确定DNN相匹配。或者，第三PDU会话建立请求消息中的DNN信息指示的DNN与SMF中配置的DNN信息指示的DNN不相同，确定DNN不匹配。
这里，第二目标状态为SMF根据请求的特定服务确定的用户面安全策略信息设置为指示特定选项对应的状态，可以是需要或者不需要进行用户面安全保护的状态。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图29所示，本实施例中提供一种传输凭证的装置，其中，装置包括：
接收模块291，用于接收基站发送的第一指示信息；
其中，第一指示信息，用于指示：请求激活或者不激活终端的无线数据承载DRB的用户面安全保护操作；DRB至少用于承载终端接入SNPN所需的凭证。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图30所示，本实施例中提供一种传输凭证的装置，其中，装置包括：
接收模块301，用于接收第二核心网设备发送的安全策略信息；
发送模块302，用于向终端发送基于所述安全策略信息确定的第一指示信息；
其中，第一指示信息，用于指示：请求激活或者不激活终端的无线数据承载DRB的用户面安全保护操作；DRB至少用于承载终端接入SNPN所需的凭证。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图31所示，本实施例中提供一种传输凭证的装置，其中，装置包括：
接收模块311，用于接收基站发送的注册请求消息；
其中，注册请求消息的注册类型被设置为预定注册类型；预定注册类型，用于指示注册请求消息用于终端登录ONN以获取终端接入SNPN所需的凭证。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图32所示，本实施例中提供一种传输凭证的装置，其中，所述装置包括：
接收模块321，用于接收第一核心网设备发送的PDU会话建立请求消息，其中，PDU会话建立请求消息，至少包括DNN的信息，其中，DNN的信息，用于指示获取终端接入SNPN所需的凭证的DNN；
确定模块322，用于：根据所述会话建立请求消息，确定所述PDU会话的安全策略信息；
发送模块323，用于向基站发送所述安全策略信息。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
本公开实施例提供一种通信设备，通信设备，包括：
处理器；
用于存储处理器可执行指令的存储器；
其中，处理器被配置为：用于运行可执行指令时，实现应用于本公开任意实施例的方法。
其中，处理器可包括各种类型的存储介质，该存储介质为非临时性计算机存储介质，在通信设备掉电之后能够继续记忆存储其上的信息。
处理器可以通过总线等与存储器连接，用于读取存储器上存储的可执行程序。
本公开实施例还提供一种计算机存储介质，其中，计算机存储介质存储有计算机可执行程序，可执行程序被处理器执行时实现本公开任意实施例的方法。
关于上述实施例中的装置，其中各个模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
如图33所示，本公开一个实施例提供一种终端的结构。
参照图33所示终端800本实施例提供一种终端800，该终端具体可是移动电话，计算机，数字广播终端，消息收发设备，游戏控制台，平板设备，医疗设备，健身设备，个人数字助理等。
参照图33，终端800可以包括以下一个或多个组件：处理组件802，存储器804，电源组件806，多媒体组件808，音频组件810，输入/输出(I/O)的接口812，传感器组件814，以及通信组件816。
处理组件802通常控制终端800的整体操作，诸如与显示，电话呼叫，数据通信，相机操作和记录操作相关联的操作。处理组件802可以包括一个或多个处理器820来执行指令，以完成上述的方法的全部或部分步骤。此外，处理组件802可以包括一个或多个模块，便于处理组件802和其他组件之间的交 互。例如，处理组件802可以包括多媒体模块，以方便多媒体组件808和处理组件802之间的交互。
存储器804被配置为存储各种类型的数据以支持在设备800的操作。这些数据的示例包括用于在终端800上操作的任何应用程序或方法的指令，联系人数据，电话簿数据，消息，图片，视频等。存储器804可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(SRAM)，电可擦除可编程只读存储器(EEPROM)，可擦除可编程只读存储器(EPROM)，可编程只读存储器(PROM)，只读存储器(ROM)，磁存储器，快闪存储器，磁盘或光盘。
电源组件806为终端800的各种组件提供电力。电源组件806可以包括电源管理系统，一个或多个电源，及其他与为终端800生成、管理和分配电力相关联的组件。
多媒体组件808包括在终端800和用户之间的提供一个输出接口的屏幕。在一些实施例中，屏幕可以包括液晶显示器(LCD)和触摸面板(TP)。如果屏幕包括触摸面板，屏幕可以被实现为触摸屏，以接收来自用户的输入信号。触摸面板包括一个或多个触摸传感器以感测触摸、滑动和触摸面板上的手势。触摸传感器可以不仅感测触摸或滑动动作的边界，而且还检测与触摸或滑动操作相关的持续时间和压力。在一些实施例中，多媒体组件808包括一个前置摄像头和/或后置摄像头。当设备800处于操作模式，如拍摄模式或视频模式时，前置摄像头和/或后置摄像头可以接收外部的多媒体数据。每个前置摄像头和后置摄像头可以是一个固定的光学透镜系统或具有焦距和光学变焦能力。
音频组件810被配置为输出和/或输入音频信号。例如，音频组件810包括一个麦克风(MIC)，当终端800处于操作模式，如呼叫模式、记录模式和语音识别模式时，麦克风被配置为接收外部音频信号。所接收的音频信号可以被进一步存储在存储器804或经由通信组件816发送。在一些实施例中，音频组件810还包括一个扬声器，用于输出音频信号。
I/O接口812为处理组件802和外围接口模块之间提供接口，上述外围接口模块可以是键盘，点击轮，按钮等。这些按钮可包括但不限于：主页按钮、音量按钮、启动按钮和锁定按钮。
传感器组件814包括一个或多个传感器，用于为终端800提供各个方面的状态评估。例如，传感器组件814可以检测到设备800的打开/关闭状态，组件的相对定位，例如组件为终端800的显示器和小键盘，传感器组件814还可以检测终端800或终端800一个组件的位置改变，用户与终端800接触的存在或不存在，终端800方位或加速/减速和终端800的温度变化。传感器组件814可以包括接近传感器，被配置用来在没有任何的物理接触时检测附近物体的存在。传感器组件814还可以包括光传感器，如CMOS或CCD图像传感器，用于在成像应用中使用。在一些实施例中，该传感器组件814还可以包括加速度传感器，陀螺仪传感器，磁传感器，压力传感器或温度传感器。
通信组件816被配置为便于终端800和其他设备之间有线或无线方式的通信。终端800可以接入基于通信标准的无线网络，如Wi-Fi，2G或3G，或它们的组合。在一个示例性实施例中，通信组件816经由广播信道接收来自外部广播管理系统的广播信号或广播相关信息。在一个示例性实施例中，通信组件816还包括近场通信(NFC)模块，以促进短程通信。例如，在NFC模块可基于射频识别(RFID)技术，红外数据协会(IrDA)技术，超宽带(UWB)技术，蓝牙(BT)技术和其他技术来实现。
在示例性实施例中，终端800可以被一个或多个应用专用集成电路(ASIC)、数字信号处理器(DSP)、数字信号处理设备(DSPD)、可编程逻辑器件(PLD)、现场可编程门阵列(FPGA)、控制器、微控制 器、微处理器或其他电子元件实现，用于执行上述方法。
在示例性实施例中，还提供了一种包括指令的非临时性计算机可读存储介质，例如包括指令的存储器804，上述指令可由终端800的处理器820执行以完成上述方法。例如，非临时性计算机可读存储介质可以是ROM、随机存取存储器(RAM)、CD-ROM、磁带、软盘和光数据存储设备等。
如图34所示，本公开一实施例示出一种基站的结构。例如，基站900可以被提供为一网络侧设备。参照图34，基站900包括处理组件922，其进一步包括一个或多个处理器，以及由存储器932所代表的存储器资源，用于存储可由处理组件922的执行的指令，例如应用程序。存储器932中存储的应用程序可以包括一个或一个以上的每一个对应于一组指令的模块。此外，处理组件922被配置为执行指令，以执行上述方法前述应用在所述基站的任意方法。
基站900还可以包括一个电源组件926被配置为执行基站900的电源管理，一个有线或无线网络接口950被配置为将基站900连接到网络，和一个输入输出(I/O)接口958。基站900可以操作基于存储在存储器932的操作系统，例如Windows Server TM，Mac OS XTM，UnixTM，LinuxTM，FreeBSDTM或类似。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本发明的其它实施方案。本公开旨在涵盖本发明的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本发明的一般性原理并包括本公开未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本发明的真正范围和精神由下面的权利要求指出。
应当理解的是，本发明并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本发明的范围仅由所附的权利要求来限制。

Claims (38)

  1. 一种传输凭证的方法，其中，所述方法由终端执行，所述方法包括：
    接收基站发送的第一指示信息；
    其中，所述第一指示信息，用于指示：请求激活或者不激活所述终端的无线数据承载DRB的用户面安全保护操作；所述DRB至少用于承载所述终端接入独立非公共网络SNPN所需的凭证。
  2. 根据权利要求1所述的方法，其中，所述用户面安全保护操作，包括：完整性保护和/或加密。
  3. 根据权利要求1所述的方法，其中，所述接收基站发送的第一指示信息，包括：
    接收基站发送的携带所述第一指示信息的无线资源控制RRC连接重配置消息。
  4. 根据权利要求2所述的方法，其中，所述方法还包括：
    验证所述RRC连接重配置消息，获得验证结果。
  5. 根据权利要求4所述的方法，其中，所述方法还包括：
    响应于所述验证结果指示验证成功，根据所述第一指示信息确定是否激活所述终端的DRB的用户面安全保护操作。
  6. 根据权利要求5所述的方法，其中，所述方法还包括：
    响应于所述第一指示信息指示请求不激活所述终端的DRB的用户面安全保护操作，拒绝所述RRC连接重配置消息；
    或者，
    响应于所述第一指示信息指示请求激活所述终端的DRB的用户面安全保护操作，接受所述RRC连接重配置消息且执行所述用户面安全保护操作。
  7. 根据权利要求6所述的方法，其中，所述方法还包括：
    向所述基站发送RRC连接重配置完成消息。
  8. 根据权利要求1所述的方法，其中，所述方法还包括：
    在RRC连接建立过程中向登录网络ONN的基站发送第二指示信息，其中，所述第二指示信息，用于指示：建立的RRC连接用于所述终端登录所述ONN。
  9. 根据权利要求8所述的方法，其中，所述方法还包括：
    响应于终端启动注册至所述ONN，向所述基站发送注册请求消息；
    其中，所述注册请求消息的注册类型被设置为预定注册类型；所述预定注册类型，用于指示所述注册请求消息用于登录所述ONN以获取所述凭证。
  10. 根据权利要求9所述的方法，其中，所述方法还包括：
    响应于所述终端登录所述ONN成功且需要通过所述ONN接收所述凭证，启动PDU会话建立程序。
  11. 根据权利要求10所述的方法，其中，所述启动PDU会话建立程序，包括：
    向所述ONN中的基站发送第一PDU会话建立请求消息，其中，所述第一PDU会话建立请求消息包括用于获取所述凭证的数字数据网络DNN信息。
  12. 一种传输凭证的方法，其中，所述方法由基站执行，所述方法包括：
    接收第二核心网设备发送的安全策略信息；
    向终端发送基于所述安全策略信息确定的第一指示信息；
    其中，所述第一指示信息，用于指示：请求激活或者不激活所述终端的无线数据承载DRB的用户面安全保护操作；所述DRB至少用于承载所述终端接入SNPN所需的凭证。
  13. 根据权利要求12所述的方法，其中，所述用户面安全保护操作，包括：完整性保护和/或加密。
  14. 根据权利要求12所述的方法，其中，所述向终端发送第一指示信息，包括：
    向终端发送携带所述第一指示信息的RRC连接重配置消息。
  15. 根据权利要求12所述的方法，其中，所述方法还包括：
    响应于向所述终端发送所述RRC连接重配置消息，启动所述基站的DRB的用户面安全保护操作。
  16. 根据权利要求12所述的方法，其中，所述方法还包括：
    在RRC连接建立过程中接收所述终端发送的第二指示信息，其中，所述第二指示信息，用于指示：建立的RRC连接用于所述终端登录所述ONN。
  17. 根据权利要求16所述的方法，其中，所述方法还包括：
    响应于接收到所述第二指示信息，确定用于支持终端登录所述ONN的第一核心网设备；
    其中，所述第一核心网设备配置有AMF登录配置数据；所述AMF登录配置数据，包括：用于获取所述凭证的数字数据网DNN信息和/或限制所述终端只能请求获取所述凭证的信息。
  18. 根据权利要求17所述的方法，其中，所述方法还包括：
    接收所述终端发送的注册请求消息；
    其中，所述注册请求消息的注册类型被设置为预定注册类型；所述预定注册类型，用于指示所述注册请求消息用于登录所述ONN以获取所述凭证。
  19. 根据权利要求18所述的方法，其中，所述方法还包括：
    向第一核心网设备发送所述注册请求消息。
  20. 根据权利要求19所述的方法，其中，所述方法还包括：
    接收终端发送的第一PDU会话建立请求消息，其中，所述第一PDU会话建立请求消息包括用于获取所述凭证的DNN信息。
  21. 根据权利要求20所述的方法，其中，所述方法还包括：
    向第一核心网设备发送所述第一PDU会话建立请求消息。
  22. 一种传输凭证的方法，其中，所述方法由第一核心网设备执行，所述方法包括：
    接收基站发送的注册请求消息；
    其中，所述注册请求消息的注册类型被设置为预定注册类型；所述预定注册类型，用于指示所述注册请求消息用于终端登录所述ONN以获取所述终端接入SNPN所需的凭证。
  23. 根据权利要求22所述的方法，其中，所述方法还包括：
    响应于接收到所述注册请求消息，启动向ONN中的认证服务功能AUSF进行所述终端的身份验证的程序。
  24. 根据权利要求23所述的方法，其中，所述方法还包括：
    接收基站发送的第一PDU会话建立请求消息，其中，所述第一PDU会话建立请求消息包括用于获取所述凭证的DNN信息。
  25. 根据权利要求24所述的方法，其中，所述方法还包括：
    根据基于所述第一PDU会话建立请求消息中的所述DNN信息确定的DNN和基于所述AMF登录配置数据中的DNN信息确定的DNN，确定所述终端是否请求建立用于获取所述凭证的PDU会话。
  26. 根据权利要求25所述的方法，其中，所述根据基于所述第一PDU会话建立请求消息中的所述DNN信息确定的DNN和基于所述AMF登录配置数据中的DNN信息确定的DNN，确定所述终端是否请求建立用于获取所述凭证的PDU会话，包括：
    响应于基于所述第一PDU会话建立请求消息中的所述DNN信息确定的DNN和基于所述AMF登录配置数据中的DNN信息确定的DNN不匹配，拒绝所述PDU会话建立请求消息；
    或者，
    响应于基于所述第一PDU会话建立请求消息中的所述DNN信息确定的DNN和基于所述AMF登录配置数据中的DNN信息确定的DNN相匹配，确定连接至所述DNN的第二核心网设备。
  27. 根据权利要求26所述的方法，其中，所述方法，还包括：
    响应于确定所述第二核心网设备，向所述核心网设备发送第二PDU会话建立请求消息，其中，所述第二PDU会话建立请求消息包括所述DNN的信息和创建用于获取所述凭证的PDU会话的创建指示信息。
  28. 根据权利要求26所述的方法，其中，所述方法还包括：
    响应于确定所述第二核心网设备，向所述第二核心网设备发送第三PDU会话建立请求消息，其中，所述第三PDU会话建立请求消息包括DNN的信息且不包括创建用于获取凭证的PDU会话的创建指示信息。
  29. 一种传输凭证的方法，其中，所述方法由会第二核心网设备执行，所述方法包括：
    接收第一核心网设备发送的PDU会话建立请求消息，其中，所述PDU会话建立请求消息，至少包括DNN的信息，其中，所述DNN的信息，用于指示获取终端接入SNPN所需的凭证的DNN；
    根据所述会话建立请求消息，确定所述PDU会话的安全策略信息；
    向基站发送所述安全策略信息。
  30. 根据权利要求29所述的方法，其中，所述PDU会话建立请求消息为还包括创建用于获取凭证的PDU会话的创建指示信息的第二PDU会话建立请求消息；所述根据所述会话建立请求消息，确定所述PDU会话的安全策略信息，包括：
    根据所述创建指示信息，将待创建的所述用于获取凭证的PDU会话的安全策略信息配置为指示第一目标状态，其中，所述第一目标状态，为指示进行用户面安全保护的状态。
  31. 根据权利要求29所述的方法，其中，所述PDU会话建立请求消息为不包括创建用于获取凭证的PDU会话的创建指示信息的第三PDU会话建立请求消息；所述根据所述会话建立请求消息，确定所述PDU会话的安全策略信息，包括：
    根据基于所述第三PDU会话建立请求消息中的所述DNN信息确定的DNN和基于所述第二核心网 设备中配置的DNN信息确定的DNN，确定PDU会话的安全策略信息。
  32. 根据权利要求31所述的方法，其中，所述根据基于所述第三PDU会话建立请求消息中的所述DNN信息确定的DNN和基于所述第二核心网设备中配置的DNN信息确定的DNN，确定PDU会话的安全策略信息，包括：
    响应于基于所述第三PDU会话建立请求消息中的所述DNN信息确定的DNN和基于所述第二核心网设备中配置的DNN信息确定的DNN相匹配，将待创建的所述用于获取凭证的PDU会话的安全策略信息配置为指示第一目标状态；
    或者，
    响应于基于所述第三PDU会话建立请求消息中的所述DNN信息确定的DNN和基于所述第二核心网设备中配置的DNN信息确定的DNN不匹配，将待创建的所述用于获取凭证的PDU会话的安全策略信息配置为指示第二目标状态，其中，所述第一目标状态，为指示进行用户面安全保护的状态。
  33. 一种传输凭证的装置，其中，所述装置包括：
    接收模块，用于接收基站发送的第一指示信息；
    其中，所述第一指示信息，用于指示：请求激活或者不激活所述终端的无线数据承载DRB的用户面安全保护操作；所述DRB至少用于承载终端接入SNPN所需的凭证。
  34. 一种传输凭证的装置，其中，所述装置包括：
    接收模块，用于接收第二核心网设备发送的安全策略信息；
    发送模块，用于向终端发送基于所述安全策略信息确定的第一指示信息；
    其中，所述第一指示信息，用于指示：请求激活或者不激活所述终端的无线数据承载DRB的用户面安全保护操作；所述DRB至少用于承载所述终端接入SNPN所需的凭证。
  35. 一种传输凭证的装置，其中，所述装置包括：
    接收模块，用于接收基站发送的注册请求消息；
    其中，所述注册请求消息的注册类型被设置为预定注册类型；所述预定注册类型，用于指示所述注册请求消息用于终端登录ONN以获取所述终端接入SNPN所需的凭证。
  36. 一种传输凭证的装置，其中，所述装置包括：
    接收模块，用于接收第一核心网设备发送的PDU会话建立请求消息，其中，所述PDU会话建立请求消息，至少包括DNN的信息，其中，所述DNN的信息，用于指示获取终端接入SNPN所需的凭证的DNN；
    确定模块，用于：根据所述会话建立请求消息，确定所述PDU会话的安全策略信息；
    发送模块，用于向基站发送所述安全策略信息。
  37. 一种通信设备，其中，包括：
    存储器；
    处理器，与所述存储器连接，被配置为通过执行存储在所述存储器上的计算机可执行指令，并能够实现权利要求1至11、12至21、22至28或者29至32任一项所述的方法。
  38. 一种计算机存储介质，所述计算机存储介质存储有计算机可执行指令，所述计算机可执行指令 被处理器执行后能够实现权利要求1至11、12至21、22至28或者39至32任一项所述的方法。
PCT/CN2021/107150 2021-07-19 2021-07-19 传输凭证的方法、装置、通信设备及存储介质 WO2023000139A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202180002207.0A CN115868188A (zh) 2021-07-19 2021-07-19 传输凭证的方法、装置、通信设备及存储介质
PCT/CN2021/107150 WO2023000139A1 (zh) 2021-07-19 2021-07-19 传输凭证的方法、装置、通信设备及存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/107150 WO2023000139A1 (zh) 2021-07-19 2021-07-19 传输凭证的方法、装置、通信设备及存储介质

Publications (1)

Publication Number Publication Date
WO2023000139A1 true WO2023000139A1 (zh) 2023-01-26

Family

ID=84979639

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/107150 WO2023000139A1 (zh) 2021-07-19 2021-07-19 传输凭证的方法、装置、通信设备及存储介质

Country Status (2)

Country Link
CN (1) CN115868188A (zh)
WO (1) WO2023000139A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111052781A (zh) * 2017-09-08 2020-04-21 华为技术有限公司 用于协商安全性算法和完整性算法的方法和设备
CN111641944A (zh) * 2019-03-01 2020-09-08 华为技术有限公司 一种通信方法及设备
US20210051577A1 (en) * 2019-08-14 2021-02-18 Nokia Technologies Oy Method and apparatus for handling non-integrity protected reject messages in non-public networks

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111052781A (zh) * 2017-09-08 2020-04-21 华为技术有限公司 用于协商安全性算法和完整性算法的方法和设备
CN111641944A (zh) * 2019-03-01 2020-09-08 华为技术有限公司 一种通信方法及设备
US20210051577A1 (en) * 2019-08-14 2021-02-18 Nokia Technologies Oy Method and apparatus for handling non-integrity protected reject messages in non-public networks

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
HUAWEI, HISILICON, ERICSSON: "Clarification on Key Issue #2", 3GPP DRAFT; S3-202749, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. e-meeting; 20201012 - 20201016, 19 October 2020 (2020-10-19), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051940479 *
INTEL: "Registration Procedure for UE Onboarding", 3GPP DRAFT; S2-2102320, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. Electronic; 20210412 - 20210416, 6 April 2021 (2021-04-06), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051993698 *

Also Published As

Publication number Publication date
CN115868188A (zh) 2023-03-28

Similar Documents

Publication Publication Date Title
US10856135B2 (en) Method and apparatus for network access
CN109033801B (zh) 应用程序验证用户身份的方法、移动终端以及存储介质
US9060028B1 (en) Method and apparatus for rejecting untrusted network
WO2023000139A1 (zh) 传输凭证的方法、装置、通信设备及存储介质
WO2023240661A1 (zh) 认证与授权方法、装置、通信设备及存储介质
WO2023070685A1 (zh) 中继通信的方法、装置、通信设备及存储介质
WO2023240657A1 (zh) 认证与授权方法、装置、通信设备及存储介质
WO2023231018A1 (zh) 个人物联网pin基元凭证配置方法、装置、通信设备及存储介质
WO2024021142A1 (zh) 应用程序接口api认证方法、装置、通信设备及存储介质
WO2023245354A1 (zh) 安全保护方法、装置、通信设备及存储介质
WO2024092801A1 (zh) 认证方法、装置、通信设备及存储介质
WO2024092735A1 (zh) 通信控制方法、系统及装置、通信设备及存储介质
WO2024021137A1 (zh) Api调用者认证方法以及装置、通信设备及存储介质
WO2023240574A1 (zh) 信息处理方法及装置、通信设备及存储介质
US9043873B1 (en) Method and apparatus for rejecting untrusted network
WO2023240659A1 (zh) 认证方法、装置、通信设备和存储介质
WO2023230924A1 (zh) 认证方法、装置、通信设备和存储介质
WO2023184548A1 (zh) 信息处理方法及装置、通信设备及存储介质
WO2023004655A1 (zh) 一种通信方法、装置、用户设备、基站、核心网设备及存储介质
WO2023240575A1 (zh) 一种中继通信方法、通信装置及通信设备
WO2024031711A1 (zh) 信息处理方法及装置、通信设备及存储介质
US12010519B2 (en) Information sharing method, terminal device, storage medium, and computer program product
WO2023216275A1 (zh) 认证方法、装置、通信设备及存储介质
WO2024031399A1 (zh) Ue加入pin的方法及装置、通信设备及存储介质
WO2022127808A1 (zh) 授信中继通信方法、装置、终端及网络侧设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21950405

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE