WO2023072271A1 - Procédé et appareil de gestion d'un contexte de sécurité - Google Patents

Procédé et appareil de gestion d'un contexte de sécurité Download PDF

Info

Publication number
WO2023072271A1
WO2023072271A1 PCT/CN2022/128421 CN2022128421W WO2023072271A1 WO 2023072271 A1 WO2023072271 A1 WO 2023072271A1 CN 2022128421 W CN2022128421 W CN 2022128421W WO 2023072271 A1 WO2023072271 A1 WO 2023072271A1
Authority
WO
WIPO (PCT)
Prior art keywords
security context
network element
context
mobility management
management network
Prior art date
Application number
PCT/CN2022/128421
Other languages
English (en)
Chinese (zh)
Inventor
杨林平
胡文
强鹂
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023072271A1 publication Critical patent/WO2023072271A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security

Definitions

  • the present application relates to the field of communication technologies, and in particular to a method and device for managing a security context.
  • the access and mobility management function is mainly used for UE registration, connection, mobility management, subscription information authentication, etc.
  • the user equipment UE moves from the area of one AMF (marked as the source AMF) to the area of another AMF (marked as the target AMF) (this refers to the location change of the UE in the idle state)
  • the UE needs to register through the network registration process onto the target AMF.
  • the network registration process of the UE fails due to some reasons at this time, it may cause inconsistency between the security contexts of the UE and the source AMF on the network side.
  • the registration request of the UE cannot pass the integrity protection check of the NAS, so that the session information of the session established by the UE through the source AMF cannot be migrated to the target AMF, which may cause the previously established PDU session to be deleted. freed.
  • the present application provides a method and device for managing a complete context, which can avoid the problem of inconsistency between the security context of the UE and the network side.
  • a method for managing a security context comprising: a terminal device sends a registration request message to a target mobility management network element, where the registration request message includes an identifier of the terminal device; the terminal device receives a message from the target mobile
  • the NAS security mode command message of the management network element, the NAS security mode command message includes horizontal derivation indication information; according to the horizontal derivation indication information, the terminal device generates a new key Kamf according to the first security context Key Kamf'; wherein, the first security context is the current security context of the terminal device; if the registration process is not successfully completed, the terminal device uses the first security context as the current security context.
  • the terminal device in the registration process of the terminal device, if the terminal device performs horizontal key derivation, that is, uses the key Kamf in the first security context to perform horizontal deduction to obtain a new key Kamf', if the registration process is not successful After completion (or failure of the registration process), the terminal device uses the first security context as the current security context, thereby avoiding the problem of inconsistent security contexts between the terminal device and the network side. Therefore, in this case, when the registration process is not successfully completed, the terminal device can use the first security context to initiate the registration process again.
  • the method further includes: after the terminal device generates the new key Kamf', maintaining the first security context and the second security context; wherein, the The second security context includes the Kamf' and a NAS key, and the NAS key is generated according to the Kamf'.
  • the terminal device after the terminal device performs horizontal key derivation, it can maintain the first security context and the second security context at the same time. In this case, regardless of whether the registration is successful or the registration fails, the terminal can select an appropriate security context. In order to avoid inconsistency between the security context on the terminal side and the security context on the network side.
  • maintaining the first security context and the second security context includes: the terminal device continues to use the first security context as the current security context, and saves the second security context. Two security contexts.
  • the terminal device can maintain the first security context as the current security context and save the second security context.
  • the terminal can choose Appropriate security context. For example, if the registration is successful, the terminal device can set the second security context as the current security context; if the registration fails, the terminal device can delete the second security context, and use the first security context for subsequent possible registration processes, so as to avoid terminal side
  • the security context of the network side is inconsistent with the security context of the network side.
  • the terminal device uses the first security context as the current security context, including: the terminal device continues to use the first security context A security context is used as the current security context, and the second security context is deleted.
  • the terminal device performs horizontal key derivation, when the terminal device maintains the first security context as the current security context and saves the second security context, in this case, if the registration fails, the terminal device can continue to use
  • the first security context is used as the current security context, so when the UE fails to register, it is also possible to avoid inconsistency between the security contexts on the terminal side and the network side.
  • maintaining the first security context and the second security context includes: the terminal device saves the first security context, and uses the second security context as the current security context.
  • the terminal device can save the first security context and set the second security context as the current security context.
  • the terminal can choose Appropriate security context. For example, if the registration is successful, the terminal device can maintain the second security context as the current security context and delete the first security context; if the registration fails, the terminal device can set the first security context as the current security context, so that the first security context can be used Performing subsequent possible registration processes can avoid inconsistency between the security context on the terminal side and the security context on the network side.
  • the terminal device uses the first security context as the current security context, including: the terminal device uses the first The security context is set as the current security context, and the second security context is deleted.
  • the terminal device after the terminal device performs horizontal key derivation, when the terminal device sets the second security context as the current security context and saves the first security context, in this case, if the registration fails, the terminal device can save the The first security context of the UE is set as the current security context, so when the UE fails to register, it is also possible to avoid inconsistency between the security contexts on the terminal side and the network side.
  • the method further includes: the terminal device determines that the registration process is not successfully completed.
  • the terminal device can determine or judge whether the registration process fails. If the registration process is not successfully completed (or the registration process fails), the terminal device will set or maintain the first security context as the current security context, so that the first security context can be used.
  • the security context is used to carry out subsequent possible registration processes, so as to avoid the failure of the registration process caused by the inconsistency of the security contexts on the terminal side or the network side in the subsequent registration process.
  • the terminal device determining that the registration process has not been successfully completed includes: the terminal device determines that the NAS security mode completion message fails to be sent before receiving the registration acceptance message; or , the terminal device determines that the link between itself and the access network device is released before receiving the registration acceptance message; the terminal device determines that the RRC connection between itself and the access network device is suspended before receiving the registration acceptance message rise or release.
  • the terminal device before receiving the registration acceptance message, the terminal device can determine whether the registration process is complete according to whether the NAS security mode completion message is successfully sent, or whether the link is released abnormally, or whether the RRC connection is suspended or released, etc. fail. If the registration process is not successfully completed, the terminal device will set or maintain the first security context as the current security context, so that the first security context can be used for subsequent possible registration processes, and the subsequent registration process can be avoided due to the failure of the terminal side or the network side. Cases where the registration process fails due to inconsistent security contexts.
  • a method for managing a security context comprising: a source mobility management network element receives a context request message from a target mobility management network element, and the context request message is used to request to obtain a context of a terminal device; In the case of horizontal key derivation, the source mobility management network element generates a new key Kamf' according to the key Kamf in the first security context; where the first security context is the source mobility management network element and the The current security context between terminal devices; in response to the context request message, the source mobility management network element sends a second security context to the target mobility management network element; wherein the second security context includes the new key Kamf' and a NAS key, where the NAS key is generated according to the Kamf'; the source mobility management network element maintains the first security context and/or the second security context.
  • the source mobility management network element after the source mobility management network element performs horizontal key derivation, it can maintain the first security context and/or the second security context.
  • the first security context may be maintained as the current security context, and the second security context may be deleted.
  • the source mobility management network element always uses the first security context, which can avoid context inconsistency between the network side and the terminal side.
  • the source mobility management network element can use the first security context to perform security verification on subsequent possible registration requests of the terminal device, and this solution can prevent registration failures caused by inconsistencies between the security context on the network side and the terminal side.
  • the second security context is also possible to set the second security context as the current security context and delete the first security context.
  • the source mobility management network element After the source mobility management network element generates the second security context, it sets the second security context as the current security context.
  • the terminal device generates the second security context and then sets the second security context as the current security context, problems caused by inconsistencies between the security contexts of the terminal device and the network side can be avoided.
  • first security context As the current security context and save the second security context; or set the second security context as the current security context and save the first security context.
  • the terminal device uses the first security context or the second security context as the current security context after horizontal deduction, it can ensure that the source mobility management network element side holds the corresponding security context, thereby avoiding network The problem that the security protection verification of the registration request of the terminal device cannot be successfully verified on the side.
  • the method further includes: the source mobility management network The element receives a context request message from another target mobility management network element, the context request message is used to request the context of the terminal device, the context request message includes a security-protected registration request message, and the registration request message includes the terminal device's identification; the source mobility management network element uses the first security context and the second security context to perform security verification on the registration request message; If the message security verification is successful and horizontal key derivation is required, the source mobility management network element generates a new key Kamf" based on the key in the security context of the successful verification, and sends it to the target mobility management network element A third security context, the third security context includes the new key Kamf".
  • the source mobility management network element when the source mobility management network element maintains the first security context and the second security context, if the source mobility management network element receives a context request message from another target mobility management network element, the source mobility management network element The unit can respectively use the first security context and the second security context to perform security verification on the registration request message carried in the context request message, so as to avoid the problem of verification failure caused by inconsistent security contexts on the terminal side and the network side.
  • the method further includes: the source mobility management network The element receives a context request message from another target mobility management network element, the context request message is used to request the context of the terminal device, the context request message includes a security-protected registration request message, and the registration request message includes the terminal device's identification; the source mobility management network element uses the first security context and the second security context to perform security verification on the registration request message; If the message security verification is successful and no horizontal key derivation is required, the source mobility management network element sends the security context of successful verification to the target mobility management network element.
  • the source mobility management network element when the source mobility management network element maintains the first security context and the second security context, if the source mobility management network element receives a context request message from another target mobility management network element, the source mobility management network element The unit can respectively use the first security context and the second security context to perform security verification on the registration request message carried in the context request message, so as to avoid the problem of verification failure caused by inconsistent security contexts on the terminal side and the network side.
  • the method further includes: the source mobility management network element receiving registration success indication information from the target mobility management network element, where the registration success indication information is used to indicate that the The terminal device is successfully registered to the network; the source mobility management network element deletes the first security context and/or the second security context.
  • the source mobility management network element can delete the security context it maintains after receiving the registration success indication information, so as to save resources.
  • the method further includes: the source mobility management network element receives a de-registration notification message, and the de-registration notification message is used to instruct the source mobility management network element to execute the terminal De-registration of the device: the source mobility management network element deletes the first security context and/or the second security context.
  • the source mobility management network element after receiving the de-registration notification message, the source mobility management network element can delete the security context it maintains, thereby saving resources.
  • the method further includes: after a preset time, the source mobility management network element deletes the first security context and/or the second security context.
  • the source mobility management network element can delete the security context it maintains after the preset time elapses, thereby saving resources.
  • the method further includes: the source mobility management network element deleting the second security context.
  • the source mobility management network element when the source mobility management network element maintains the first security context as the current security context, the second security context can be deleted, thereby saving resources.
  • a method for managing a security context comprising: a target mobility management network element receiving a registration request message from a terminal device, where the registration request message includes an identity of the terminal device; the target mobility management network element Sending a context request message to the source mobility management network element, where the context request message is used to request to obtain the context of the terminal device; the target mobility management network element receives a context response message from the target mobility management network element, and the context response message includes security Context and horizontal derivation indication information; the target mobility management network element sends a non-access stratum NAS security mode command message to the terminal device, the NAS security mode command message includes the horizontal derivation indication information, and the horizontal derivation indication information is used to indicate the The terminal device performs horizontal key derivation; the target mobility management network element receives the security-protected NAS security mode completion message from the terminal device; the target mobility management network element uses the security context to secure the NAS security mode completion message Verifying: if the verification is successful, the target mobility
  • the target mobility management network element after the target mobility management network element successfully verifies the NAS security mode message from the terminal device, only the source mobility management network element can delete the context of the terminal device, thereby saving resources and reducing the possibility of key leakage , improve security.
  • an apparatus for managing a security context includes: a transceiver module configured to send a registration request message to a target mobility management network element, where the registration request message includes an identity of the terminal device; the transceiver module further For receiving a non-access stratum NAS security mode command message from the target mobility management network element, the NAS security mode command message includes horizontal derivation indication information; the processing module is used for, according to the key Kamf in the first security context, Generate a new key Kamf'; wherein, the first security context is the current security context of the terminal device; the processing module is also used to use the first security context as the current security context if the registration process is not successfully completed. context.
  • the processing module is further configured to: after generating the new key Kamf', maintain the first security context and the second security context; wherein, the second The security context includes the Kamf' and a NAS key, and the NAS key is generated according to the Kamf'.
  • the processing module is specifically configured to: continue to use the first security context as the current security context, and save the second security context.
  • the processing module is specifically configured to: continue to use the first security context as the current security context, and delete the second security context.
  • the processing module is specifically configured to: the terminal device saves the first security context, and uses the second security context as a current security context.
  • the processing module is specifically configured to: the terminal device sets the first security context as the current security context, and deletes the second security context.
  • the processing module is further configured to: the terminal device determines that the registration process has not been successfully completed.
  • the processing module is specifically configured to: before the transceiver module receives the registration acceptance message, determine that the NAS security mode completion message fails to be sent; or, before the transceiver module receives the registration acceptance message; Before accepting the message, it is determined that the link between itself and the access network device is released; before the transceiver module receives the registration acceptance message, it is determined that the RRC connection between itself and the access network device is suspended or released.
  • an apparatus for managing security context includes: a transceiver module, configured to receive a context request message from a target mobility management network element, where the context request message is used to request to obtain a context of a terminal device; a processing module , used to generate a new key Kamf' according to the key Kamf in the first security context when horizontal key derivation is required; where the first security context is the source mobility management network element and the device The current security context between; the transceiver module is also used to send a second security context to the target mobility management network element; wherein, the second security context includes the new key Kamf' and the NAS key, the NAS key Generated according to the Kamf'; the processing module is also used to maintain the first security context and/or the second security context.
  • the transceiving module is further configured to: receive a context request message from another target mobility management network element, where the context request message is used to request the context of the terminal device, the The context request message includes a security-protected registration request message, the registration request message includes the identity of the terminal device; a processing module, configured to use the first security context and the second security context to perform security verification on the registration request message ; In the case that the security verification of the registration request message is successful using any one of the first security context and the second security context, and horizontal key derivation is required, the processing module is also used to The key in is used to generate a new key Kamf", and the transceiver module is also used to send a third security context to the target mobility management network element, where the third security context includes the new key Kamf".
  • the transceiving module is further configured to: receive a context request message from another target mobility management network element, where the context request message is used to request the context of the terminal device, the The context request message includes a security-protected registration request message, the registration request message includes the identity of the terminal device; the processing module is also used to use the first security context and the second security context to secure the registration request message Verification; when the security verification of the registration request message is successful using any one of the first security context and the second security context, and horizontal key derivation is not required, the transceiver module is also used to move to the target The management network element sends the security context of successful authentication.
  • the transceiver module is further configured to: receive registration success indication information from the target mobility management network element, where the registration success indication information is used to indicate that the terminal device has successfully registered to the network; the processing module is further configured to: delete the first security context and/or the second security context.
  • the transceiver module is further configured to: receive a de-registration notification message, where the de-registration notification message is used to instruct the source mobility management network element to perform de-registration of the terminal device ;
  • the processing module is also used to: delete the first security context and/or the second security context.
  • the processing module is further configured to: delete the first security context and/or the second security context after a preset time.
  • the processing module when the processing module maintains the first security context, the processing module is further configured to: delete the second security context.
  • an apparatus for managing a security context which includes: a transceiver module, configured to receive a registration request message from a terminal device, where the registration request message includes the identity of the terminal device; The source mobility management network element sends a context request message, where the context request message is used to request to acquire the context of the terminal device; the transceiver module is also used to receive a context response message from the target mobility management network element, where the context response message includes a security context and horizontal derivation indication information; the transceiver module is also used to send a non-access stratum NAS security mode command message to the terminal device, the NAS security mode command message includes the horizontal derivation indication information, and the horizontal derivation indication information is used to instruct the terminal The device performs horizontal key derivation; the transceiver module is also used to receive a security-protected NAS security mode completion message from the terminal device; the processing module is also used to use the security context to perform security verification on the NAS security mode completion message ; If the verification
  • a communication device is provided, and the device is configured to execute the methods provided in the first aspect to the fifth aspect.
  • the apparatus may include a unit and/or module for executing the methods provided in the first aspect to the third aspect, such as a processing unit and/or a communication unit.
  • the apparatus is a network device, for example, the apparatus is a source mobility management network element or a target mobility management network element.
  • the communication unit may be a transceiver, or an input/output interface; the processing unit may be a processor.
  • the apparatus is a chip, a chip system or a circuit used in a network device.
  • the communication unit may be an input/output interface, interface circuit, output circuit, input circuit, pin or related circuit on the chip, chip system or circuit etc.
  • the processing unit may be a processor, a processing circuit or a logic circuit and the like.
  • the device is the source mobility management network element or a chip, chip system or circuit in the source mobility management network element.
  • the device may include units and/or modules for performing the method provided by the second aspect, such as a processing unit and/or a communication unit.
  • the device is a chip, a chip system or a circuit in the target mobility management network element.
  • the apparatus may include units and/or modules for executing the method provided by the third aspect, such as a processing unit and/or a communication unit.
  • the apparatus is a terminal device.
  • the communication unit may be a transceiver, or an input/output interface;
  • the processing unit may be a processor.
  • the device is the terminal device (10) or a chip, a chip system or a circuit in the terminal device (10).
  • the apparatus may include units and/or modules for performing the method provided in any one of the first aspects, such as a processing unit and/or a communication unit.
  • the above-mentioned transceiver may be a transceiver circuit.
  • the above input/output interface may be an input/output circuit.
  • a communication device which includes: a memory for storing a program; a processor for executing the program stored in the memory, and when the program stored in the memory is executed, the processor is used for executing the above-mentioned first aspect to The method provided by the third aspect.
  • the present application provides a processor configured to execute the methods provided in the foregoing aspects.
  • the process of sending the above information and obtaining/receiving the above information in the above method can be understood as the process of outputting the above information by the processor and the process of receiving the input of the above information by the processor.
  • the processor When outputting the above information, the processor outputs the above information to the transceiver for transmission by the transceiver. After the above information is output by the processor, other processing may be required before reaching the transceiver.
  • the transceiver acquires/receives the above-mentioned information and inputs it into the processor. Furthermore, after the transceiver receives the above information, the above information may need to be processed before being input to the processor.
  • the receiving request message mentioned in the foregoing method may be understood as the processor receiving input information.
  • processor For the operations of transmitting, sending, and acquiring/receiving involved in the processor, if there is no special description, or if it does not conflict with its actual function or internal logic in the relevant description, it can be understood more generally as the processor Output and receive, input and other operations, rather than the transmission, transmission and reception operations performed directly by radio frequency circuits and antennas.
  • the above-mentioned processor may be a processor dedicated to performing these methods, or may be a processor that executes computer instructions in a memory to perform these methods, such as a general-purpose processor.
  • the above-mentioned memory can be a non-transitory (non-transitory) memory, such as a read-only memory (read only memory, ROM), which can be integrated with the processor on the same chip, or can be respectively arranged on different chips.
  • ROM read-only memory
  • a computer-readable storage medium stores program code for execution by a device, and the program code includes a method for executing the methods provided in the first aspect to the third aspect above.
  • a computer program product containing instructions is provided, and when the computer program product is run on a computer, the computer is made to execute the methods provided in the first aspect to the third aspect above.
  • a twelfth aspect provides a chip, the chip includes a processor and a communication interface, the processor reads instructions stored in the memory through the communication interface, and executes the methods provided in the first aspect to the third aspect above.
  • the chip may further include a memory, the memory stores instructions, the processor is used to execute the instructions stored in the memory, and when the instructions are executed, the processor is used to execute the above-mentioned first The method provided by the first aspect to the third aspect.
  • Fig. 1 is a schematic diagram of a network structure applicable to the embodiment of the present application.
  • Fig. 2 is a schematic flowchart of a method for registering a terminal device.
  • Fig. 3 is an exemplary flow chart of a method for managing a security context provided by an embodiment of the present application.
  • Fig. 4 is an exemplary flowchart of another method for managing a security context provided by an embodiment of the present application.
  • Fig. 5 is an exemplary flow chart of another method for managing a security context provided by an embodiment of the present application.
  • Fig. 6 is an exemplary flow chart of another method for managing a security context provided by an embodiment of the present application.
  • Fig. 7 is a schematic block diagram of an apparatus for managing a security context provided by an embodiment of the present application.
  • Fig. 8 is a schematic block diagram of an apparatus for managing a security context provided by another embodiment of the present application.
  • Fig. 9 is a schematic block diagram of an apparatus for managing a security context provided by another embodiment of the present application.
  • Fig. 10 is a schematic block diagram of an apparatus for managing a security context provided by another embodiment of the present application.
  • the present application provides a communication system, which includes a target mobility management network element 10 and a source mobility management network element 20 .
  • the target mobility management network element 10 is configured to send a context request message to the source mobility management network element after receiving the registration request message from the terminal device; receive a context response message from the target mobility management network element, and the context response
  • the message includes the context information of the terminal device, and the context information of the terminal device includes security context and horizontal game indication information.
  • the context information may also include other information, which is not limited in this application, and may refer to existing protocols for details; further, the target mobility management network element 10 sends a non-access stratum NAS security mode command message to the terminal device, and the The NAS security mode command message includes the horizontal derivation instruction information, and the horizontal derivation instruction information is used to instruct the terminal device to perform horizontal key derivation; after receiving the NAS security mode completion message from the terminal device, use the security context to secure the NAS mode completion message for security verification; after the verification is successful, if the registration process of the terminal device is successfully completed, the target mobility management network element sends instruction information to the source mobility management network element, and the instruction information is used to instruct the source mobility management network element to delete The context of this end device.
  • the source mobility management network element 20 is used to request to obtain the context of the terminal device after receiving the context request message from the target mobility management network element; if horizontal key derivation is required, according to the first
  • the key Kamf in the security context generates a new key Kamf'; wherein, the first security context is the current security context between the source mobility management network element and the terminal device; in response to the context request message, send the The target mobility management network element sends a second security context; wherein, the second security context includes the new key Kamf' and a NAS key, and the NAS key is generated according to the Kamf'; maintaining the first security context and/or The second security context.
  • the communication system may further include one or more terminal devices, such as the terminal device 30 .
  • the terminal device 30 is configured to: send a registration request message to the target mobility management network element, where the registration request message includes the identifier of the terminal device; receive a non-access stratum NAS security mode command message from the target mobility management network element, and the NAS
  • the security mode command message includes horizontal derivation instruction information; according to the horizontal derivation instruction information, a new key Kamf' and a new NAS key are generated according to the key Kamf in the first security context; wherein, the first security context is The current security context of the terminal device; if the registration process is not successfully completed, use the first security context as the current security context.
  • both the target mobility management network element 10 and the source mobility management network element 20 are network elements for implementing mobility management and access management functions, wherein the target mobility management network element 10 may be a terminal device 30 requesting registration
  • the source mobility management network element 20 may be the mobility management network element that provides services for the terminal device 30 before the terminal device 30 requests to register with the target mobility management network element 10 .
  • the terminal device 30 Before the terminal device 30 requests to register with the target mobility management network element, the terminal device 30 has already registered with the source mobility management network element through a registration process.
  • the above network element names are only used to distinguish different network elements. In different scenarios or examples, they may also have other names. In other words, network elements that implement the same function should be within the scope of protection of this application.
  • the technical solution provided by this application can be applied to various communication systems, such as: the fifth generation (5th generation, 5G) or new radio (new radio, NR) system, long term evolution (long term evolution, LTE) system, LTE frequency division Duplex (frequency division duplex, FDD) system, LTE time division duplex (time division duplex, TDD) system, etc.
  • 5G fifth generation
  • NR new radio
  • long term evolution long term evolution
  • LTE long term evolution
  • LTE frequency division Duplex frequency division duplex
  • FDD frequency division duplex
  • TDD time division duplex
  • the technical solution provided by this application can also be applied to device to device (device to device, D2D) communication, vehicle to everything (vehicle-to-everything, V2X) communication, machine to machine (machine to machine, M2M) communication, machine type Communication (machine type communication, MTC), and Internet of things (internet of things, IoT) communication system or other communication systems.
  • D2D device to device
  • V2X vehicle-to-everything
  • M2M machine to machine
  • M2M machine type Communication
  • MTC machine type communication
  • IoT Internet of things
  • FIG. 1 it is a schematic diagram of a fifth generation (5th generation, 5G) network architecture based on a service architecture.
  • the 5G network architecture shown in (b) of FIG. 1 may include three parts, namely a terminal device part, a data network (data network, DN) and an operator network part.
  • a terminal device part namely a terminal device part, a data network (data network, DN) and an operator network part.
  • DN data network
  • operator network part namely a data network (data network, DN) and a operator network part.
  • the operator network may include one or more of the following network elements: authentication server function (authentication server function, AUSF) network element, network exposure function (network exposure function, NEF) network element, policy control function (policy control function, PCF) network element, unified data management (unified data management, UDM) network element, unified database (unified data repository, UDR), network storage function (network repository function, NRF) network element, application function (application function, AF) ) network elements, access and mobility management function (access and mobility management function, AMF) network elements, session management function (session management function, SMF) network elements, radio access network (radioaccess network, RAN) and user plane functions (user plane function, UPF) network element, etc.
  • authentication server function authentication server function, AUSF
  • NEF network exposure function
  • policy control function policy control function
  • PCF policy control function
  • unified data management unified data management
  • UDM unified database
  • NRF network repository function
  • application function application function, AF
  • AMF access and mobility management function
  • Terminal device it can also be called user equipment (UE), which is a device with wireless transceiver function, which can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed in On the water (such as ships, etc.); can also be deployed in the air (such as aircraft, balloons and satellites, etc.).
  • the terminal device may be a mobile phone, a tablet computer (pad), a computer with a wireless transceiver function, a virtual reality (virtual reality, VR) terminal, an augmented reality (augmented reality, AR) terminal, an industrial control (industrial control ), wireless terminals in self driving, wireless terminals in remote medical, wireless terminals in smart grid, wireless terminals in transportation safety , wireless terminals in smart cities, wireless terminals in smart homes, etc.
  • the terminal device here refers to a 3rd generation partnership project (3rd generation partnership project, 3GPP) terminal.
  • 3rd generation partnership project 3rd generation partnership project
  • the above-mentioned terminal device can establish a connection with the operator network through an interface provided by the operator network (such as N1, etc.), and use services such as data and/or voice provided by the operator network.
  • the terminal device can also access the DN through the operator's network, and use the operator's service deployed on the DN, and/or the service provided by a third party.
  • the above-mentioned third party may be a service party other than the operator's network and the terminal device, and may provide other services such as data and/or voice for the terminal device.
  • the specific form of expression of the above-mentioned third party can be determined according to the actual application scenario, and is not limited here.
  • Wireless access network radio access network, RAN
  • RAN radio access network
  • the RAN is a sub-network of the operator's network and an implementation system between service nodes and terminal equipment in the operator's network.
  • the terminal equipment To access the operator's network, the terminal equipment first passes through the RAN, and then can be connected to the service node of the operator's network through the RAN.
  • the RAN device in this application is a device that provides a wireless communication function for a terminal device, and the RAN device is also called an access network device.
  • the RAN equipment in this application includes but is not limited to: next-generation base station (g nodeB, gNB) in 5G, evolved node B (evolved node B, eNB), radio network controller (radio network controller, RNC), node B (node B, NB), base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or home node B, HNB), baseband unit (baseBand unit, BBU), transmission point (transmitting and receiving point, TRP), transmission point (transmitting point, TP), mobile switching center, etc.
  • next-generation base station g nodeB, gNB
  • 5G evolved node B (evolved node B, eNB), radio network controller (radio network controller, RNC), node B (node B, NB), base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS
  • User plane function used for packet routing and forwarding and quality of service (QoS) processing of user plane data.
  • QoS quality of service
  • the user plane network element may be a user plane function (user plane function, UPF) network element.
  • UPF user plane function
  • the user plane network element may still be a UPF network element, or may have other names, which are not limited in this application.
  • the access and mobility management network element is mainly used for mobility management and access management, etc., and can be used to implement other functions in the MME function except session management, for example, functions such as access authorization/authentication.
  • the access and mobility management network element may be an access and mobility management function (access and mobility management function, AMF).
  • AMF access and mobility management function
  • the access and mobility management device may still be an AMF, or may have other names, which are not limited in this application.
  • Session management function session management function, SMF: mainly used for session management, user equipment network interconnection protocol (internet protocol, IP) address allocation and management, selection of manageable user plane functions, policy control and charging function interface endpoints and downlink data notifications, etc.
  • the session management network element may be a session management function network element.
  • the session management network element may still be an SMF network element, or may have other names, which are not limited in this application.
  • PCF Policy control function
  • the policy control network element may be a policy and charging rules function (policy and charging rules function, PCRF) network element.
  • policy control network element may be a policy control function PCF network element.
  • the policy control network element may still be a PCF network element, or may have other names, which are not limited in this application.
  • Application function (Application function, AF): It is used for data routing affected by applications, open function network elements of wireless access networks, and interacts with policy frameworks for policy control, etc.
  • the application network element may be an application function network element.
  • the application network element may still be an AF network element, or may have other names, which are not limited in this application.
  • Unified data management used to process UE identification, access authentication, registration and mobility management.
  • the data management network element may be a unified data management network element; in a 4G communication system, the data management network element may be a home subscriber server (HSS) network element.
  • HSS home subscriber server
  • the unified data management may still be a UDM network element, or may have other names, which are not limited in this application.
  • AUSF Authentication server function
  • the authentication server may be an authentication server functional network element.
  • the authentication server functional network element may still be an AUSF network element, or may have other names, which are not limited in this application.
  • DN is a network located outside the operator's network.
  • the operator's network can access multiple DNs, and multiple services can be deployed on the DN, which can provide data and/or voice for terminal equipment. and other services.
  • DN is a private network of a smart factory.
  • the sensors installed in the workshop of the smart factory can be terminal devices.
  • the control server of the sensor is deployed in the DN, and the control server can provide services for the sensor.
  • the sensor can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions.
  • DN is a company's internal office network, and the mobile phone or computer of the company's employees can be a terminal device, and the employee's mobile phone or computer can access information and data resources on the company's internal office network.
  • Nausf, Nnef, Npcf, Nudm, Naf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface serial numbers.
  • interface serial numbers refer to the meanings defined in the 3GPP standard protocol, and there is no limitation here.
  • various network elements can communicate through the interfaces shown in the figure.
  • the UE and the AMF can interact through the N1 interface, and the interaction message can be called an N1 message (N1 Message), for example.
  • the RAN and the AMF can interact through the N2 interface, and the N2 interface can be used for sending non-access stratum (non-access stratum, NAS) messages, etc.
  • the RAN and UPF can interact through the N3 interface, and the N3 interface can be used to transmit user plane data, etc.
  • the SMF and UPF can interact through the N4 interface, and the N4 interface can be used to transmit information such as the tunnel identification information of the N3 connection, data cache indication information, and downlink data notification messages.
  • the UPF and DN can interact through the N6 interface, and the N6 interface can be used to transmit data on the user plane.
  • the relationship between other interfaces and each network element is shown in FIG. 1 , and for the sake of brevity, details are not described here one by one.
  • the above-mentioned network architecture applied to the embodiment of the present application is only an example network architecture described from the perspective of a service-oriented architecture, and the network architecture applicable to the embodiment of the present application is not limited thereto. Any network element that can implement the above-mentioned All functional network architectures are applicable to this embodiment of the application.
  • Functional network elements can be combined into network slices on demand.
  • These core network elements may be independent devices, or may be integrated into the same device to implement different functions. This application does not limit the specific forms of the above network elements.
  • the above-mentioned network element or function may be a network element in a hardware device, or a software function running on dedicated hardware, or a virtualization function instantiated on a platform (for example, a cloud platform).
  • the network device is the access and mobility management network element AMF
  • the base station is the radio access network RAN as an example for description.
  • the network architecture and business scenarios described in the embodiments of the present application are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute limitations on the technical solutions provided by the embodiments of the present application.
  • the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.
  • Computer-readable media may include, but are not limited to: magnetic storage devices (e.g., hard disk, floppy disk, or tape, etc.), optical disks (e.g., compact disc (compact disc, CD), digital versatile disc (digital versatile disc, DVD) etc.), smart cards and flash memory devices (for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.).
  • magnetic storage devices e.g., hard disk, floppy disk, or tape, etc.
  • optical disks e.g., compact disc (compact disc, CD), digital versatile disc (digital versatile disc, DVD) etc.
  • smart cards and flash memory devices for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.
  • various storage media described herein can represent one or more devices and/or other machine-readable media for storing information.
  • the term "machine-readable medium” may include, but is not limited to, wireless channels and various other media capable of storing, containing and/or carrying instructions and/or data.
  • NAS security context information that can be used to implement data encryption/decryption and/or integrity protection/verification at the NAS layer.
  • the NAS security context corresponding to the UE includes: key identifier (eg ngKSI), Kamf, security capability of the UE, uplink NAS COUNT and downlink NAS COUNT.
  • key identifier eg ngKSI
  • Kamf security capability of the UE
  • uplink NAS COUNT uplink NAS COUNT
  • downlink NAS COUNT e.g. ngKSI
  • the integrity protection key and the selected integrity protection algorithm, the encryption key and the selected encryption algorithm are also included.
  • the encryption key and the selected encryption algorithm are used to encrypt and protect the NAS message transmitted between the UE and the AMF
  • the integrity key and the selected integrity protection algorithm are used to protect the NAS message transmitted between the UE and the AMF Integrity protection.
  • the UE's security capability is used to characterize the encryption algorithm and integrity protection algorithm supported by the UE.
  • the source AMF decides to perform horizontal Kamf deduction according to the local policy, the source AMF can perform horizontal Kamf according to the key Kamf in the current NAS security context and the uplink NAS count value in the received registration request message. Deduce the new key Kamf'.
  • the source AMF may then send the new key Kamf', the new ngKSI, the UE security capabilities and the level derivation indication (keyAmfHDerivationInd) to the target AMF.
  • keyAmfHDerivationInd level derivation indication
  • the new ngKSI here is the same as the previous (ie pre-derivation) ngKSI.
  • the target AMF can send a K_AMF_change_flag with a value of 1 to the UE through a NASSMC message, where the K_AMF_change_flag with a value of 1 is used to instruct the UE to perform horizontal key derivation.
  • the NASSMC message here also includes UE security capability, selected NAS algorithm and ngKSI. If the UE receives K_AMF_change_flag with a value of 1, the UE performs horizontal Kamf derivation to obtain a new key Kamf'.
  • Current NAS security context (currentNAS security context): the NAS security context in use or active state.
  • Non-current NAS security context A NAS security context that is not currently in use or is in an inactive state.
  • a method 200 for managing a security context is introduced below with reference to FIG. 2 .
  • the method 200 includes:
  • the UE sends a registration request message to a target AMF.
  • the UE triggers a Registration Request message to the network. For example, the UE moves to a new AMF area (denoted as the target AMF), and the registration request message of the UE is delivered to the target AMF.
  • the UE sends a registration request (registration request, RR) message to a target AMF (target AMF), and the RR message carries an identifier of the UE, such as a 5G globally unique temporary user equipment identity (5G generation globally unique temporary user equipment identity, 5G-GUTI).
  • 5G globally unique temporary user equipment identity 5G generation globally unique temporary user equipment identity, 5G-GUTI
  • the UE has protected the integrity of the RR message through the current NAS security context
  • the current NAS security context is the NAS security context used by the UE to protect the NAS message transmitted between the UE and the source AMF before the registration process
  • the current NAS security context is the NAS security context used by the source AMF before performing horizontal K AMF deduction in 203 .
  • the target AMF sends a UE context transfer request message to the source AMF.
  • the target AMF receives the registration request message from the UE, and according to the GUTI carried in the message, determines the AMF that served the UE last time (referred to as the source AMF). Then the target AMF calls the UE context transfer service (Namf_Communication_UEContextTransfer) operation provided by the source AMF to request the context information of the UE.
  • the Namf_Communication_UEContextTransfer includes the identity of the UE (such as 5G-GUTI), and the Namf_Communication_UEContextTransfer also includes the complete RR message received by the target AMF, that is, the target AMF sends the RR message received in 201 in the Namf_Communication_UEContextTransfer.
  • the source AMF performs horizontal deduction according to the local policy to generate a new NAS security context.
  • the source AMF acquires UE data (including the current NAS security context corresponding to the UE) in the database according to the UE identifier, and the source AMF uses the current NAS security context to verify the received integrity of the RR message. If the integrity verification of the RR message passes, the source AMF decides whether to deduce a new NAS security context according to the local policy. If the source AMF decides to deduce a new NAS security context, the source AMF performs horizontal K AMF deduction to obtain a new NAS security context. Specifically, the source AMF uses the currently activated Kamf and the uplink NAScount carried in the registration request message to perform horizontal deduction to obtain a new key Kamf'.
  • the new key Kamf' is included in the security context of the new NAS.
  • the new NAS security context here is relative to the NAS security context before the source AMF performs horizontal deduction. Therefore, at this time, the NAS security context before the source AMF performs horizontal deduction can also be recorded as the old NAS security context.
  • the source AMF then deletes the NAS security context it holds.
  • the source AMF sends a UE context transfer response message to the target AMF.
  • the source AMF finds the data corresponding to the UE in the database, and performs horizontal key derivation according to the local policy, the source AMF sends a UE context transfer response (Namf_Communication_UEContextTransfer Response) message to the target AMF, and the response message carries UE Context, SUPI, horizontal K AMF derivation indication (keyAmfHDerivationInd indication).
  • the UE context includes a security context. If the source AMF has deduced the horizontal K AMF according to the local policy, the security context carried in the response message is the new security context deduced by the source AMF in 203 .
  • the target AMF sends a security mode command message to the UE.
  • the target AMF receives the UE context transfer response message from the source AMF, and if the response message carries the SUPI of the UE, the target AMF saves the NAS security context carried in the UE context transfer response message. If the target AMF activates the security context carried in the response message according to the local policy, that is, the new NAS security context deduced by the source AMF, the target AMF initiates a non access stratum security mode command (NAS SMC ) message to the UE, which is used to establish the NAS security context between the UE and the target AMF.
