WO2023030148A1 - 一种通信方法、装置及系统 - Google Patents

一种通信方法、装置及系统 Download PDF

Info

Publication number
WO2023030148A1
WO2023030148A1 PCT/CN2022/114680 CN2022114680W WO2023030148A1 WO 2023030148 A1 WO2023030148 A1 WO 2023030148A1 CN 2022114680 W CN2022114680 W CN 2022114680W WO 2023030148 A1 WO2023030148 A1 WO 2023030148A1
Authority
WO
WIPO (PCT)
Prior art keywords
node
key
communication
connection
authentication
Prior art date
Application number
PCT/CN2022/114680
Other languages
English (en)
French (fr)
Inventor
何青春
李明超
王勇
程型清
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP22863286.5A priority Critical patent/EP4387302A1/en
Priority to KR1020247010737A priority patent/KR20240049384A/ko
Publication of WO2023030148A1 publication Critical patent/WO2023030148A1/zh
Priority to US18/592,062 priority patent/US20240205674A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/30—Connection release
    • H04W76/34—Selective release of ongoing connections

Definitions

  • the embodiments of the present application relate to the field of communication technologies, and in particular, to a communication method, device, and system.
  • Embodiments of the present application provide a communication method, device, and system, which are used to update a communication authentication key to improve communication security.
  • the embodiment of the present application provides a communication method, which may be applied to a first node.
  • the method includes:
  • the embodiment of the present application provides a technical solution for the first node and the second node to release the connection after confirming the updated key, and to establish a connection using a new key, so as to realize the switching of different communication connections for communication
  • the update process of the authenticated key effectively improves the security of communication.
  • connection establishment request is used to request to establish a connection based on the second key, including that the connection establishment request is used to request to perform an authentication and security context negotiation process based on the second key .
  • the method further includes: receiving authentication information based on the second key from the second node; the authentication information is used to verify the identity of the second node .
  • the authentication information is used to verify the identity of the second node, including whether the authentication information is used to verify whether to establish a second node with the second node based on the second key.
  • the first key is a key derived (or negotiated) based on the first communication system, and/or the second key is derived (or negotiated) based on the second communication system ), the first communication system is different from the second communication system.
  • the first communication system may be a single communication system
  • the second communication system may be a communication system obtained by merging different communication systems.
  • the embodiment of the present application provides a communication method in a scenario where different communication systems perform converged communication, which effectively improves communication security.
  • an authentication response based on the second key is sent to the second node, where the authentication response is used to verify the identity of the first node.
  • the authentication response is used to verify the identity of the first node, including whether the authentication response is used by the second node to verify A node establishes the second communication connection.
  • the first node can make the second node further determine whether the authentication based on the second key is successful according to the authentication response by sending the authentication response to the second node.
  • the release request includes request reason information; the request reason information is used to indicate key update for communication authentication.
  • carrying the request reason in the release request can enable the first node to understand the reason of the request after receiving the release request from the second node, so as to make a more targeted response to the request and have greater adaptability.
  • the second key is valid within a first duration
  • the first duration is defined by a timer or a time stamp.
  • the second key is valid within a first period of time starting from a first moment, and the first moment is the moment when the first communication connection is released, or the connection establishment request is sent moment.
  • the present application provides a variety of situations at the first moment, thereby providing a variety of solutions for judging the validity of the second key, with greater flexibility.
  • the method further includes performing information transmission with the third node through the backhaul link between the second node and the third node within the validity period of the second key .
  • the embodiment of the present application provides a communication method, which may be applied to a second node.
  • the method includes:
  • the embodiment of the present application provides a technical solution for the first node and the second node to release the connection after confirming the updated key, and to establish a connection using a new key, so as to realize the switching of different communication connections for communication
  • the update process of the authenticated key effectively improves the security of communication.
  • connection establishment request is used to request to establish a connection based on the second key, including: the connection establishment request is used to request to perform authentication and security context negotiation based on the second key process.
  • the method further includes: sending authentication information based on the second key to the first node; the authentication information is used to verify the identity of the second node.
  • the authentication information is used to verify the identity of the second node, including whether the authentication information is used by the first node to verify based on the second key and the second A node establishes a second communication connection.
  • the first key is a key derived (or negotiated) based on the first communication system, and/or the second key is derived (or negotiated) based on the second communication system ), the first communication system is different from the second communication system.
  • the first communication system may be a single communication system
  • the second communication system may be a communication system obtained by merging different communication systems.
  • the embodiment of the present application provides a communication method in a scenario where different communication systems perform converged communication, which effectively improves communication security.
  • the method further includes receiving an authentication response based on the second key from the first node; the authentication response is used to verify the identity of the first node.
  • the authentication response is used to verify the identity of the first node, including whether the authentication response is used by the second node to verify A node establishes the second communication connection.
  • the first node can make the second node further determine whether the authentication based on the second key is successful according to the authentication response by sending the authentication response to the second node.
  • the release request includes request reason information; the request reason information is used to indicate key update for communication authentication.
  • carrying the request reason in the release request can enable the first node to understand the reason of the request after receiving the release request from the second node, so as to make a more targeted response to the request and have greater adaptability.
  • the second key is valid within a first duration
  • the first duration may be defined by a timer or a time stamp.
  • the second key is valid within a first duration starting from a first moment, and the first moment is the moment when the first communication connection is released, or the second node receives to the moment of the connection establishment request.
  • the present application provides a variety of situations at the first moment, thereby providing a variety of solutions for judging the validity of the second key, with greater flexibility.
  • the method further includes passing the transmission information from the first node through the backhaul chain between the second node and the third node within the validity period of the second key route, and send it to the third node.
  • the backhaul link is suspended.
  • the second node suspends the backhaul link after releasing the first communication connection, which can effectively reduce system overhead and save resources.
  • the method further includes activating the backhaul link after determining that the second communication connection with the first node is successfully established; the second communication connection is based on the The second key is used for communication authentication.
  • the previously suspended backhaul link is activated to continue to use the backhaul link for communication transmission, which can effectively reduce System overhead, saving resources.
  • the embodiment of the present application provides a communication method, which may be applied to the first node.
  • the method includes:
  • the embodiment of the present application provides a technical solution for the first node and the second node to release the connection after confirming the updated key, and to establish a connection using a new key, so as to realize the switching of different communication connections for communication
  • the update process of the authenticated key effectively improves the security of communication.
  • connection establishment request is used to request to establish a connection based on the second key, including that the connection establishment request is used to request to perform an authentication and security context negotiation process based on the second key .
  • the method further includes: receiving authentication information based on the second key from the second node; the authentication information is used to verify the identity of the second node .
  • the authentication information is used to verify the identity of the second node, including whether the authentication information is used to verify whether to establish a second node with the second node based on the second key.
  • the first key is a key derived (or negotiated) based on the first communication system, and/or the second key is derived (or negotiated) based on the second communication system ), the first communication system is different from the second communication system.
  • the first communication system may be a single communication system
  • the second communication system may be a communication system obtained by merging different communication systems.
  • the embodiment of the present application provides a communication method in a scenario where different communication systems perform converged communication, which effectively improves communication security.
  • the method further includes: sending an authentication response based on the second key to the second node, where the authentication response is used to verify the identity of the first node.
  • the authentication response is used to verify the identity of the first node, including whether the authentication response is used by the second node to verify A node establishes the second communication connection.
  • the first node can make the second node further determine whether the authentication based on the second key is successful according to the authentication response by sending the authentication response to the second node.
  • the release request includes request reason information; the request reason information is used to indicate key update for communication authentication.
  • carrying the request reason in the release request can enable the first node to understand the reason of the request after receiving the release request from the second node, so as to make a more targeted response to the request and have greater adaptability.
  • the second key is valid within a first duration
  • the first duration is defined by a timer or a time stamp.
  • the second key is valid within a first period of time starting from a first moment, and the first moment is the moment when the first communication connection is released, or the connection establishment request is sent moment.
  • the present application provides a variety of situations at the first moment, thereby providing a variety of solutions for judging the validity of the second key, with greater flexibility.
  • the method further includes: within the validity period of the second key, communicating with the third node through the backhaul link between the second node and the third node transmission.
  • the embodiment of the present application provides a communication method, which may be applied to the second node.
  • the method includes:
  • the embodiment of the present application provides a technical solution for the first node and the second node to release the connection after confirming the updated key, and to establish a connection using a new key, so as to realize the switching of different communication connections for communication
  • the update process of the authenticated key effectively improves the security of communication.
  • connection establishment request is used to request to establish a connection based on the second key, including: the connection establishment request is used to request to perform authentication and security context negotiation based on the second key process.
  • the method further includes: sending authentication information based on the second key to the first node; the authentication information is used to verify the identity of the second node.
  • the authentication information is used to verify the identity of the second node, including whether the authentication information is used by the first node to verify based on the second key and the second A node establishes a second communication connection.
  • the first key is a key derived (or negotiated) based on the first communication system, and/or the second key is derived (or negotiated) based on the second communication system ), the first communication system is different from the second communication system.
  • the first communication system may be a single communication system
  • the second communication system may be a communication system obtained by merging different communication systems.
  • the embodiment of the present application provides a communication method in a scenario where different communication systems perform converged communication, which effectively improves communication security.
  • the method further includes receiving an authentication response fed back from the first node; the authentication response is used to verify the identity of the first node.
  • the authentication response is used to verify the identity of the first node, including whether the authentication response is used by the second node to verify A node establishes the second communication connection.
  • the first node can make the second node further determine whether the authentication based on the second key is successful according to the authentication response by sending the authentication response to the second node.
  • the release request includes request reason information; the request reason information is used to indicate key update for communication authentication.
  • carrying the request reason in the release request can enable the first node to understand the reason of the request after receiving the release request from the second node, so as to make a more targeted response to the request and have greater adaptability.
  • the second key is valid within a first duration
  • the first duration may be defined by a timer or a time stamp.
  • the second key is valid within a first duration starting from a first moment, and the first moment is the moment when the first communication connection is released, or the second node receives to the moment of the connection establishment request.
  • the present application provides a variety of situations at the first moment, thereby providing a variety of solutions for judging the validity of the second key, with greater flexibility.
  • the method further includes passing the transmission information from the first node through the backhaul chain between the second node and the third node within the validity period of the second key route, and send it to the third node.
  • the backhaul link is suspended.
  • the second node suspends the backhaul link after releasing the first communication connection, which can effectively reduce system overhead and save resources.
  • the method further includes activating the backhaul link after determining that the second communication connection with the first node is successfully established; the second communication connection is based on the The second key is used for communication authentication.
  • the previously suspended backhaul link is activated to continue to use the backhaul link for communication transmission, which can effectively reduce System overhead, saving resources.
  • the embodiment of the present application provides a communication device, which is used to realize the above first aspect or any one of the methods in the first aspect, including corresponding functional modules or units, respectively used to realize the above first aspect steps in the method.
  • the function can be realized by hardware, or by executing corresponding software by hardware, and the hardware or software includes one or more modules or units corresponding to the above functions; or,
  • the device is used to realize the above-mentioned third aspect or any method in the third aspect, and includes corresponding functional modules or units, respectively used to realize the steps in the above-mentioned method of the third aspect.
  • Functions can be realized by hardware, or by executing corresponding software by hardware, and the hardware or software includes one or more modules or units corresponding to the above-mentioned functions.
  • the embodiment of the present application provides a communication device, which is used to implement the second aspect or any one of the methods in the second aspect, including corresponding functional modules or units, respectively used to implement the second aspect steps in the method.
  • the function can be realized by hardware, or by executing corresponding software by hardware, and the hardware or software includes one or more modules or units corresponding to the above functions; or,
  • the device is used to implement the fourth aspect or any one of the methods in the fourth aspect, and includes corresponding functional modules or units, respectively used to implement the steps in the method of the fourth aspect.
  • Functions can be realized by hardware, or by executing corresponding software by hardware, and the hardware or software includes one or more modules or units corresponding to the above-mentioned functions.
  • a communication device includes a processor and a memory.
  • the memory is used to store calculation programs or instructions
  • the processor is coupled to the memory; when the processor executes the computer programs or instructions, the device is made to perform any method in the first aspect or the first aspect; or the device is made to Execute the third aspect or any one method in the third aspect.
  • the communication device may be the first device, or a device capable of supporting the first device to implement the functions required by the method provided by the first aspect above, or a device capable of supporting the first device to implement the functions required by the method provided by the third aspect above, For example, system-on-a-chip.
  • the communication device may be a terminal device or a part of components (such as a chip) in the terminal device.
  • the terminal device may be, for example, a smart mobile terminal, a smart home device, a smart car, a smart wearable device, and the like.
  • the smart mobile terminal includes a mobile phone, a tablet computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA) and the like.
  • Smart home devices such as smart refrigerators, smart washing machines, smart TVs, speakers, etc.
  • Smart car wearable devices such as smart headphones, smart glasses, smart clothing or shoes, etc.
  • a communication device includes a processor and a memory.
  • the memory is used to store calculation programs or instructions
  • the processor is coupled to the memory; when the processor executes the computer programs or instructions, the device is made to perform any method in the second aspect or the second aspect above; or the device is made to Executing the fourth aspect or any one of the methods in the fourth aspect.
  • the communication device may be a second device or a device capable of supporting the second device to implement the functions required by the method provided by the second aspect above, or a device capable of supporting the second device to implement the functions required by the method provided by the fourth aspect above, for example system on a chip.
  • the communication device may be a terminal device or a part of components (such as a chip) in the terminal device.
  • the terminal device may be, for example, a smart mobile terminal, a smart home device, a smart car, a smart wearable device, and the like.
  • the smart mobile terminal is such as a mobile phone, a tablet computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (personal digital assistant, PDA) and the like.
  • Smart home devices such as smart refrigerators, smart washing machines, smart TVs, speakers, etc.
  • Smart car wearable devices such as smart headphones, smart glasses, smart clothing or shoes, etc.
  • a ninth aspect provides a terminal, and the terminal may include the device described in the fifth aspect or the seventh aspect, and the device in the sixth aspect or the eighth aspect above.
  • the device may be smart home equipment, smart manufacturing equipment, smart transportation equipment, etc., such as vehicles, drones, unmanned transport vehicles, cars and vehicles, or robots.
  • the device may be a mouse, a keyboard, a wearable device, a TWS earphone, and the like.
  • the present application provides a chip, which is connected to a memory, and used to read and execute computer programs or instructions stored in the memory, so as to realize the above-mentioned first aspect or any possible implementation of the first aspect or to achieve the second aspect or a method in any possible implementation of the second aspect; or to achieve the third aspect or a method in any possible implementation of the third aspect; or To implement the fourth aspect or the method in any possible implementation manner of the fourth aspect.
  • a computer-readable storage medium in which a computer program or instruction is stored, and when the computer program or instruction is executed by a device, the device executes the above-mentioned first aspect or the first aspect.
  • a computer-readable storage medium In a twelfth aspect, a computer-readable storage medium is provided. Computer programs or instructions are stored in the computer-readable storage medium. When the computer programs or instructions are executed by a device, the device executes the above-mentioned second aspect or the second aspect. A method in any possible implementation manner, or causing the device to execute the fourth aspect or the method in any possible implementation manner of the fourth aspect.
  • the present application provides a computer program product, the computer program product includes a computer program or an instruction, and when the computer program or instruction is executed by a device, the device executes the above-mentioned first aspect or any possibility of the first aspect
  • the present application provides a computer program product, the computer program product includes a computer program or an instruction, and when the computer program or instruction is executed by a device, the device executes the above-mentioned second aspect or any possibility of the second aspect
  • FIG. 1 is a schematic diagram of a first communication system provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of a second communication system provided by an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of the first communication method provided by the embodiment of the present application.
  • FIG. 4 is a schematic flow diagram of a second communication method provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of a third communication method provided by an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of a fourth communication method provided by an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of a fifth communication method provided by the embodiment of the present application.
  • FIG. 8 is a schematic flowchart of a sixth communication method provided by the embodiment of the present application.
  • FIG. 9 is a schematic flowchart of a sixth communication method provided by the embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a first communication device provided in an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of a second communication device provided by an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of a terminal provided by an embodiment of the present application.
  • the embodiment of the present application provides a communication method and device, in order to realize the authentication process of the integration of wireless short-distance and 5G cellular network.
  • the embodiments of the present application will be further described in detail below in conjunction with the accompanying drawings.
  • the communication method provided by the embodiment of the present application can be applied to the fifth generation (5th generation, 5G) communication system, such as 5G new air interface (new radio, NR), and can also be applied to various communication systems in the future, such as the sixth generation ( 6th generation, 6G) communication system, which is not limited here.
  • 5G 5G new air interface
  • 6th generation, 6G 6th generation
  • the embodiment of the present application provides an architecture of a communication system to which the communication method is applicable.
  • the communication system may include a first node 100 , a second node 110 and a third node 120 .
  • the first node may be connected to the second node, and the second node may be connected to the third node.
  • the communication system may be a communication system after integration of different communication systems, for example, a communication system obtained after integration of a wireless short-distance communication system and a 5G cellular network communication system, which is not limited here.
  • the integrated communication system may also be called a tightly coupled (tight interworking) communication system, or an interworking (interworking) communication system.
  • this application takes the integrated communication system of the wireless short-distance communication system and the 5G cellular network communication system as an example, and introduces the integrated communication system:
  • the terminal nodes supporting wireless short-distance communication can access the 5G network through the control node or gateway node, and further use the services provided by the 5G network.
  • the 5G network can also configure and manage data transmission policies for terminal nodes based on the terminal node's subscription information and link state information, so as to provide refined services for the network. That is to say, in the integrated communication system, the wireless short-distance communication system and the 5G cellular network communication system can work interactively and complement each other.
  • the wireless short-distance communication system described in this application can be any possible short-distance communication system, such as Bluetooth, wifi, vehicle-mounted general short-distance communication system and star flash, etc. .
  • the first node may be a terminal device or a communication device capable of supporting the terminal device to implement the functions required by the method, or the first node may be a network device or a communication device capable of supporting the network device to implement the functions required by the method, Of course, it can also be other communication devices, such as a system on a chip.
  • the second node may be a network device or a communication device capable of supporting the network device to implement the functions required by the method, or the second node may be a terminal device or a communication device capable of supporting the terminal device to implement the functions required by the method, and of course are other communication devices such as system-on-a-chip.
  • the third node may be a network device or a communication device capable of supporting the network device to implement the functions required by the method, or the third node may be a terminal device or a communication device capable of supporting the terminal device to implement the functions required by the method, and of course It may be other communication devices, such as a system on a chip.
  • the terminal device in this embodiment of the present application may be a device for implementing a wireless communication function, such as a terminal or a chip that may be used in the terminal.
  • Examples may include a handheld device with wireless connectivity, or a processing device connected to a wireless modem.
  • the terminal device can communicate with the core network via a radio access network (radio access network, RAN), and exchange voice and/or data with the RAN.
  • radio access network radio access network
  • the terminal equipment may include user equipment (user equipment, UE), wireless terminal equipment, mobile terminal equipment, subscriber unit (subscriber unit), subscriber station (subscriber station), mobile station (mobile station), mobile station (mobile), remote Station (remote station), access point (access point, AP), remote terminal device (remote terminal), access terminal device (access terminal), user terminal device (user terminal), user agent (user agent), or user Equipment (user device), etc.
  • user equipment user equipment
  • UE wireless terminal equipment
  • mobile terminal equipment subscriber unit (subscriber unit), subscriber station (subscriber station), mobile station (mobile station), mobile station (mobile), remote Station (remote station), access point (access point, AP), remote terminal device (remote terminal), access terminal device (access terminal), user terminal device (user terminal), user agent (user agent), or user Equipment (user device), etc.
  • mobile phones or called "cellular" phones
  • computers with mobile terminal equipment portable, pocket, hand-held, computer built-in or vehicle-mounted mobile devices, smart wearable devices, etc.
  • PCS personal communication service
  • cordless telephone cordless telephone
  • session initiation protocol session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • constrained devices such as devices with low power consumption, or devices with limited storage capabilities, or devices with limited computing capabilities, etc.
  • it includes barcodes, radio frequency identification (radio frequency identification, RFID), sensors, global positioning system (global positioning system, GPS), laser scanners and other information sensing devices.
  • the terminal device may also be a wearable device.
  • Wearable devices can also be called wearable smart devices, which is a general term for the application of wearable technology to intelligently design daily wear and develop wearable devices, such as glasses, gloves, watches, clothing and shoes.
  • a wearable device is a portable device that is worn directly on the body or integrated into the user's clothing or accessories. Wearable devices are not only a hardware device, but also achieve powerful functions through software support, data interaction, and cloud interaction.
  • Generalized wearable smart devices include full-featured, large-sized, complete or partial functions without relying on smart phones, such as smart watches or smart glasses, etc., and only focus on a certain type of application functions, and need to cooperate with other devices such as smart phones Use, such as various smart bracelets, smart helmets, smart jewelry, etc. for physical sign monitoring.
  • the network equipment in the embodiment of the present application may include access network (access network, AN) equipment, radio access network (radio access network, RAN) equipment, access network equipment such as base stations (for example, access point), may refer to a device in an access network that communicates with a wireless terminal device through one or more cells over an air interface.
  • the base station can be used to convert received over-the-air frames to and from Internet Protocol (IP) packets, acting as a router between the terminal device and the rest of the access network, which can include the IP network.
  • IP Internet Protocol
  • the network side device can also coordinate attribute management of the air interface.
  • the network equipment may include an evolved base station (NodeB or eNB or e-NodeB, evolved Node B) in a long term evolution (long term evolution, LTE) system or an advanced long term evolution (long term evolution-advanced, LTE-A), Or it can also include the next generation node B (next generation node B, gNB) or the next generation evolved base station (next generation evolved base station) in the fifth generation mobile communication technology (the 5th generation, 5G) new air interface (new radio, NR) system nodeB, ng-eNB), en-gNB (enhanced next generation node B, gNB): Enhanced next-generation base stations; can also include centralized units in the cloud access network (cloud radio access network, Cloud RAN) system (centralized unit, CU) and a distributed unit (distributed unit, DU), or may also include a relay device, which is not limited in this embodiment of the present application.
  • a relay device which is not limited in this embodiment of the present application.
  • the present application also provides another communication system, as shown in Figure 2, the communication system may also include session management function (session management function, SMF), access and mobility management function (access and mobility management function, AMF), user plane function (User Plane Function, UPF) and functional entities such as DN.
  • session management function session management function
  • AMF access and mobility management function
  • UPF User Plane Function
  • Each function may be connected through an interface, and the serial number or name of the interface is not limited in this embodiment of the application.
  • the interface defined in the 3GPP related standard protocol of the 5G system may be used, or the interface in the future communication system may be used.
  • the terminal device communicates with the AMF through the next generation network (next generation, N)1 interface (N1 for short), the network device communicates with the AMF through the N2 interface (N2 for short), and the network device communicates with the local UPF through the N3 interface (N3 for short).
  • the UPF communicates with the DN through the N6 interface (N6 for short).
  • the AMF communicates with the SMF through the N11 interface (N11 for short), and the SMF communicates with the UPF through the N4 interface (N4 for short).
  • Each function included in the communication system may also be called a functional entity, a network element or other names.
  • SMF may be referred to as an SMF entity.
  • each function in the embodiment of the present application can be realized by one device, can also be realized by multiple devices, or can be realized by one or more functional modules in one device, and this embodiment of the present application does not make any Specific limits.
  • the various functions involved in the embodiments of the present application can be network elements in hardware devices, software functions running on dedicated hardware, or a combination of hardware and software, or platforms (for example, cloud platform) instantiated virtualization functions.
  • each function may also include other functional entities formed by the fusion of any of the above-mentioned functions, for example, it has two types of session management and policy control.
  • the communication systems shown in FIG. 1 to FIG. 2 do not constitute a limitation to the applicable communication systems of the embodiments of the present application.
  • the number of terminal devices in Figure 2 is just an example.
  • a network device can provide services for multiple terminal devices, and the network device, as well as all or part of the terminal devices among the multiple terminal devices, can all use this method.
  • the method provided in the embodiment of the application determines the scheduling limit.
  • the communication system architecture shown in FIG. 1 and/or FIG. 2 may be a non-roaming 5G system architecture.
  • the method in the embodiment of the present application is also applicable to a roaming 5G system architecture and various communication networks in the future.
  • Each function or device involved in the embodiment of the present application may also be referred to as a communication device, which may be a general-purpose device or a special-purpose device, which is not specifically limited in the embodiment of the present application.
  • the embodiment of the present application provides a technical solution for the first node and the second node to release the connection after confirming the updated key, and to establish a connection using a new key, and provides communication in the converged communication scenario of different communication systems
  • This method effectively improves the security of communication.
  • the method and the device are based on the same technical conception. Since the principles of the method and the device to solve the problem are similar, the implementation of the device and the method can be referred to each other, and the repetition will not be repeated.
  • FIG. 3 is a flow chart of the method.
  • the first node acquires a second key used for communication authentication with the second node.
  • the second key in this embodiment of the present application is different from the pre-configured first key.
  • the first node is used for communication authentication of the first communication connection
  • the second node is used for communication authentication of the second communication connection
  • the first key is a key derived (or negotiated) based on the first communication system
  • the second key is derived based on the second communication system ( or negotiated)
  • the first communication system is different from the second communication system.
  • the first communication system in this application may be a single communication system, such as a wireless short-distance communication system, a 5G cellular network communication system, an ultra-high reliability and low-latency communication system, an enhanced mobile broadband communication system, and a massive machine connection communication system, etc.
  • the second communication system may be a communication system after the fusion of different communication systems, such as a communication system obtained after the fusion of a wireless short-distance communication system and a 5G cellular network communication system, and a 5G cellular network communication system and an ultra-high reliability low-time communication system.
  • the communication system obtained after the fusion of the extended communication system may be a single communication system, such as a wireless short-distance communication system, a 5G cellular network communication system, an ultra-high reliability and low-latency communication system, an enhanced mobile broadband communication system, and a massive machine connection communication system, etc.
  • the second communication system may be a communication system after the fusion of different communication systems, such as a communication system obtained after the fusion
  • the first key may be a key used for authentication during the initial connection phase between the first node and the second node.
  • the first key may be pre-configured between the first node and the second node before the initial connection; or, the first key may be determined by the second node and indicated to the first node through signaling or, the first key may be determined by the first node and indicated to the second node through signaling, which is not limited in this application.
  • the second key may be determined by the first node after the first node establishes the first communication connection with the second node, and indicated to the second node through signaling; or, the second key may be After the first node establishes the first communication connection with the second node, the second node determines and indicates to the first node through signaling; or, the second key may be established by the first node and the second node in the first After the communication connection, the first node and the second node jointly negotiate, which is not limited in this application.
  • the second key obtained by the first node and used for communication authentication with the second node has a certain timeliness. It can be understood that if the second key If valid, the second key can be used for authentication of the second communication connection; if the second key is invalid, the second key cannot be used for authentication of the second communication connection. Further, after the second key becomes invalid, a key update can be performed.
  • step 1 may also be included: the first node performs a fusion connection with the second node (that is, implements an initial authentication process in a scenario where different communication systems are converged).
  • step 1 can be that the first node and the second node perform the authentication of the initial connection based on the first key, and the first node and the second node determine that the authentication of the initial connection based on the first key is successful Afterwards, the first node and the second node establish a first communication connection for communication authentication based on the first key.
  • the second node acquires a second key used for communication authentication with the first node.
  • the second key may be determined by the first node after the first node establishes the first communication connection with the second node, and indicated to the second node through signaling; or, the second key may be After the first node establishes the first communication connection with the second node, the second node determines and indicates to the first node through signaling; or, the second key may be established by the first node and the second node in the first After the communication connection, the first node and the second node jointly negotiate, which is not limited in this application.
  • the second node sends a release request for the first communication connection to the first node.
  • the release request may include one or more of the following information 1 to information 4:
  • Request reason information where the request reason information is used to indicate key update for communication authentication.
  • request time where the request time is used to indicate the time when the second node sends the release request.
  • the request time may be represented by a timestamp.
  • release time where the release time is used to indicate the time when the first node releases the first communication connection.
  • the release time may indicate a specific time, for example, the specific time is the first minute after the first node receives the release request, then the first node, after receiving the release request, according to the The release time is to release the first communication connection in the first minute after receiving the release request; or, the release time may indicate a specific time period, for example, the specific time period is within five minutes after the first node receives the release request , then after receiving the release request, the first node releases the first communication connection within five minutes after receiving the release request according to the release time included in the release request.
  • Information 4 information used to indicate that wireless resources are suspended.
  • the release request may also be used to indicate to suspend wireless resources.
  • the release request may include information for indicating that the wireless resource corresponding to the first communication connection is suspended.
  • the first node and the second node determine that the first key used for communication authentication is updated to the second key, when the first communication connection is released and the second communication connection is not successfully established, by making the first communication connection correspond to The wireless resources are suspended and not released, which can effectively facilitate the rapid recovery of the communication link.
  • the content of the information 1-4 included in the release request is only an enumeration of the information included in the release request, and does not constitute a limitation on the information included in the release request.
  • the release request received by the first node from the second node may include but not limited to:
  • the release request may be based on an improvement of the transmission signaling between the first node and the second node, or the release request may be carried on the transmission signaling between the first node and the second node.
  • the The release request may be included in the signaling sent by the first node to the second node to indicate the second key; or, the release request may be new signaling between the first node and the second node.
  • the second node releases the first communication connection with the first node.
  • the second node after receiving the second key, the second node can determine that the key has been updated, and therefore, the second node can trigger the release of the first key with the first node.
  • a communication connection establishing a second communication connection for communication authentication based on the second key.
  • the second node may also receive a release request response from the first node, which is used to notify the first node of the release request for the first communication connection. - The release of the communication connection.
  • the second node may release the first communication connection with the first node before performing S302, that is, the second node releases the first communication connection with the first node after obtaining the second key or, the second node may release the first communication connection with the first node after performing S302, that is, after the second node sends a release request for the first communication connection to the first node, release the connection with the first node.
  • the first communication connection of a node; or, the second node may also release the first communication connection with the first node after receiving the release request response from the first node and determining that the first node has completed the release of the first communication connection. the first communication connection.
  • the first node receives a release request for the first communication connection from the second node.
  • the first node releases the first communication connection with the second node.
  • the first node may trigger the release of the first communication connection with the second node.
  • the first node may also send a response based on the release request to the second node, for notifying the second node of its release of the first communication connection.
  • the first node sends a connection establishment request to the second node, where the connection establishment request is used to request establishment of a connection based on the second key.
  • connection establishment request sent by the first node to the second node may include but not limited to:
  • connection establishment request may be based on an improvement of the transmission signaling between the first node and the second node, or the connection establishment request may be carried on the transmission signaling between the first node and the second node; or, the connection establishment request It may be new signaling between the first node and the second node.
  • connection establishment request may include one or more of the following information 1-information 4:
  • Request reason information where the request reason information is used to indicate key update for communication authentication.
  • request time where the request time is used to indicate the time when the first node sends the connection establishment request.
  • the request time may be represented by a timestamp.
  • connection establishment time where the connection establishment time is used to indicate the time when the first node establishes the second communication connection with the second node.
  • the connection establishment time may indicate a specific time, for example, the specific time is the first minute after the second node receives the connection establishment request, then the second node, after receiving the connection establishment request, The connection establishment time included in the request establishes a second communication connection with the first node in the first minute after receiving the connection establishment request; or, the connection establishment time may indicate a specific time period, for example, the specific time period is the second Within five minutes after the node receives the connection establishment request, the second node, after receiving the connection establishment request, according to the connection establishment time included in the connection establishment request, within five minutes after receiving the connection establishment request A second communication connection is established with the first node.
  • Information 4 Information used to indicate connection recovery.
  • connection establishment request may be a connection recovery request between the first node and the second node. That is, after the first communication connection between the first node and the second node is released, the first node and the second node need to establish a second communication connection based on the second key for communication authentication, then the first node can send to the second node A connection restoration request. After receiving the connection restoration request, the second node establishes a communication connection with the first node.
  • connection establishment request contents of the information 1 to 4 included in the above connection establishment request are only an enumeration of the information included in the connection establishment request, and do not constitute a limitation on the information included in the connection establishment request.
  • the second node receives the connection establishment request sent from the first node.
  • connection establishment request is used to request to establish a connection based on the second key, and may include: the connection establishment request is used to request to perform authentication and security context negotiation processes based on the second key.
  • the authentication and security context negotiation process may include the identity authentication process of the first node and the second node (for example, the interaction of authentication information and authentication response).
  • the content of the identity authentication process of the first and second nodes can be as follows:
  • the second node After the second node receives the connection establishment request sent by the first node, the second node sends authentication information based on the second key to the first node, and the authentication information is used to verify the second node's identity.
  • the authentication information is used to verify the identity of the second node, it can be understood that the first node can use the authentication information to verify whether the second communication connection with the second node can be established based on the second key.
  • the authentication information may include an authentication vector calculated by the second node using the second key.
  • the first node receives authentication information based on the second key from the second node, and after determining that the second node has passed the authentication, the first node sends an authentication message for the authentication information to the second node.
  • the authentication response is used to verify the identity of the first node.
  • the authentication response is used to verify the identity of the first node, it can be understood that the second node can use the authentication response to verify whether the second communication connection with the first node can be established based on the second key.
  • the first node may determine whether the second node passes the authentication according to the authentication vector calculated by the second node using the second key included in the received authentication information.
  • the first node after receiving the authentication information, obtains the first authentication vector calculated by the second node based on the second key in the authentication information.
  • the first node calculates a second authentication vector based on the second key, and then compares the first authentication vector with the second authentication vector. If the first authentication vector and the second authentication vector meet the authentication requirement, for example, the authentication requirement can be that the first authentication vector and the second authentication vector are the same, or the sum of the first authentication vector and the second authentication vector is zero, etc., then The first node determines that the second node has passed the authentication, and if the first authentication vector and the second authentication vector do not meet the authentication requirements, the first node determines that the second node has not passed the authentication.
  • the second node receives the authentication response sent by the first node, and performs identity verification on the first node based on the authentication response.
  • Scenario 1 After obtaining the second key, the first node actively releases the first communication connection.
  • the following steps may be performed in the method corresponding to the scenario.
  • the first node and the second node establish a first communication connection based on the first key.
  • the first node acquires a second key used for communication authentication with the second node.
  • the second node acquires a second key used for communication authentication with the first node.
  • the second node releases the first communication connection with the first node.
  • the first node releases the first communication connection with the second node.
  • the first node sends a connection establishment request to the second node, where the connection establishment request is used to request establishment of a connection based on the second key.
  • the second node receives the connection establishment request sent from the first node.
  • the second node sends authentication information based on the second key to the first node, where the authentication information is used to verify the identity of the second node.
  • the first node receives authentication information based on the second key from the second node.
  • the first node determines whether the second node is authenticated, if yes, executes S410, if not, executes S411.
  • the first node sends an authentication response to the authentication information to the second node, where the authentication response is used to verify the identity of the first node, and proceed to S412.
  • the authentication response includes authentication information generated based on the second key.
  • the authentication information may include one or more of the following information 1-2:
  • the authentication vector obtained by the first node based on the second key for example, the second authentication vector in the example content of step S305 above.
  • the content of information 1-2 included in the authentication information is only an enumeration of the information included in the authentication information, and does not constitute a limitation on the information included in the authentication information.
  • the first node After determining that the second node fails to authenticate the second communication connection based on the second key, the first node terminates the communication transmission.
  • the present application is an optional method, after the first node determines that the authentication of the second node has failed, the second node can also initiate communication authentication based on the second key again, when the number of authentication failures reaches the threshold number of failures , to terminate the communication transmission.
  • the first node may send an authentication failure message to the second node after determining for the first time that the communication authentication of the second node based on the second key fails.
  • the second node may send authentication information based on the second key to the first node again to re-authenticate.
  • the first node receives authentication information based on the second key from the second node again and performs communication authentication. If the first node determines that the second node's communication based on the second key still fails during the second authentication, then at this time, the first node determines that the number of authentication failures reaches the threshold of 2 times, and then terminates the communication transmission.
  • the second node may terminate the communication transmission; or, the first node may terminate the communication transmission Afterwards, a message for terminating the communication transmission may be sent to the second node, and the second node terminates the communication transmission after receiving the message for terminating the communication transmission from the first node.
  • the second node receives the authentication response sent from the first node.
  • the second node that receives the authentication response can judge whether the first node has passed the authentication according to the authentication information contained in the authentication response and generated based on the second key.
  • the specific judgment method can be Refer to the judging manner of the first node above, for a brief description, details are not repeated here.
  • the second node determines whether the first node is authenticated, if yes, executes S414, and if not, executes S415.
  • the second node After determining that the second node passes the authentication, the second node establishes a second communication connection with the first node, and continues to execute S416.
  • the second node terminates the communication transmission after determining that the first node fails to authenticate the second communication connection based on the second key.
  • the second node may send a message of terminating the communication transmission to the first node, and the first node receives the message of terminating the communication transmission from the second node. After the message, the communication transmission is terminated.
  • the first node After completing the establishment of the second communication connection with the second node, the first node notifies the second node that the establishment of the second communication connection is completed.
  • the first node performs information transmission with the third node through the backhaul link between the second node and the third node.
  • step numbers do not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any obligation for the implementation process of the embodiment of the present application. limited.
  • S402 may take precedence over S401.
  • the above-mentioned steps are not limited, and any additions, deletions, modifications, etc. to the above-mentioned steps belong to the protection scope of the present application.
  • Scenario 2 After receiving the release request for the first communication connection from the second node, the first node releases the first communication connection.
  • the method corresponding to the second scenario may perform the following steps.
  • the first node and the second node establish a first communication connection based on the first key.
  • the first node acquires a second key used for communication authentication with the second node.
  • the second node acquires a second key used for communication authentication with the first node.
  • the second node releases the first communication connection with the first node.
  • the second node sends a release request for the first communication connection to the first node.
  • the first node receives a release request for the first communication connection from the second node.
  • the first node releases the first communication connection with the second node.
  • the first node sends a connection establishment request to the second node, where the connection establishment request is used to request establishment of a connection based on the second key.
  • the second node receives the connection establishment request sent from the first node.
  • the second node sends authentication information based on the second key to the first node, where the authentication information is used to verify the identity of the second node.
  • the first node receives authentication information based on the second key from the second node.
  • the first node determines whether the second node is authenticated. If yes, execute S512. If not, execute S513.
  • the first node After determining that the second node has passed the authentication, the first node sends an authentication response to the authentication information to the second node, where the authentication response is used to verify the identity of the first node, and proceed to S514.
  • the first node After determining that the second node fails to authenticate the second communication connection based on the second key, the first node terminates the communication transmission.
  • the second node receives the authentication response sent from the first node.
  • the second node that receives the authentication response can determine whether the first node has passed the authentication according to the authentication information generated based on the second key contained in the authentication response,
  • the judgment method of the first node above which is not described here for brevity.
  • the second node determines whether the first node is authenticated, if yes, executes S516, and if not, executes S517.
  • the second node After determining that the first node fails to authenticate the second communication connection based on the second key, the second node terminates the communication transmission.
  • the first node After completing the establishment of the second communication connection with the second node, the first node notifies the second node that the establishment of the second communication connection is completed.
  • the first node performs information transmission with the third node through the backhaul link between the second node and the third node.
  • step numbers do not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any obligation for the implementation process of the embodiment of the present application. limited.
  • S502 may take precedence over S501.
  • the above-mentioned steps are not limited, and any additions, deletions, modifications, etc. to the above-mentioned steps belong to the protection scope of the present application.
  • the second node may also suspend the backhaul link after releasing the first communication connection with the first node. Then, after the second node determines that the second communication connection is successfully established with the first node, the backhaul link may be activated.
  • the first node and the second node establish a first communication connection based on the first key.
  • the first node acquires a second key used for communication authentication with the second node.
  • the second node acquires a second key used for communication authentication with the first node.
  • the second node releases the first communication connection with the first node.
  • the second node suspends the backhaul link with the third node.
  • the second node sends a release request for the first communication connection to the first node.
  • the first node receives a release request for the first communication connection from the second node.
  • the first node releases the first communication connection with the second node.
  • the first node sends a connection establishment request to the second node, where the connection establishment request is used to request establishment of a connection based on the second key.
  • the second node receives the connection establishment request sent from the first node.
  • the second node sends authentication information based on the second key to the first node, where the authentication information is used to verify the identity of the second node.
  • the first node receives authentication information based on the second key from the second node.
  • the first node After determining that the second node has passed the authentication, the first node sends an authentication response to the authentication information to the second node, where the authentication response is used to verify the identity of the first node.
  • the second node receives the authentication response sent from the first node.
  • the second node After determining that the second node passes the authentication, the second node establishes a second communication connection with the first node.
  • the first node After completing the establishment of the second communication connection with the second node, the first node notifies the second node that the establishment of the second communication connection is completed.
  • the second node activates the backhaul link after determining that the second communication connection is successfully established with the first node.
  • the first node performs information transmission with the third node through the backhaul link between the second node and the third node.
  • step numbers do not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any obligation for the implementation process of the embodiment of the present application. limited.
  • S605 may take precedence over S604.
  • the above-mentioned steps are not limited, and any additions, deletions, modifications, etc. to the above-mentioned steps belong to the protection scope of the present application.
  • the first node and the second node can also verify the second key during the process of communication and transmission using the second key. Key is valid.
  • the first node can judge whether the second key is valid, and then notify the second node of the judgment result of the second key; or, the second node can judge whether the second key is valid. If the key is valid, then notify the first node of the judgment result of the second key; or, both the first node and the second node may judge the validity of the second key.
  • the second key is valid within a first duration
  • the first duration may be defined by a timer or a time stamp.
  • the first duration can be counted from the first moment, and the first moment can be the moment when the first communication connection is released, or the moment when the second node receives the connection establishment request and/or the first node sends
  • the timing of the connection establishment request is not specifically limited.
  • Mode 1 the first node and the second node respectively determine whether the second key is valid based on their corresponding timers.
  • the first node and the second node establish a first communication connection based on the first key.
  • the first node acquires a second key used for communication authentication with the second node.
  • the second node acquires a second key used for communication authentication with the first node.
  • the second node releases the first communication connection with the first node.
  • the second node starts a corresponding second timer for determining the validity of the second key.
  • the normal operation duration of the second timer is the first duration.
  • the second node sends a release request for the first communication connection to the first node.
  • the first node receives a release request for the first communication connection from the second node.
  • the first node releases the first communication connection with the second node.
  • the first node starts a corresponding first timer for determining the validity of the second key.
  • the normal operation duration of the first timer is the first duration.
  • the first node sends a connection establishment request to the second node, where the connection establishment request is used to request establishment of a connection based on the second key.
  • the second node receives the connection establishment request sent from the first node.
  • the second node sends authentication information based on the second key to the first node, where the authentication information is used to verify the identity of the second node.
  • the first node receives authentication information based on the second key from the second node.
  • the first node After determining that the second node has passed the authentication, the first node sends an authentication response to the authentication information to the second node, where the authentication response is used to verify the identity of the first node.
  • the second node receives the authentication response sent from the first node.
  • the second node After determining that the second node passes the authentication, the second node establishes a second communication connection with the first node.
  • the first node After completing the establishment of the second communication connection with the second node, the first node notifies the second node that the establishment of the second communication connection is completed.
  • the first node closes the corresponding first timer.
  • the first node judges whether the first timer times out, and if it times out, executes S719, and if not, executes S720.
  • the first node determines that the second key is invalid, and terminates communication transmission.
  • the first node performs information transmission with the third node through the backhaul link between the second node and the third node.
  • the second node After receiving the notification from the first node that the establishment of the second communication connection is completed, the second node closes the corresponding second timer.
  • the second node judges whether the second timer times out, and if it times out, executes S723, and if not, executes S724.
  • the second node determines that the second key is invalid, and terminates communication transmission.
  • the second node sends the transmission information from the first node to the third node through the backhaul link between the second node and the third node.
  • the time when the first node starts the corresponding first timer is not limited to after step S707 is performed, for example, the first node starts the corresponding first timer
  • the moment at which S709 is executed can also be performed; similarly, the moment at which the second node starts the corresponding second timer is not limited to after performing step S704.
  • the moment at which the second node starts the corresponding second timer can also be performed after executing After S710.
  • step numbers do not mean the order of execution, the execution order of each process should be determined by its function and internal logic, and should not constitute any obligation for the implementation process of the embodiment of the present application. limited.
  • S702 may take precedence over S701.
  • the above-mentioned steps are not limited, and any additions, deletions, modifications, etc. to the above-mentioned steps belong to the protection scope of the present application.
  • Mode 2 the first node and the second node jointly maintain the same timer to determine whether the second key is valid.
  • the first node and the second node establish a first communication connection based on the first key.
  • the first node acquires a second key used for communication authentication with the second node.
  • the second node acquires a second key used for communication authentication with the first node.
  • the second node releases the first communication connection with the first node.
  • the second node starts a timer for determining the validity of the second key.
  • the second node sends a release request for the first communication connection to the first node.
  • the first node receives a release request for the first communication connection from the second node.
  • the first node releases the first communication connection with the second node.
  • the first node sends a connection establishment request to the second node, where the connection establishment request is used to request establishment of a connection based on the second key.
  • the second node receives the connection establishment request sent from the first node.
  • the second node sends authentication information based on the second key to the first node, where the authentication information is used to verify the identity of the second node.
  • the first node receives authentication information based on the second key from the second node.
  • the first node After determining that the second node has passed the authentication, the first node sends an authentication response to the authentication information to the second node, where the authentication response is used to verify the identity of the first node.
  • the second node receives the authentication response sent from the first node.
  • the second node After determining that the second node passes the authentication, the second node establishes a second communication connection with the first node.
  • the first node After completing the establishment of the second communication connection with the second node, the first node notifies the second node that the establishment of the second communication connection is completed.
  • the first node disables the timer.
  • the first node judges whether the timer times out, and if it times out, executes S818, and if not, executes S819.
  • the first node determines that the second key is invalid, and terminates communication transmission.
  • the first node may also notify the second node of the second key invalidation result.
  • the first node performs information transmission with the third node through the backhaul link between the second node and the third node.
  • the timer can also be started by the first node, and the timer can be turned off by the second node. For example, after the first node executes S807, the timer is started. After the second node receives the notification that the second communication connection establishment is completed sent by the first node in S815, it closes the timer; key is valid.
  • step numbers do not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any obligation for the implementation process of the embodiment of the present application. limited.
  • S802 may take precedence over S801.
  • the above-mentioned steps are not limited, and any additions, deletions, modifications, etc. to the above-mentioned steps belong to the protection scope of the present application.
  • Manner 3 The first node and the second node determine whether the second key is valid based on the time stamp carried in the signaling.
  • the first node and the second node establish a first communication connection based on the first key.
  • the first node acquires a second key used for communication authentication with the second node.
  • the second node acquires a second key used for communication authentication with the first node.
  • the second node releases the first communication connection with the first node.
  • the second node sends a release request for the first communication connection to the first node, where the release request carries the first timestamp.
  • the first timestamp may be the time when the second node sends the release request to the first node.
  • the second node records the first timestamp after sending the release request to the first node.
  • the first node receives the release request for the first communication connection from the second node, and acquires the first timestamp.
  • the first node releases the first communication connection with the second node.
  • the first node sends a connection establishment request to the second node, where the connection establishment request is used to request establishment of a connection based on the second key.
  • the second node receives the connection establishment request sent from the first node.
  • the second node sends authentication information based on the second key to the first node, where the authentication information is used to verify the identity of the second node.
  • the first node receives authentication information based on the second key from the second node.
  • the first node After determining that the second node has passed the authentication, the first node sends an authentication response to the authentication information to the second node, where the authentication response is used to verify the identity of the first node.
  • the second node receives the authentication response sent from the first node.
  • the second node After determining that the second node passes the authentication, the second node establishes a second communication connection with the first node.
  • the first node After completing the establishment of the second communication connection with the second node, the first node sends an establishment complete message to the second node, where the establishment complete message carries a second time stamp.
  • the establishment complete message is used to notify the second node that the first node has completed the establishment of the second communication connection.
  • the second time stamp may be the time when the first node sends the establishment completion message to the second node; or, the second time stamp may be the time when the first node completes the establishment of the second communication connection.
  • the first node records the second timestamp.
  • the first node determines whether the time difference between the second time stamp and the first time stamp is not greater than the first time time. If yes, perform S916; if not, perform S917.
  • the first node performs information transmission with the third node through the backhaul link between the second node and the third node.
  • the first node determines that the second key is invalid, and terminates communication transmission.
  • the second node After receiving the establishment complete message, the second node acquires the second timestamp.
  • the second node determines whether the time difference between the second time stamp and the first time stamp is not greater than the first time time. If yes, perform S920; if not, perform S921.
  • the second node sends the transmission information from the first node to the third node through the backhaul link between the second node and the third node.
  • the second node determines that the second key is invalid, and terminates communication transmission.
  • the method flow shown in FIG. 9 is only an example for the first node and the second node to determine whether the second key is valid through the timestamp, and does not constitute a limitation on the method for determining whether the second key is valid through the timestamp. , and are not limited to the above steps, and any additions, deletions, deformations, etc. to the above steps belong to the protection scope of the present application.
  • the content of judging the validity of the second key using this method 3 is similar to the content of the above-mentioned figure 9.
  • This application further verifies whether the second key is valid through the process of communication and transmission between the first node and the second node using the second key, which can ensure the timeliness of the second key and better ensure the security of communication transmission sex.
  • the present application provides a communication method in a scenario where different communication systems perform converged communication, which effectively improves communication security.
  • the content of the above-mentioned Figures 3 to 9 does not constitute a limitation on the communication method provided by this application. Any modification to the content of the above-mentioned Figures 3 to 9 belongs to the scope of protection of this application.
  • the above-mentioned Figure 4 The contents of Figure 6 and Figure 7 are combined to obtain a communication scheme in which the application suspends and activates the backhaul link and verifies the validity of the second key in Scenario 1, which can better reduce system overhead, Improve communication security.
  • the method and the device are conceived based on the same or similar technology. Since the principle of solving the problem of the method and the device is similar, the implementation of the device and the method can be referred to each other, and the repetition will not be repeated.
  • the terms "system” and "network” in the embodiments of the present application may be used interchangeably.
  • “and/or” describes the association relationship of associated objects, indicating that there may be three types of relationships, for example, A and/or B, which may mean: A exists alone, A and B exist simultaneously, and There are three cases of B.
  • the character "/" generally indicates that the contextual objects are an "or” relationship.
  • the at least one involved in this application refers to one or more; a plurality refers to two or more than two.
  • terms such as “first”, “second”, and “third” are only used for the purpose of distinguishing descriptions, and should not be understood as indicating or implying relative importance. Neither should it be construed as indicating or implying an order.
  • Reference to “one embodiment” or “some embodiments” or the like in this specification means that a particular feature, structure, or characteristic described in connection with the embodiment is included in one or more embodiments of the present application. Thus, appearances of the phrases “in one embodiment,” “in some embodiments,” “in other embodiments,” “in other embodiments,” etc.
  • Fig. 10 is a schematic block diagram of an apparatus 1000 provided by an embodiment of the present application, which is used to realize the functions of the first apparatus or the second apparatus in the above method embodiment.
  • the device may be a software module or a system on a chip.
  • the chip may consist of chips, or may include chips and other discrete devices.
  • the apparatus 1000 includes a processing unit 1001 and a communication unit 1002 .
  • the communication unit 1002 is used to communicate with other devices, and can also be called a communication interface, a transceiver unit, or an input/output interface, etc.
  • the above-mentioned device 1000 can be used to realize the function of the first device in the above method, and the device 1000 can be the first device, or a chip or a circuit configured in the first device.
  • the processing unit 1001 may be configured to perform processing-related operations of the first device in the above method embodiments, and the communication unit 1002 may be configured to instruct the first device to perform transceiving-related operations in the above method embodiments.
  • the processing unit 1001 is configured to obtain a second key used for communication authentication with the second node, the second key is different from the pre-configured first key; the communication unit 1002 is configured to receive the second key from the second node A release request for the first communication connection by the two nodes, the first key is used for communication authentication of the first communication connection; the communication unit 1002 is further configured to send a connection establishment request to the second node , the connection establishment request is used to request to establish a connection based on the second key.
  • connection establishment request is used to request to establish a connection based on the second key, including that the connection establishment request is used to request to perform an authentication and security context negotiation process based on the second key.
  • the communication unit 1002 is further configured to receive authentication information based on the second key from the second node; the authentication information is used to verify the identity of the second node.
  • the authentication information is used to verify the identity of the second node, including whether the authentication information is used to verify whether to establish a second communication connection with the second node based on the second key.
  • the communication unit 1002 is further configured to send an authentication response based on the second key to the second node, where the authentication response is used to verify the identity of the first node.
  • the authentication response is used to verify the identity of the first node, including used for the second node to verify whether to establish the second communication connection with the first node based on the second key.
  • the release request includes request reason information; the request reason information is used to indicate key update for communication authentication.
  • the second key is valid within a first duration
  • the first duration is defined by a timer or a time stamp.
  • the second key is valid within a first duration starting from a first moment, and the first moment is a moment when the first communication connection is released, or a moment when the connection establishment request is sent.
  • the processing unit 1001 is further configured to perform information transmission with the third node through a backhaul link between the second node and the third node within the validity period of the second key.
  • the first key is a key derived (or negotiated) based on the first communication system
  • the second key is a key derived (or negotiated) based on the second communication system
  • the first communication system is different from the second communication system.
  • the above-mentioned device 1000 can be used to realize the function of the second device in the above method embodiment, and the device 1000 can be the second device, or a chip or a circuit configured in the second device.
  • the processing unit 1001 may be used to perform processing related operations of the second device in the above method embodiments, and the communication unit 1002 may be used to perform sending and receiving related operations of the second device in the above method embodiments.
  • the processing unit 1001 is configured to obtain a second key used for communicating with the first node for authentication, the second key being different from the pre-configured first key; the communication unit 1002 is configured to send the first node sending a release request for the first communication connection, where the first key is used for communication authentication of the first communication connection; the communication unit 1002 is further configured to receive a connection establishment request sent from the first node, The connection establishment request is used to request to establish a connection based on the second key.
  • connection establishment request is used to request to establish a connection based on the second key, including that the connection establishment request is used to request to perform an authentication and security context negotiation process based on the second key.
  • the communication unit 1002 is further configured to send authentication information based on the second key to the first node; the authentication information is used to verify the identity of the second node.
  • the authentication information is used to verify the identity of the second node, including that the authentication information is used by the first node to verify whether to establish a second communication with the second node based on the second key connect.
  • the first key is a key derived (or negotiated) based on the first communication system
  • the second key is a key derived (or negotiated) based on the second communication system
  • the first communication system is different from the second communication system.
  • the communication unit 1002 is further configured to receive an authentication response based on the second key from the first node; the authentication response is used to verify the identity of the first node.
  • the authentication response is used to verify the identity of the first node, including that the authentication response is used by the second node to verify whether the second key is established with the first node based on the second key.
  • the release request includes request reason information; the request reason information is used to indicate key update for communication authentication.
  • the second key is valid within a first duration
  • the first duration may be defined by a timer or a time stamp.
  • the second key is valid within the first duration starting from the first moment, the first moment is the moment when the first communication connection is released, or the second node receives the connection establishment moment of request.
  • the processing unit 1001 is further configured to pass the transmission information from the first node through the backhaul link between the second node and the third node within the validity period of the second key, sent to the third node.
  • the processing unit 1001 is further configured to suspend the backhaul link.
  • the processing unit 1001 is further configured to activate the backhaul link after determining that the second communication connection with the first node is successfully established; the second communication connection is based on the second key for communication authentication.
  • each functional unit may be integrated into one processor, or physically exist separately, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.
  • FIG. 11 is a schematic diagram of an apparatus 1100 provided by an embodiment of the present application.
  • the apparatus 1100 may be a node, or a component in a node, such as a chip or an integrated circuit.
  • the apparatus 1100 can include at least one processor 1102 and a communication interface 1104 .
  • the device may further include at least one memory 1101 .
  • a bus 1103 may also be included. Wherein, the memory 1101 , the processor 1102 and the communication interface 1104 are connected through a bus 1103 .
  • the memory 1101 is used to provide a storage space, in which data such as operating systems and computer programs can be stored.
  • the memory 1101 mentioned in the embodiment of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM double data rate synchronous dynamic random access memory
  • double data rate SDRAM double data rate SDRAM
  • DDR SDRAM enhanced synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • serial link DRAM SLDRAM
  • direct memory bus random access memory direct rambus RAM, DR RAM
  • Processor 1102 is a module for performing arithmetic operations and/or logic operations, specifically, it may be a central processing unit (central processing unit, CPU), a picture processor (graphics processing unit, GPU), a microprocessor (microprocessor unit, MPU), Application specific integrated circuit (ASIC), field programmable logic gate array (field programmable gate array, FPGA), complex programmable logic device (complex programmable logic device, CPLD), coprocessor (to assist the central processing unit to complete Corresponding processing and application), microcontroller unit (microcontroller unit, MCU) and other processing modules or a combination of more.
  • CPU central processing unit
  • CPU central processing unit
  • MPU graphics processing unit
  • ASIC application specific integrated circuit
  • FPGA field programmable logic gate array
  • FPGA field programmable gate array
  • CPLD complex programmable logic device
  • coprocessor to assist the central processing unit to complete Corresponding processing and application
  • microcontroller unit microcontroller unit, MCU
  • the processor is a general-purpose processor, ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components
  • the memory storage module may be integrated in the processor.
  • Communication interface 1104 may be used to provide information input or output to the at least one processor. And/or the communication interface can be used to receive data sent from the outside and/or send data to the outside, which can be a wired link interface such as an Ethernet cable, or a wireless link (Wi-Fi, Bluetooth, General wireless transmission, vehicle short-distance communication technology, etc.) interface.
  • the communication interface 1104 may further include a transmitter (such as a radio frequency transmitter, an antenna, etc.) or a receiver coupled with the interface.
  • the above-mentioned device 1100 may be the first device in the above method embodiments or components in the first device, such as a chip or an integrated circuit.
  • the processor 1102 in the device 1100 is used to read the computer program stored in the memory 1101, and control the first device to perform the following operations:
  • the processor 1102 in the first device can also be used to read the program in the memory 1101 and execute the method flow executed by the first node in S300-S305 as shown in Figure 3; or execute The method flow executed by the first node in S400-S417 shown in 4; or execute the method flow executed by the first node in S500-S519 shown in Figure 5; or execute the method flow executed by the first node in S600-S617 shown in Figure 6
  • the above-mentioned device 1100 may be the second device in the above method embodiment or a component in the second device, such as a chip or an integrated circuit.
  • the processor 1102 in the device 1100 is used to read the computer program stored in the memory 1101, and control the second device to perform the following operations:
  • the processor 1102 in the second device can also be used to read the program in the memory 1101 and execute the method flow executed by the second node in S300-S305 as shown in FIG. 3; or execute The method flow executed by the second node in S400-S417 shown in 4; or execute the method flow executed by the second node in S500-S519 shown in Figure 5; or execute the method flow executed by the second node in S600-S617 shown in Figure 6
  • the embodiment of the present application also provides a terminal, and the terminal may be an intelligent terminal such as a smart phone, a notebook, and a tablet computer with a short-distance communication function, a mouse, a keyboard, an earphone, an audio system, or a vehicle-mounted playback device.
  • the terminal includes a first device and/or a second device, and the first device and the second device may be the first node and the second node in the embodiment shown in FIG. 3 above, respectively.
  • the types of the first device and the second device may be the same or different.
  • FIG. 12 shows a schematic structural diagram of a simplified terminal device.
  • the terminal device includes a processor, a memory, a radio frequency circuit, an antenna, and an input and output device.
  • the processor is mainly used to process communication protocols and communication data, control terminal equipment, execute software programs, process data of software programs, and the like.
  • Memory is primarily used to store software programs and data.
  • the radio frequency circuit is mainly used for the conversion of the baseband signal and the radio frequency signal and the processing of the radio frequency signal.
  • Antennas are mainly used to send and receive radio frequency signals in the form of electromagnetic waves.
  • Input and output devices such as touch screens, display screens, and keyboards, are mainly used to receive data input by users and output data to users. It should be noted that some types of terminal equipment may not have input and output devices.
  • the processor When data needs to be sent, the processor performs baseband processing on the data to be sent, and outputs the baseband signal to the radio frequency circuit.
  • the radio frequency circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor, and the processor converts the baseband signal into data and processes the data.
  • FIG. 12 only one memory and processor are shown in FIG. 12 . In an actual terminal device product, there may be one or more processors and one or more memories.
  • a memory may also be called a storage medium or a storage device. The memory may be set independently of the processor, or may be integrated with the processor, which is not limited in this embodiment of the present application.
  • the antenna and the radio frequency circuit with the transceiver function may be regarded as the transceiver unit of the terminal device, and the processor with the processing function may be regarded as the processing unit of the terminal device.
  • the terminal device includes a transceiver unit 1210 and a processing unit 1220 .
  • the transceiver unit may also be referred to as a transceiver, a transceiver, a transceiver device, and the like.
  • a processing unit may also be called a processor, a processing board, a processing module, a processing device, and the like.
  • the device in the transceiver unit 1210 for realizing the receiving function may be regarded as a receiving unit
  • the device in the transceiver unit 1210 for realizing the sending function may be regarded as a sending unit, that is, the transceiver unit 1210 includes a receiving unit and a sending unit.
  • the transceiver unit may sometimes also be referred to as a transceiver, a transceiver, or a transceiver circuit.
  • the receiving unit may sometimes be called a receiver, a receiver, or a receiving circuit, etc.
  • the sending unit may sometimes be called a transmitter, a transmitter, or a transmitting circuit, etc.
  • transceiver unit 1210 is used to perform the sending and receiving operations on the first node side in the method embodiment shown in FIG. 3 above, and the processing unit 1220 is used to perform the first node side in the method embodiment shown in FIG. Operations other than sending and receiving operations.
  • the transceiving unit 1210 is configured to perform the transceiving steps on the terminal device side in the embodiment shown in FIG. 3, such as S303 and S305, and/or other processes for supporting the technology described herein .
  • the processing unit 1220 is configured to execute other operations on the terminal device side in the embodiment shown in FIG. 3 except the transceiving operation, such as S300, and/or other processes for supporting the technology described herein.
  • the transceiver unit 1210 is used to perform the sending and receiving operations on the terminal device side in the method embodiment shown in FIG. other operations.
  • the transceiving unit 1210 is configured to perform the transceiving steps at the terminal device side in the embodiment shown in FIG. 4 , such as S406, and/or other processes for supporting the technology described herein.
  • the processing unit 1220 is configured to execute other operations on the terminal device side in the embodiment shown in FIG. 4 except for the transceiving operation, such as S409, and/or other processes for supporting the technology described herein.
  • the transceiver unit 1210 is used to perform the sending and receiving operations on the terminal device side in the method embodiment shown in FIG. other operations.
  • the transceiving unit 1210 is configured to perform the transceiving steps at the terminal device side in the embodiment shown in FIG. 5 , such as S508, and/or other processes for supporting the technology described herein.
  • the processing unit 1220 is configured to execute other operations on the terminal device side in the embodiment shown in FIG. 5 except the transceiving operation, such as S511, and/or other processes for supporting the technology described herein.
  • the transceiver unit 1210 is used to perform the sending and receiving operations on the terminal device side in the method embodiment shown in FIG. other operations.
  • the transceiving unit 1210 is configured to perform the transceiving steps at the terminal device side in the embodiment shown in FIG. 6 , such as S606, and/or other processes for supporting the technology described herein.
  • the processing unit 1220 is configured to execute other operations on the terminal device side in the embodiment shown in FIG. 6 except the transceiving operation, such as S604, and/or other processes for supporting the technology described herein.
  • the transceiver unit 1210 is used to perform the sending operation and receiving operation on the terminal device side in the method embodiment shown in FIG. 7 above, and the processing unit 1220 is used to perform the terminal device side in the method embodiment shown in FIG. other operations.
  • the transceiving unit 1210 is configured to perform the transceiving steps at the terminal device side in the embodiment shown in FIG. 7 , such as S706, and/or other processes for supporting the technology described herein.
  • the processing unit 1220 is configured to execute other operations on the terminal device side in the embodiment shown in FIG. 7 except the transceiving operation, such as S704, and/or other processes for supporting the technology described herein.
  • the transceiver unit 1210 is used to perform the sending and receiving operations on the terminal device side in the method embodiment shown in FIG. other operations.
  • the transceiving unit 1210 is configured to perform the transceiving steps on the terminal device side in the embodiment shown in FIG. 8 , such as S806, and/or other processes for supporting the technology described herein.
  • the processing unit 1220 is configured to execute other operations on the terminal device side in the embodiment shown in FIG. 8 except the transceiving operation, such as S804, and/or other processes for supporting the technology described herein.
  • the transceiver unit 1210 is configured to perform the sending and receiving operations on the terminal device side in the method embodiment shown in FIG. other operations.
  • the transceiving unit 1210 is configured to perform the transceiving steps at the terminal device side in the embodiment shown in FIG. 9 , such as S905, and/or other processes for supporting the technology described herein.
  • the processing unit 1220 is configured to execute other operations on the terminal device side in the embodiment shown in FIG. 9 except the transceiving operation, such as S915, and/or other processes for supporting the technology described herein.
  • the chip When the communication device is a chip, the chip includes a transceiver unit and a processing unit.
  • the transceiver unit may be an input-output circuit or a communication interface;
  • the processing unit is a processor or a microprocessor or an integrated circuit integrated on the chip.
  • the embodiments of the present application also provide a computer-readable storage medium, including instructions, which, when run on a computer, cause the computer to execute the method described in the above embodiments.
  • An embodiment of the present application further provides a system on chip, where the system on chip includes at least one processor and an interface circuit. Further optionally, the chip system may further include a memory or an external memory. The processor is configured to perform instruction and/or data interaction through the interface circuit, so as to implement the methods in the above method embodiments.
  • the system-on-a-chip may consist of chips, or may include chips and other discrete devices.
  • the embodiments of the present application also provide a computer program product, including instructions, which, when run on a computer, cause the computer to execute the method described in the above embodiments.
  • the processor may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, or a coprocessor etc., can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application.
  • a general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the methods disclosed in connection with the embodiments of the present application may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.
  • the memory may be a non-volatile memory, such as a hard disk (hard disk drive, HDD) or a solid-state drive (solid-state drive, SSD), etc., and may also be a volatile memory (volatile memory), such as Random-access memory (RAM).
  • a memory is, but is not limited to, any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer.
  • the memory in the embodiment of the present application may also be a circuit or any other device capable of implementing a storage function, and is used for storing program instructions and/or data.
  • the methods provided in the embodiments of the present application may be implemented in whole or in part by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, network equipment, user equipment or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server or data center by wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (for example, a floppy disk, a hard disk, or a magnetic tape), an optical medium (for example, a digital video disc (digital video disc, DVD for short)), or a semiconductor medium (for example, SSD).
  • a magnetic medium for example, a floppy disk, a hard disk, or a magnetic tape
  • an optical medium for example, a digital video disc (digital video disc, DVD for short)
  • a semiconductor medium for example, SSD
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开了一种通信方法、装置及系统，涉及通信技术领域。该方法包括：获取用于与第二节点通信认证的第二密钥，所述第二密钥不同于预先配置的第一密钥；接收来自所述第二节点的、针对第一通信连接的释放请求，所述第一密钥用于所述第一通信连接的通信认证；向所述第二节点发送连接建立请求，所述连接建立请求用于请求基于所述第二密钥建立连接。该方法提供了第一节点与第二节点确定更新的密钥后，释放连接，以及采用新的密钥建立连接的技术方案，实现了多通信场景融合下的鉴权流程。

Description

一种通信方法、装置及系统
相关申请的交叉引用
本申请要求在2021年08月30日提交中国专利局、申请号为202111005514.2、申请名称为“一种通信方法、装置及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术领域，尤其涉及一种通信方法、装置及系统。
背景技术
移动通信的飞速发展促进了多种应用场景的不断涌现，基于不同通信技术的通信系统不可避免的产生融合。例如，随着5G技术的成熟发展及无线短距通信系统的广泛应用，无线短距通信与5G蜂窝网络融合的场景已然成为新潮流。与此同时，新的融合场景，对于通信传输的安全性也提出了更高的要求。
然而现有标准下，并没有针对不同通信系统融合场景下进行安全有效的通信方法。
发明内容
本申请实施例提供一种通信方法、装置及系统，用以对通信认证的密钥进行更新，提高通信安全性。
第一方面，本申请实施例提供了一种通信方法，可以应用于第一节点。该方法包括：
获取用于与第二节点通信认证的第二密钥，所述第二密钥不同于预先配置的第一密钥；接收来自所述第二节点的、针对第一通信连接的释放请求，所述第一密钥用于所述第一通信连接的通信认证；向所述第二节点发送连接建立请求，所述连接建立请求用于请求基于所述第二密钥建立连接。
通过上述方法，本申请实施例提供了第一节点与第二节点确定更新的密钥后，释放连接，以及采用新的密钥建立连接的技术方案，实现了不同通信连接切换，用于进行通信认证的密钥的更新过程，有效提升了通信的安全性。
在一种可能的实现方式中，所述连接建立请求用于请求基于所述第二密钥建立连接，包括所述连接建立请求用于请求基于所述第二密钥执行认证和安全上下文协商流程。
在一种可能的实现方式中，所述方法还包括：接收来自所述第二节点的基于所述第二密钥的鉴权信息；所述鉴权信息用于验证所述第二节点的身份。
在一种可能的实现方式中，所述鉴权信息用于验证所述第二节点的身份，包括所述鉴权信息用于验证是否基于所述第二密钥与所述第二节点建立第二通信连接。
在一种可能的实现方式中，所述第一密钥是基于第一通信系统推演(或协商)的密钥，和/或，所述第二密钥是基于第二通信系统推演(或协商)的密钥，所述第一通信系统与所述第二通信系统不同。
在一种可能的实现方式中，所述第一通信系统可以为单一通信系统，所述第二通信系 统可以为不同通信系统融合后的通信系统。
通过上述方法，本申请实施例提供了不同通信系统进行融合通信场景下的通信方法，有效提升了通信的安全性。
在一种可能的实现方式中，向所述第二节点发送基于所述第二密钥的鉴权响应，所述鉴权响应用于验证所述第一节点的身份。
在一种可能的实现方式中，所述鉴权响应用于验证所述第一节点的身份，包括所述鉴权响应用于所述第二节点验证是否基于所述第二密钥与第一节点建立所述第二通信连接。
通过上述方法，第一节点通过向第二节点发送鉴权响应，可以使第二节点根据该鉴权响应进一步确定基于第二密钥是否鉴权成功。
在一种可能的实现方式中，所述释放请求中包括请求原因信息；所述请求原因信息用于指示用于通信认证的密钥更新。
通过上述方法，在释放请求中携带请求原因，可以使第一节点在接收到来自第二节点的释放请求后，了解请求的原因，从而更有针对性的做出请求响应，适应性更强。
在一种可能的实现方式中，所述第二密钥在第一时长内有效，所述第一时长通过定时器或者时间戳定义。
通过上述方法，第一节点与第二节点采用第二密钥进行通信传输过程中，进一步验证该第二密钥是否有效，能够保证第二密钥的时效性，以及更好的保证通信传输的安全性。
在一种可能的实现方式中，所述第二密钥在第一时刻开始的第一时长内有效，所述第一时刻为所述第一通信连接释放的时刻，或者发送所述连接建立请求的时刻。
通过上述方法，本申请提供了多种第一时刻的情况，由此提供了多种判断第二密钥有效性的方案，灵活性更强。
在一种可能的实现方式中，所述方法还包括在所述第二密钥的有效期内，通过所述第二节点与第三节点的回传链路，与所述第三节点进行信息传输。
第二方面，本申请实施例提供了一种通信方法，可以应用于第二节点。该方法包括：
获取用于与第一节点通信认证的第二密钥，所述第二密钥不同于预先配置的第一密钥；向所述第一节点发送针对第一通信连接的释放请求，所述第一密钥用于所述第一通信连接的通信认证；接收来自所述第一节点发送的连接建立请求，所述连接建立请求用于请求基于所述第二密钥建立连接。
通过上述方法，本申请实施例提供了第一节点与第二节点确定更新的密钥后，释放连接，以及采用新的密钥建立连接的技术方案，实现了不同通信连接切换，用于进行通信认证的密钥的更新过程，有效提升了通信的安全性。
在一种可能的实现方式中，所述连接建立请求用于请求基于所述第二密钥建立连接，包括：所述连接建立请求用于请求基于所述第二密钥执行认证和安全上下文协商流程。
在一种可能的实现方式中，所述方法还包括：向所述第一节点发送基于所述第二密钥的鉴权信息；所述鉴权信息用于验证第二节点的身份。
在一种可能的实现方式中，所述鉴权信息用于验证第二节点的身份，包括所述鉴权信息用于所述第一节点验证是否基于所述第二密钥与所述第二节点建立第二通信连接。
在一种可能的实现方式中，所述第一密钥是基于第一通信系统推演(或协商)的密钥，和/或，所述第二密钥是基于第二通信系统推演(或协商)的密钥，所述第一通信系统与所 述第二通信系统不同。
在一种可能的实现方式中，所述第一通信系统可以为单一通信系统，所述第二通信系统可以为不同通信系统融合后的通信系统。
通过上述方法，本申请实施例提供了不同通信系统进行融合通信场景下的通信方法，有效提升了通信的安全性。
在一种可能的实现方式中，所述方法还包括接收来自所述第一节点的基于所述第二密钥的鉴权响应；所述鉴权响应用于验证所述第一节点的身份。
在一种可能的实现方式中，所述鉴权响应用于验证所述第一节点的身份，包括所述鉴权响应用于所述第二节点验证是否基于所述第二密钥与第一节点建立所述第二通信连接。通过上述方法，第一节点通过向第二节点发送鉴权响应，可以使第二节点根据该鉴权响应进一步确定基于第二密钥是否鉴权成功。
在一种可能的实现方式中，所述释放请求中包括请求原因信息；所述请求原因信息用于指示用于通信认证的密钥更新。
通过上述方法，在释放请求中携带请求原因，可以使第一节点在接收到来自第二节点的释放请求后，了解请求的原因，从而更有针对性的做出请求响应，适应性更强。
在一种可能的实现方式中，所述第二密钥在第一时长内有效，所述第一时长可以通过定时器或者时间戳定义。
通过上述方法，第一节点与第二节点采用第二密钥进行通信传输过程中，进一步验证该第二密钥是否有效，能够保证第二密钥的时效性，以及更好的保证通信传输的安全性。
在一种可能的实现方式中，所述第二密钥在第一时刻开始的第一时长内有效，所述第一时刻为所述第一通信连接释放的时刻，或者所述第二节点接收到所述连接建立请求的时刻。
通过上述方法，本申请提供了多种第一时刻的情况，由此提供了多种判断第二密钥有效性的方案，灵活性更强。
在一种可能的实现方式中，所述方法还包括在所述第二密钥的有效期内，将来自所述第一节点的传输信息，通过所述第二节点与第三节点的回传链路，发送给所述第三节点。
在一种可能的实现方式中，在释放与所述第一节点的第一通信连之后，将所述回传链路挂起。
通过上述方法，第二节点在释放第一通信连接后，将该回传链路挂起，能够有效降低系统开销，节约资源。
在一种可能的实现方式中，所述方法还包括在确定与所述第一节点之间成功建立第二通信连接后，激活所述回传链路；所述第二通信连接是基于所述第二密钥进行通信认证的。
通过上述方法，在确定与所述第一节点之间成功建立第二通信连接后，通过将之前挂起的回传链路进行激活，从而继续采用该回传链路进行通信传输，能够有效降低系统开销，节约资源。
第三方面，本申请实施例提供了一种通信方法，可以应用于第一节点。该方法包括：
获取用于与第二节点通信认证的第二密钥，所述第二密钥不同于预先配置的第一密钥；释放与所述第二节点的第一通信连接，所述第一密钥用于所述第一通信连接的通信认证；向所述第二节点发送连接建立请求，所述连接建立请求用于请求基于所述第二密钥建立连 接。
通过上述方法，本申请实施例提供了第一节点与第二节点确定更新的密钥后，释放连接，以及采用新的密钥建立连接的技术方案，实现了不同通信连接切换，用于进行通信认证的密钥的更新过程，有效提升了通信的安全性。
在一种可能的实现方式中，所述连接建立请求用于请求基于所述第二密钥建立连接，包括所述连接建立请求用于请求基于所述第二密钥执行认证和安全上下文协商流程。
在一种可能的实现方式中，所述方法还包括：接收来自所述第二节点的基于所述第二密钥的鉴权信息；所述鉴权信息用于验证所述第二节点的身份。
在一种可能的实现方式中，所述鉴权信息用于验证所述第二节点的身份，包括所述鉴权信息用于验证是否基于所述第二密钥与所述第二节点建立第二通信连接。
在一种可能的实现方式中，所述第一密钥是基于第一通信系统推演(或协商)的密钥，和/或，所述第二密钥是基于第二通信系统推演(或协商)的密钥，所述第一通信系统与所述第二通信系统不同。
在一种可能的实现方式中，所述第一通信系统可以为单一通信系统，所述第二通信系统可以为不同通信系统融合后的通信系统。
通过上述方法，本申请实施例提供了不同通信系统进行融合通信场景下的通信方法，有效提升了通信的安全性。
在一种可能的实现方式中，所述方法还包括：向所述第二节点发送基于所述第二密钥的鉴权响应，所述鉴权响应用于验证所述第一节点的身份。
在一种可能的实现方式中，所述鉴权响应用于验证所述第一节点的身份，包括所述鉴权响应用于所述第二节点验证是否基于所述第二密钥与第一节点建立所述第二通信连接。
通过上述方法，第一节点通过向第二节点发送鉴权响应，可以使第二节点根据该鉴权响应进一步确定基于第二密钥是否鉴权成功。
在一种可能的实现方式中，所述释放请求中包括请求原因信息；所述请求原因信息用于指示用于通信认证的密钥更新。
通过上述方法，在释放请求中携带请求原因，可以使第一节点在接收到来自第二节点的释放请求后，了解请求的原因，从而更有针对性的做出请求响应，适应性更强。
在一种可能的实现方式中，所述第二密钥在第一时长内有效，所述第一时长通过定时器或者时间戳定义。
通过上述方法，第一节点与第二节点采用第二密钥进行通信传输过程中，进一步验证该第二密钥是否有效，能够保证第二密钥的时效性，以及更好的保证通信传输的安全性。
在一种可能的实现方式中，所述第二密钥在第一时刻开始的第一时长内有效，所述第一时刻为所述第一通信连接释放的时刻，或者发送所述连接建立请求的时刻。
通过上述方法，本申请提供了多种第一时刻的情况，由此提供了多种判断第二密钥有效性的方案，灵活性更强。
在一种可能的实现方式中，所述方法还包括：在所述第二密钥的有效期内，通过所述第二节点与第三节点的回传链路，与所述第三节点进行信息传输。
第四方面，本申请实施例提供了一种通信方法，可以应用于第二节点。该方法包括：
获取用于与第一节点通信认证的第二密钥，所述第二密钥不同于预先配置的第一密钥； 释放与所述第一节点的第一通信连接，所述第一密钥用于所述第一通信连接的通信认证；接收来自所述第一节点发送的连接建立请求，所述连接建立请求用于请求基于所述第二密钥建立连接。
通过上述方法，本申请实施例提供了第一节点与第二节点确定更新的密钥后，释放连接，以及采用新的密钥建立连接的技术方案，实现了不同通信连接切换，用于进行通信认证的密钥的更新过程，有效提升了通信的安全性。
在一种可能的实现方式中，所述连接建立请求用于请求基于所述第二密钥建立连接，包括：所述连接建立请求用于请求基于所述第二密钥执行认证和安全上下文协商流程。
在一种可能的实现方式中，所述方法还包括：向所述第一节点发送基于所述第二密钥的鉴权信息；所述鉴权信息用于验证第二节点的身份。
在一种可能的实现方式中，所述鉴权信息用于验证第二节点的身份，包括所述鉴权信息用于所述第一节点验证是否基于所述第二密钥与所述第二节点建立第二通信连接。
在一种可能的实现方式中，所述第一密钥是基于第一通信系统推演(或协商)的密钥，和/或，所述第二密钥是基于第二通信系统推演(或协商)的密钥，所述第一通信系统与所述第二通信系统不同。
在一种可能的实现方式中，所述第一通信系统可以为单一通信系统，所述第二通信系统可以为不同通信系统融合后的通信系统。
通过上述方法，本申请实施例提供了不同通信系统进行融合通信场景下的通信方法，有效提升了通信的安全性。
在一种可能的实现方式中，所述方法还包括接收来自所述第一节点反馈的鉴权响应；所述鉴权响应用于验证所述第一节点的身份。
在一种可能的实现方式中，所述鉴权响应用于验证所述第一节点的身份，包括所述鉴权响应用于所述第二节点验证是否基于所述第二密钥与第一节点建立所述第二通信连接。
通过上述方法，第一节点通过向第二节点发送鉴权响应，可以使第二节点根据该鉴权响应进一步确定基于第二密钥是否鉴权成功。
在一种可能的实现方式中，所述释放请求中包括请求原因信息；所述请求原因信息用于指示用于通信认证的密钥更新。
通过上述方法，在释放请求中携带请求原因，可以使第一节点在接收到来自第二节点的释放请求后，了解请求的原因，从而更有针对性的做出请求响应，适应性更强。
在一种可能的实现方式中，所述第二密钥在第一时长内有效，所述第一时长可以通过定时器或者时间戳定义。
通过上述方法，第一节点与第二节点采用第二密钥进行通信传输过程中，进一步验证该第二密钥是否有效，能够保证第二密钥的时效性，以及更好的保证通信传输的安全性。
在一种可能的实现方式中，所述第二密钥在第一时刻开始的第一时长内有效，所述第一时刻为所述第一通信连接释放的时刻，或者所述第二节点接收到所述连接建立请求的时刻。
通过上述方法，本申请提供了多种第一时刻的情况，由此提供了多种判断第二密钥有效性的方案，灵活性更强。
在一种可能的实现方式中，所述方法还包括在所述第二密钥的有效期内，将来自所述第一节点的传输信息，通过所述第二节点与第三节点的回传链路，发送给所述第三节点。
在一种可能的实现方式中，在释放与所述第一节点的第一通信连之后，将所述回传链路挂起。
通过上述方法，第二节点在释放第一通信连接后，将该回传链路挂起，能够有效降低系统开销，节约资源。
在一种可能的实现方式中，所述方法还包括在确定与所述第一节点之间成功建立第二通信连接后，激活所述回传链路；所述第二通信连接是基于所述第二密钥进行通信认证的。
通过上述方法，在确定与所述第一节点之间成功建立第二通信连接后，通过将之前挂起的回传链路进行激活，从而继续采用该回传链路进行通信传输，能够有效降低系统开销，节约资源。
第五方面，本申请实施例提供了一种通信装置，该装置用于实现上述第一方面或第一方面中任意一种方法，包括相应的功能模块或单元，分别用于实现上述第一方面方法中的步骤。功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，硬件或软件包括一个或多个与上述功能相应的模块或单元；或者，
该装置用于实现上述第三方面或第三方面中任意一种方法，包括相应的功能模块或单元，分别用于实现上述第三方面方法中的步骤。功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，硬件或软件包括一个或多个与上述功能相应的模块或单元。
第六方面，本申请实施例提供了一种通信装置，该装置用于实现上述第二方面或第二方面中任意一种方法，包括相应的功能模块或单元，分别用于实现上述第二方面方法中的步骤。功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，硬件或软件包括一个或多个与上述功能相应的模块或单元；或者，
该装置用于实现上述第四方面或第四方面中任意一种方法，包括相应的功能模块或单元，分别用于实现上述第四方面方法中的步骤。功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，硬件或软件包括一个或多个与上述功能相应的模块或单元。
第七方面，提供一种通信装置，该装置包括处理器和存储器。其中，存储器用于存储计算程序或指令，处理器与存储器耦合；当处理器执行计算机程序或指令时，使得该装置执行上述第一方面或第一方面中的任意一种方法；或者使得该装置执行上述第三方面或第三方面中的任意一种方法。通信装置可以是第一装置，或能够支持第一装置实现上述第一方面提供的方法所需的功能的装置，或能够支持第一装置实现上述第三方面提供的方法所需的功能的装置，例如芯片系统。例如，所述通信装置可以是终端设备或终端设备内的部分组件(比如芯片)。所述终端设备例如可以是智能移动终端、智能家居设备、智能汽车、智能穿戴设备等等。其中，智能移动终端比如手机、平板电脑、笔记本电脑、超级移动个人计算机(ultra-mobile personal computer，UMPC)、上网本、个人数字助理(personal digital assistant，PDA)等。智能家居设备比如智能冰箱、智能洗衣机、智能电视机、音箱等。智能汽车穿戴设备比如智能耳机、智能眼镜、智能服饰或鞋子等。
第八方面，提供一种通信装置，该装置包括处理器和存储器。其中，存储器用于存储计算程序或指令，处理器与存储器耦合；当处理器执行计算机程序或指令时，使得该装置执行上述第二方面或第二方面中的任意一种方法；或者使得该装置执行上述第四方面或第四方面中的任意一种方法。通信装置可以是第二装置或能够支持第二装置实现上述第二方面提供的方法所需的功能的装置，或能够支持第二装置实现上述第四方面提供的方法所需 的功能的装置，例如芯片系统。例如，所述通信装置可以是终端设备或终端设备内的部分组件(比如芯片)。所述终端设备例如可以是智能移动终端、智能家居设备、智能汽车、智能穿戴设备等等。其中，智能移动终端比如手机、平板电脑、笔记本电脑、超级移动个人计算机(ultra-mobile personal computer，UMPC)、上网本、个人数字助理(personal digital assistant，PDA)等。智能家居设备比如智能冰箱、智能洗衣机、智能电视机、音箱等。智能汽车穿戴设备比如智能耳机、智能眼镜、智能服饰或鞋子等。
第九方面，提供一种终端，该终端可包括上述第五方面或第七方面所述的装置，和上述第六方面或第八方面的装置。可选的，该装置可以为智能家居设备、智能制造设备、智能运输设备等，例如车辆、无人机、无人运输车、汽车和车辆等，或机器人等。或者，该装置可以为鼠标、键盘、可穿戴设备、TWS耳机等。
第十方面，本申请提供一种芯片，芯片与存储器相连，用于读取并执行存储器中存储的计算机程序或指令，以实现上述第一方面或第一方面的任一种可能的实现方式中的方法；或以实现上述第二方面或第二方面的任一种可能的实现方式中的方法；或以实现上述第三方面或第三方面的任一种可能的实现方式中的方法；或以实现上述第四方面或第四方面的任一种可能的实现方式中的方法。
第十一方面，提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机程序或指令，当计算机程序或指令被装置执行时，使得该装置执行上述第一方面或第一方面的任意可能的实现方式中的方法，或使得该装置执行上述第三方面或第三方面的任意可能的实现方式中的方法。
第十二方面，提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机程序或指令，当计算机程序或指令被装置执行时，使得该装置执行上述第二方面或第二方面的任意可能的实现方式中的方法，或使得该装置执行上述第四方面或第四方面的任意可能的实现方式中的方法。
第十三方面，提供本申请提供一种计算机程序产品，该计算机程序产品包括计算机程序或指令，当计算机程序或指令被装置执行时，使得该装置执行上述第一方面或第一方面的任意可能的实现方式中的方法，或使得该装置执行上述第三方面或第三方面的任意可能的实现方式中的方法。
第十四方面，提供本申请提供一种计算机程序产品，该计算机程序产品包括计算机程序或指令，当计算机程序或指令被装置执行时，使得该装置执行上述第二方面或第二方面的任意可能的实现方式中的方法，或使得该装置执行上述第三方面或第三方面的任意可能的实现方式中的方法。
应理解，基于本申请所提供的技术方案，可应用于不同通信系统融合场景下，提供了不同通信系统进行融合通信场景下的通信方法，有效提升了通信的安全性。此外，通过对用于进行通信认证的密钥进行有效性设置，能够保证用于进行通信认证的密钥的时效性，更好的保证通信传输的安全性。
附图说明
图1为本申请实施例提供的第一种通信系统示意图；
图2为本申请实施例提供的第二种通信系统示意图；
图3为本申请实施例提供的第一种通信方法流程示意图；
图4为本申请实施例提供的第二种通信方法流程示意图；
图5为本申请实施例提供的第三种通信方法流程示意图；
图6为本申请实施例提供的第四种通信方法流程示意图；
图7为本申请实施例提供的第五种通信方法流程示意图；
图8为本申请实施例提供的第六种通信方法流程示意图；
图9为本申请实施例提供的第六种通信方法流程示意图；
图10为本申请实施例提供的第一种通信装置结构示意图；
图11为本申请实施例提供的第二种通信装置结构示意图；
图12为本申请实施例提供的一种终端结构示意图。
具体实施方式
本申请实施例提供一种通信方法及装置，以期实现无线短距与5G蜂窝网络融合的鉴权流程。为了使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施例作进一步地详细描述。
本申请实施例提供的通信方法可以应用到第五代(5th generation，5G)通信系统，例如5G新空口(new radio，NR)，也可以应用于未来的各种通信系统，例如第六代(6th generation，6G)通信系统，在此并不进行限定。
如图1所示，本申请实施例提供了该通信方法适用的一种通信系统的架构，该通信系统可以包括第一节点100、第二节点110以及第三节点120。可选的，该通信系统中第一节点可以与第二节点连接，第二节点可以与第三节点连接。
本申请中该通信系统可以为不同通信系统融合后的通信系统，例如无线短距通信系统与5G蜂窝网络通信系统融合后得到的通信系统，在此并不进行限定。其中，融合后的通信系统还可以称为紧耦合(tight interworking)的通信系统，或者互相配合(interworking)的通信系统。
示例性的，本申请以无线短距通信系统与5G蜂窝网络通信系统融合后的通信系统为例，对融合后的通信系统进行介绍：
在该融合后的通信系统中，支持无线短距通信的终端节点可以通过控制节点或网关节点接入5G网络，进一步使用5G网络提供的服务。此外，5G网络还可以根据终端节点的签约信息和链路状态信息，对终端节点进行数据传输策略的配置和管理，以便为提供精细化服务。也就是说，在该融合后的通信系统中，无线短距通信系统与5G蜂窝网络通信系统可以交互工作，优势互补。
可选的，本申请所述的无线短距通信系统，可以是任意可能的短距通信系统，例如蓝牙，wifi、车载通用短距通信系统以及星闪等现在以及未来可能出现的短距通信系统。
其中，第一节点可以是终端设备或能够支持终端设备实现该方法所需的功能的通信装置，或者，第一节点可以是网络设备或能够支持网络设备实现该方法所需的功能的通信装置，当然还可以是其他通信装置，例如芯片系统。第二节点可以是网络设备或能够支持网络设备实现该方法所需的功能的通信装置，或者第二节点可以是终端设备或能够支持终端设备实现该方法所需的功能的通信装置，当然还可以是其他通信装置，例如芯片系统。第三节点可以是网络设备或能够支持网络设备实现该方法所需的功能的通信装置，或者，第三节点可以是终端设备或能够支持终端设备实现该方法所需的功能的通信装置，当然还可 以是其他通信装置，例如芯片系统。
可选的，本申请实施例中的终端设备，可以是用于实现无线通信功能的设备，例如终端或者可用于终端中的芯片等。例如可以包括具有无线连接功能的手持式设备、或连接到无线调制解调器的处理设备。该终端设备可以经无线接入网(radio access network，RAN)与核心网进行通信，与RAN交换语音和/或数据。该终端设备可以包括用户设备(user equipment，UE)、无线终端设备、移动终端设备、订户单元(subscriber unit)、订户站(subscriber station)，移动站(mobile station)、移动台(mobile)、远程站(remote station)、接入点(access point，AP)、远程终端设备(remote terminal)、接入终端设备(access terminal)、用户终端设备(user terminal)、用户代理(user agent)、或用户装备(user device)等。例如，可以包括移动电话(或称为“蜂窝”电话)，具有移动终端设备的计算机，便携式、袖珍式、手持式、计算机内置的或者车载的移动装置，智能穿戴式设备等。例如，个人通信业务(personal communication service，PCS)电话、无绳电话、会话发起协议(session initiation protocol，SIP)话机、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、等设备。还包括受限设备，例如功耗较低的设备，或存储能力有限的设备，或计算能力有限的设备等。例如包括条码、射频识别(radio frequency identification，RFID)、传感器、全球定位系统(global positioning system，GPS)、激光扫描器等信息传感设备。
作为示例而非限定，在本申请实施例中，该终端设备还可以是可穿戴设备。可穿戴设备也可以称为穿戴式智能设备，是应用穿戴式技术对日常穿戴进行智能化设计、开发出可以穿戴的设备的总称，如眼镜、手套、手表、服饰及鞋等。可穿戴设备即直接穿在身上，或是整合到用户的衣服或配件的一种便携式设备。可穿戴设备不仅仅是一种硬件设备，更是通过软件支持以及数据交互、云端交互来实现强大的功能。广义穿戴式智能设备包括功能全、尺寸大、可不依赖智能手机实现完整或者部分的功能，例如：智能手表或智能眼镜等，以及只专注于某一类应用功能，需要和其它设备如智能手机配合使用，如各类进行体征监测的智能手环、智能头盔、智能首饰等。
可选的，本申请实施例中的网络设备，可以包括接入网(access network，AN)设备，无线接入网(radio access network，RAN)设备，接入网设备例如基站(例如，接入点)，可以是指接入网中在空口通过一个或多个小区与无线终端设备通信的设备。基站可用于将收到的空中帧与网际协议(IP)分组进行相互转换，作为终端设备与接入网的其余部分之间的路由器，其中接入网的其余部分可包括IP网络。网络侧设备还可协调对空口的属性管理。例如，网络设备可以包括长期演进(long term evolution，LTE)系统或高级长期演进(long term evolution-advanced，LTE-A)中的演进型基站(NodeB或eNB或e-NodeB，evolved Node B)，或者也可以包括第五代移动通信技术(the 5th generation，5G)新空口(new radio，NR)系统中的下一代节点B(next generation node B，gNB)或者下一代演进型基站(next generation evolved nodeB，ng-eNB)、en-gNB(enhanced next generation node B，gNB)：增强的下一代基站；也可以包括云接入网(cloud radio access network，Cloud RAN)系统中的集中式单元(centralized unit，CU)和分布式单元(distributed unit，DU)，或者还可以包括中继设备，本申请实施例并不限定。
此外，本申请还提供另一种通信系统，如图2所示，该通信系统中还可以包括会话管 理功能(session management function，SMF)、接入和移动性管理功能(access and mobility management function，AMF)、用户面功能(User Plane Function，UPF)以及DN等功能实体。
各个功能之间可以通过接口连接，接口的序列号或接口的名称本申请实施例中不作限定。可以按照5G系统的3GPP相关标准协议中定义的接口，也可以使用未来通信系统中的接口。例如，终端设备通过下一代网络(next generation，N)1接口(简称N1)与AMF通信，网络设备通过N2接口(简称N2)与AMF通信，网络设备通过N3接口(简称N3)与本地UPF通信，UPF通过N6接口(简称N6)与DN通信。AMF通过N11接口(简称N11)与SMF通信，SMF通过N4接口(简称N4)与UPF通信。
通信系统中包括的各个功能也可以称为功能实体、网元或其他名称。例如，SMF可以称为SMF实体。可选的，本申请实施例中的各个功能可以由一个设备实现，也可以由多个设备共同实现，还可以是由一个设备内的一个或多个功能模块实现，本申请实施例对此不作具体限定。可以理解的是，本申请实施例涉及的各个功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行的软件功能，或者是硬件与软件的结合，或者是平台(例如，云平台)上实例化的虚拟化功能。
需要说明的是，本申请实施例并不限定各个功能的分布形式，可选的，各个功能也可以包含上述任意多种功能融合后形成的其他功能实体，例如，具有会话管理和策略控制两种功能的功能实体，或者具有会话管理、接入与移动性管理和策略控制三种功能的功能实体，或者具有网络开放和应用功能两种功能的功能实体。
需要说明的是，图1～图2所示的通信系统并不构成本申请实施例能够适用的通信系统的限定。当然图2中的终端设备的数量只是举例，在实际应用中，网络设备可以为多个终端设备提供服务，网络设备，以及多个终端设备中的全部终端设备或者部分终端设备，都可以采用本申请实施例提供的方法确定调度限制。图1和/或图2所示的通信系统架构可以是非漫游的5G系统架构，可选的，本申请实施例的方法还适用于漫游的5G系统架构、以及适用于未来的各种通信网络。
本申请实施例中涉及的各个功能或设备也可以称之为通信装置，其可以是一个通用设备或者是一个专用设备，本申请实施例对此不作具体限定。
如上介绍了本申请实施例涉及的应用架构，下面介绍本申请实施例的技术特征。
目前针对不同通信系统的融合场景，并没有安全有效的通信方法。鉴于此，本申请实施例提供了第一节点与第二节点确定更新的密钥后，释放连接，以及采用新的密钥建立连接的技术方案，提供了不同通信系统进行融合通信场景下的通信方法，有效提升了通信的安全性。其中，方法和装置是基于同一技术构思的，由于方法及设备解决问题的原理相似，因此设备与方法的实施可以相互参见，重复之处不再赘述。
本申请实施例提供第一种通信方法，请参见图3，为该方法的流程图。
S300、第一节点获取用于与第二节点通信认证的第二密钥。
其中，本申请实施例中的该第二密钥不同于预先配置的第一密钥。
可选的，本申请实施例中该第一节点用于第一通信连接的通信认证，该第二节点用于第二通信连接的通信认证。
应理解，本申请中一种可选的方式，该第一密钥是基于第一通信系统推演(或协商) 的密钥，和/或，该第二密钥是基于第二通信系统推演(或协商)的密钥，该第一通信系统与该第二通信系统不同。
其中，本申请中该第一通信系统可以为单一通信系统，例如无线短距通信系统、5G蜂窝网络通信系统、超高可靠低时延通信系统、增强移动宽带通信系统以及海量机器连接通信系统等；本申请中该第二通信系统可以为不同通信系统融合后的通信系统，例如无线短距通信系统与5G蜂窝网络通信系统融合后得到的通信系统，5G蜂窝网络通信系统与超高可靠低时延通信系统融合后得到的通信系统。
具体的，该第一密钥可以为在第一节点与第二节点初始连接阶段用于进行鉴权的密钥。其中，该第一密钥可以是第一节点与第二节点在进行初始连接前预配置的；或者，该第一密钥可以是第二节点确定的，以及通过信令指示给第一节点的；或者，该第一密钥可以是第一节点确定的，以及通过信令指示给第二节点的，本申请对此不做限定。
具体的，该第二密钥可以是第一节点与第二节点建立第一通信连接后，第一节点确定的，以及通过信令指示给第二节点的；或者，该第二密钥可以是第一节点与第二节点建立第一通信连接后，第二节点确定的，以及通过信令指示给第一节点的；或者，该第二密钥可以是第一节点与第二节点建立第一通信连接后，第一节点与第二节点共同协商的，本申请对此不做限定。
进一步的，为了更好的保障通信系统的安全性，该第一节点获取到的用于与第二节点通信认证的第二密钥具有一定的时效性，可以理解的，若该第二密钥有效，则该第二密钥可以用于第二通信连接的认证；若该第二密钥失效，则该第二密钥不可以用于第二通信连接的认证。进一步的，该第二密钥失效后，可以执行密钥更新。
可以理解的是，在实施S300之前，还可以包括步骤1：第一节点与第二节点进行融合连接(即实现不同通信系统进行融合场景下的初始鉴权流程)。
其中，步骤1具体的实现过程可以为第一节点与第二节点基于第一密钥进行初始连接的鉴权，第一节点与第二节点在确定基于第一密钥进行初始连接的鉴权成功后，第一节点与第二节点建立基于第一密钥进行通信认证的第一通信连接。
S301、第二节点获取用于与第一节点通信认证的第二密钥。
具体的，该第二密钥可以是第一节点与第二节点建立第一通信连接后，第一节点确定的，以及通过信令指示给第二节点的；或者，该第二密钥可以是第一节点与第二节点建立第一通信连接后，第二节点确定的，以及通过信令指示给第一节点的；或者，该第二密钥可以是第一节点与第二节点建立第一通信连接后，第一节点与第二节点共同协商的，本申请对此不做限定。
S302、第二节点向第一节点发送针对第一通信连接的释放请求。
其中，该释放请求可以包括下列信息1～信息4中的一种或多种：
信息1：请求原因信息，该请求原因信息用于指示用于通信认证的密钥更新。
信息2：请求时间，该请求时间用于指示第二节点发送该释放请求的时间。可选的，该请求时间可以通过时间戳表示。
信息3：释放时间，该释放时间用于指示第一节点释放第一通信连接的时间。
示例性的，该释放时间可以指示具体时间，例如，具体时间为第一节点接收到释放请求后的第一分钟，则该第一节点在接收到该释放请求后，根据该释放请求中包括的该释放时间，在接收到释放请求后的第一分钟释放该第一通信连接；或者，该释放时间可以指示 具体时间段，例如，具体时间段为第一节点接收到释放请求后的五分钟内，则该第一节点在接收到该释放请求后，根据该释放请求中包括的该释放时间，在接收到释放请求后的五分钟内释放该第一通信连接。
信息4：用于指示挂起无线资源的信息。
可选的，该释放请求还可以用于指示挂起(suspend)无线资源。例如，该释放请求中可以包括用于指示挂起第一通信连接对应的无线资源的信息。
在第一节点与第二节点确定用于通信认证的第一密钥更新为第二密钥后，在该第一通信连接释放，第二通信连接未成功建立期间，通过使第一通信连接对应的无线资源挂起，不释放，能够有效便于通信链路的快速恢复。
需要说明的是，上述释放请求中包括的信息1～4的内容仅是对该释放请求中包括的信息的列举，并不构成对该释放请求包括的信息的限定。
此外，该第一节点接收来自该第二节点的释放请求，可以包括但不限于：
该释放请求可以是基于第一节点与第二节点间传输信令的改进，或该释放请求可以携带在该第一节点与该第二节点间传输信令上，例如，在实际应用中，该释放请求可以携带在第一节点发送给第二节点的，用于指示第二密钥的信令中；或者，该释放请求可以为第一节点与第二节点间的新的信令。
进一步，第二节点释放与该第一节点的第一通信连接。
应理解，本申请中一种可选的方式，第二节点在收到第二密钥后，可以确定密钥发生了更新，因此，该第二节点可以触发释放与该第一节点的第一通信连接，建立基于该第二密钥进行通信认证的第二通信连接。
进一步的，基于第二节点向第一节点发送针对该第一通信连接的释放请求的情况，该第二节点还可以接收到来自该第一节点的释放请求响应，用于通知第一节点针对第一通信连接的释放情况。
可选的，第二节点可以在执行该S302之前释放与该第一节点的第一通信连接，即该第二节点在获取到第二密钥后，释放与该第一节点的第一通信连接；或者，该第二节点可以在执行该S302之后释放与该第一节点的第一通信连接，即该第二节点向该第一节点发送针对第一通信连接的释放请求后，释放与该第一节点的第一通信连接；再或者，该第二节点还可以在接收到来自该第一节点的释放请求响应，确定该第一节点完成第一通信连接的释放后，释放与该第一节点的第一通信连接。
S303、第一节点接收来自第二节点的、针对第一通信连接的释放请求。
进一步，第一节点释放与该第二节点的第一通信连接。
应理解，本申请中一种可选的方式，第一节点在收到来自第二节点的、针对第一通信连接的释放请求后，可以触发释放与该第二节点的第一通信连接。
进一步的，该第一节点还可以向该第二节点发送基于该释放请求的响应，用于通知第二节点，自身针对第一通信连接的释放情况。
S304、第一节点向第二节点发送连接建立请求，该连接建立请求用于请求基于该第二密钥建立连接。
可选的，该第一节点向该第二节点发送的连接建立请求，可以包括但不限于：
该连接建立请求可以是基于第一节点与第二节点间传输信令的改进，或该连接建立请求可以携带在该第一节点与该第二节点间传输信令上；或者，该连接建立请求可以为第一 节点与第二节点间的新的信令。
其中，该连接建立请求可以包括下列信息1-信息4中的一种或多种：
信息1：请求原因信息，该请求原因信息用于指示用于通信认证的密钥更新。
信息2：请求时间，该请求时间用于指示第一节点发送该连接建立请求的时间。可选的，该请求时间可以通过时间戳表示。
信息3：连接建立时间，该连接建立时间用于指示第一节点与第二节点建立第二通信连接的时间。
示例性的，该连接建立时间可以指示具体时间，例如，具体时间为第二节点接收到连接建立请求后的第一分钟，则该第二节点在接收到该连接建立请求后，根据该连接建立请求中包括的该连接建立时间，在接收到连接建立请求后的第一分钟与第一节点建立第二通信连接；或者，该连接建立时间可以指示具体时间段，例如，具体时间段为第二节点接收到连接建立请求后的五分钟内，则该第二节点在接收到该连接建立请求后，根据该连接建立请求中包括的该连接建立时间，在接收到连接建立请求后的五分钟内与第一节点建立第二通信连接。
信息4：用于指示连接恢复的信息。
可以理解的，该连接建立请求可以为第一节点与第二节点间的连接恢复请求。即第一节点与第二节点间的第一通信连接释放后，第一节点与第二节点需要建立基于第二密钥进行通信认证的第二通信连接，则第一节点可以向第二节点发送连接恢复请求，第二节点在接收到该连接恢复请求后，与该第一节点建立通信连接。
需要说明的是，上述连接建立请求中包括的信息1～4的内容仅是对该连接建立请求中包括的信息的列举，并不构成对该连接建立请求包括的信息的限定。
S305、第二节点接收来自第一节点发送的该连接建立请求。
进一步的，该连接建立请求用于请求基于该第二密钥建立连接，可以包括：该连接建立请求用于请求基于该第二密钥执行认证和安全上下文协商流程。
可选的，该认证和安全上下文协商流程可以包含第一和第二节点的身份鉴权过程(例如鉴权信息和鉴权响应的交互)。
其中，该第一和第二节点的身份鉴权过程的内容可以如下所述：
首先，第二节点接收来自第一节点发送的该连接建立请求后，第二节点向该第一节点发送基于该第二密钥的鉴权信息，该鉴权信息用于验证该第二节点的身份。其中，该鉴权信息用于验证该第二节点的身份，可以理解为该第一节点可以通过该鉴权信息验证与该第二节点是否能够基于该第二密钥建立第二通信连接。
可选的，该鉴权信息可以包括第二节点使用该第二密钥推算出的认证向量。
然后，该第一节点接收来自该第二节点的基于该第二密钥的鉴权信息，该第一节点在确定第二节点通过认证后，向第二节点发送针对该鉴权信息的鉴权响应，该鉴权响应用于验证该第一节点的身份。其中，该鉴权响应用于验证该第一节点的身份，可以理解为该第二节点可以通过该鉴权响应验证与该第一节点是否能够基于该第二密钥建立第二通信连接。
可选的，第一节点可以根据接收到的该鉴权信息中包括的第二节点使用第二密钥推算出的认证向量，判断该第二节点是否通过认证。
示例性的，该第一节点接收到该鉴权信息后，获取该鉴权信息中第二节点基于第二密 钥推算出的第一认证向量。该第一节点基于第二密钥推算出第二认证向量，然后将第一认证向量与第二认证向量进行比对。若第一认证向量与第二认证向量符合认证要求，例如，认证要求可以为第一认证向量与第二认证向量相同，或第一认证向量与第二认证向量相加之和为零等，则第一节点确定第二节点通过认证，若第一认证向量与第二认证向量不符合认证要求，则第一节点确定第二节点未通过认证。
最后，该第二节点接收来自该第一节点发送的该鉴权响应，基于该鉴权响应对该第一节点进行身份验证。
通过上述方法，第一节点与第二节点确定更新的密钥后，释放连接，然后采用新的密钥建立连接，实现了不同通信连接切换，用于进行通信认证的密钥的更新过程，有效提升了通信的安全性。
其中，为了更好的对本申请提供的通信方法进行介绍，基于图3所示的内容，结合下述两种场景，进一步详细介绍，其中，下文所涉及的场景中的部分步骤可以是可选的，步骤顺序也不代表实际的执行顺序，因此本申请不限定完全按照下文的步骤和顺序执行。
场景一、第一节点在获取到第二密钥后，主动释放该第一通信连接。
参阅图4所示，该场景一对应的方法的可以执行下述步骤。
S400、第一节点与第二节点基于第一密钥建立第一通信连接。
S401、第一节点获取用于与第二节点通信认证的第二密钥。
S402、第二节点获取用于与第一节点通信认证的第二密钥。
S403、第二节点释放与第一节点的第一通信连接。
S404、第一节点释放与该第二节点的第一通信连接。
S405、第一节点向该第二节点发送连接建立请求，该连接建立请求用于请求基于该第二密钥建立连接。
S406、第二节点接收来自该第一节点发送的连接建立请求。
S407、第二节点向该第一节点发送基于该第二密钥的鉴权信息，该鉴权信息用于验证该第二节点的身份。
S408、第一节点接收来自该第二节点的基于该第二密钥的鉴权信息。
S409、第一节点确定第二节点是否通过认证，若是，执行S410，若否，执行S411。
S410、第一节点向第二节点发送针对该鉴权信息的鉴权响应，该鉴权响应用于验证该第一节点的身份，继续执行S412。
可选的，该鉴权响应中包含基于该第二密钥生成的鉴权信息。
其中，该鉴权信息可以包括下列信息1～2中的一种或多种：
信息1：第一节点基于第二密钥获取的认证向量，例如，上述S305步骤示例内容里的第二认证向量。
信息2：第一节点对第二节点的鉴权结果。
需要说明的是，上述鉴权信息中包括的信息1～2的内容仅是对该鉴权信息中包括的信息的列举，并不构成对该鉴权信息包括的信息的限定。
S411、第一节点在确定该第二节点基于第二密钥进行第二通信连接的认证失败后，终止通信传输。
其中，本申请一种可选的方式，该第一节点在确定该第二节点认证失败后，第二节点 还可以再次发起基于第二密钥的通信认证，当认证失败次数达到阈值失败次数后，终止通信传输。
示例性的，假设阈值失败次数为2次，该第一节点在第一次确定该第二节点基于第二密钥的通信认证失败后，可以向该第二节点发送认证失败的消息。该第二节点在接收到该认证失败的消息后，可以再次向该第一节点发送基于该第二密钥的鉴权信息，重新进行认证。
该第一节点再次接收来自该第二节点的基于该第二密钥的鉴权信息并进行通信认证。若该第一节点在第二次认证中，确定该第二节点基于第二密钥的通信依旧失败，则此时第一节点确定认证失败的次数达到阈值失败次数2次，则终止通信传输。
同理，可以理解的，若该第二节点连续两次接收到基于该第二密钥通信认证失败的消息，则该第二节点可以终止通信传输；或者，该第一节点在确定终止通信传输后，可以向该第二节点发送终止通信传输的消息，第二节点在接收到来自该第一节点的终止通信传输的消息后，终止通信传输。
S412、第二节点接收来自第一节点发送的该鉴权响应。
可选的，使接收到该鉴权响应的第二节点，可以根据该鉴权响应中包含的基于该第二密钥生成的鉴权信息，判断该第一节点是否通过认证，具体判断方式可以参见上述第一节点的判断方式，为简洁描述，在此不进行赘述。
S413、第二节点确定第一节点是否通过认证，若是，执行S414，若否，执行S415。
S414、第二节点在确定该第二节点通过认证后，与第一节点建立第二通信连接，继续执行S416。
S415、第二节点在确定第一节点基于第二密钥进行第二通信连接的认证失败后，终止通信传输。
本申请中一种可选的方式，该第二节点在确定终止通信传输后，可以向该第一节点发送终止通信传输的消息，第一节点在接收到来自该第二节点的终止通信传输的消息后，终止通信传输。
S416、第一节点在完成与第二节点的第二通信连接建立后，通知第二节点该第二通信连接建立完成。
S417、第一节点通过第二节点与第三节点的回传链路，与第三节点进行信息传输。
应理解，在如图4所示的方法流程中，步骤序号不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。例如，S402可以优先于S401。此外，在如图4所示的方法流程中，也并不局限上述步骤，任何对上述步骤的增删变形等，都属于本申请保护范围。
场景二、第一节点接收到来自第二节点发送的针对第一通信连接的释放请求后，释放该第一通信连接。
参阅图5所示，该场景二对应的方法的可以执行下述步骤。
S500、第一节点与第二节点基于第一密钥建立第一通信连接。
S501、第一节点获取用于与第二节点通信认证的第二密钥。
S502、第二节点获取用于与第一节点通信认证的第二密钥。
S503、第二节点释放与第一节点的第一通信连接。
S504、第二节点向第一节点发送针对该第一通信连接的释放请求。
S505、第一节点接收来自该第二节点的、针对该第一通信连接的释放请求。
S506、第一节点释放与该第二节点的第一通信连接。
S507、第一节点向该第二节点发送连接建立请求，该连接建立请求用于请求基于该第二密钥建立连接。
S508、第二节点接收来自该第一节点发送的连接建立请求。
S509、第二节点向该第一节点发送基于该第二密钥的鉴权信息，该鉴权信息用于验证该第二节点的身份。
S510、第一节点接收来自该第二节点的基于该第二密钥的鉴权信息。
S511、第一节点确定第二节点是否通过认证，若是，执行S512，若否，执行S513。
S512、第一节点在确定该第二节点鉴权通过后，向第二节点发送针对该鉴权信息的鉴权响应，该鉴权响应用于验证该第一节点的身份，继续执行S514。
S513、第一节点在确定该第二节点基于第二密钥进行第二通信连接的认证失败后，终止通信传输。
S514、第二节点接收来自第一节点发送的该鉴权响应。
本申请中，可选的，使接收到该鉴权响应的第二节点，可以根据该鉴权响应中包含的基于该第二密钥生成的鉴权信息，判断该第一节点是否通过认证，具体判断方式可以参见上述第一节点的判断方式，为简洁描述，在此不进行赘述。
S515、第二节点确定第一节点是否通过认证，若是，执行S516，若否，执行S517。
S516、第二节点在确定该第二节点通过认证后，与第一节点建立第二通信连接，继续执行S518。
S517、第二节点在确定第一节点基于第二密钥进行第二通信连接的认证失败后，终止通信传输。
S518、第一节点在完成与第二节点的第二通信连接建立后，通知第二节点该第二通信连接建立完成。
S519、第一节点通过第二节点与第三节点的回传链路，与第三节点进行信息传输。
应理解，在如图5所示的方法流程中，步骤序号不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。例如，S502可以优先于S501。此外，在如图5所示的方法流程中，也并不局限上述步骤，任何对上述步骤的增删变形等，都属于本申请保护范围。
进一步的，本申请为了有效节省系统开销，该第二节点可以在释放与该第一节点的第一通信连接之后，还可以将该回传链路挂起。然后，在第二节点确定与该第一节点之间成功建立第二通信连接后，可以激活该回传链路。
下面结合上述场景二的情况，对通信过程中回传链路进行挂起以及激活的操作内容进行介绍，参阅图6所示，对应的方法流程如下：
S600、第一节点与第二节点基于第一密钥建立第一通信连接。
S601、第一节点获取用于与第二节点通信认证的第二密钥。
S602、第二节点获取用于与第一节点通信认证的第二密钥。
S603、第二节点释放与第一节点的第一通信连接。
S604、第二节点将与第三节点间的回传链路挂起。
S605、第二节点向第一节点发送针对该第一通信连接的释放请求。
S606、第一节点接收来自该第二节点的、针对该第一通信连接的释放请求。
S607、第一节点释放与该第二节点的第一通信连接。
S608、第一节点向该第二节点发送连接建立请求，该连接建立请求用于请求基于该第二密钥建立连接。
S609、第二节点接收来自该第一节点发送的连接建立请求。
S610、第二节点向该第一节点发送基于该第二密钥的鉴权信息，该鉴权信息用于验证该第二节点的身份。
S611、第一节点接收来自该第二节点的基于该第二密钥的鉴权信息。
S612、第一节点在确定该第二节点鉴权通过后，向第二节点发送针对该鉴权信息的鉴权响应，该鉴权响应用于验证该第一节点的身份。
S613、第二节点接收来自该第一节点发送的该鉴权响应。
S614、第二节点在确定该第二节点通过认证后，与该第一节点建立第二通信连接。
S615、第一节点在完成与该第二节点的第二通信连接建立后，通知该第二节点该第二通信连接建立完成。
S616、第二节点在确定与该第一节点之间成功建立第二通信连接后，激活该回传链路。
S617、第一节点通过该第二节点与第三节点的回传链路，与该第三节点进行信息传输。
应理解，在如图6所示的方法流程中，步骤序号不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。例如，S605可以优先于S604。此外，在如图6所示的方法流程中，也并不局限上述步骤，任何对上述步骤的增删变形等，都属于本申请保护范围。
本申请通过在连接释放后挂起回传链路，在连接建立后激活该回传链路，能够有效的降低系统功耗，节约资源。
其中，结合上述场景一的情况，对通信过程中回传链路进行挂起以及激活的内容与上述图6的内容相似，为简洁描述，可以参见上述图6的内容，以及场景一的情况，删减上述图6中S605与S606步骤，得到结合上述场景一的情况，对通信过程中回传链路进行挂起以及激活的内容，在此不进行赘述。
进一步的，本申请为了更好的保证第二密钥的时效性，提高通信传输的安全性，第一节点与第二节点采用第二密钥进行通信传输过程中，还可以验证该第二密钥是否有效。
可以理解的，本申请中，可以通过第一节点判断该第二密钥是否有效，然后将对该第二密钥的判断结果通知给第二节点；或者，可以通过第二节点判断该第二密钥是否有效，然后将对该第二密钥的判断结果通知给第一节点；再或者，还可以第一节点与第二节点都对该第二密钥的有效性进行判断。
本申请中一种可选的方式，该第二密钥在第一时长内有效，该第一时长可以通过定时器或者时间戳定义。其中，该第一时长可以从第一时刻开始计时，该第一时刻可以为该第一通信连接释放的时刻，或者该第二节点接收到该连接建立请求的时刻和/或该第一节点发送该连接建立请求的时刻，具体并不进行限定。
下面结合上述场景二的情况，以及选取第一节点与第二节点都对第二密钥有效性进行判断的情况进行介绍，其中，本申请提供多种验证方式，具体并不限于下述几种：
方式1：第一节点与第二节点分别基于各自对应的定时器，确定该第二密钥是否有效。
参阅图7所示，该方式1对应的方法流程如下：
S700、第一节点与第二节点基于第一密钥建立第一通信连接。
S701、第一节点获取用于与第二节点通信认证的第二密钥。
S702、第二节点获取用于与第一节点通信认证的第二密钥。
S703、第二节点释放与第一节点的第一通信连接。
S704、第二节点开启对应的用于确定第二密钥有效性的第二定时器。
其中，该第二定时器的正常运转时长为第一时长。
S705、第二节点向第一节点发送针对该第一通信连接的释放请求。
S706、第一节点接收来自该第二节点的、针对该第一通信连接的释放请求。
S707、第一节点释放与该第二节点的第一通信连接。
S708、第一节点开启对应的用于确定第二密钥有效性的第一定时器。
其中，该第一定时器的正常运转时长为第一时长。
S709、第一节点向该第二节点发送连接建立请求，该连接建立请求用于请求基于该第二密钥建立连接。
S710、第二节点接收来自该第一节点发送的连接建立请求。
S711、第二节点向该第一节点发送基于该第二密钥的鉴权信息，该鉴权信息用于验证该第二节点的身份。
S712、第一节点接收来自该第二节点的基于该第二密钥的鉴权信息。
S713、第一节点在确定该第二节点鉴权通过后，向第二节点发送针对该鉴权信息的鉴权响应，该鉴权响应用于验证该第一节点的身份。
S714、第二节点接收来自该第一节点发送的该鉴权响应。
S715、第二节点在确定该第二节点通过认证后，与该第一节点建立第二通信连接。
S716、第一节点在完成与该第二节点的第二通信连接建立后，通知该第二节点该第二通信连接建立完成。
S717、第一节点关闭对应的第一定时器。
S718、第一节点判断第一定时器是否超时，若超时，执行S719，若未超时，执行S720。
S719、第一节点确定该第二密钥失效，终止通信传输。
S720、第一节点通过该第二节点与第三节点的回传链路，与该第三节点进行信息传输。
S721、第二节点在接收到来自该第一节点的第二通信连接建立完成的通知后，关闭对应的第二定时器。
S722、第二节点判断第二定时器是否超时，若超时，执行S723，若未超时，执行S724。
S723、第二节点确定该第二密钥失效，终止通信传输。
S724、第二节点将来自该第一节点的传输信息，通过该第二节点与第三节点的回传链路，发送给该第三节点。
本申请中，可选的，在如图7所示的方法流程中，第一节点开启对应第一定时器的时刻并不局限于执行步骤S707之后，例如，第一节点开启对应第一定时器的时刻还可以在执行S709之后；同理的，第二节点开启对应第二定时器的时刻并不局限于执行步骤S704之后，例如，第二节点开启对应第二定时器的时刻还可以在执行S710之后。
应理解，在如图7所示的方法流程中，步骤序号不意味着执行顺序的先后，各过程的 执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。例如，S702可以优先于S701。此外，在如图7所示的方法流程中，也并不局限上述步骤，任何对上述步骤的增删变形等，都属于本申请保护范围。
其中，结合上述场景一的情况，采用该方式1对第二密钥有效性判断的内容与上述图7的内容相似，为简洁描述，可以参见上述图7的内容，以及场景一的情况，删减上述图7中的S705与S706步骤，得到结合上述场景一的情况，采用该方式1对第二密钥有效性判断的内容，在此不进行赘述。
方式2：第一节点与第二节点共同维护同一定时器，确定该第二密钥是否有效。
参阅图8所示，该方式2对应的方法流程如下：
S800、第一节点与第二节点基于第一密钥建立第一通信连接。
S801、第一节点获取用于与第二节点通信认证的第二密钥。
S802、第二节点获取用于与第一节点通信认证的第二密钥。
S803、第二节点释放与第一节点的第一通信连接。
S804、第二节点开启用于确定第二密钥有效性的定时器。
S805、第二节点向第一节点发送针对该第一通信连接的释放请求。
S806、第一节点接收来自该第二节点的、针对该第一通信连接的释放请求。
S807、第一节点释放与该第二节点的第一通信连接。
S808、第一节点向该第二节点发送连接建立请求，该连接建立请求用于请求基于该第二密钥建立连接。
S809、第二节点接收来自该第一节点发送的连接建立请求。
S810、第二节点向该第一节点发送基于该第二密钥的鉴权信息，该鉴权信息用于验证该第二节点的身份。
S811、第一节点接收来自该第二节点的基于该第二密钥的鉴权信息。
S812、第一节点在确定该第二节点鉴权通过后，向第二节点发送针对该鉴权信息的鉴权响应，该鉴权响应用于验证该第一节点的身份。
S813、第二节点接收来自该第一节点发送的该鉴权响应。
S814、第二节点在确定该第二节点通过认证后，与该第一节点建立第二通信连接。
S815、第一节点在完成与该第二节点的第二通信连接建立后，通知该第二节点该第二通信连接建立完成。
S816、第一节点关闭该定时器。
S817、第一节点判断该定时器是否超时，若超时，执行S818，若未超时，执行S819。
S818、第一节点确定该第二密钥失效，终止通信传输。
本申请中，可选的，该第一节点还可以将该第二密钥失效的结果通知给第二节点。
S819、第一节点通过该第二节点与第三节点的回传链路，与该第三节点进行信息传输。
可以理解的，上述图8所示的方法流程中，还可以由第一节点开启该定时器，由第二节点关闭该定时器，例如，第一节点在执行S807后，开启该定时器，第二节点在接收到S815中第一节点发送的第二通信连接建立完成的通知后，关闭该定时器；同理的，可以由第二节点判断该定时器是否超时，由此确定该第二密钥是否有效。
应理解，在如图8所示的方法流程中，步骤序号不意味着执行顺序的先后，各过程的 执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。例如，S802可以优先于S801。此外，在如图8所示的方法流程中，也并不局限上述步骤，任何对上述步骤的增删变形等，都属于本申请保护范围。
其中，结合上述场景一的情况，采用该方式2对第二密钥有效性判断的内容与上述图8的内容相似，为简洁描述，可以参见上述图8的内容，以及场景一的情况，删减上述图8中的S805与S806的步骤，得到结合上述场景一的情况，采用该方式2对第二密钥有效性判断的内容，在此不进行赘述。
方式3：第一节点与第二节点基于信令中携带的时间戳，确定该第二密钥是否有效。
参阅图9所示，该方式3对应的方法流程如下：
S900、第一节点与第二节点基于第一密钥建立第一通信连接。
S901、第一节点获取用于与第二节点通信认证的第二密钥。
S902、第二节点获取用于与第一节点通信认证的第二密钥。
S903、第二节点释放与该第一节点的第一通信连接。
S904、第二节点向第一节点发送针对该第一通信连接的释放请求，该释放请求中携带第一时间戳。
其中，该第一时间戳可以是该第二节点向第一节点发送该释放请求的时间。
本申请中，可选的，该第二节点向该第一节点发送该释放请求后，记录该第一时间戳。
S905、第一节点接收来自该第二节点的、针对该第一通信连接的释放请求，获取该第一时间戳。
S906、第一节点释放与该第二节点的第一通信连接。
S907、第一节点向该第二节点发送连接建立请求，该连接建立请求用于请求基于该第二密钥建立连接。
S908、第二节点接收来自该第一节点发送的连接建立请求。
S909、第二节点向该第一节点发送基于该第二密钥的鉴权信息，该鉴权信息用于验证该第二节点的身份。
S910、第一节点接收来自该第二节点的基于该第二密钥的鉴权信息。
S911、第一节点在确定该第二节点鉴权通过后，向第二节点发送针对该鉴权信息的鉴权响应，该鉴权响应用于验证该第一节点的身份。
S912、第二节点接收来自该第一节点发送的该鉴权响应。
S913、第二节点在确定该第二节点通过认证后，与该第一节点建立第二通信连接。
S914、第一节点在完成与该第二节点的第二通信连接建立后，向第二节点发送建立完成消息，该建立完成消息中携带第二时间戳。
其中，该建立完成消息用于通知该第二节点，第一节点已完成第二通信连接的建立。
该第二时间戳可以是第一节点向第二节点发送建立完成消息的时间；或者，该第二时间戳可以是第一节点完成第二通信连接建立的时间。
本申请中，可选的，该第一节点记录该第二时间戳。
S915、第一节点确定该第二时间戳与该第一时间戳相差时长是否不大于第一时长，若是，执行S916，若否，执行S917。
S916、第一节点通过该第二节点与第三节点的回传链路，与该第三节点进行信息传输。
S917、第一节点确定该第二密钥失效，终止通信传输。
S918、第二节点接收到该建立完成消息后，获取该第二时间戳。
S919、第二节点确定该第二时间戳与该第一时间戳相差时长是否不大于该第一时长，若是，执行S920，若否，执行S921。
S920、第二节点将来自该第一节点的传输信息，通过该第二节点与第三节点的回传链路，发送给该第三节点。
S921、第二节点确定该第二密钥失效，终止通信传输。
应理解，如图9所示的方法流程仅是对第一节点与第二节点通过时间戳确定第二密钥是否有效的示例，并不构成通过时间戳确定第二密钥是否有效的方法限定，也并不局限上述步骤，任何对上述步骤的增删变形等，都属于本申请保护范围。
其中，结合上述场景一的情况，采用该方式3对第二密钥有效性判断的内容与上述图9的内容相似，为简洁描述，可以参见上述图9的内容，以及场景一的情况，删减上述图9中的S904与S905步骤，得到结合上述场景一的情况，采用该方式3对第二密钥有效性判断的内容，在此不进行赘述。
本申请通过第一节点与第二节点采用第二密钥进行通信传输过程中，进一步验证该第二密钥是否有效，能够保证第二密钥的时效性，以及更好的保证通信传输的安全性。
至此，已经结合图3～图9详细介绍了本申请的通信系统以及所述实现的通信方法。在该通信方案中，本申请提供了不同通信系统进行融合通信场景下的通信方法，有效提升了通信的安全性。
此外，上述图3～图9的内容，并不构成对本申请提供的通信方法的限定，任何针对上述图3～图9的内容的变形都属于本申请保护范围，例如，可以将上述图4，图6以及图7的内容进行组合，得到本申请在场景一的情况下，通过挂起以及激活回传链路，并验证第二密钥有效性的通信方案，能够更好的降低系统开销，提升通信安全性。
其中，方法和装置是基于相同或相似技术构思的，由于方法及装置解决问题的原理相似，因此装置与方法的实施可以相互参见，重复之处不再赘述。本申请实施例中的术语“系统”和“网络”可被互换使用。本申请实施例的描述中，“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。本申请中所涉及的至少一个是指一个或多个；多个，是指两个或两个以上。另外，需要理解的是，在本申请的描述中，“第一”、“第二”、“第三”等词汇，仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序。在本说明书中描述的参考“一个实施例”或“一些实施例”等意味着在本申请的一个或多个实施例中包括结合该实施例描述的特定特征、结构或特点。由此，在本说明书中的不同之处出现的语句“在一个实施例中”、“在一些实施例中”、“在其他一些实施例中”、“在另外一些实施例中”等不是必然都参考相同的实施例，而是意味着“一个或多个但不是所有的实施例”，除非是以其他方式另外特别强调。术语“包括”、“包含”、“具有”及它们的变形都意味着“包括但不限于”，除非是以其他方式另外特别强调。
以下结合图10和图11详细说明本申请实施例提供的装置。应理解，装置实施例的描述与方法实施例的描述相互对应。因此，未详细描述的内容可相互参见。
图10是本申请实施例提供的装置1000的示意性框图，用于实现上文方法实施例中第一装置或第二装置的功能。例如，该装置可以为软件模块或芯片系统。所述芯片可以由芯片构成，也可以包括芯片和其他分立器件。该装置1000包括处理单元1001和通信单元1002。通信单元1002用于与其它设备进行通信，还可以称为通信接口、收发单元或输入\输出接口等。
在一些实施例中，上述装置1000可用于实现上文方法中第一装置的功能，装置1000可以是第一装置，或者配置于第一装置中的芯片或电路等。处理单元1001可用于执行上文方法实施例中第一装置的处理相关操作，通信单元1002用于指示上文方法实施例中第一装置的收发相关操作。
例如，处理单元1001，用于获取用于与第二节点通信认证的第二密钥，所述第二密钥不同于预先配置的第一密钥；通信单元1002，用于接收来自所述第二节点的、针对第一通信连接的释放请求，所述第一密钥用于所述第一通信连接的通信认证；所述通信单元1002，还用于向所述第二节点发送连接建立请求，所述连接建立请求用于请求基于所述第二密钥建立连接。
可选的，所述连接建立请求用于请求基于所述第二密钥建立连接，包括所述连接建立请求用于请求基于所述第二密钥执行认证和安全上下文协商流程。
可选的，所述通信单元1002还用于接收来自所述第二节点的基于所述第二密钥的鉴权信息；所述鉴权信息用于验证所述第二节点的身份。
可选的，所述鉴权信息用于验证所述第二节点的身份，包括所述鉴权信息用于验证是否基于所述第二密钥与所述第二节点建立第二通信连接。
可选的，所述通信单元1002还用于向所述第二节点发送基于所述第二密钥的鉴权响应，所述鉴权响应用于验证所述第一节点的身份。
可选的，所述鉴权响应用于验证所述第一节点的身份，包括用于所述第二节点验证是否基于所述第二密钥与第一节点建立所述第二通信连接。
可选的，所述释放请求中包括请求原因信息；所述请求原因信息用于指示用于通信认证的密钥更新。
可选的，所述第二密钥在第一时长内有效，所述第一时长通过定时器或者时间戳定义。
可选的，所述第二密钥在第一时刻开始的第一时长内有效，所述第一时刻为所述第一通信连接释放的时刻，或者发送所述连接建立请求的时刻。
可选的，所述处理单元1001还用于在所述第二密钥的有效期内，通过所述第二节点与第三节点的回传链路，与所述第三节点进行信息传输。
可选的，所述第一密钥是基于第一通信系统推演(或协商)的密钥，和/或，所述第二密钥是基于第二通信系统推演(或协商)的密钥，所述第一通信系统与所述第二通信系统不同。
在另一些实施例中，上述装置1000可用于实现上文方法实施例中第二装置的功能，装置1000可以是第二装置，或者配置于第二装置中的芯片或电路等。处理单元1001可用于执行上文方法实施例中第二装置的处理相关操作，通信单元1002可用于执行上文方法实施例中第二装置的收发相关操作。
例如，处理单元1001，用于获取用于与第一节点通信认证的第二密钥，所述第二密钥不同于预先配置的第一密钥；通信单元1002用于向所述第一节点发送针对第一通信连接 的释放请求，所述第一密钥用于所述第一通信连接的通信认证；所述通信单元1002，还用于接收来自所述第一节点发送的连接建立请求，所述连接建立请求用于请求基于所述第二密钥建立连接。
可选的，所述连接建立请求用于请求基于所述第二密钥建立连接，包括所述连接建立请求用于请求基于所述第二密钥执行认证和安全上下文协商流程。
可选的，所述通信单元1002还用于向所述第一节点发送基于所述第二密钥的鉴权信息；所述鉴权信息用于验证第二节点的身份。
可选的，所述鉴权信息用于验证第二节点的身份，包括所述鉴权信息用于所述第一节点验证是否基于所述第二密钥与所述第二节点建立第二通信连接。
可选的，所述第一密钥是基于第一通信系统推演(或协商)的密钥，和/或，所述第二密钥是基于第二通信系统推演(或协商)的密钥，所述第一通信系统与所述第二通信系统不同。
可选的，所述通信单元1002还用于接收来自所述第一节点的基于所述第二密钥的鉴权响应；所述鉴权响应用于验证所述第一节点的身份。
可选的，所述鉴权响应用于验证所述第一节点的身份，包括所述鉴权响应用于所述第二节点验证是否基于所述第二密钥与第一节点建立所述第二通信连接。
可选的，所述释放请求中包括请求原因信息；所述请求原因信息用于指示用于通信认证的密钥更新。
可选的，所述第二密钥在第一时长内有效，所述第一时长可以通过定时器或者时间戳定义。
可选的，所述第二密钥在第一时刻开始的第一时长内有效，所述第一时刻为所述第一通信连接释放的时刻，或者所述第二节点接收到所述连接建立请求的时刻。
可选的，所述处理单元1001还用于在所述第二密钥的有效期内，将来自所述第一节点的传输信息，通过所述第二节点与第三节点的回传链路，发送给所述第三节点。
可选的，在释放与所述第一节点的第一通信连之后，所述处理单元1001还用于将所述回传链路挂起。
可选的，所述处理单元1001还用于在确定与所述第一节点之间成功建立第二通信连接后，激活所述回传链路；所述第二通信连接是基于所述第二密钥进行通信认证的。
本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。另外，在本申请实施例中各功能单元可以集成在一个处理器中，也可以是单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
请参见图11，图11为本申请实施例提供的装置1100的示意图，该装置1100可以为节点，或者节点中的一部件，例如芯片或集成电路等。该装置1100可包括至少一个处理器1102和通信接口1104。进一步，可选的，所述装置还可以包括至少一个存储器1101。更进一步，可选的，还可以包含总线1103。其中，存储器1101、处理器1102和通信接口1104通过总线1103相连。
其中，存储器1101用于提供存储空间，存储空间中可以存储操作系统和计算机程序等数据。本申请实施例中提及的存储器1101可以是易失性存储器或非易失性存储器，或可包 括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
应注意，本文描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。处理器1102是进行算术运算和/或逻辑运算的模块，具体可以是中央处理器(central processing unit，CPU)、图片处理器(graphics processing unit，GPU)、微处理器(microprocessor unit，MPU)、专用集成电路(application specific integrated circuit，ASIC)、现场可编程逻辑门阵列(field programmable gate array，FPGA)、复杂可编程逻辑器件(complex programmable logic device，CPLD)、协处理器(协助中央处理器完成相应处理和应用)、微控制单元(microcontroller unit，MCU)等处理模块中的一种或者多种的组合。
需要说明的是，当处理器为通用处理器、ASIC、FPGA或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件时，存储器(存储模块)可以集成在处理器中。
通信接口1104可以用于为所述至少一个处理器提供信息输入或者输出。和/或所述通信接口可以用于接收外部发送的数据和/或向外部发送数据，可以为包括诸如以太网电缆等的有线链路接口，也可以是无线链路(Wi-Fi、蓝牙、通用无线传输、车载短距通信技术等)接口。可选的，通信接口1104还可以包括与接口耦合的发射器(如射频发射器、天线等)，或者接收器等。
在一些实施例中，上述装置1100可以为上文方法实施例中的第一装置或者第一装置中的部件，例如芯片或者集成电路。该装置1100中的处理器1102用于读取所述存储器1101中存储的计算机程序，控制所述第一装置执行以下操作：
获取用于与第二节点通信认证的第二密钥，所述第二密钥不同于预先配置的第一密钥；接收来自所述第二节点的、针对第一通信连接的释放请求，所述第一密钥用于所述第一通信连接的通信认证；向所述第二节点发送连接建立请求，所述连接建立请求用于请求基于所述第二密钥建立连接。
可选的，该第一装置中的处理器1102，还可以用于读取存储器1101中的程序并执行如图3所示的S300～S305中该第一节点执行的方法流程；或执行如图4所示的S400～S417中该第一节点执行的方法流程；或执行如图5所示的S500～S519中该第一节点执行的方法流程；或执行如图6所示的S600～S617中该第一节点执行的方法流程；或执行如图7所示的S700～S724中该第一节点执行的方法流程；或执行如图8所示的S800～S819中该第一节点执行的方法流程；或执行如图9所示的S900～S921中该第一节点执行的方法流程。
关于具体细节，可参见上文方法实施例中的记载，在此不再赘述。
在另一些实施例中，上述装置1100可以为上文方法实施例中的第二装置或者第二装置 中的部件，例如芯片或者集成电路。该装置1100中的处理器1102用于读取所述存储器1101中存储的计算机程序，控制所述第二装置执行以下操作：
获取用于与第一节点通信认证的第二密钥，所述第二密钥不同于预先配置的第一密钥；向所述第一节点发送针对第一通信连接的释放请求，所述第一密钥用于所述第一通信连接的通信认证；接收来自所述第一节点发送的连接建立请求，所述连接建立请求用于请求基于所述第二密钥建立连接。
可选的，该第二装置中的处理器1102，还可以用于读取存储器1101中的程序并执行如图3所示的S300～S305中该第二节点执行的方法流程；或执行如图4所示的S400～S417中该第二节点执行的方法流程；或执行如图5所示的S500～S519中该第二节点执行的方法流程；或执行如图6所示的S600～S617中该第二节点执行的方法流程；或执行如图7所示的S700～S724中该第二节点执行的方法流程；或执行如图8所示的S800～S819中该第二节点执行的方法流程；或执行如图9所示的S900～S921中该第二节点执行的方法流程。
关于具体细节，可参见上文方法实施例中的记载，在此不再赘述。
本申请实施例还提供一种终端，所述终端可以为具备短距通信功能的智能手机、笔记本、平板电脑等智能终端、鼠标、键盘、耳机、音响或者车载播放设备等。所述终端包括第一装置和/或第二装置，该第一装置和第二装置可分别为上述图3所示实施例中的第一节点和第二节点。其中，第一装置与第二装置的类型可相同或不同。
其中，图12示出了一种简化的终端设备的结构示意图。便于理解和图示方便，图12中，终端设备以手机作为例子。如图12所示，终端设备包括处理器、存储器、射频电路、天线以及输入输出装置。处理器主要用于对通信协议以及通信数据进行处理，以及对终端设备进行控制，执行软件程序，处理软件程序的数据等。存储器主要用于存储软件程序和数据。射频电路主要用于基带信号与射频信号的转换以及对射频信号的处理。天线主要用于收发电磁波形式的射频信号。输入输出装置，例如触摸屏、显示屏，键盘等主要用于接收用户输入的数据以及对用户输出数据。需要说明的是，有些种类的终端设备可以不具有输入输出装置。
当需要发送数据时，处理器对待发送的数据进行基带处理后，输出基带信号至射频电路，射频电路将基带信号进行射频处理后将射频信号通过天线以电磁波的形式向外发送。当有数据发送到终端设备时，射频电路通过天线接收到射频信号，将射频信号转换为基带信号，并将基带信号输出至处理器，处理器将基带信号转换为数据并对该数据进行处理。为便于说明，图12中仅示出了一个存储器和处理器。在实际的终端设备产品中，可以存在一个或多个处理器和一个或多个存储器。存储器也可以称为存储介质或者存储设备等。存储器可以是独立于处理器设置，也可以是与处理器集成在一起，本申请实施例对此不做限制。
在本申请实施例中，可以将具有收发功能的天线和射频电路视为终端设备的收发单元，将具有处理功能的处理器视为终端设备的处理单元。如图12所示，终端设备包括收发单元1210和处理单元1220。收发单元也可以称为收发器、收发机、收发装置等。处理单元也可以称为处理器，处理单板，处理模块、处理装置等。可选的，可以将收发单元1210中用于实现接收功能的器件视为接收单元，将收发单元1210中用于实现发送功能的器件视为发送单元，即收发单元1210包括接收单元和发送单元。收发单元有时也可以称为收发机、收发器、或收发电路等。接收单元有时也可以称为接收机、接收器、或接收电路等。 发送单元有时也可以称为发射机、发射器或者发射电路等。
应理解，收发单元1210用于执行上述图3所示的方法实施例中第一节点侧的发送操作和接收操作，处理单元1220用于执行上述图3所示的方法实施例中第一节点侧除了收发操作之外的其他操作。
例如，在一种实现方式中，收发单元1210用于执行图3所示的实施例中的终端设备侧的收发步骤，例如S303和S305，和/或用于支持本文所描述的技术的其它过程。处理单元1220，用于执行图3所示的实施例中的终端设备侧除了收发操作之外的其他操作，例如S300，和/或用于支持本文所描述的技术的其它过程。
或者，收发单元1210用于执行上述图4所示的方法实施例中终端设备侧的发送操作和接收操作，处理单元1220用于执行上述图4所示的方法实施例中终端设备侧除了收发操作之外的其他操作。
例如，在一种实现方式中，收发单元1210用于执行图4所示的实施例中的终端设备侧的收发步骤，例如S406，和/或用于支持本文所描述的技术的其它过程。处理单元1220，用于执行图4所示的实施例中的终端设备侧除了收发操作之外的其他操作，例如S409，和/或用于支持本文所描述的技术的其它过程。
或者，收发单元1210用于执行上述图5所示的方法实施例中终端设备侧的发送操作和接收操作，处理单元1220用于执行上述图5所示的方法实施例中终端设备侧除了收发操作之外的其他操作。
例如，在一种实现方式中，收发单元1210用于执行图5所示的实施例中的终端设备侧的收发步骤，例如S508，和/或用于支持本文所描述的技术的其它过程。处理单元1220，用于执行图5所示的实施例中的终端设备侧除了收发操作之外的其他操作，例如S511，和/或用于支持本文所描述的技术的其它过程。
或者，收发单元1210用于执行上述图6所示的方法实施例中终端设备侧的发送操作和接收操作，处理单元1220用于执行上述图6所示的方法实施例中终端设备侧除了收发操作之外的其他操作。
例如，在一种实现方式中，收发单元1210用于执行图6所示的实施例中的终端设备侧的收发步骤，例如S606，和/或用于支持本文所描述的技术的其它过程。处理单元1220，用于执行图6所示的实施例中的终端设备侧除了收发操作之外的其他操作，例如S604，和/或用于支持本文所描述的技术的其它过程。
或者，收发单元1210用于执行上述图7所示的方法实施例中终端设备侧的发送操作和接收操作，处理单元1220用于执行上述图7所示的方法实施例中终端设备侧除了收发操作之外的其他操作。
例如，在一种实现方式中，收发单元1210用于执行图7所示的实施例中的终端设备侧的收发步骤，例如S706，和/或用于支持本文所描述的技术的其它过程。处理单元1220，用于执行图7所示的实施例中的终端设备侧除了收发操作之外的其他操作，例如S704，和/或用于支持本文所描述的技术的其它过程。
或者，收发单元1210用于执行上述图8所示的方法实施例中终端设备侧的发送操作和接收操作，处理单元1220用于执行上述图8所示的方法实施例中终端设备侧除了收发操作之外的其他操作。
例如，在一种实现方式中，收发单元1210用于执行图8所示的实施例中的终端设备 侧的收发步骤，例如S806，和/或用于支持本文所描述的技术的其它过程。处理单元1220，用于执行图8所示的实施例中的终端设备侧除了收发操作之外的其他操作，例如S804，和/或用于支持本文所描述的技术的其它过程。
或者，收发单元1210用于执行上述图9所示的方法实施例中终端设备侧的发送操作和接收操作，处理单元1220用于执行上述图9所示的方法实施例中终端设备侧除了收发操作之外的其他操作。
例如，在一种实现方式中，收发单元1210用于执行图9所示的实施例中的终端设备侧的收发步骤，例如S905，和/或用于支持本文所描述的技术的其它过程。处理单元1220，用于执行图9所示的实施例中的终端设备侧除了收发操作之外的其他操作，例如S915，和/或用于支持本文所描述的技术的其它过程。
当该通信装置为芯片时，该芯片包括收发单元和处理单元。其中，收发单元可以是输入输出电路、通信接口；处理单元为该芯片上集成的处理器或者微处理器或者集成电路。
本申请实施例还提供一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行上文实施例所描述的方法。
本申请实施例还提供一种芯片系统，该芯片系统包括至少一个处理器和接口电路。进一步可选的，所述芯片系统还可以包括存储器或者外接存储器。所述处理器用于通过所述接口电路执行指令和/或数据的交互，以实现上文方法实施例中的方法。该芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
本申请实施例还提供一种计算机程序产品，包括指令，当其在计算机上运行时，使得计算机执行上文实施例所描述的方法。
在本申请实施例中，处理器可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件、协处理器等，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
在本申请实施例中，存储器可以是非易失性存储器，比如硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)等，还可以是易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)。存储器是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。本申请实施例中的存储器还可以是电路或者其它任意能够实现存储功能的装置，用于存储程序指令和/或数据。
本申请实施例提供的方法中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、网络设备、用户设备或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，简称DSL))或无线(例 如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机可以存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，数字视频光盘(digital video disc，简称DVD))、或者半导体介质(例如，SSD)等。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (26)

  1. 一种通信方法，其特征在于，所述方法包括：
    获取用于与第二节点通信认证的第二密钥，所述第二密钥不同于预先配置的第一密钥；
    接收来自所述第二节点的、针对第一通信连接的释放请求，所述第一密钥用于所述第一通信连接的通信认证；
    向所述第二节点发送连接建立请求，所述连接建立请求用于请求基于所述第二密钥建立连接。
  2. 如权利要求1所述的方法，其特征在于：
    所述连接建立请求用于请求基于所述第二密钥建立连接，包括：
    所述连接建立请求用于请求基于所述第二密钥执行认证和安全上下文协商流程。
  3. 如权利要求1或2所述的方法，其特征在于，所述方法还包括：
    接收来自所述第二节点的基于所述第二密钥的鉴权信息；所述鉴权信息用于验证所述第二节点的身份。
  4. 如权利要求3所述的方法，其特征在于，所述方法还包括：
    向所述第二节点发送基于所述第二密钥的鉴权响应，所述鉴权响应用于验证所述第一节点的身份。
  5. 如权利要求1～4任一项所述的方法，其特征在于，所述释放请求中包括请求原因信息；
    所述请求原因信息用于指示用于通信认证的密钥更新。
  6. 如权利要求1～5任一项所述的方法，其特征在于，所述第二密钥在第一时长内有效，所述第一时长通过定时器或者时间戳定义。
  7. 如权利要求6所述的方法，其特征在于：
    所述第二密钥在第一时刻开始的第一时长内有效，所述第一时刻为所述第一通信连接释放的时刻，或者发送所述连接建立请求的时刻。
  8. 如权利要求1～7任一项所述的方法，其特征在于，所述方法还包括：
    在所述第二密钥的有效期内，通过所述第二节点与第三节点的回传链路，与所述第三节点进行信息传输。
  9. 如权利要求1～8任一项所述的方法，其特征在于，所述第一密钥是基于第一通信系统推演的密钥，和/或，所述第二密钥是基于第二通信系统推演的密钥，所述第一通信系统与所述第二通信系统不同。
  10. 一种通信方法，其特征在于，包括：
    获取用于与第一节点通信认证的第二密钥，所述第二密钥不同于预先配置的第一密钥；
    向所述第一节点发送针对第一通信连接的释放请求，所述第一密钥用于所述第一通信连接的通信认证；
    接收来自所述第一节点发送的连接建立请求，所述连接建立请求用于请求基于所述第二密钥建立连接。
  11. 如权利要求10所述的方法，其特征在于：
    所述连接建立请求用于请求基于所述第二密钥建立连接，包括：
    所述连接建立请求用于请求基于所述第二密钥执行认证和安全上下文协商流程。
  12. 如权利要求10或11所述的方法，其特征在于，所述方法还包括:
    向所述第一节点发送基于所述第二密钥的鉴权信息；所述鉴权信息用于验证第二节点的身份。
  13. 如权利要求12所述的方法，其特征在于，所述方法还包括：
    接收来自所述第一节点的基于所述第二密钥的鉴权响应；所述鉴权响应用于验证所述第一节点的身份。
  14. 如权利要求10～13任一项所述的方法，其特征在于，所述释放请求中包括请求原因信息；
    所述请求原因信息用于指示用于通信认证的密钥更新。
  15. 如权利要求10～14任一项所述的方法，其特征在于，所述第二密钥在第一时长内有效，所述第一时长可以通过定时器或者时间戳定义。
  16. 如权利要求15所述的方法，其特征在于：
    所述第二密钥在第一时刻开始的第一时长内有效，所述第一时刻为所述第一通信连接释放的时刻，或者所述第二节点接收到所述连接建立请求的时刻。
  17. 如权利要求10～16任一项所述的方法，其特征在于，所述方法还包括：
    在所述第二密钥的有效期内，将来自所述第一节点的传输信息，通过所述第二节点与第三节点的回传链路，发送给所述第三节点。
  18. 如权利要求17所述的方法，其特征在于，在释放与所述第一节点的第一通信连之后，还包括：
    将所述回传链路挂起。
  19. 如权利要求18所述的方法，其特征在于，所述方法还包括：
    在确定与所述第一节点之间成功建立第二通信连接后，激活所述回传链路；所述第二通信连接是基于所述第二密钥进行通信认证的。
  20. 一种通信装置，其特征在于，包括：
    处理模块，用于获取用于与第二节点通信认证的第二密钥，所述第二密钥不同于预先配置的第一密钥；
    通信模块，用于接收来自所述第二节点的、针对第一通信连接的释放请求，所述第一密钥用于所述第一通信连接的通信认证；
    所述通信模块，还用于向所述第二节点发送连接建立请求，所述连接建立请求用于请求基于所述第二密钥建立连接。
  21. 一种通信装置，其特征在于，包括：
    处理模块，用于获取用于与第一节点通信认证的第二密钥，所述第二密钥不同于预先配置的第一密钥；
    通信模块，用于向所述第一节点发送针对第一通信连接的释放请求，所述第一密钥用于所述第一通信连接的通信认证；
    所述通信模块，还用于接收来自所述第一节点发送的连接建立请求，所述连接建立请求用于请求基于所述第二密钥建立连接。
  22. 一种通信装置，其特征在于，包括至少一个处理器和接口电路；所述接口电路为所 述至少一个处理器提供程序或者指令，所述至少一个处理器通过逻辑电路或执行程序或者指令以实现所述通信装置所在的设备执行如权利要求1至9中任一项。
  23. 一种通信装置，其特征在于，包括至少一个处理器和接口电路；所述接口电路为所述至少一个处理器提供程序或者指令，所述至少一个处理器通过逻辑电路或执行程序或者指令以实现所述通信装置所在的设备执行如权利要求10至19中任一项。
  24. 一种通信系统，其特征在于，包括如权利要求20或22所述的通信装置，以及包括如权利要求21或23所述的通信装置。
  25. 一种计算机可读存储介质，其特征在于，包括程序指令，当所述程序指令在计算机上运行时，使得所述计算机执行如权利要求1～19中任一所述的方法。
  26. 一种终端，其特征在于，包括执行如权利要求1～9中任一所述方法的第一节点，和/或，执行如权利要求10～19任一项所述方法的第二节点。
PCT/CN2022/114680 2021-08-30 2022-08-25 一种通信方法、装置及系统 WO2023030148A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP22863286.5A EP4387302A1 (en) 2021-08-30 2022-08-25 Communication method, apparatus and system
KR1020247010737A KR20240049384A (ko) 2021-08-30 2022-08-25 통신 방법, 장치 및 시스템
US18/592,062 US20240205674A1 (en) 2021-08-30 2024-02-29 Communication method, apparatus, and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111005514.2A CN115734219A (zh) 2021-08-30 2021-08-30 一种通信方法、装置及系统
CN202111005514.2 2021-08-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/592,062 Continuation US20240205674A1 (en) 2021-08-30 2024-02-29 Communication method, apparatus, and system

Publications (1)

Publication Number Publication Date
WO2023030148A1 true WO2023030148A1 (zh) 2023-03-09

Family

ID=85290928

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/114680 WO2023030148A1 (zh) 2021-08-30 2022-08-25 一种通信方法、装置及系统

Country Status (5)

Country Link
US (1) US20240205674A1 (zh)
EP (1) EP4387302A1 (zh)
KR (1) KR20240049384A (zh)
CN (1) CN115734219A (zh)
WO (1) WO2023030148A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101400059A (zh) * 2007-09-28 2009-04-01 华为技术有限公司 一种active状态下的密钥更新方法和设备
US20160295406A1 (en) * 2013-11-14 2016-10-06 Samsung Electronics Co., Ltd. Method and apparatus for managing security key in a near field d2d communication system
WO2019213925A1 (zh) * 2018-05-10 2019-11-14 华为技术有限公司 密钥更新方法、设备和存储介质
CN112771815A (zh) * 2020-03-31 2021-05-07 华为技术有限公司 密钥处理方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101400059A (zh) * 2007-09-28 2009-04-01 华为技术有限公司 一种active状态下的密钥更新方法和设备
US20160295406A1 (en) * 2013-11-14 2016-10-06 Samsung Electronics Co., Ltd. Method and apparatus for managing security key in a near field d2d communication system
WO2019213925A1 (zh) * 2018-05-10 2019-11-14 华为技术有限公司 密钥更新方法、设备和存储介质
CN112771815A (zh) * 2020-03-31 2021-05-07 华为技术有限公司 密钥处理方法和装置

Also Published As

Publication number Publication date
EP4387302A1 (en) 2024-06-19
CN115734219A (zh) 2023-03-03
KR20240049384A (ko) 2024-04-16
US20240205674A1 (en) 2024-06-20

Similar Documents

Publication Publication Date Title
JP7410930B2 (ja) 無線通信ネットワークにおける非アクセス階層通信の保護
CN114557059A (zh) 处理时间同步报文的方法和装置
WO2020211778A1 (zh) 小区切换方法以及装置
WO2020098719A1 (zh) 一种通信方法及其装置
WO2019085676A1 (zh) 无人机与控制器的通信方法及设备
WO2021023088A1 (zh) 数据传输的方法和装置
US20230092744A1 (en) Ckey obtaining method and apparatus
WO2023030148A1 (zh) 一种通信方法、装置及系统
US20230021397A1 (en) Time Synchronization Packet Processing Method and Apparatus
CN112654046A (zh) 用于注册的方法和装置
WO2022160205A1 (zh) 一种数据传输方法、终端设备和网络设备
WO2021184219A1 (zh) 连接云端的方法和终端设备
CN112154682B (zh) 密钥更新方法、设备和存储介质
WO2023125342A1 (zh) 通信方法、装置及系统
US20240244681A1 (en) Communication method, apparatus, and system
WO2024087072A1 (zh) 一种通信方法、装置及系统
WO2023273880A1 (zh) 传输方式切换的方法和相关装置
WO2021057456A1 (zh) 用于注册的方法和装置
EP4391614A1 (en) Communication method, apparatus and system
WO2023137760A1 (zh) 无线通信方法、远端ue、ausf以及amf
WO2024065765A1 (zh) 安全建立的方法、通信方法及装置
WO2023142815A1 (zh) 通信的方法和装置
WO2023185960A1 (zh) 通信方法及装置
WO2023213184A1 (zh) 一种通信方法及通信装置
WO2023056852A1 (zh) 一种通信方法、装置及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22863286

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2024513466

Country of ref document: JP

ENP Entry into the national phase

Ref document number: 2022863286

Country of ref document: EP

Effective date: 20240313

ENP Entry into the national phase

Ref document number: 20247010737

Country of ref document: KR

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE