WO2023071836A1 - 一种通信方法及装置 - Google Patents

一种通信方法及装置 Download PDF

Info

Publication number
WO2023071836A1
WO2023071836A1 PCT/CN2022/125486 CN2022125486W WO2023071836A1 WO 2023071836 A1 WO2023071836 A1 WO 2023071836A1 CN 2022125486 W CN2022125486 W CN 2022125486W WO 2023071836 A1 WO2023071836 A1 WO 2023071836A1
Authority
WO
WIPO (PCT)
Prior art keywords
identifier
management function
network
user equipment
key
Prior art date
Application number
PCT/CN2022/125486
Other languages
English (en)
French (fr)
Inventor
李飞
邓娟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023071836A1 publication Critical patent/WO2023071836A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/068—Authentication using credential vaults, e.g. password manager applications or one time password [OTP] applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent

Definitions

  • the present application relates to the technical field of communication, and in particular to a communication method and device.
  • the private network architecture includes a large central network and a small network.
  • the small network is, for example, a network deployed close to the service server.
  • at least user plane function (UPF) is deployed, and the UPF in the small network is deployed near the client server.
  • the central large network can correspond to multiple small networks, that is, it supports establishing sessions through UPFs in multiple small networks.
  • the central network may be a public network.
  • the central network may be a central network (such as a core network) deployed centrally by operators.
  • the small network can be a local network deployed near the customer.
  • the user equipment can access the central network of the private network architecture through the base station, and the central network establishes a session passing through the UPF in the local network, which is used to transmit the user equipment of the user equipment.
  • surface data so that the user equipment can obtain the service data in the client server through the UPF in the local network, and the UPF used in the local network is deployed near the client server, so it can reduce the transmission delay of service data between the user equipment and the client server .
  • the local control plane network function is deployed in the local network, and the local control plane network function includes access and mobility management function (access and mobility management function, AMF), session management function (session management function) , SMF) and unified data management (unified data management, UDM), respectively referred to as local AMF, local SMF and local UDM.
  • AMF access and mobility management function
  • SMF session management function
  • UDM unified data management
  • central control plane network functions such as AMF, SMF, PCF, and UDM can be deployed in the central network, which are respectively called central AMF, central SMF, central PCF, and central UDM.
  • the process of UE registering to the central network through the base station still depends on the central control plane network function, that is, the UE registration is realized through the central AMF.
  • the UE communicates with the central network.
  • the base station may need to choose to access the local network for the UE. In this case, if the UE can access the local network, it can ensure that the service will not be interrupted. That is to say, the local network can provide high reliability guarantee for the UE.
  • the UE needs to register with the local network.
  • the UE's long-term key is stored in the central UDM, and the local UDM cannot know the UE's long-term key, so the local network cannot authenticate the UE by using the long-term key.
  • the failure of the local network to authenticate the UE will cause the UE to fail to register with the local network. Therefore, a user plane data transmission path in the local network cannot be established for the UE, resulting in the UE being unable to obtain user plane data and reducing service reliability.
  • the purpose of the embodiments of the present application is to provide a communication method and device for providing an authentication method for a UE in a local network and improving service reliability.
  • the embodiment of the present application provides a communication method.
  • the method can be executed by the first UDM deployed in the first network (or local network).
  • the method includes: the first UDM receives from the second UDM the first identity of the UE, a random number (RAND), an authentication token (AUTN) and a first key.
  • the first key corresponds to the long-term key of the UDM and the name of the first service network.
  • the first service network name corresponds to the identifier of the first network.
  • the first UDM is deployed on the first network, and the second unified data management function is deployed on the second network.
  • the first UDM may also receive a UE authentication request from the AMF, where the UE authentication request includes a second identity of the UE, and the second identity corresponds to the first identity, or the second identity is the same as the first identity.
  • the AMF is deployed on the first network.
  • the first UDM determines a random number, an authentication token, and a first key corresponding to the first identifier according to the second identifier.
  • the first UDM sends the random number and the authentication token to the AMF.
  • the first UDM may also send the second key corresponding to the first key to the AMF.
  • the first UDM deployed in the first network can obtain the random number, authentication token and first key of the user equipment from the second UDM in the second network, and the first UDM can also send The AMF sends the random number and the authentication token to realize the authentication of the UE, so that for the scenario where the connection between the base station accessed by the UE and the second network fails or the connection between the second network and the first network fails, the UE can be supported Access services through a local network, that is, access services through a local network to ensure that services will not be interrupted, thereby improving service reliability.
  • the method can ensure that the UE's long-term key is not leaked to the local network, thereby improving the security of the user's long-term key.
  • the first identifier may include a subscription permanent identifier (SUPI) of the UE
  • the second identifier may include the SUPI of the UE or a first subscription concealed identifier (subscription concealed identifier, SUPI) determined according to the SUPI. SUCI).
  • the first identifier may include the hidden SUPI of the UE (in this application, SUPI* represents the hidden SUPI for convenience of description)
  • the second identifier includes the second SUCI determined according to the SUPI*
  • the SUPI* of the UE corresponds to the SUPI of the UE.
  • SUPI or in other words, the SUPI* of the UE is determined according to the SUPI of the UE.
  • the first UDM can decrypt the second SUCI according to the first private key to obtain the SUPI *; if the first identity includes the SUPI of the UE, and the second identity includes the first SUCI determined according to the SUPI, then the first UDM can also decrypt the first SUCI according to the second private key to obtain the SUPI, wherein the first private key and The second private key is different.
  • the local network where the first UDM is located only supports authentication of the UE based on the SUPI* of the UE, even if the UE mistakenly assigns the second A SUCI is sent to the first UDM, and the first UDM cannot obtain the SUPI by decrypting the first SUCI according to the first private key. Therefore, it can further prevent the real SUPI of the UE from being leaked to the local network, thereby further improving security.
  • the first private key corresponds to the first UDM
  • the second private key corresponds to the second UDM. Therefore, different UDMs decrypt SUCI with their own corresponding private keys to prevent SUPI from intercommunicating between different networks and further improve security.
  • the second UDM can send the first authentication vector to the first UDM, including random numbers, authentication tokens, expected response XRES* and A key Kausf, where the key Kausf corresponds to the long-term key of the user equipment and the name of the first serving network. Among them, the key Kausf is the first key.
  • the first UDM may send a second authentication vector to the AMF, including a random number, an authentication token, and an expected response HXRES*.
  • the second UDM can send the first authentication vector to the first UDM, which includes random numbers, authentication tokens, expected response XRES , a confidentiality key CK' and an integrity key IK', the confidentiality key CK' and the integrity key IK' are determined according to the long-term key and the name of the first service network. Among them, the confidentiality key CK' and the integrity key IK' are the first keys.
  • the first UDM may send the second authentication vector to the AMF, including the random number and the authentication token.
  • a communication method is provided.
  • the method can be executed by the second UDM deployed in the second network (or central network).
  • the method includes: the second UDM determines a random number, an authentication token and a first key, the first key corresponds to a long-term key of the UE and a first service network name, and the first service network name corresponds to an identifier of the first network .
  • the first UDM is deployed on the first network
  • the second UDM is deployed on the second network.
  • the second UDM may also send the first identity of the UE, the random number, the authentication token and the first key to the first UDM.
  • the first identifier includes the SUPI of the UE or the SUPI* of the UE, and the SUPI* of the UE corresponds to the SUPI of the UE.
  • a communication method may be executed by an AMF (or local AMF) deployed in the first network.
  • the method includes: the AMF receives the first SUCI from the UE, and the first SUCI corresponds to the SUPI of the UE; or, the AMF receives a globally unique temporary UE identity (GUTI) from the UE, and the GUTI corresponds to the user
  • the SUPI* of the device the SUPI* corresponds to the SUPI of the UE, and the AMF determines that the correspondence between the GUTI and the SUPI* is not stored.
  • the AMF may also send the first indication information to the UE, and receive a registration request from the UE, where the registration request includes the second SUCI, and the second SUCI corresponds to the SUPI*.
  • the AMF may also send the random number and the authentication token to the UE. The random number and authentication token are used for UE authentication.
  • the AMF may instruct the UE to send the second SUCI, so that the first UDM performs UE authentication according to the UE's SUPI*, so as to avoid leakage of the UE's real SUPI to the first network, thereby improving communication security.
  • the first indication information may be used to indicate at least one of the following: a connection failure between the second network and the first network, where the second network is a public network where the UE is located; or, The UE registers with the first network; or, the UE accesses the first network. Wherein, the AMF is deployed on the first network; or, a concealed identity of the UE is used.
  • the first indication information can be flexibly set, so that the UE sends the second SUCI to the AMF according to the first indication information.
  • the embodiment of the present application provides a communication method, which can be executed by a UE.
  • the method includes: the UE receives the first indication information, and the UE determines the second SUCI according to the SUPI* of the UE, where the SUPI* corresponds to the SUPI of the UE.
  • the UE may also send a registration request to the AMF, where the registration request includes the second SUCI.
  • the UE may also receive the nonce and authentication token from the AMF. The random number and authentication token are used for UE authentication.
  • the first indication information may be used to indicate at least one of the following: a connection failure between the second network and the first network, where the second network is a public network where the UE is located; or, The UE registers with the first network; or, the UE accesses the first network.
  • the AMF is deployed on the first network; or, a concealed identity of the UE is used.
  • the UE may receive first indication information from the AMF or the base station.
  • the first indication information is carried in a broadcast message.
  • the embodiment of the present application provides a communication device, the communication device includes a processor, and the processor is coupled to a memory, wherein: the memory is used to store instructions; the processor is used to execute the instructions stored in the memory to execute The method in any possible design of the first aspect to the fourth aspect or the above aspects.
  • the communication device may further include the memory.
  • the communication device may further include a transceiver, configured to support the communication device in sending and/or receiving information in the above method.
  • the communication device may be a terminal device, or a device in a terminal device, such as a chip or a chip system, wherein the chip system includes at least one chip, and the chip system may also include other circuit structures and/or discrete devices.
  • the embodiment of the present application provides a communication device, which is used to implement the method in any possible design of the first aspect to the fourth aspect or the above aspects, including corresponding functional modules, for example, including a processing unit, The communication unit and the like are respectively used to realize the steps in the above method.
  • the embodiment of the present application provides a computer-readable storage medium, where computer-readable instructions are stored in the computer-readable medium, and when the computer reads and executes the computer-readable instructions, the communication device executes the first Aspect to the third aspect or a method in any possible design of the above aspects.
  • the embodiment of the present application provides a computer program product.
  • the communication device is made to execute any possible design of the first aspect to the third aspect or the above aspects. Methods.
  • the embodiment of the present application provides a chip, the chip is connected to the memory, and is used to read and execute the software program stored in the memory, so as to execute any one of the first aspect to the third aspect or the above aspects a possible design approach.
  • the embodiment of the present application provides a communication device, including a processor, the processor is configured to be coupled with the transceiver, read and execute the instructions in the memory, so as to implement the first aspect to the third aspect or above A method in any one of the possible designs of the aspect.
  • the embodiment of the present application provides a communication method, and the communication method may be executed by a first UDM and an AMF deployed in a first network (or local network).
  • the method includes: the first UDM receives the first identifier, the random number, the authentication token and the first key of the UE from the second UDM.
  • the first key corresponds to the long-term key of the UDM and the name of the first service network.
  • the first service network name corresponds to the identifier of the first network.
  • the first UDM is deployed on the first network, and the second unified data management function is deployed on the second network.
  • the AMF may be configured to send a UE authentication request to the first UDM, where the UE authentication request includes a second identity of the UE, and the second identity corresponds to the first identity, or the second identity is the same as the first identity.
  • the AMF is deployed on the first network.
  • the first UDM determines a random number, an authentication token, and a first key corresponding to the first identifier according to the second identifier.
  • the first UDM sends the random number and the authentication token to the AMF.
  • the AMF sends the random number and the authentication token to the UE.
  • the AMF sends an indication that the UE passes the authentication to the first UDM.
  • the first UDM may also be used to send the second key corresponding to the first key to the AMF.
  • the first UDM may also be used to execute the method in any possible design shown in the first aspect
  • the AMF may also be used to execute the method in any possible design shown in the second aspect.
  • the embodiment of the present application provides a communication system, including a device for performing the method in the first aspect or any possible design of the first aspect and a device for performing the second aspect or the method in the second aspect
  • FIG. 1 is a schematic structural diagram of a communication system provided by an embodiment of the present application.
  • FIG. 2 is a schematic structural diagram of another communication system provided by an embodiment of the present application.
  • FIG. 3 is a schematic structural diagram of another communication system provided by an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of another communication system provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of a communication method provided by an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of another communication method provided by the embodiment of the present application.
  • FIG. 7 is a schematic flowchart of another communication method provided by the embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • At least one means one, or more than one, including one, two, three and more.
  • a plurality refers to two, or more than two, including two, three or more.
  • Carrying may mean that a certain message is used to carry certain information or data, or it may mean that a certain message is composed of certain information.
  • Coupling refers to an indirect coupling or communication connection between devices, units or modules, which may be in electrical, mechanical or other forms, and is used for information exchange between devices, units or modules.
  • At least one item (unit) of a, b or c can represent: a, b, c, a and b, a and c, b and c, or a, b and c, wherein a, b, c Can be single or multiple.
  • a wireless communication system 100 may include a terminal device 101 and a network device 102 .
  • the wireless communication system 100 provided in the embodiment of the present application is applicable to both low frequency scenarios (sub 6G) and high frequency scenarios (above 6G).
  • the application scenarios of the wireless communication system 100 provided by the embodiment of the present application include but are not limited to wideband code division multiple access (WCDMA) system, general packet radio service (general packet radio service, GPRS), long term evolution (long term term evolution (LTE) system, LTE frequency division duplex (frequency division duplex, FDD) system, LTE time division duplex (time division duplex, TDD), universal mobile telecommunications system (universal mobile telecommunications system, UMTS), global interconnected microwave access Access (worldwide interoperability for microwave access, WiMAX) communication system, fifth generation system or new radio (new radio, NR) communication system, etc.
  • WCDMA wideband code division multiple access
  • GPRS general packet radio service
  • LTE long term evolution
  • LTE frequency division duplex frequency division duplex
  • FDD frequency division duplex
  • TDD time division duplex
  • the terminal device 101 shown above may be a user equipment, a terminal (terminal), a mobile station (mobile station, MS), a mobile terminal (mobile terminal) and the like, and the terminal device 101 can communicate with one or more communication systems of one or more communicate with each network device and accept network services provided by the network device, the network device here includes but not limited to the network device 102 shown in the figure.
  • the terminal device 101 in the embodiment of the present application can be a mobile phone (or called a "cellular" phone), a computer with a mobile terminal, etc., and the terminal device 101 can also be a portable, pocket-sized, hand-held, computer built-in or vehicle-mounted mobile devices.
  • the terminal device 101 may also be a communication chip with a communication module.
  • the network device 102 shown above may include the access network device (or referred to as an access network site) described in this application. Specifically, the network device 102 may include an access network device.
  • an access network device refers to a device that provides a network access function, such as a radio access network (radio access network, RAN) base station and the like.
  • RAN radio access network
  • the network device 102 may include a base station (base station, BS), or include a base station and a radio resource management device for controlling the base station, etc., and the network device 102 may be a relay station (relay device), an access point, a vehicle-mounted device, or a
  • the embodiments of the present application are not limited to wearable devices, base stations in networks such as 5G in the future, base stations in public land mobile network (PLMN) networks that will evolve in the future, or NR base stations.
  • the network device 102 may also be a communication chip with a communication module.
  • the network device 102 can serve as a RAN base station to provide a wireless network connection to the terminal device 101, for example, the network device 102 can serve as a 4G access network—evolved universal mobile telecommunications system (universal mobile telecommunications system, UMTS) terrestrial radio access network (evolved UMTSterrestrial radio access network, E-UTRAN) in the access network base station, or, the network device 102 can be used as the 5G access network—the access network base station in the 5G RAN, or , the network device 102 may serve as an access network base station in a future wireless communication system.
  • UMTS universal mobile telecommunications system
  • E-UTRAN wireless UMTSterrestrial radio access network
  • the 5G network architecture may include three parts, namely UE, data network (data network, DN) and operator network.
  • the operator network may include network slice selection function (network slice selection function, NSSF), network exposure function (network exposure function, NEF), network storage function (network function repository function, NRF), policy control function (policy control function, PCF), UDM, application function (application function, AF), network slice specific authentication and authorization function (network slice specific authentication and authorization function, NSSAAF), authentication server function (authentication server function, AUSF), access and mobility Network elements or network functions such as access and mobility management function (AMF), session management function (SMF), (wireless) access network ((radio) access network, (R)AN) and UPF (network function, NF).
  • the part other than the (wireless) access network part may be referred to as the core network (CN) part.
  • the (R)AN is referred to as RAN as an example in the following description.
  • the user equipment may include the UE shown in FIG. 2 .
  • UE can be a device with wireless transceiver function, which can be deployed on land, including indoor or outdoor, hand-held or vehicle-mounted; it can also be deployed on water (such as ships, etc.); it can also be deployed in the air (such as aircraft, balloons, etc. and satellites, etc.).
  • the UE may be a mobile phone, a tablet computer (pad), a computer with a wireless transceiver function, a virtual reality (virtual reality, VR) terminal, an augmented reality (augmented reality, AR) terminal, an industrial control (industrial control) Wireless terminals in self driving, wireless terminals in remote medical, wireless terminals in smart grid, wireless terminals in transportation safety, Wireless terminals in smart cities, wireless terminals in smart homes, etc.
  • the UE can also be the terminal device 101 shown in FIG. 1 .
  • the aforementioned UE can establish a connection with the operator network through an interface provided by the operator network (for example, N1, etc.), and use services such as data and/or voice provided by the operator network.
  • the UE can also access the DN through the operator's network, use the operator's services deployed on the DN (such as accessing a client server deployed in the DN), and/or services provided by a third party.
  • the above-mentioned third party may be a service party other than the operator's network and the UE, and may provide other services such as data and/or voice for the UE.
  • the specific form of expression of the above-mentioned third party can be determined according to the actual application scenario, and is not limited here.
  • the unified data management function in this application may include the UDM shown in Figure 2.
  • the unified data management function may still be UDM or have other names, which are not limited in this application.
  • the access and mobility management function may include AMF as shown in Figure 2.
  • the access and mobility management function may still be AMF or have other names, which are not limited in this application.
  • the user plane function may include UPF as shown in Figure 2.
  • the unified data management function may still be UPF or have other names, which are not limited in this application.
  • Nnssf, Nnef, Nausf, Nnrf, Npcf, Nudm, Naf, Namf, Nssaaf, Nsmf, Nhse, N1, N2, N3, N4, N6, BEST-C, BEST-U, EAS-C, and EAS- U are the serial numbers of the interfaces respectively.
  • the meaning and usage of these interface serial numbers can refer to the meaning defined in the 3GPP standard agreement, and there is no limitation here.
  • the data network as shown in FIG. 2 may include a client server for providing service data to user equipment. Data transmission can be performed between the UE and the client server through a session (session).
  • the SMF shown in Figure 2 can be used for execution management, such as execution session establishment.
  • the central network can deploy network functions such as AMF, SMF, PCF, UDM, and UPF.
  • network functions deployed in the central network are referred to as central AMF, central SMF, central PCF, central UDM, and central UPF.
  • a UPF can be deployed in a local network, which is called a local UPF.
  • the local network can include network functions deployed near the campus in the campus scenario.
  • UPF can be deployed near the campus.
  • UEs in the campus can preferentially access the network through the RAN near the campus and use the local UPF to access the network nearby.
  • Obtaining business services can reduce business delays.
  • the transmission path of service data between the UE and the client server is: UE—RAN—local UPF—client server.
  • the central SMF needs to maintain and manage the session. After a fault occurs, the central SMF cannot maintain and manage the session, and the service may be interrupted.
  • the private network architecture shown in Figure 4 is another architecture proposed to solve the above problems.
  • the UE registers through the central AMF.
  • the base station may need to choose to access the UE for the UE.
  • the local network enables the UE to access services through the local network. At this time, the services of the UE are not interrupted.
  • the UE needs to register with the local network. Specifically, the local AMF in the local network needs to perform UE registration, and then the local network establishes a UE session, which can be indicated by a dotted arrow in FIG. 4 .
  • the UE's long-term key is stored in the central UDM, and the local UDM cannot obtain the UE's long-term key, so the local network cannot use the long-term key to authenticate the UE.
  • the failure of the local network to authenticate the UE will cause the UE to fail to register with the local network. Therefore, a user plane data transmission path in the local network cannot be established for the UE, resulting in the UE being unable to obtain user plane data and reducing service reliability.
  • the embodiment of the present application provides a communication method, which is used to enable a local network to implement authentication on a UE, so as to improve service reliability.
  • the communication method can be implemented by the first UDM and the second UDM, wherein the first UDM is deployed on the first network, the second UDM is deployed on the second network, and the first network can also deploy AMF.
  • the first UDM may include a local UDM
  • the second UDM may include a central UDM
  • the first network may include a local example
  • the second network may include a central network
  • the AMF deployed in the first network may Including local AMF.
  • the method may include the following steps:
  • the second UDM determines a random number, an authentication token, and a first key.
  • the first key corresponds to the long-term key of the UE and the name of the first serving network, or in other words, the first key is determined according to the long-term key of the UE and the name of the first serving network.
  • the name of the first service network corresponds to the identifier of the first network, or in other words, the name of the first service network is determined according to the identifier of the first network.
  • the second UDM may determine a first authentication vector of the UE, where the first authentication vector includes a random number, an authentication token, and a first key.
  • the first authentication vector when the authentication mode supported by the first network is 5G authentication and key agreement (5Gauthentication and key agreement, AKA), the first authentication vector includes a random number, an authentication token, an expected response XRES*, and a secret key Key Kausf.
  • the key Kausf is the first key.
  • the key Kausf corresponds to the UE's long-term key and the first serving network name (serving network name, SN name), that is, the key Kausf is determined according to the UE's long-term key and the first serving network name.
  • the name of the first service network corresponds to the identifier of the first network, for example, the name of the first service network is determined according to the identifier of the first network.
  • the first authentication vector includes a random number , authentication token, expected response XRES, confidentiality key CK' and integrity key IK'.
  • the confidentiality key CK' and the integrity key IK' are the first keys.
  • the confidentiality key CK' and the integrity key IK' are determined according to the long-term key of the UE and the name of the first serving network, and the first serving network name corresponds to the identifier of the first network.
  • the second UDM may determine the UE's random number, authentication token, and first key when determining that the condition is met.
  • the condition is, for example: determining a random number, an authentication token, and a first key according to a time interval, or, after a certain trigger condition is met, performing determination of a random number, an authentication token, and a first key of the UE, and triggering Conditions such as the administrator triggers the second UDM to determine the random number, the authentication token and the first key, or the first UDM requests the second UDM to determine the random number, the authentication token and the first key.
  • the second UDM can determine the UE's The random number, the authentication token and the first key, or, after a certain time interval has elapsed from the last sending of the UE's first identifier and the random number, the authentication token and the first key, determine the UE's random number, Authentication token and first key.
  • the time interval is, for example, one month.
  • the second UDM can determine the authentication token every time , use the sequence number (sequence number, SQN) and time T (such as 1 month) used when determining the first authentication vector to determine the new SQN, and calculate the new first authentication vector according to the determined new SQN, That is, the accumulated value of the previously used SQN and time T (such as the number of seconds corresponding to one month) is used as a new SQN to determine a new first authentication vector.
  • sequence number sequence number
  • time T such as 1 month
  • the second UDM can determine multiple first authentication vectors of the UE and send them to the first UDM, and the second UDM can use the sum SQN1 of the SQN and time X used to determine the first authentication vector last time as the new SQN , to determine the first first authentication vector, for example, the elapsed time interval from the previous determination of the first authentication vector is 1 month, or the elapsed time interval from the previous sending of the UE's first ID and the first authentication vector is 1 month Month, X can take the number of seconds corresponding to 1 month.
  • the second UDM can also determine SQN2 according to SQN1 and the corresponding time T1 of a day, determine the second first authentication vector according to SQN2, and determine SQN3 according to SQN2 and the corresponding time T1 of a day, and determine the third first authentication vector according to SQN3 , and so on, the second UDM may determine 10 first authentication vectors, and send the 10 first authentication vectors and the first identity of the UE to the first UDM respectively. Since the repair time of the N2 connection failure between the base station and the central AMF and the connection failure between the central network and the local network generally does not exceed 7 days, the first UDM can use the 10 first UDMs every day in the order of SQN from small to large. One of the authentication vectors, to meet the requirements of the local network for the authentication vector of the UE authentication process during the recovery of the connection failure.
  • the second UDM sends the first identifier, the random number, the authentication token, and the first key of the UE to the first UDM.
  • the first identifier may be the SUPI of the UE, or the SUPI* determined according to the SUPI of the UE.
  • the SUPI* in this application is an identifier determined based on newly introduced parameters based on SUPI or according to a specific algorithm according to SUPI. The purpose is to prevent UE from carrying real SUPI into the network, so as to further improve network communication security.
  • the manner of determining the SUPI* according to the SUPI refer to the description in the embodiment of the present application, which will not be introduced here.
  • the first network may support UE authentication based on SUPI or SUPI*, if the first network supports UE authentication based on SUPI, the first identifier is SUPI; if the first network supports UE authentication based on SUP I*, then the first network One identified as SUP I*. If the first identifier includes SUPI*, the first network implements UE authentication through the UE's SUPI*, which can prevent the UE's real SUPI from leaking to the first network, thereby improving communication security.
  • the second UDM may send the first identifier of the UE and the first authentication vector to the first UDM.
  • first authentication vector refer to the description in S501.
  • the first UDM receives the first identifier, the random number, the authentication token and the first key of the UE. After receiving the first identifier, the random number, the authentication token, and the first key, the first UDM may store the correspondence between the first identifier and the random number, the authentication token, and the first key.
  • the steps shown in S501 and S502 occur before the connection between the first network and the second network fails.
  • the first UDM receives a UE authentication request from the AMF, where the UE authentication request includes a second identity of the UE, where the second identity corresponds to the first identity, or the second identity is the same as the first identity.
  • the UE authentication request may be sent by the AMF after receiving a registration request (registration request, RR) from the UE, and the registration request may be used to initiate registration of the UE.
  • the registration request may carry the UE identifier, specifically, the UE identifier carried in the registration request may be the UE's SUCI or GUTI.
  • the SUCI of the UE may be determined according to the SUPI or SUPI* of the UE.
  • the SUCI determined according to SUPI in order to distinguish the SUCI determined according to SUPI and the SUCI determined according to SUPI*, the SUCI determined according to SUPI is called the first SUCI, and the SUCI determined according to SUPI* is called the second SUCI.
  • the manner of determining the first SUCI according to the SUPI may be the same as or different from the manner of determining the second SUCI according to the SUPI*, which is not specifically limited in this application.
  • the second identity of the UE in the authentication request will be described below according to different types of the identity of the UE in the registration request.
  • the AMF may require the UE to report the SUCI. Specifically, the AMF sends first indication information to the UE, and the first indication information may be used to instruct the UE to send the SUCI to the AMF.
  • the first indication information may be specifically used to indicate a connection failure between the second network and the first network, the UE to register with the first network, the UE to access the first network, or indicate to use a hidden identity of the UE.
  • the first indication information may be carried in an identity request (identity request).
  • identity request After receiving the first indication information, the UE can determine and send the SUCI of the UE to the AMF. For example, the UE can send the UE authentication request again, and carry the SUCI in the UE authentication request, or, if the first indication information is carried in the identification request , the UE may carry the SUCI in the response message of the identification request.
  • the AMF may carry the SUCI in the UE authentication request, and send the UE authentication request to the first UDM.
  • the second identifier carried in the UE authentication request is the UE's SUCI.
  • the AMF may carry the first identity of the UE in the UE authentication request, and send the UE authentication request to the first UDM.
  • the first identifier may be SUPI or SUPI* of the UE.
  • the AMF can carry the first SUCI in the UE authentication request and send the UE authentication request to the first UDM for the first UDM to determine the random number, authentication token, and first key corresponding to the SUPI.
  • the second identifier carried in the UE authentication request is the UE's first SUCI.
  • the AMF may require the UE to report the second SUCI .
  • the AMF may send first indication information to the UE, and the first indication information may be used to instruct the UE to send the second SUCI to the AMF.
  • the first indication information may be specifically used to indicate a connection failure between the second network and the first network, the UE to register with the first network, the UE to access the first network, or indicate to use a hidden identity of the UE.
  • the first indication information may be carried in the identification request.
  • the UE After receiving the first indication information, the UE can determine the SUPI*, and send the second SUCI corresponding to the SUPI* to the AMF, for example, the UE can send the UE authentication request again, and carry the second SUCI in the UE authentication request, or, if The first indication information is carried in the identification request, and the UE may carry the second SUCI in the response message of the identification request.
  • the AMF After receiving the second SUCI of the UE, the AMF can carry the second SUCI in the UE authentication request, and send the UE authentication request to the first UDM.
  • the second identifier carried in the UE authentication request is the second SUCI of the UE. SUCI.
  • the AMF can carry the UE's second SUCI
  • the UE authentication request is sent to the first UDM.
  • the UE may receive a broadcast message or other messages from the base station, and the message may indicate that the connection between the RAN accessed by the UE and the first network fails, or that the connection between the first network and the second network fails , the UE may determine the SUPI* and further determine the second SUCI after receiving the message, and then carry the second SUCI in the registration request.
  • the AMF may also carry the name of the first serving network in the UE authentication request shown in S503.
  • the first UDM determines a random number, an authentication token, and a first key corresponding to the first identifier according to the second identifier.
  • the first identifier may be the SUPI of the UE, and the second identifier may be the SUPI or the first SUCI determined according to the SUPI.
  • the first identifier may also be the SUPI* determined according to the SUPI of the UE, and at this time the second identifier may be the SUCI determined according to the SUPI*.
  • the first UDM may query the first identity, the random number , the corresponding relationship between the authentication token and the first key, so as to determine the random number, the authentication token, and the first key corresponding to the first identification.
  • S505 The first UDM sends the random number and the authentication token to the AMF.
  • the first UDM may send a second authentication vector to the AMF, where the second authentication vector includes a random number and an authentication token.
  • the second authentication vector may also include an expected response HXRES*, where the expected response HXRES* is calculated according to the expected response XRES*.
  • the random number and the authentication token are used for authentication of the UE.
  • the AMF sends the random number and the authentication token to the UE, sends an indication that the UE is authenticated to the AMF after the UE determines that the authentication is passed according to the random number and the authentication token, and the AMF sends an indication that the UE is authenticated to the first UDM.
  • the first UDM sends the second key corresponding to the first key to the AMF.
  • the first UDM after receiving the indication from the AMF that the UE has passed the authentication, the first UDM sends the second key to the AMF, so as to perform security protection of the UE according to the second key.
  • the second key is for example the key Kseaf.
  • the authentication method is 5G AKA
  • the first UDM can derive Kseaf according to the Kausf, and send Kseaf to AMF;
  • the authentication method is EAP-AKA'
  • the first UDM can use the confidentiality key CK' and integrity
  • the key IK' derives Kausf, then derives Kseaf based on Kausf, and then sends Kseaf to AMF.
  • the first UDM deployed on the first network can obtain the random number, The authentication token and the first key, the first UDM can also send the random number and the authentication token to the AMF in the first network to realize the authentication of the UE, so that if the connection between the base station and the central network fails or the central network and the In the scenario of a connection failure between local networks, it is possible to support the UE to access services through the local network, that is, access services through the local network to ensure that the services will not be interrupted, thereby improving service reliability.
  • the method can ensure that the long-term key of the UE is not leaked to the local network, thereby improving the security of the long-term key of the user.
  • Mode 1 introducing a parameter for determining SUPI* for each UE, such as a random number, and determining SUPI* according to the parameter and the SUPI of the UE.
  • the SUPI* can be determined through a hash-based message authentication code (hash-based message authentication code, HMAC) algorithm according to the parameter and the SUPI of the UE.
  • HMAC hash-based message authentication code
  • the second UDM can configure the parameter to the UE through a user parameter update (UEparameters update, UPU) procedure.
  • the parameter may be determined by the UE, for example, the UE determines the parameter by means of pre-definition, pre-configuration, and the like.
  • Mode 2 introducing parameters for each local network, such as a local network identifier or a campus identifier corresponding to the local network, etc., and determining SUPI* according to the SUPI of the UE and the parameters.
  • the SUPI* can be determined through the HMAC algorithm according to the parameter and the SUPI of the UE. This parameter can be sent through RAN broadcast.
  • the second UDM and the UE may determine the SUPI* of the UE in the same manner, for example, both the UE and the second UDM determine the SUPI* according to a random number and the SUPI of the UE.
  • the SUPI* may also be determined in other manners, which are not specifically limited in this application.
  • the UE and the second UDM may also negotiate to determine a parameter for determining SUPI*, and determine SUPI* according to the parameter.
  • the first network may acquire the second SUCI of the UE, determine the SUPI* of the UE according to the second SUCI, and further implement UE authentication based on the SUPI* of the UE.
  • the AMF in the first network may request the UE to report the second SUCI carrying the UE, or the UE may actively report the second SUCI carrying the UE
  • the registration request of will be described below with reference to FIG. 6 and FIG. 7 respectively.
  • a possible UE authentication process may include the following steps:
  • the second UDM located in the second network determines the SUPI* of the UE, and stores the correspondence between the SUPI of the UE and the SUPI*.
  • the first network may be a local network
  • the second network may be a central network.
  • the UE is configured with information for determining the SUPI*, so as to support the UE to determine the SUPI* in the same manner as the second UDM.
  • the UE is further configured with a first public key, and the first public key is used to determine the second SUCI of the UE according to the SUPI* of the UE.
  • the first public key corresponds to the first private key, and the first private key can be used to determine the SUPI* of the UE according to the second SUCI of the UE.
  • a second public key may also be configured in the UE, and the second public key is used to determine the first SUCI of the UE according to the SUPI of the UE.
  • the second public key may correspond to a second private key, the second private key is used to determine the SUPI of the UE according to the first SUCI of the UE, the second public key is different from the first public key, and the second private key is different from the first private key different.
  • the second private key may be stored in the second UDM.
  • the local network where the first UDM is located only supports authentication of the UE based on the SUPI* of the UE, even if the UE mistakenly assigns the first
  • the SUCI is sent to the first UDM, and the first UDM cannot decrypt the first SUCI according to the first private key to obtain the SUPI. Therefore, it can further prevent the real SUPI of the UE from being leaked to the local network, thereby further improving security.
  • the second UDM sends the SUPI* of the UE and the subscription data of the UE to the first UDM.
  • the first UDM is deployed in the first network, and the first UDM is configured with a first private key.
  • the subscription data of the UE may include information of a network slice subscribed by the UE.
  • S602 is executed when the network between the first network and the second network does not fail.
  • the first UDM receives the SUPI* of the UE and the subscription data of the UE.
  • the first UDM may also receive the UE, for example, receive the correspondence between the UE's SUPI* and the first authentication vector.
  • the first authentication vector may include a random number, an authentication token, and a first secret key. For details about the first authentication vector, refer to the description in S501 shown in FIG. 5 .
  • the first UDM may store a correspondence table between the UE's identifier and the subscription data.
  • the table may include a correspondence between SUPI* and subscription data of at least one UE.
  • S603 The UE sends a registration request to the AMF, where the registration request carries the identifier of the UE.
  • the identifier of the UE carried in the registration request may be the first SUCI, the second SUCI or the GUTI of the UE. If the first SUCI of the UE is carried in the registration request, or if the GUTI of the UE is carried in the registration request, the GUTI corresponds to the SUPI* of the UE, but the AMF does not store the correspondence between the GUTI and the SUPI*, Then execute S604. If the UE identifier carried in the registration request is the second SUCI of the UE, perform S606.
  • the AMF receives the registration request.
  • the AMF sends the first indication information to the UE.
  • the first indication information is used to instruct the UE to send the second SUCI of the UE to the AMF.
  • For the first indication information refer to the description in this application, which will not be expanded here.
  • the first indication information may be carried in the identification request.
  • the UE receives the first indication information.
  • S605 The UE sends the second SUCI of the UE to the AMF.
  • the UE determines the SUPI* according to the information for determining the SUPI*, and determines the second SUCI according to the first public key and the SUPI*.
  • the AMF receives a response message corresponding to the identification request.
  • the AMF sends a UE authentication request to the first UDM, where the UE authentication request carries the second SUCI of the UE.
  • the UE authentication request may further include the name of the first serving network.
  • the first UDM receives the UE authentication request.
  • the first UDM determines the SUPI* of the UE according to the second SUCI of the UE and the first private key.
  • the first UDM determines the subscription data corresponding to the SUPI*.
  • the first UDM may query the UE identifier-subscription data correspondence table to obtain the subscription data corresponding to the SUPI* of the UE.
  • the first UDM sends a UE authentication response to the AMF.
  • the random number and the authentication token may be carried in the UE authentication response.
  • the second authentication vector may be carried in the UE authentication response.
  • the second authentication vector may include a random number and an authentication token.
  • the second authentication vector refer to the description in S505 shown in FIG. 5 .
  • S606 may be replaced by: AMF sends a UE authentication request to the AUSF, and the AUSF sends a UE authentication acquisition request to the first UDM, and the UE authentication acquisition request carries the second SUCI of the UE.
  • the first UDM receives the UE authentication acquisition request.
  • S609 may be replaced by the first UDM sending the UE authentication acquisition response to the AUSF, and the AUSF sending the UE authentication response to the AMF. At this time, the random number and the authentication token may be carried in the UE authentication acquisition response.
  • the AMF sends an authentication request to the UE.
  • the authentication request may include a random number and an authentication token. If the authentication method is 5G AKA, the authentication request may also include an expected response HXRES* for authentication of the UE. Specifically, the authentication request may carry the second authentication vector.
  • the UE receives an authentication request.
  • the UE can perform authentication according to the RAND carried in the authentication request and the authentication token.
  • the UE may also send an authentication response to the AMF, indicating that the UE passes the authentication.
  • the first UDM in the local network can query the subscription information of the UE according to the SUPI* of the UE, and realize the subscription information according to the SUPI* of the UE. Authentication of the UE, thus avoiding the authentication of the local network according to the real SUPI of the UE, which can improve communication security.
  • another UE authentication process through SUPI* includes the following steps shown in S701-S710:
  • S701-S702 may be implemented with reference to S601-S602, which will not be repeated here.
  • the UE receives a broadcast message from the base station, where the broadcast message may indicate that the connection between the RAN accessed by the UE and the first network fails, or that the connection between the first network and the second network fails.
  • the UE determines the SUPI* of the UE, and determines the second SUCI of the UE according to the SUPI* of the UE.
  • S704 may be implemented with reference to S605.
  • S705 The UE sends a registration request to the AMF, where the registration request carries the second SUCI of the UE.
  • the AMF receives the registration request.
  • the flow shown in FIG. 7 can prevent the local network from performing authentication based on the real SUPI of the UE, and can improve communication security. Moreover, in the process shown in Figure 7, the UE can obtain the network disconnection information, then actively generate SUPI*, and request registration with SUPI*, which can improve the authentication efficiency compared with the authentication method shown in Figure 6 .
  • an embodiment of the present application further provides an apparatus 800 for implementing the above method.
  • the device may be a software module or a system on a chip.
  • the system-on-a-chip may be composed of chips, or may include chips and other discrete devices.
  • the apparatus 800 may include: a processing unit 801 and a communication unit 802 .
  • the device may include the first UDM, second UDM, AMF or UE shown in the above method embodiments, or include a device equipped with the first UDM, second UDM, AMF or UE shown in the above method embodiments functional device.
  • the communication unit may also be referred to as a transceiver unit, and may include a sending unit and/or a receiving unit, which are respectively used to perform the sending and receiving of the first UDM, the second UDM, AMF or UE in the above method embodiments A step of.
  • the communication unit 802 may also be called a transceiver, a transceiver, a transceiver device, and the like.
  • the processing unit 801 may also be called a processor, a processing board, a processing module, a processing device, and the like.
  • the device in the communication unit 802 for realizing the receiving function can be regarded as a receiving unit
  • the device in the communication unit 802 for realizing the sending function can be regarded as a sending unit, that is, the communication unit 802 includes a receiving unit and a sending unit.
  • the communication unit 802 may sometimes also be referred to as a transceiver, a transceiver, or a transceiver circuit and the like.
  • the receiving unit may sometimes be called a receiver, a receiver, or a receiving circuit, etc.
  • the sending unit may sometimes be called a transmitter, a transmitter, or a transmitting circuit, etc.
  • the communication unit 802 may be configured to receive the first identifier, the random number, the authentication token and the first key of the UE from the second UDM, and receive the User device authentication request.
  • the processing unit 801 may be configured to determine, according to the second identifier, the random number, the authentication token, and the first key corresponding to the first identifier.
  • the communication unit 802 is further configured to send the random number and the authentication token to the AMF, and send the second key corresponding to the first key to the AMF.
  • the communication unit and the processing unit may also perform other operations, for example, the communication unit 802 is used to perform the sending and receiving operations of the first UDM in the method embodiments shown in FIGS. 5 to 7 above, and the processing unit 801 is used to For performing other operations of the first UDM in the method embodiments shown in FIG. 5 to FIG. 7 except the transceiving operation, reference may be made to the foregoing description for details, and details are not repeated here.
  • the processing unit 801 may be configured to determine the random number, the authentication token and the first key of the UE.
  • the communication unit 802 can be used to send the first identification, the random number, the authentication token and the first key of the UE to the first UDM.
  • the communication unit and the processing unit may also perform other operations, for example, the communication unit 802 is used to perform the sending and receiving operations of the second UDM in the method embodiments shown in FIGS. 5 to 7 above, and the processing unit 801 is used to For performing other operations of the second UDM in the method embodiments shown in FIG. 5 to FIG. 7 except the transceiving operation, reference may be made to the foregoing description for details, and details are not repeated here.
  • the processing unit 801 may be configured to receive the first SUCI from the UE, or to receive the GUTI from the user equipment.
  • the communication unit 802 is further configured to send the first indication information to the UE, and to receive a registration request from the user equipment, where the registration request includes the second SUCI, and the second SUCI corresponds to a SUPI*.
  • the communication unit and the processing unit may also perform other operations, for example, the communication unit 802 is used to perform the sending and receiving operations of the AMF in the method embodiments shown in FIGS. 5 to 7 above, and the processing unit 801 is used to perform the above In the method embodiments shown in FIG. 5 to FIG. 7 , for other operations of the AMF except for the transceiving operation, reference may be made to the foregoing description for details, and details are not repeated here.
  • the communication unit 802 may be configured to receive the first indication information.
  • the processing unit 801 may be configured to determine the second SUCI according to the SUPI* of the UE, where the SUPI* corresponds to the SUPI of the user equipment.
  • the communication unit 802 may be configured to send a registration request to the AMF, where the registration request includes the second SUCI.
  • the communication unit 802 is also configured to receive an authentication request from the AMF.
  • random numbers and authentication tokens may be carried in the authentication request.
  • the communication unit and the processing unit may also perform other operations, for example, the communication unit 802 is used to perform the sending and receiving operations of the UE in the method embodiments shown in FIGS. 5 to 7 above, and the processing unit 801 is used to perform the above In the method embodiments shown in FIG. 5 to FIG. 7 , for other operations of the UE except the transceiving operation, reference may be made to the foregoing description for details, and details are not repeated here.
  • FIG. 9 another communication device provided by the embodiment of the present application is shown.
  • the device shown in FIG. 9 may be a hardware circuit implementation manner of the device shown in FIG. 8 .
  • the communication device may be applicable to the flow chart shown above to perform the functions of the first UDM, the second UDM, the AMF or the UE in the above-mentioned method embodiments.
  • the communication interface may correspond to the communication unit 802, and the processor 920 may Corresponds to the processing unit 801.
  • FIG. 9 only shows the main components of the communication device.
  • Apparatus 900 may also include at least one memory 930 for storing program instructions and/or data.
  • the memory 930 is coupled to the processor 920 .
  • the coupling in the embodiments of the present application is an indirect coupling or a communication connection between devices, units or modules, which may be in electrical, mechanical or other forms, and is used for information exchange between devices, units or modules.
  • Processor 920 may cooperate with memory 930 .
  • Processor 920 may execute program instructions stored in memory 930 . At least one of the at least one memory may be included in the processor.
  • the device 900 shown in FIG. 9 includes at least one processor 920 and a communication interface 910 , and the processor 920 is configured to execute instructions or programs stored in a memory 930 .
  • the processor 920 is used to perform the operations performed by the processing unit 801 in the above embodiments
  • the communication interface 910 is used to perform the operations performed by the communication unit 802 in the above embodiments.
  • the communication interface may be a transceiver, a circuit, a bus, a module, or other types of communication interfaces.
  • the transceiver when the communication interface is a transceiver, the transceiver may include an independent receiver and an independent transmitter; it may also be a transceiver integrated with a transceiver function, or be a communication interface.
  • Apparatus 900 may also include a communication link 940 .
  • the communication interface 910, the processor 920 and the memory 930 can be connected to each other through the communication line 940;
  • the communication line 940 can be a peripheral component interconnect (PCI for short) bus or an extended industry standard architecture (extended industry standard architecture) , referred to as EISA) bus and so on.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the communication line 940 can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is used in FIG. 9 , but it does not mean that there is only one bus or one type of bus.
  • the present application also provides a communication system, configured to execute the method provided in any of the above processes, for example, execute any of the processes in FIG. 5 to FIG. 7 .
  • the communication system may include the architecture shown in FIG. 4 .
  • the present application also provides a computer-readable storage medium for storing a computer program, and the computer program includes instructions for executing the method provided in any one of the processes above.
  • the present application also provides a computer program product, the computer program product comprising: computer program code, when the computer program code is run on a computer, the computer is made to execute the method provided in any one of the processes above.
  • the present application also provides a chip, including a processor, the processor is coupled with the memory, and is used to execute the computer program or instruction stored in the memory, when the processor executes the computer program or instruction, so that The methods provided in either flow above are implemented.
  • the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) having computer-usable program code embodied therein.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions
  • the device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种通信方法及装置，该方法包括：第一UDM接收来自于第二UDM的UE的第一标识、随机数、认证令牌和第一密钥。第一UDM接收来自于AMF的携带UE的第二标识的UE认证请求后，根据第二标识确定第一标识对应的随机数、认证令牌和第一密钥，并向AMF发送随机数和认证令牌，从而，对于UE接入的基站与第二网络的连接出现故障或者在第二网络与第一网络之间的连接故障的场景，能够支持UE通过本地网络访问业务，即通过本地网络访问业务来保证业务不会中断，从而提高业务可靠性。同时，该方法能够保证UE的长期密钥不被泄漏到本地网络，提升用户长期密钥的安全性。

Description

一种通信方法及装置
相关申请的交叉引用
本申请要求在2021年10月29日提交中国专利局、申请号为202111269553.3、申请名称为“一种通信方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种通信方法及装置。
背景技术
在第五代通信系统中，引入了专网架构。专网架构包括中心大网和小网，其中，小网例如是靠近业务服务器部署的网络，小网中至少部署用户面功能(user plane function，UPF)，小网中的UPF部署在客户服务器附近，中心大网可对应于多个小网，即支持通过多个小网中的UPF建立会话。中心大网可以是公共网络，例如，中心大网可以是运营商集中部署的中心网络(如核心网)。小网可以是部署在客户附近的本地网络，用户设备(UE)可通过基站接入专网架构的中心网络，由中心网络建立途经本地网络中的UPF的会话，用于传输该用户设备的用户面数据，使得用户设备能够通过本地网络中的UPF获得客户服务器中的业务数据，用于本地网络中的UPF部署在客户服务器附近，因此能够降低用户设备与客户服务器之间业务数据的传输时延。
在一种专网网络架构中，在本地网络中部署本地控制面网络功能，本地控制面网络功能包括接入与移动性管理功能(access and mobility management function，AMF)、会话管理功能(session management function，SMF)和统一数据管理(unified data management，UDM)，分别称为本地AMF、本地SMF和本地UDM。该架构中，中心大网中可部署AMF、SMF、PCF和UDM等中心控制面网络功能，分别称为中心AMF、中心SMF、中心PCF、中心UDM。
该架构中，UE通过基站注册到中心大网的过程仍然依赖于中心控制面网络功能，也就是通过中心AMF实现UE注册。在UE完成注册后，UE与中心大网进行通信。当基站和中心AMF之间的N2连接故障之后或者基站与中心大网之间出现其他连接故障之后，基站可能需要选择为该UE接入本地网络。在这种情况下，UE如果能够接入本地网络，则可以保证业务不被中断。也就是说，本地网络可以为UE提供高可靠性的保障。
但是，在UE使用本地网络进行通信之前，UE需要注册到本地网络。而在以上架构中，出于安全考虑，UE的长期密钥存储在中心UDM，且本地UDM无法获知UE的长期密钥，因此本地网络无法通过使用长期密钥对UE实现认证。本地网络无法实现对UE的认证，会导致UE到本地网络的注册失败，因此无法为UE建立在本地网络中的用户面数据传输路径，导致UE无法获得用户面数据，造成业务可靠性降低。
发明内容
本申请实施方式的目的在于提供一种通信方法及装置，用以提供UE在本地网络的认证方法，提高业务可靠性。
第一方面，本申请实施例提供一种通信方法。该方法可由部署在第一网络(或称本地网络)中的第一UDM执行。该方法包括：第一UDM接收来自于第二UDM的UE的第一标识、随机数(RAND)、认证令牌(AUTN)和第一密钥。其中，该第一密钥对应UDM的长期密钥和第一服务网络名称。第一服务网络名称对应第一网络的标识。该第一UDM部署于该第一网络，第二统一数据管理功能部署于第二网络。第一UDM还可接收来自于AMF的UE认证请求，UE认证请求包括该UE的第二标识，第二标识对应第一标识，或者第二标识与第一标识相同。该AMF部署于第一网络。第一UDM根据第二标识确定第一标识对应的随机数、认证令牌和第一密钥。第一UDM向该AMF发送该随机数和该认证令牌。第一UDM还可向AMF发送第一密钥对应的第二密钥。
基于该方法，部署在第一网络的第一UDM可从第二网络中的第二UDM获取用户设备的随机数、认证令牌和第一密钥，第一UDM还可向第一网络中的AMF发送随机数和认证令牌以实现UE的认证，从而，对于UE接入的基站与第二网络的连接出现故障或者在第二网络与第一网络之间的连接故障的场景，能够支持UE通过本地网络访问业务，即通过本地网络访问业务来保证业务不会中断，从而提高业务可靠性。同时，该方法能够保证UE的长期密钥不被泄漏到本地网络，提升用户长期密钥的安全性。
在一种可能的设计中，第一标识可包括UE的签约永久标识(subscription permanent identifier，SUPI)，第二标识可包括UE的SUPI或根据该SUPI确定的第一签约隐藏标识(subscription concealed identifier，SUCI)。或者，第一标识可包括UE的隐藏的SUPI(本申请中为方便说明，通过SUPI*表示隐藏的SUPI)，第二标识包括根据该SUPI*确定的第二SUCI，UE的SUPI*对应于UE的SUPI，或者说，UE的SUPI*是根据UE的SUPI确定的。采用该设计，可根据UE的不同标识，灵活实现UE的认证。其中，如果第一标识包括SUPI*，则可以避免UE的真实SUPI泄露到第一网络，从而可提高通信安全。
在一种可能的设计中，如果第一标识包括UE的SUPI*，且第二标识包括根据UE的SUPI*确定的第二SUCI，则第一UDM可根据第一私钥解密第二SUCI获得SUPI*；如果第一标识包括UE的SUPI，且第二标识包括根据SUPI确定的第一SUCI，则第一UDM还可根据第二私钥解密第一SUCI以获得SUPI，其中，第一私钥和第二私钥不同。采用该设计，当第一UDM配置有第一私钥而未配置第二私钥时，第一UDM所在的本地网络仅支持根据UE的SUPI*实现UE的认证，即便此时UE错误地将第一SUCI发送至第一UDM，第一UDM也是无法根据第一私钥解密第一SUCI而获得SUPI的，因此可以进一步避免UE真实的SUPI被泄露至本地网络，从而进一步提高安全性。
在一种可能的设计中，第一私钥对应于第一UDM，第二私钥对应于第二UDM。因此，不同的UDM通过自身对应的私钥对SUCI进行解密，避免SUPI在不同网络之间互通，以进一步提高安全性。
在一种可能的设计中，当第一网络支持的认证方式为5G AKA认证时，第二UDM可向第一UDM发送第一认证向量，其中包括随机数、认证令牌、期望响应XRES*和密钥Kausf，所述密钥Kausf对应所述用户设备的长期密钥和第一服务网络名称。其中，密钥Kausf为第一密钥。第一UDM可向AMF发送第二认证向量，其中包括随机数、认证令牌 和期望响应HXRES*。
在一种可能的设计中，当第一网络支持的认证方式为EAP-AKA’认证时，第二UDM可向第一UDM发送第一认证向量，其中包括随机数、认证令牌、期望响应XRES、机密性密钥CK’和完整性密钥IK’，所述机密性密钥CK’和完整性密钥IK’根据所述长期密钥和所述第一服务网络名称确定。其中，机密性密钥CK’和完整性密钥IK’为第一密钥。第一UDM可向AMF发送第二认证向量，其中包括随机数和认证令牌。
第二方面，提供一种通信方法。该方法可由部署在第二网络(或称中心网络)中的第二UDM执行。该方法包括：第二UDM确定随机数、认证令牌和第一密钥，该第一密钥对应UE的长期密钥和第一服务网络名称，该第一服务网络名称对应第一网络的标识。其中，该第一UDM部署于第一网络，第二UDM部署于第二网络。第二UDM还可向第一UDM发送该UE的第一标识、该随机数、该认证令牌和该第一密钥。
在一种可能的设计中，第一标识包括UE的SUPI或UE的SUPI*，UE的SUPI*对应于UE的SUPI。
以上第二方面及其任一可能的设计的有益效果可参见第一方面及其可能的设计中的说明。
第三方面，提供一种通信方法。该方法可由部署在第一网络中的AMF(或称本地AMF)执行。该方法包括：AMF接收来自于UE的第一SUCI，第一SUCI对应UE的SUPI；或者，AMF接收来自于UE的全球唯一临时UE标识(globally unique temporary UE identity，GUTI)，该GUTI对应于用户设备的SUPI*，SUPI*对应UE的SUPI，AMF确定未存储该GUTI与该SUPI*之间的对应关系。AMF还可向UE发送第一指示信息，并从UE接收注册请求，该注册请求包括第二SUCI，第二SUCI对应SUPI*。可选的，AMF还可向UE发送随机数和认证令牌。该随机数和认证令牌用于UE进行认证。
根据该方法，可由AMF指示UE发送第二SUCI，使得第一UDM根据UE的SUPI*进行UE的认证，以避免UE的真实SUPI泄露到第一网络，从而可提高通信安全。
在一种可能的设计中，第一指示信息可用于指示以下中的至少一项：第二网络与该第一网络之间的连接故障，所述第二网络为UE所在的公共网络；或者，UE注册到第一网络；或者，UE接入该第一网络。其中，该AMF部署于第一网络；或者，使用UE的隐藏标识。采用该设计，可灵活设置第一指示信息，使得UE根据第一指示信息向AMF发送第二SUCI。
第四方面，本申请实施例提供一种通信方法，该方法可由UE执行。该方法包括：UE接收第一指示信息，UE根据UE的SUPI*确定第二SUCI，该SUPI*对应于UE的SUPI。UE还可向AMF发送注册请求，该注册请求中包括该第二SUCI。UE还可接收来自于AMF的随机数和认证令牌。该随机数和认证令牌用于UE进行认证。
在一种可能的设计中，第一指示信息可用于指示以下中的至少一项：第二网络与该第一网络之间的连接故障，所述第二网络为UE所在的公共网络；或者，UE注册到第一网络；或者，UE接入该第一网络。其中，该AMF部署于第一网络；或者，使用UE的隐藏标识。
在一种可能的设计中，UE可接收来自于AMF或基站的第一指示信息。
在一种可能的设计中，第一指示信息承载于广播消息。
第五方面，本申请实施例提供一种通信装置，所述通信装置包括处理器，所述处理器与存储器耦合，其中：存储器用于存储指令；处理器用于根据执行存储器存储的指令，以 执行上述第一方面至第四方面或以上方面中任一种可能的设计中的方法。可选的，所述通信装置还可以包括所述存储器。可选的，所述通信装置还可以包括收发器，用于支持所述通信装置进行上述方法中的信息发送和/或接收。可选的，该通信装置可以是终端设备，也可以是终端设备中的装置，如芯片或者芯片系统，其中所述芯片系统包含至少一个芯片，所述芯片系统还可以包括其他电路结构和/或分立器件。
第六方面，本申请实施例提供一种通信装置，用于实现上述第一方面至第四方面或以上方面中任一种可能的设计中的方法，包括相应的功能模块，例如包括处理单元、通信单元等，分别用于实现以上方法中的步骤。
第七方面，本申请实施例提供一种计算机可读存储介质，所述计算机存储介质中存储有计算机可读指令，当计算机读取并执行所述计算机可读指令时，使得通信装置执行第一方面至第三方面或以上方面中任一种可能的设计中的方法。
第八方面，本申请实施例提供一种计算机程序产品，当计算机读取并执行所述计算机程序产品时，使得通信装置执行第一方面至第三方面或以上方面中任一种可能的设计中的方法。
第九方面，本申请实施例提供一种芯片，所述芯片与存储器相连，用于读取并执行所述存储器中存储的软件程序，以执行第一方面至第三方面或以上方面中任一种可能的设计中的方法。
第十方面，本申请实施例提供一种通信装置，包括处理器，所述处理器用于与收发器耦合，读取并执行所述存储器中的指令，以执行第一方面至第三方面或以上方面中任一种可能的设计中的方法。
第十一方面，本申请实施例提供一种通信方法，该通信方法可由部署在第一网络(或称本地网络)中的第一UDM和AMF执行。该方法包括：第一UDM接收来自于第二UDM的UE的第一标识、随机数、认证令牌和第一密钥。其中，该第一密钥对应UDM的长期密钥和第一服务网络名称。第一服务网络名称对应第一网络的标识。该第一UDM部署于该第一网络，第二统一数据管理功能部署于第二网络。AMF可用于向第一UDM发送UE认证请求，该，UE认证请求包括该UE的第二标识，第二标识对应第一标识，或者第二标识与第一标识相同。该AMF部署于第一网络。第一UDM根据第二标识确定第一标识对应的随机数、认证令牌和第一密钥。第一UDM向该AMF发送该随机数和该认证令牌。AMF向UE发送该随机数和该认证令牌。AMF向第一UDM发送UE通过认证的指示。第一UDM还可用于向AMF发送第一密钥对应的第二密钥。
在一种可能的设计中，第一UDM还可用于执行第一方面所示任意可能的设计中的方法，AMF还可用于执行第二方面所示任意可能的设计中的方法。
第十二方面，本申请实施例提供一种通信系统，包括用于执行第一方面或第一方面中任一种可能的设计中的方法的装置和用于执行第二方面或第二方面中任一种可能的设计中的方法的装置，或包括用于执行第一方面或第一方面中任一种可能的设计中的方法的装置和用于执行第三方面或第三方面中任一种可能的设计中的方法的装置，或包括用于执行第十一方面所示方法的AMF和第一UDM。
以上第二方面至第十二方面的有益效果可以参照第一方面中有益效果的描述。
附图说明
图1为本申请实施例提供的一种通信系统的架构示意图；
图2为本申请实施例提供的另一种通信系统的架构示意图；
图3为本申请实施例提供的另一种通信系统的架构示意图；
图4为本申请实施例提供的另一种通信系统的架构示意图；
图5为本申请实施例提供的一种通信方法的流程示意图；
图6为本申请实施例提供的另一种通信方法的流程示意图；
图7为本申请实施例提供的另一种通信方法的流程示意图；
图8为本申请实施例提供的一种通信装置的结构示意图；
图9为本申请实施例提供的另一种通信装置的结构示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地详细描述。方法实施例中的具体操作方法也可以应用于装置实施例或系统实施例中。
下面对本申请涉及术语进行解释：
至少一个，是指一个，或一个以上，即包括一个、两个、三个及以上。
多个，是指两个，或两个以上，即包括两个、三个及以上。
携带，可以是指某消息用于承载某信息或数据，也可以是指某消息由某信息构成。
耦合是指装置、单元或模块之间的间接耦合或通信连接，可以是电性，机械或其它的形式，用于装置、单元或模块之间的信息交互。
本申请实施例中，“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A、B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一(项)个”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a、b或c中的至少一项(个)，可以表示：a，b，c，a和b，a和c，b和c，或a、b和c，其中a、b、c可以是单个，也可以是多个。
下面，结合附图对本申请实施例进行详细说明。首先，介绍本申请实施例提供的无线通信系统，本申请提供的中的通信方法可应用于该系统，然后介绍本申请实施例提供的通信方法，最后介绍本申请实施例提供的通信装置。
如图1所示，本申请实施例提供的无线通信系统100可包括终端设备101以及网络设备102。
应理解，本申请实施例提供的无线通信系统100，既可适用于低频场景(sub 6G)，也适用于高频场景(above6G)。本申请实施例提供的无线通信系统100的应用场景包括但不限于宽带码分多址(wideband code division multiple access，WCDMA)系统、通用分组无线业务(general packet radio service，GPRS)、长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、通用移动通信系统(universal mobile telecommunication system，UMTS)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、第五代系统或新无线(new radio，NR)通信系统等。
以上所示终端设备101可以是用户设备、终端(terminal)、移动台(mobile station，MS)、移动终端(mobile terminal)等设备，该终端设备101能够与一个或多个通信系统的一个或多个网络设备进行通信，并接受网络设备提供的网络服务，这里的网络设备包括但不限于图示网络设备102。举例来说，本申请实施例中的终端设备101可以是移动电话(或称为“蜂窝”电话)、具有移动终端的计算机等，终端设备101还可以是便携式、袖珍式、手持式、计算机内置的或者车载的移动装置。终端设备101也可以是具有通信模块的通信芯片。
以上所示网络设备102可包括本申请所述的接入网设备(或称接入网站点)。具体的，网络设备102可包括接入网设备。在本申请中，接入网设备是指有提供网络接入功能的设备，如无线接入网(radio access network，RAN)基站等等。网络设备102具体可包括基站(base station，BS)，或包括基站以及用于控制基站的无线资源管理设备等，该网络设备102可以为中继站(中继设备)、接入点、车载设备、可穿戴设备以及未来5G等网络中的基站、未来演进的公共陆地移动网络(public land mobile network，PLMN)网络中的基站或者NR基站等，本申请实施例并不限定。网络设备102也可以是具有通信模块的通信芯片。
在本申请所述方法的执行过程中，网络设备102可作为RAN基站向终端设备101提供无线网络连接，例如，网络设备102可作为4G接入网——演进的通用移动通信系统(universal mobile telecommunications system，UMTS)陆地无线接入网(evolved UMTSterrestrial radio access network，E-UTRAN)中的接入网基站，或者，网络设备102可作为5G接入网——5G RAN中的接入网基站，或者，网络设备102可作为未来无线通信系统中的接入网基站。
如图2所示，5G网络架构可包括三部分，分别是UE、数据网络(data network，DN)和运营商网络。
其中，运营商网络可包括网络切片选择(network slice selection function，NSSF)、网络开放功能(network exposure function，NEF)、网络存储功能(network function repository function，NRF)、策略控制功能(policy control function，PCF)、UDM、应用功能(application function，AF)、网络切片特定鉴权和授权功能(network slice specific authentication and authorization function，NSSAAF)、鉴权服务器功能(authentication server function，AUSF)、接入与移动性管理功能(access and mobility management function，AMF)、会话管理功能(session management function，SMF)、(无线)接入网((radio)access network，(R)AN)以及UPF等网元或网络功能(network function，NF)。上述运营商网络中，除(无线)接入网部分之外的部分可以称为核心网络(CN)部分。为方便说明，后续以(R)AN称为RAN为例进行说明。
本申请中，用户设备可以包括图2所示的UE。UE可以是一种具有无线收发功能的设备，其可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。所述UE可以是手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。UE还可以是图1所示终端设备 101。
上述UE可通过运营商网络提供的接口(例如N1等)与运营商网络建立连接，使用运营商网络提供的数据和/或语音等服务。UE还可通过运营商网络访问DN，使用DN上部署的运营商业务(如访问DN中部署的客户服务器)，和/或第三方提供的业务。其中，上述第三方可为运营商网络和UE之外的服务方，可为UE提供他数据和/或语音等服务。其中，上述第三方的具体表现形式，具体可根据实际应用场景确定，在此不做限制。
此外，本申请中的统一数据管理功能，可包括图2所示UDM，在未来通信如6G中，统一数据管理功能仍可以是UDM，或有其它的名称，本申请不做限定。接入与移动性管理功能可包括图2所示AMF，在未来通信如6G中，接入与移动性管理功能仍可以是AMF，或有其它的名称，本申请不做限定。用户面功能可包括图2所示UPF，在未来通信如6G中，统一数据管理功能仍可以是UPF，或有其它的名称，本申请不做限定。
图2中Nnssf、Nnef、Nausf、Nnrf、Npcf、Nudm、Naf、Namf、Nssaaf、Nsmf、Nhse、N1、N2、N3、N4、N6、BEST-C、BEST-U、EAS-C，以及EAS-U分别为接口序号。这些接口序号的含义和用途可参见3GPP标准协议中定义的含义，在此不做限制。
此外，如图2所示的数据网络可包括客户服务器，用于向用户设备提供业务数据。UE与客户服务器之间可通过会话(session)进行数据的传输。图2所示SMF可用于执行的管理，如执行会话建立。
目前的一种专网架构如图3所示。图3中，中心网络可部署AMF、SMF、PCF、UDM和UPF等网络功能，为方便说明，将中心网络中部署的以上网络功能分别称为中心AMF、中心SMF、中心PCF、中心UDM和中心UPF。另外如图3所示，本地网络中可部署UPF，称为本地UPF。本申请中，本地网络可以包括园区场景中部署在园区附近的网络功能，比如，UPF可以部署在园区附近，此时园区内的UE可优先通过园区附近的RAN接入网络，并通过本地UPF就近获取业务服务，可降低业务时延。如图3中虚线箭头所示，UE与客户服务器之间业务数据的传输路径为：UE—RAN—本地UPF—客户服务器。
在该架构下，如果中心网络与本地网络之间的连接(如N4连接)出现故障，或者基站与中心网络的AMF之间的N2接口连接发生故障，则导致以下问题：1)在发生故障之后，UE无法注册到中心网络，从而无法建立使用客户业务的传输通道，导致业务被中断；2)针对在故障发生之前已经注册到中心网络并且通过建立了途经本地UPF的用于与客户服务器进行数据传输的会话的UE，该会话的维护和管理需要中心SMF执行，在故障发生后，中心SMF无法对该会话进行维护和管理，业务也可能被中断。
图4所示专网架构是为了解决以上问题所提出的另一种架构。基于图4所示专网架构，UE通过中心AMF实现注册，当基站和中心AMF之间的N2连接故障之后或者中心网络与本地网络之间的连接故障时，基站可能需要选择为该UE接入本地网络，使得UE通过本地网络访问业务。此时UE的业务不被中断。
然而在UE通过本地网络获取业务之前，UE需要注册到本地网络。具体来说，需要由本地网络中的本地AMF进行UE注册，之后由本地网络建立UE的会话，该会话可通过图4中虚线箭头表示。但在图4所示架构中，出于安全考虑，UE的长期密钥存储在中心UDM，且本地UDM无法获知UE的长期密钥，因此本地网络无法通过使用长期密钥对UE实现认证。本地网络无法实现对UE的认证，会导致UE到本地网络的注册失败，因此无法为UE建立在本地网络中的用户面数据传输路径，导致UE无法获得用户面数据，造成业务可 靠性降低。
本申请实施例提供一种通信方法，用以令本地网络实现对UE的认证，以提高业务可靠性。以5G通信系统为例，该通信方法可由第一UDM和第二UDM实施，其中，第一UDM部署在第一网络，第二UDM部署在第二网络，该第一网络还可部署AMF。以图4所示架构为例，第一UDM可包括本地UDM，第二UDM可包括中心UDM，第一网络可包括本地为例，第二网络可包括中心网络，第一网络中部署的AMF可包括本地AMF。此外，如果该方法应用在图4以外的其他专网架构中，也可以由其他网络功能或网元执行第一UDM的动作，例如，如果第一网络中未部署UDM，且第一网络中部署了AUSF，则可由AUSF执行本申请中由第一UDM执行的动作。
如图5所示，该方法可包括以下步骤：
S501：第二UDM确定随机数、认证令牌和第一密钥。
其中，第一密钥对应UE的长期密钥和第一服务网络名称，或者说，第一密钥根据UE的长期密钥和第一服务网络名称确定。第一服务网络名称对应第一网络的标识，或者说，第一服务网络名称根据第一网络的标识确定。
具体的，第二UDM可确定UE的第一认证向量，第一认证向量包括随机数、认证令牌和第一密钥。
一种可能的示例中，当第一网络支持的认证方式为5G认证和秘钥协商(5Gauthentication and key agreement，AKA)时，第一认证向量包括随机数、认证令牌、期望响应XRES*和密钥Kausf。其中，密钥Kausf为第一密钥。密钥Kausf对应UE的长期密钥和第一服务网络名称(serving network name，SN name)，也就是说，密钥Kausf根据UE的长期密钥和第一服务网络名称确定。第一服务网络名称对应于第一网络的标识，例如，第一服务网络名称根据第一网络的标识确定。
另一种可能的示例中，当第一网络支持的认证方式为扩展认证协议’认证和秘钥协商(extensible authentication protocol-authentication and key agreement，EAP-AKA’)时，第一认证向量包括随机数、认证令牌、期望响应XRES、机密性密钥CK’和完整性密钥IK’。其中，机密性密钥CK’和完整性密钥IK’为第一密钥。机密性密钥CK’和完整性密钥IK’根据UE的长期密钥和第一服务网络名称确定，第一服务网络名称对应于第一网络的标识。
可选的，S501中，第二UDM可以在确定满足条件时，确定UE的随机数、认证令牌和第一密钥。其中，该条件例如：根据时间间隔确定随机数、认证令牌和第一密钥，或者，在满足一定的触发条件后，执行UE的随机数、认证令牌和第一密钥的确定，触发条件例如管理员触发第二UDM确定随机数、认证令牌和第一密钥，或者，第一UDM请求第二UDM确定随机数、认证令牌和第一密钥。
根据时间间隔确定随机数、认证令牌和第一密钥时，第二UDM可以在距离上一次确定UE的随机数、认证令牌和第一密钥经过了一定的时间间隔后，确定UE的随机数、认证令牌和第一密钥，或者，在距离上一次发送UE的第一标识和随机数、认证令牌和第一密钥经过了一定的时间间隔后，确定UE的随机数、认证令牌和第一密钥。其中，时间间隔例如是一个月。
作为一种示例，如果按照设定的时间间隔确定UE的第一认证向量，第一认证向量指示包括随机数、认证令牌和第一密钥，则第二UDM可以在每次确定认证令牌时，使用前 一次确定第一认证向量时使用的序列号(sequence number，SQN)和时间T(比如1个月)确定新的SQN，并根据确定的新的SQN计算新的第一认证向量，也就是将前一次使用的SQN和时间T(比如1个月对应的秒数)的累加值作为新的SQN，用于确定新的第一认证向量。
实施中，第二UDM可确定UE的多个第一认证向量，并发送至第一UDM，第二UDM可根据前一次确定第一认证向量所使用的SQN与时间X的和SQN1作为新的SQN，确定第一个第一认证向量，例如距离前一次确定第一认证向量经过的时间间隔为1个月，或者距离前一次发送UE的第一标识和第一认证向量经过的时间间隔为1个月，X可以取1个月对应的秒数。第二UDM还可根据SQN1和一天对应的时间T1确定SQN2，根据SQN2确定第二个第一认证向量，以及，根据SQN2和一天对应的时间T1确定SQN3，根据SQN3确定第三个第一认证向量，以此类推，第二UDM可确定10个第一认证向量，并将该10个第一认证向量和UE的第一标识分别发送至第一UDM。由于基站和中心AMF之间的N2连接故障和中心网络与本地网络之间的连接故障的修复时间一般不超过7天，第一UDM可按照SQN由小到大的顺序每天采用该10个第一认证向量中的一个，以满足连接故障的修复期间本地网络对于UE认证过程的认证向量的需求。
S502：第二UDM向第一UDM发送UE的第一标识、随机数、认证令牌和第一密钥。
本申请中，第一标识可以是UE的SUPI，或者是根据UE的SUPI确定的SUPI*。应理解，本申请中的SUPI*是在SUPI基础上根据新引入的参数或根据SUPI按照特定的算法确定的标识，目的是避免UE携带真实SUPI入网，以进一步提高网络的通信安全。根据SUPI确定SUPI*的方式可参见本申请实施例中的说明，这里暂不展开介绍。第一网络可支持根据SUPI或SUPI*进行UE的认证，如果第一网络支持根据SUPI进行UE的认证，则第一标识为SUPI；如果第一网络支持根据SUP I*进行UE的认证，则第一标识为SUP I*。如果第一标识包括SUPI*，则第一网络通过UE的SUPI*实现UE的认证，可以避免UE的真实SUPI泄露到第一网络，从而可提高通信安全。
其中，第二UDM可向第一UDM发送UE的第一标识和第一认证向量。其中，第一认证向量可参见S501中的说明。
相应地，第一UDM接收UE的第一标识、随机数、认证令牌和第一密钥。第一UDM可在接收到第一标识、随机数、认证令牌和第一密钥之后，存储第一标识与随机数、认证令牌和第一密钥之间的对应关系。
可选的，在第一网络与第二网络之间的连接故障的场景中，S501和S502所示的步骤发生在第一网络与第二网络的连接出现故障之前。
S503：第一UDM接收来自于AMF的UE认证请求，该UE认证请求中包括UE的第二标识，第二标识对应于第一标识，或者，第二标识与第一标识相同。
其中，UE认证请求可以是AMF接收来自于UE的注册请求(registration request，RR)后发送的，注册请求可用于发起UE的注册。该注册请求中可携带UE的标识，具体的，该注册请求中携带的UE的标识可以是UE的SUCI或GUTI。
本申请中，UE的SUCI可以是根据UE的SUPI或SUPI*确定的。本申请中为区分根据SUPI确定的SUCI和根据SUPI*确定的SUCI，将根据SUPI确定的SUCI称为第一SUCI，以及将根据SUPI*确定的SUCI称为第二SUCI。其中，根据SUPI确定第一SUCI的方式，与根据SUPI*确定第二SUCI的方式可以相同或不同，本申请不具体限定。
下面分别根据注册请求中UE的标识的不同类型对认证请求中UE的第二标识进行说明。
如果注册请求中携带的是UE的GUTI，并且AMF未存储与该GUTI对应的第一标识，由于第一UDM从第二UDM获得的只有UE的第一标识和随机数、认证令牌和第一密钥，而没有获得UE的GUTI与随机数、认证令牌和第一密钥之间的对应关系，第一UDM因此无法根据该GUTI查找到对应的随机数、认证令牌和第一密钥，第一网络也就无法对UE进行认证，此时AMF可要求UE上报SUCI。具体的，AMF向UE发送第一指示信息，第一指示信息可用于指示UE向AMF发送SUCI。第一指示信息具体可用于指示第二网络与所述第一网络之间的连接故障、UE注册到第一网络、UE接入到第一网络，或指示使用UE的隐藏标识。可选的，第一指示信息可携带在标识请求(identity request)中。UE在接收到第一指示信息后，可确定并向AMF发送UE的SUCI，例如，UE可再次发送UE认证请求，在UE认证请求中携带SUCI，或者，如果第一指示信息携带在标识请求中，则UE可以在标识请求的响应消息中携带SUCI。AMF在收到UE的SUCI后，可以将SUCI携带在UE认证请求中，并将UE认证请求发送给第一UDM，此时UE认证请求中携带的第二标识为UE的SUCI。其中，如果第一网络支持根据SUPI进行UE的认证(或者说UE的第一标识是UE的SUPI)，则该第二标识为UE的第一SUCI；如果第一网络支持根据SUPI*进行UE的认证(或者说UE的第一标识是UE的SUPI*)，则该第二标识为UE的第二SUCI。
如果注册请求中携带的是UE的GUTI，并且AMF存储有与该GUTI对应的第一标识，比如，UE此前在第一网络中注册过，AMF在此前的注册过程中存储了该UE的GUTI与第一标识的对应关系，则AMF可在UE认证请求中携带UE的第一标识，并将UE认证请求发送至第一UDM。其中，第一标识可以是UE的SUPI或SUPI*。
如果注册请求中携带的是UE的第一SUCI，且第一网络支持根据SUPI进行UE的认证(或者说UE的第一标识是UE的SUPI)，则AMF可将第一SUCI携带在UE认证请求中并将UE认证请求发送给第一UDM，用于第一UDM确定该SUPI对应的随机数、认证令牌和第一密钥，此时UE认证请求中携带的第二标识为UE的第一SUCI。
如果注册请求中携带的是UE的第一SUCI，且第一网络支持根据SUPI*进行UE的认证(或者说UE的第一标识是UE的SUPI*)，此时AMF可要求UE上报第二SUCI。具体的，AMF可向UE发送第一指示信息，第一指示信息可用于指示UE向AMF发送第二SUCI。第一指示信息具体可用于指示第二网络与所述第一网络之间的连接故障、UE注册到第一网络、UE接入到第一网络，或指示使用UE的隐藏标识。可选的，第一指示信息可携带在标识请求中。UE在接收到第一指示信息后，可确定SUPI*，并向AMF发送SUPI*对应的第二SUCI，例如，UE可再次发送UE认证请求，在UE认证请求中携带第二SUCI，或者，如果第一指示信息携带在标识请求中，则UE可以在标识请求的响应消息中携带第二SUCI。AMF在收到UE的第二SUCI后，可以将第二SUCI携带在UE认证请求中，并将UE认证请求发送给第一UDM，此时UE认证请求中携带的第二标识为UE的第二SUCI。
如果注册请求中携带的是UE的第二SUCI，且第一网络支持根据SUPI*进行UE的认证(或者说UE的第一标识是UE的SUPI*)，则AMF可将UE的第二SUCI携带在UE认证请求中，并向第一UDM发送UE认证请求。其中，UE可接收来自于基站的广播消息或其他消息，该消息可指示UE接入的RAN与第一网络之间的连接发生故障，或者指示第一网络与第二网络之间的连接发生故障，则UE可在接收到该消息后确定SUPI*并进一步确 定第二SUCI，之后在注册请求中携带第二SUCI。
此外，AMF还可在S503所示的UE认证请求中携带第一服务网络名称。
S504：第一UDM根据第二标识确定第一标识对应的随机数、认证令牌和第一密钥。
本申请中，第一标识可以是UE的SUPI，则第二标识可以是SUPI或者是根据SUPI确定的第一SUCI。此外，第一标识还可以是根据UE的SUPI确定的SUPI*，则此时第二标识可以是根据SUPI*确定的SUCI。
示例性的，在接收到UE的第二标识后，如果第一UDM确定第二标识对应于第一标识，或者第二标识与第一标识相同，则第一UDM可查询第一标识、随机数、认证令牌和第一密钥之间的对应关系，以确定该第一标识对应的随机数、认证令牌和第一密钥。
S505：第一UDM向AMF发送随机数和认证令牌。
可选的，第一UDM可向AMF发送第二认证向量，第二认证向量中包括随机数和认证令牌。
此外，当用户设备的认证方式为5G AKA时，第二认证向量还可包括期望响应HXRES*，其中期望响应HXRES*是根据期望响应XRES*计算所得的。
其中，随机数和认证令牌用于UE的认证。例如，AMF将随机数和认证令牌发送至UE，在UE根据随机数和认证令牌确定通过认证后向AMF发送UE通过认证的指示，以及由AMF向第一UDM发送UE通过认证的指示。
S506：第一UDM向AMF发送第一密钥对应的第二密钥。
例如，第一UDM在接收到来自于AMF的UE通过认证的指示后，向AMF发送第二密钥，用于根据第二密钥进行UE的安全保护。第二密钥例如是密钥Kseaf。当认证方式为5G AKA时，第一UDM可根据该Kausf推导出Kseaf，并将Kseaf发送至AMF；当认证方式为EAP-AKA’时，第一UDM可根据机密性密钥CK’和完整性密钥IK’推导出Kausf，再根据Kausf推导出Kseaf，之后将Kseaf发送至AMF。
采用图5所示流程，以第一网络是本地网络，第二网络是中心网络为例，部署在第一网络的第一UDM可从第二网络中的第二UDM获取用户设备的随机数、认证令牌和第一密钥，第一UDM还可向第一网络中的AMF发送随机数和认证令牌以实现UE的认证，从而，对于基站与中心网络的连接出现故障或者在中心网络与本地网络之间的连接故障的场景，能够支持UE通过本地网络访问业务，即通过本地网络访问业务来保证业务不会中断，从而提高业务可靠性。同时，该方法能够保证UE的长期密钥不被泄漏到本地网络，提升用户长期密钥的安全性。
下面结合示例对本申请中的SUPI*的确定方式进行说明。
方式1，针对每个UE引入用于确定SUPI*的参数，如一个随机数，并根据该参数和UE的SUPI，确定SUPI*。例如，可根据该参数和UE的SUPI通过基于哈希的消息验证码(hash-based message authentication code，HMAC)算法确定SUPI*。
其中，对于已注册至第二网络的UE，第二UDM可将该参数通过用户参数更新(UEparameters update，UPU)流程配置给UE。对于未注册至第二网络的UE，该参数可以由UE确定，比如UE通过预定义、预配置等方式确定该参数。
方式2，针对每个本地网络引入参数，如本地网络标识或本地网络对应的园区标识等，根据UE的SUPI和该参数确定SUPI*。例如，可根据该参数和UE的SUPI通过HMAC算法确定SUPI*。该参数可通过RAN广播的方式发送。
方式3，可以不引入新的参数，使用UE的SUPI通过固定算法和已有参数生成SUPI*。
应理解，本申请中，第二UDM和UE可以通过同一种方式确定UE的SUPI*，比如，UE和第二UDM都是根据一个随机数和UE的SUPI确定SUPI*。除了以上示例的方式，还可以通过其他方式确定SUPI*，本申请不做具体限定。比如，UE和第二UDM也可协商确定一个用于确定SUPI*的参数，并根据该参数确定SUPI*。
如果第一网络支持根据SUPI*进行UE的认证，第一网络可获取UE的第二SUCI，并根据第二SUCI确定UE的SUPI*，进一步根据UE的SUPI*实现UE认证。
其中，第一网络中的AMF可以在确定来自于UE的注册请求中未携带第二SUCI后，由AMF要求UE上报携带UE的第二SUCI，或者，可以由UE主动上报携带UE的第二SUCI的注册请求，下面分别结合图6和图7进行说明。
例如图6所示，如果由AMF要求UE上报携带UE的第二SUCI的注册请求，一种可能的UE认证过程可包括以下步骤：
S601：位于第二网络的第二UDM确定UE的SUPI*，并存储UE的SUPI和SUPI*之间的对应关系。第一网络可以是本地网络，第二网络可以是中心网络。
其中，该UE中配置有用于确定SUPI*的信息，以支持UE采用与第二UDM相同的方式确定SUPI*。
可选的，该UE还配置有第一公钥，该第一公钥用于根据UE的SUPI*确定UE的第二SUCI。该第一公钥与第一私钥相对应，第一私钥可用于根据UE的第二SUCI确定UE的SUPI*。
进一步可选的，该UE中还可配置由第二公钥，该第二公钥用于根据UE的SUPI确定UE的第一SUCI。第二公钥可对应于第二私钥，第二私钥用于根据UE的第一SUCI确定UE的SUPI，第二公钥与第一公钥不同，且第二私钥与第一私钥不同。可选的，该第二私钥可存储在第二UDM中。据此，当第一UDM配置有第一私钥而未配置第二私钥时，第一UDM所在的本地网络仅支持根据UE的SUPI*实现UE的认证，即便此时UE错误地将第一SUCI发送至第一UDM，第一UDM也是无法根据第一私钥解密第一SUCI而获得SUPI的，因此可以进一步避免UE真实的SUPI被泄露至本地网络，从而进一步提高安全性。
S602：第二UDM向第一UDM发送UE的SUPI*和UE的签约数据。
该第一UDM部署在第一网络中，且该第一UDM中配置有第一私钥。
S602中，UE的签约数据可包括UE签约的网络切片的信息。
其中，S602在第一网络与第二网络之间的网络未出现故障时执行。
相应地，第一UDM接收UE的SUPI*和UE的签约数据。
可选的，第一UDM还可接收UE的，例如，接收UE的SUPI*与第一认证向量之间的对应关系。该第一认证向量可包括随机数、认证令牌和第一密钥。第一认证向量具体可参见图5所示S501中的说明。
可选的，第一UDM在接收到UE的SUPI*和签约数据后，可存储UE的标识与签约数据对应关系表。该表格中可包括至少一个UE的SUPI*与签约数据之间的对应关系。
S603：UE向AMF发送注册请求，注册请求中携带UE的标识。
可选的，S603中，在UE接入的基站与第二网络之间的连接出现故障或在第一网络与第二网络之间的连接出现故障的情况下执行。
S603中，注册请求中携带的UE的标识可以是UE的第一SUCI、第二SUCI或GUTI。 如果注册请求中携带的是UE的第一SUCI，或者，如果注册请求中携带的是UE的GUTI，该GUTI对应于UE的SUPI*，但AMF未存储该GUTI与SUPI*之间的对应关系，则执行S604。如果注册请求中携带的UE的标识是UE的第二SUCI，则执行S606。
相应地，AMF接收该注册请求。
S604：AMF向UE发送第一指示信息。
第一指示信息用于指示UE向AMF发送UE的第二SUCI。第一指示信息可参见本申请中的说明，这里不再展开。
可选的，第一指示信息可携带在标识请求中。
相应地，UE接收该第一指示信息。
S605：UE向AMF发送UE的第二SUCI。
可选的，UE在接收到S604所示的指示信息后，根据用于确定SUPI*的信息确定SUPI*，并根据第一公钥和SUPI*确定第二SUCI。
相应地，AMF接收标识请求对应的响应消息。
S606：AMF向第一UDM发送UE认证请求，UE认证请求中携带UE的第二SUCI。
可选的，UE认证请求中还可包括第一服务网络名称。
相应地，第一UDM接收UE认证请求。
S607：第一UDM根据UE的第二SUCI和第一私钥确定UE的SUPI*。
S608：第一UDM确定该SUPI*对应的签约数据。
可选的，第一UDM可查询UE的标识与签约数据对应关系表，获得UE的SUPI*对应的签约数据。
S609：第一UDM向AMF发送UE认证响应。
可选的，UE认证响应中可携带随机数和认证令牌。具体的，UE认证响应中可携带第二认证向量。该第二认证向量可包括随机数和认证令牌。第二认证向量具体可参见图5所示S505中的说明。
应理解，如果第一网络中部署有AUSF，则S606可替换为：AMF向AUSF发送UE认证请求，AUSF向第一UDM发送UE认证获取请求，UE认证获取请求中携带UE的第二SUCI。相应地，第一UDM接收UE认证获取请求。此外，如果第一网络中部署有AUSF，则S609可替换为，第一UDM向AUSF发送UE认证获取响应，AUSF向AMF发送UE认证响应。此时UE认证获取响应中可携带随机数和认证令牌。
S610：AMF向UE发送认证请求。
可选的，认证请求可包括随机数和认证令牌，如果认证方式是5G AKA，则认证请求中还可包括期望响应HXRES*，用于UE的认证。具体的，认证请求中可携带第二认证向量。
相应地，UE接收认证请求。UE可根据认证请求中携带的RAND和认证令牌进行认证。
可选的，如果UE根据认证请求中携带的RAND和认证令牌确定通过认证，则UE还可向AMF发送认证响应，表示UE认证通过。
采用图6所示方式，以第一网络是本地网络且第二网络是中心网络为例，本地网络中的第一UDM可以根据UE的SUPI*查询UE的签约信息，以及根据UE的SUPI*实现UE的认证，因此避免了本地网络根据UE的真实SUPI进行认证，能够提高通信安全性。
如图7所示，如果由UE主动上报携带有第二SUCI的注册请求，本申请实施例提供的另一种通过SUPI*进行UE认证的过程包括S701-S710所示的以下步骤：
其中，S701-S702可参照S601-S602实施，这里不再赘述。
S703：UE接收来自于基站的广播消息，该广播消息可指示UE接入的RAN与第一网络之间的连接发生故障，或者指示第一网络与第二网络之间的连接发生故障。
S704：UE确定UE的SUPI*，并根据UE的SUPI*确定UE的第二SUCI。
S704可参照S605实施。
S705：UE向AMF发送注册请求，注册请求中携带UE的第二SUCI。
相应地，AMF接收注册请求。
S706-S710可参照S606-S610，不再展开赘述。
与图6所示流程同理，图7所示流程能够避免本地网络根据UE的真实SUPI进行认证，能够提高通信安全性。并且，图7所示流程中可由UE获取断网信息，然后主动生成SUPI*，并以SUPI*请求注册，相比于图6所示认证方式可提高认证效率。
与上述构思相同，如图8所示，本申请实施例还提供一种装置800用于实现上述方法。例如，该装置可以为软件模块或者芯片系统。本申请实施例中，芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。该装置800可以包括：处理单元801和通信单元802。
应理解，该装置可包括以上方法实施例中所示的第一UDM、第二UDM、AMF或UE，或者包括具备以上方法实施例中所示的第一UDM、第二UDM、AMF或UE的功能的装置。
本申请实施例中，通信单元也可以称为收发单元，可以包括发送单元和/或接收单元，分别用于执行上文方法实施例中第一UDM、第二UDM、AMF或UE的发送和接收的步骤。
以下，结合图8至图9详细说明本申请实施例提供的通信装置。应理解，装置实施例的描述与方法实施例的描述相互对应，因此，未详细描述的内容可以参见上文方法实施例，为了简洁，这里不再赘述。
通信单元802也可以称为收发器、收发机、收发装置等。处理单元801也可以称为处理器，处理单板，处理模块、处理装置等。可选的，可以将通信单元802中用于实现接收功能的器件视为接收单元，将通信单元802中用于实现发送功能的器件视为发送单元，即通信单元802包括接收单元和发送单元。通信单元802有时也可以称为收发机、收发器、或收发电路等。接收单元有时也可以称为接收机、接收器、或接收电路等。发送单元有时也可以称为发射机、发射器或者发射电路等。
举例来说，如果该装置800是第一UDM，则通信单元802可用于接收来自第二UDM的UE的第一标识、随机数、认证令牌和第一密钥，以及，接收来自于AMF的用户设备认证请求。处理单元801可用于根据所述第二标识确定所述第一标识对应的所述随机数、所述认证令牌和所述第一密钥。通信单元802还可用于向所述AMF发送所述随机数和所述认证令牌，以及向所述AMF发送所述第一密钥对应的第二密钥。
可选的，通信单元和处理单元还可以执行其他操作，例如通信单元802用于执行上述图5至图7所示的方法实施例中第一UDM的发送操作和接收操作，处理单元801用于执行上述图5至图7所示的方法实施例中第一UDM除了收发操作之外的其他操作，具体可以参考前面的描述，在此不再赘述。
又如，如果该装置800是第二UDM，则处理单元801可用于确定UE的随机数、认证令牌和第一密钥。通信单元802可用于向第一UDM发送UE的第一标识、随机数、认证 令牌和第一密钥。
可选的，通信单元和处理单元还可以执行其他操作，例如通信单元802用于执行上述图5至图7所示的方法实施例中第二UDM的发送操作和接收操作，处理单元801用于执行上述图5至图7所示的方法实施例中第二UDM除了收发操作之外的其他操作，具体可以参考前面的描述，在此不再赘述。
又如，如果该装置800是部署于第一网络的AMF，则处理单元801可用于接收来自于UE的第一SUCI，或者，用于接收来自于所述用户设备的GUTI。通信单元802还可用于向UE发送第一指示信息，以及用于从所述用户设备接收注册请求，所述注册请求包括所述第二SUCI，所述第二SUCI对应SUPI*。
可选的，通信单元和处理单元还可以执行其他操作，例如通信单元802用于执行上述图5至图7所示的方法实施例中AMF的发送操作和接收操作，处理单元801用于执行上述图5至图7所示的方法实施例中AMF除了收发操作之外的其他操作，具体可以参考前面的描述，在此不再赘述。
又如，如果该装置800是UE，则通信单元802可用于接收第一指示信息。处理单元801可用于根据UE的SUPI*确定第二SUCI，SUPI*对应所述用户设备的SUPI。通信单元802可用于向AMF发送注册请求，注册请求包括所述第二SUCI。通信单元802还可用于接收来自于AMF的认证请求。可选的，认证请求中可携带随机数和认证令牌。
可选的，通信单元和处理单元还可以执行其他操作，例如通信单元802用于执行上述图5至图7所示的方法实施例中UE的发送操作和接收操作，处理单元801用于执行上述图5至图7所示的方法实施例中UE除了收发操作之外的其他操作，具体可以参考前面的描述，在此不再赘述。
如图9所示为本申请实施例提供的另一种通信装置，图9所示的装置可以为图8所示的装置的一种硬件电路的实现方式。该通信装置可适用于前面所示出的流程图中，执行上述方法实施例中第一UDM、第二UDM、AMF或UE的功能，例如，通信接口可对应于通信单元802，处理器920可对应于处理单元801。为了便于说明，图9仅示出了该通信装置的主要部件。
装置900还可以包括至少一个存储器930，用于存储程序指令和/或数据。存储器930和处理器920耦合。本申请实施例中的耦合是装置、单元或模块之间的间接耦合或通信连接，可以是电性，机械或其它的形式，用于装置、单元或模块之间的信息交互。处理器920可能和存储器930协同操作。处理器920可能执行存储器930中存储的程序指令。所述至少一个存储器中的至少一个可以包括于处理器中。
图9所示的装置900包括至少一个处理器920以及通信接口910，处理器920用于执行存储器930中存储的指令或程序。存储器930中存储的指令或程序被执行时，该处理器920用于执行上述实施例中处理单元801执行的操作，通信接口910用于执行上述实施例中通信单元802执行的操作。
在本申请实施例中，通信接口可以是收发器、电路、总线、模块或其它类型的通信接口。在本申请实施例中，通信接口为收发器时，收发器可以包括独立的接收器、独立的发射器；也可以集成收发功能的收发器、或者是通信接口。
装置900还可以包括通信线路940。其中，通信接口910、处理器920以及存储器930可以通过通信线路940相互连接；通信线路940可以是外设部件互连标准(peripheral  component interconnect，简称PCI)总线或扩展工业标准结构(extended industry standard architecture，简称EISA)总线等。所述通信线路940可以分为地址总线、数据总线、控制总线等。为便于表示，图9中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
本申请提还提供了一种通信系统，用于执行上面任一流程中提供的方法，如执行图5至图7中任一流程。该通信系统可包括图4所示架构。
本申请提还提供了一种计算机可读存储介质，用于存储计算机程序，该计算机程序包括用于执行上面任一流程中提供的方法的指令。
本申请提还提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序代码，当所述计算机程序代码在计算机上运行时，使得计算机执行上面任一流程中提供的方法。
本申请提还提供一种芯片，包括处理器，所述处理器与存储器耦合，用于执行所述存储器中存储的计算机程序或指令，当所述处理器执行所述计算机程序或指令时，使得上面任一流程中提供的方法被实现。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的保护范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (18)

  1. 一种通信方法，其特征在于，包括：
    第一统一数据管理功能接收来自于第二统一数据管理功能的用户设备的第一标识、随机数、认证令牌和第一密钥，所述第一密钥对应所述用户设备的长期密钥和第一服务网络名称，所述第一服务网络名称对应第一网络的标识；所述第一统一数据管理功能部署于所述第一网络，所述第二统一数据管理功能部署于第二网络；
    所述第一统一数据管理功能接收来自于接入与移动性管理功能的用户设备认证请求，所述用户设备认证请求包括所述用户设备的第二标识，所述第二标识对应所述第一标识，或者所述第二标识与第一标识相同，所述接入与移动性管理功能部署于所述第一网络；
    所述第一统一数据管理功能根据所述第二标识确定所述第一标识对应的所述随机数、所述认证令牌和所述第一密钥；
    所述第一统一数据管理功能向所述接入与移动性管理功能发送所述随机数和所述认证令牌；
    所述第一统一数据管理功能向所述接入与移动性管理功能发送所述第一密钥对应的第二密钥。
  2. 一种通信方法，其特征在于，包括：
    第一统一数据管理功能接收来自于第二统一数据管理功能的用户设备的第一标识、随机数、认证令牌和第一密钥，所述第一密钥对应所述用户设备的长期密钥和第一服务网络名称，所述第一服务网络名称对应第一网络的标识；所述第一统一数据管理功能部署于所述第一网络，所述第二统一数据管理功能部署于第二网络；
    接入与移动性管理功能向所述第一统一数据管理功能发送用户设备认证请求，所述用户设备认证请求包括所述用户设备的第二标识，所述第二标识对应所述第一标识，或者所述第二标识与第一标识相同，所述接入与移动性管理功能部署于所述第一网络；
    所述第一统一数据管理功能接收来自于接入与移动性管理功能的所述用户设备认证请求；
    所述第一统一数据管理功能根据所述第二标识确定所述第一标识对应的所述随机数、所述认证令牌和所述第一密钥；
    所述第一统一数据管理功能向所述接入与移动性管理功能发送所述随机数和所述认证令牌；
    所述接入与移动性管理功能向所述用户设备发送所述随机数和所述认证令牌；
    所述接入与移动性管理功能向所述第一统一数据管理功能发送所述用户设备通过认证的指示；
    所述第一统一数据管理功能向所述接入与移动性管理功能发送所述第一密钥对应的第二密钥。
  3. 如权利要求1或2所述的方法，其特征在于，所述第一标识包括所述用户设备的签约永久标识，所述第二标识包括所述签约永久标识或根据所述签约永久标识确定的第一签约隐藏标识；或者，
    所述第一标识包括所述用户设备的隐藏的签约永久标识，所述第二标识包括根据所述隐藏的签约永久标识确定的第二签约隐藏标识，所述用户设备的隐藏的签约永久标识对应 于所述用户设备的签约永久标识。
  4. 如权利要求3所述的方法，其特征在于，
    所述第一标识包括所述隐藏的签约永久标识，所述第二标识包括根据所述隐藏的签约永久标识确定的第二签约隐藏标识，所述方法还包括：
    所述第一统一数据管理功能根据第一私钥解密所述第二签约隐藏标识获得所述隐藏的签约永久标识；或者，
    所述第一标识包括所述用户设备的签约永久标识，所述第二标识包括根据所述签约永久标识确定的第一签约隐藏标识，所述方法还包括：
    所述第一统一数据管理功能根据第二私钥解密所述第一签约隐藏标识获得所述签约永久标识；
    其中，所述第一私钥和所述第二私钥不同。
  5. 如权利要求4所述的方法，其特征在于，所述第一私钥对应于所述第一统一数据管理功能，所述第二私钥对应于所述第二统一数据管理功能。
  6. 一种通信方法，其特征在于，包括：
    第二统一数据管理功能确定随机数、认证令牌和第一密钥，所述第一密钥对应用户设备的长期密钥和第一服务网络名称，所述第一服务网络名称对应第一网络的标识，所述第二统一数据管理功能部署于第二网络；
    所述第二统一数据管理功能向第一统一数据管理功能发送所述用户设备的第一标识、所述随机数、所述认证令牌和所述第一密钥，所述第一统一数据管理功能部署于所述第一网络。
  7. 如权利要求6所述的方法，其特征在于，所述第一标识包括所述用户设备的签约永久标识或所述用户设备的隐藏的签约永久标识，所述用户设备的隐藏的签约永久标识对应于所述用户设备的签约永久标识。
  8. 一种通信装置，其特征在于，包括：
    通信模块，用于接收来自于第二统一数据管理功能的用户设备的第一标识、随机数、认证令牌和第一密钥，所述第一密钥对应所述用户设备的长期密钥和第一服务网络名称，所述第一服务网络名称对应第一网络的标识；所述通信装置部署于所述第一网络，所述第二统一数据管理功能部署于第二网络；
    所述通信模块，还用于接收来自于接入与移动性管理功能的用户设备认证请求，所述用户设备认证请求包括所述用户设备的第二标识，所述第二标识对应所述第一标识，或者所述第二标识与第一标识相同，所述接入与移动性管理功能部署于所述第一网络；
    处理模块，用于根据所述第二标识确定所述第一标识对应的所述随机数、所述认证令牌和所述第一密钥；
    所述通信模块，还用于向所述接入与移动性管理功能发送所述随机数和所述认证令牌；
    所述通信模块，还用于向所述接入与移动性管理功能发送所述第一密钥对应的第二密钥。
  9. 如权利要求8所述的装置，其特征在于，所述第一标识包括所述用户设备的签约永久标识，所述第二标识包括所述签约永久标识或根据所述签约永久标识确定的第一签约隐藏标识；或者，
    所述第一标识包括所述用户设备的隐藏的签约永久标识，所述第二标识包括根据所述 隐藏的签约永久标识确定的第二签约隐藏标识，所述用户设备的隐藏的签约永久标识对应于所述用户设备的签约永久标识。
  10. 如权利要求9所述的装置，其特征在于，
    所述第一标识包括所述隐藏的签约永久标识，所述第二标识包括根据所述隐藏的签约永久标识确定的第二签约隐藏标识，所述处理模块还用于：
    根据第一私钥解密所述第二签约隐藏标识获得所述隐藏的签约永久标识；或者，
    所述第一标识包括所述用户设备的签约永久标识，所述第二标识包括根据所述签约永久标识确定的第一签约隐藏标识，所述处理模块还用于：
    根据第二私钥解密所述第一签约隐藏标识获得所述签约永久标识；
    其中，所述第一私钥和所述第二私钥不同。
  11. 如权利要求10所述的装置，其特征在于，所述第一私钥对应于所述第二统一数据管理功能，所述第二私钥对应于所述第一统一数据管理功能。
  12. 一种通信装置，其特征在于，包括：
    处理模块，用于确定随机数、认证令牌和第一密钥，所述第一密钥对应用户设备的长期密钥和第一服务网络名称，所述第一服务网络名称对应第一网络的标识；
    通信模块，用于向第一统一数据管理功能发送所述用户设备的第一标识、所述随机数、所述认证令牌和所述第一密钥，所述第一统一数据管理功能部署于所述第一网络，所述通信装置部署于第二网络。
  13. 如权利要求12所述的装置，其特征在于，所述第一标识包括签约永久标识或所述用户设备的隐藏的签约永久标识，所述用户设备的隐藏的签约永久标识对应于所述用户设备的签约永久标识。
  14. 一种通信系统，其特征在于，包括第一统一数据管理功能和接入与移动性管理功能：
    所述第一统一数据管理功能，用于接收来自于第二统一数据管理功能的用户设备的第一标识、随机数、认证令牌和第一密钥，所述第一密钥对应所述用户设备的长期密钥和第一服务网络名称，所述第一服务网络名称对应第一网络的标识；所述第一统一数据管理功能部署于所述第一网络，所述第二统一数据管理功能部署于第二网络；
    所述接入与移动性管理功能，用于预约向所述第一统一数据管理功能发送用户设备认证请求，所述用户设备认证请求包括所述用户设备的第二标识，所述第二标识对应所述第一标识，或者所述第二标识与第一标识相同，所述接入与移动性管理功能部署于所述第一网络；
    所述第一统一数据管理功能，还用于接收来自于接入与移动性管理功能的所述用户设备认证请求；
    所述第一统一数据管理功能，还用于根据所述第二标识确定所述第一标识对应的所述随机数、所述认证令牌和所述第一密钥；
    所述第一统一数据管理功能，还用于向所述接入与移动性管理功能发送所述随机数和所述认证令牌；
    所述接入与移动性管理功能，还用于向所述用户设备发送所述随机数和所述认证令牌；
    所述接入与移动性管理功能，还用于向所述第一统一数据管理功能发送所述用户设备通过认证的指示；
    所述第一统一数据管理功能，还用于向所述接入与移动性管理功能发送所述第一密钥 对应的第二密钥。
  15. 如权利要求14所述的通信系统，其特征在于，所述第一标识包括所述用户设备的签约永久标识，所述第二标识包括所述签约永久标识或根据所述签约永久标识确定的第一签约隐藏标识；或者，
    所述第一标识包括所述用户设备的隐藏的签约永久标识，所述第二标识包括根据所述隐藏的签约永久标识确定的第二签约隐藏标识，所述用户设备的隐藏的签约永久标识对应于所述用户设备的签约永久标识。
  16. 如权利要求15所述的通信系统，其特征在于，
    所述第一标识包括所述隐藏的签约永久标识，所述第二标识包括根据所述隐藏的签约永久标识确定的第二签约隐藏标识，所述第一统一数据管理功能还用于：
    根据第一私钥解密所述第二签约隐藏标识获得所述隐藏的签约永久标识；或者，
    所述第一标识包括所述用户设备的签约永久标识，所述第二标识包括根据所述签约永久标识确定的第一签约隐藏标识，所述第一统一数据管理功能还用于：
    根据第二私钥解密所述第一签约隐藏标识获得所述签约永久标识；
    其中，所述第一私钥和所述第二私钥不同。
  17. 如权利要求16所述的通信系统，其特征在于，所述第一私钥对应于所述第一统一数据管理功能，所述第二私钥对应于所述第二统一数据管理功能。
  18. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机程序或指令，当所述计算机程序或指令被计算设备执行时，以使得所述计算设备执行如权利要求1，以及3至7中任一项所述的方法。
PCT/CN2022/125486 2021-10-29 2022-10-14 一种通信方法及装置 WO2023071836A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111269553.3 2021-10-29
CN202111269553.3A CN116074821A (zh) 2021-10-29 2021-10-29 一种通信方法及装置

Publications (1)

Publication Number Publication Date
WO2023071836A1 true WO2023071836A1 (zh) 2023-05-04

Family

ID=86159135

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/125486 WO2023071836A1 (zh) 2021-10-29 2022-10-14 一种通信方法及装置

Country Status (2)

Country Link
CN (1) CN116074821A (zh)
WO (1) WO2023071836A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116367204A (zh) * 2023-05-31 2023-06-30 阿里巴巴（中国）有限公司 用户设备业务处理方法、电子设备、存储介质及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111669276A (zh) * 2019-03-07 2020-09-15 华为技术有限公司 一种网络验证方法、装置及系统
WO2020199700A1 (zh) * 2019-03-29 2020-10-08 华为技术有限公司 一种鉴权方法及通信装置
CN113453213A (zh) * 2021-06-02 2021-09-28 中国联合网络通信集团有限公司 一种鉴权数据同步方法及装置
WO2021209379A1 (en) * 2020-04-13 2021-10-21 Telefonaktiebolaget Lm Ericsson (Publ) Authentication server function (ausf) push of authentication and key management (akma) material

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111669276A (zh) * 2019-03-07 2020-09-15 华为技术有限公司 一种网络验证方法、装置及系统
WO2020199700A1 (zh) * 2019-03-29 2020-10-08 华为技术有限公司 一种鉴权方法及通信装置
WO2021209379A1 (en) * 2020-04-13 2021-10-21 Telefonaktiebolaget Lm Ericsson (Publ) Authentication server function (ausf) push of authentication and key management (akma) material
CN113453213A (zh) * 2021-06-02 2021-09-28 中国联合网络通信集团有限公司 一种鉴权数据同步方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ERICSSON: "UDM within 5GC", 3GPP DRAFT; S2-170897, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. Dubrovnik, Croatia; 20170213 - 20170217, 13 February 2017 (2017-02-13), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051217018 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116367204A (zh) * 2023-05-31 2023-06-30 阿里巴巴（中国）有限公司 用户设备业务处理方法、电子设备、存储介质及系统
CN116367204B (zh) * 2023-05-31 2023-09-12 阿里巴巴（中国）有限公司 用户设备业务处理方法、电子设备、存储介质及系统

Also Published As

Publication number Publication date
CN116074821A (zh) 2023-05-05

Similar Documents

Publication Publication Date Title
WO2020029729A1 (zh) 一种通信方法和装置
US10798082B2 (en) Network authentication triggering method and related device
CN111328112B (zh) 一种安全上下文隔离的方法、装置及系统
US10142840B2 (en) Method and apparatus for operating a user client wireless communication device on a wireless wide area network
US11871223B2 (en) Authentication method and apparatus and device
KR102568230B1 (ko) 보안 컨텍스트를 취득하기 위한 방법 및 장치와 통신 시스템
US20230048066A1 (en) Slice authentication method and apparatus
US20220225095A1 (en) External Authentication Method, Communication Apparatus, and Communication System
US20220210859A1 (en) Data transmission method and apparatus
US20230362199A1 (en) Mechanism for dynamic authorization
US20230096402A1 (en) Service obtaining method and apparatus, and communication device and readable storage medium
US10142834B2 (en) Method and apparatus for operating a user client wireless communication device on a wireless wide area network
US20220174497A1 (en) Communication Method And Apparatus
US20220086145A1 (en) Secondary Authentication Method And Apparatus
WO2023071836A1 (zh) 一种通信方法及装置
WO2021212497A1 (zh) 安全认证方法、装置、设备及存储介质
WO2022237561A1 (zh) 一种通信方法及装置
WO2020220862A1 (zh) 一种通信方法及装置
US20230102604A1 (en) Slice service verification method and apparatus
CN114600487B (zh) 身份认证方法及通信装置
WO2024041467A1 (zh) 系统信息传输方法、装置、终端、网络侧设备及介质
EP4274310A1 (en) Network intercommunication method and apparatus
WO2023131044A1 (zh) 认证与安全方法、装置及存储介质
WO2023141945A1 (en) Authentication mechanism for access to an edge data network based on tls-psk
WO2023179595A1 (zh) 非3gpp设备的会话通道建立方法、装置及设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22885714

Country of ref document: EP

Kind code of ref document: A1