  • the security mode command message carries a horizontal derivation parameter (horizontal derivation parameter, HDP).
  • the HDP may be K_AMF_change_flag with a value of 1, wherein the K_AMF_change_flag with a value of 1 is used to instruct the UE to perform horizontal K AMF derivation.
  • the NASSMC message also includes selected NAS algorithms, including NAS encryption algorithms and NAS integrity protection algorithms.
  • the target AMF sets the non-access stratum count value (NAScounts) to 0, and derives a new key NASkeys according to the new key Kamf' and the selected NAS algorithm, including the NAS encryption key and the NAS integrity protection key.
  • This new security context is then used to encrypt and integrity-protect the security mode command messages (using derived new NAS keys).
  • the UE performs horizontal deduction to generate a new NAS security context.
  • the UE receives a security mode command message from the target AMF. If the security mode command message carries K_AMF_change_flag with a value of 1, the UE performs KAMF deduction based on the key Kamf in the current security context to generate a new key Kamf', thereby obtaining a new NAS security context.
  • the new NAS security context Including the new key Kamf' and the NAS key, the NAS key is generated according to the algorithm generated and selected by the Kamf'.
  • the NAS key includes a NAS encryption key and a NAS integrity key.
  • the UE uses the NAS key in the new NAS security context (specifically, it can be the NAS integrity key in the NAS key) to perform integrity check on the security mode command message, if the security mode command message If the integrity check passes, the UE sends a security mode completion message to the target AMF.
  • the NAS key in the new NAS security context specifically, it can be the NAS integrity key in the NAS key
  • the UE may fail the registration process due to some internal or external reasons.
  • the UE's security mode completion message fails to be sent, or the UE's link is released before the registration is completed, or due to some other reasons, the UE's registration process may fail.
  • the registration failure caused by the failure to send the security mode completion message of the UE is taken as an example for illustration.
  • the UE sends a security mode completion message to the target AMF, but the security mode completion message fails to be sent, the UE receives an underlying instruction, and determines that the security mode completion message fails to be sent according to the underlying instruction.
  • the UE sends a registration request message to the target AMF.
  • the UE resends the registration request to the target AMF. It should be understood that the UE performs integrity protection on the registration request message.
  • the target AMF sends a UE context transfer request message to the source AMF.
  • the target AMF receives the registration request message from the UE, and according to the GUTI carried in the message, determines the AMF that served the UE last time (referred to as the source AMF). Then the target AMF calls the UE context transfer service (Namf_Communication_UEContextTransfer) operation provided by the source AMF to request the context information of the UE.
  • the Namf_Communication_UEContextTransfer includes the complete RR message received by the target AMF, that is, the target AMF sends the RR message received in 208 in the Namf_Communication_UEContextTransfer.
  • the source AMF after the source AMF receives the UE context request from the target AMF, the source AMF performs integrity verification on the received RR message.
  • the source AMF performs integrity verification on the received RR message.
  • the source AMF continues to maintain and use the old security context as the current security context, and the UE uses the new security context to perform integrity protection on the registration request message in 208, then the source AMF uses the old security context in 209 The security context verification of the integrity of the RR message will fail;
  • the source AMF deletes the old security context and uses the new security context as the current security context, and the UE uses the old security context to perform integrity protection on the registration request message in 208, then If the source AMF uses the new security context to verify the integrity of the RR message in 209, the verification fails.
  • the source AMF sends a UE context transfer response message to the target AMF at 210, where the response message is used to indicate that the temporary identifier 5G-GUTI cannot be obtained.
  • the target AMF performs an identity authentication and authentication process with the UE.
  • the target AMF receives the UE context transfer response message from the source AMF, and determines that the UE identity cannot be identified through the response message, and then the target AMF starts the UE identity authentication and authentication process.
  • the target AMF sends a registration acceptance message to the UE.
  • the target AMF sends a registration acceptance message to the UE.
  • the network since the network re-authenticates and authenticates the UE, all PDU session information previously established by the UE may not be migrated to the target AMF, resulting in the release of the previously activated PDU session.
  • FIG. 3 shows an exemplary flow chart of a method 300 for managing a security context provided by an embodiment of the present application.
  • the method 300 includes: 301, the terminal device 30 sends a registration request message to the target mobility management network element 10 .
  • the terminal device 30 sends a registration request message to the target mobility management network element 10 to request to register with the target mobility management network element 10 , and the registration request message includes the identifier of the terminal device 30 .
  • the identifier of the terminal device 30 is, for example, the GUTI of the terminal device 30 .
  • the terminal device 30 uses the first security context to perform security protection on the registration request message, for example, the terminal device 30 uses the first security context and the registration request message to generate an integrity check parameter, and the integrity check parameter It is used to verify whether the registration request message has been tampered with.
  • the first security context is the current security context of the source mobility management network element 20 of the terminal device 30 .
  • the first security context includes the key Kamf and the NAS key set identifier ngKSI.
  • the first security context may also include other information elements (information element, IE), such as the selected algorithm, uplink NAScount, downlink NAScount, etc., which are not limited in this application, and may refer to existing standards for details. It should be understood that, unless otherwise specified, the security contexts in the embodiments of the present application are non-access stratum NAS security contexts.
  • the registration request message may also include an uplink non-access stratum count (NAScount) value.
  • NAScount uplink non-access stratum count
  • the target mobility management network element 10 sends a context request message to the source mobility management network element 20.
  • the target mobility management network element 10 receives the registration request message from the terminal equipment 30, and determines the source mobility management network element 20 corresponding to the identifier of the terminal equipment 30 according to the identifier of the terminal equipment 30, denoted as the source mobility management network element 20
  • the element 20 targets the mobility management network element 10 .
  • the target mobility management network element 10 sends a context request message to the source mobility management network element 20, where the context request message is used to request to obtain the context of the terminal device 30.
  • the context request message includes the identification of the terminal device 30 .
  • the target mobility management network element 10 carries a complete registration request message from the terminal device 30 in the context request message, or in other words, the target mobility management network element 10 will receive the security protection in step 301
  • the registration request message of is carried in the context request message.
  • the source mobility management network element 20 When horizontal key derivation is required, the source mobility management network element 20 generates a new key Kamf' according to the key Kamf in the first security context.
  • the source mobility management network element 20 receives the context request message from the target mobility management network element 10 .
  • the source mobility management network element 20 searches the local database for the context information of the terminal device 30 according to the identifier of the terminal device 30 carried in the context request message, the context information includes the first security context, and the first security context is the The current security context between the source mobility management network element 20 and the terminal device 30 .
  • the source mobility management network element 20 uses the first security context to perform security verification on the registration request message carried in the context request message. If the verification is successful, the source mobility management network element 20 judges whether to perform horizontal key derivation. If the source mobility management network element 20 determines that horizontal key derivation is required, further, the source mobility management network element 20 generates a new key Kamf' according to the key Kamf in the first security context. For example, the source mobility management network element 20 uses Kamf in the first security context and the non-access stratum count value carried in the registration request message to perform horizontal key derivation to obtain a new key Kamf'.
  • the source mobility management network element 20 sends the second security context to the target mobility management network element 10.
  • the source mobility management network element 20 in response to the context request message, sends a context response message to the target mobility management network element 10, the context response message includes the second security context, and the second security context includes the new key Kamf '.
  • the second security context may also include other IEs, such as NAS key set identifier ngKSI', selected algorithm, uplink NAScount, downlink NAScount, etc., which are not limited in this application, and can refer to existing standards for details.
  • the context response message includes the identifier of the terminal device 30 , such as the SUPI of the terminal device 30 .
  • the target mobility management network element 10 sends a security mode command message to the terminal device 30.
  • the target mobility management network element 10 receives a context response message from the source mobility management network element 20 from the terminal device 30, and if the context response message carries a horizontal derivation instruction, the target mobility management network element 10 then uses the new key Kamf' and the selected algorithm deduce the new key NASkeys, and then save the second security context carried in the context response message. If the target mobility management network element 10 enables the second security context according to the local policy, the target mobility management network element 10 sends a security mode command message to the terminal device 30, the security mode command message includes horizontal derivation indication information, and the horizontal derivation indication The information is used to instruct the terminal device 30 to perform horizontal key derivation.
  • the terminal device 30 generates a new key Kamf' according to the key Kamf in the first security context.
  • the terminal device 30 receives a security mode command message from the target mobility management network element 10, and according to the horizontal derivation instruction information in the security mode command message, the terminal device 30 generates a new key Kamf according to the first security context.
  • the key Kamf' For example, the target mobility management network element 10, the terminal device 30 uses the key Kamf in the first security context and the uplink non-access stratum count value carried in the registration request message to perform horizontal key derivation to obtain the key Kamf', and then uses the The new key Kamf' and the algorithm identifier (ngKSI) in the security mode completion message are used to deduce the new NAS key (NASkeys).
  • ngKSI algorithm identifier
  • the source mobility management network element 20 maintains the first security context as the current security context.
  • the source mobility management network element 20 after the source mobility management network element 20 generates Kamf' according to Kamf, it maintains the first security context as the first security context, or continues to use the first security context as the current security context, or does not delete the first security context. context.
  • the maintenance here can be that after the terminal device deduces the new kamf', it does not immediately set the new security context as the current context, but continues to maintain the first security context as the current security context. After the registration process is successful, the new The security context (the second security context) is set as the current security context, and the first security context is deleted.
  • the source mobility management network element 20 deletes the second security context.
  • 307 may be performed before 304 or after 304, which is not limited in this application.
  • the source mobility management network element 20 deletes the first security context.
  • the source mobility management network element 20 receives indication information from the target mobility management network element 10, and the source mobility management network element 20 deletes the context of the terminal device 30 according to the indication information.
  • the indication information is used to indicate that the terminal device 30 has successfully registered to the network; in another example, the indication information indicates that the context of the terminal device 30 is deleted. According to the indication information, the source mobility management network element 20 deletes the first security context.
  • the source mobility management network element 20 receives a de-registration notification message, for example, the source mobility management network element 20 receives a de-registration notification message from a unified data management network element, and the de-registration notification message is used to indicate that the source mobility management network element 20
  • the unified data management network element may be, for example, a UDM in a 5G network.
  • the source mobility management network element 20 deletes the second security context. Specifically, for example, after the source mobility management network element 20 sends the second security context to the target mobility management network element 10, a timer is started.
  • the source mobility management network element 20 When When the timer expires, the source mobility management network element 20 still does not receive a response message, then the source mobility management network element 20 deletes the second security context; or, the source mobility management network element 20 starts the timer after generating a new key Kamf' When the timer expires and the source mobility management network element 20 still does not receive the response message, the source mobility management network element 20 deletes the second security context. It should be understood that the present application does not limit the specific timing for starting the timer. It should be understood that the registration success indication information may be carried in an existing message, or in a message newly added by the source mobility management network element 20, which is not limited in this application.
  • the terminal device 30 determines that the registration process has not been successfully completed. It should be understood that the successful registration here refers to the situation that the registration process of the terminal device cannot be successfully completed due to abnormal conditions, or the failure of the registration process can be interpreted as a failure of the registration process. It should also be understood that this application does not limit the specific reasons for the unsuccessful completion of the registration process. Several possible situations in which the terminal device 30 determines that the registration process has not been successfully completed are illustrated below: In one example, the terminal device does not receive a registration acceptance message within a preset time.
  • the terminal device 30 After the terminal device 30 sends the registration request message, the timer is started, and after the timer expires, if the registration acceptance message is not received, the terminal device 30 determines that the registration process has not been successfully completed; in another example, the terminal device 30 receives Receive a registration rejection message, the registration rejection message is used to deny the terminal device 30 access to the network, or in other words, the registration rejection message is used to deny the terminal device 30 to register with the target mobility management network element, according to the registration rejection message, the terminal device 30 determines that the registration process has not been successfully completed; in another example, the terminal device 30 needs to re-trigger the registration process before receiving the registration acceptance message.
  • the terminal device 30 enters a new tracking area, so that the registration process needs to be triggered again. In this case, the terminal device 30 determines that the registration process fails; in another example, the terminal device 30 bottom layer Failure (Lower layer failure) indication information, according to the underlying failure indication information, the terminal device 30 determines that the registration process has not been successfully completed; in another example, the terminal device 30 determines that the NAS security mode completes the message sending before receiving the registration acceptance message Failure; in another example, before receiving the registration acceptance message, the terminal device 30 determines that the link between itself and the access network device is released; The RRC connection between network devices is suspended or released.
  • the terminal device 30 determines that the registration process fails; in another example, the terminal device 30 bottom layer Failure (Lower layer failure) indication information, according to the underlying failure indication information, the terminal device 30 determines that the registration process has not been successfully completed; in another example, the terminal device 30 determines that the NAS security mode completes the message sending before receiving the registration acceptance message Failure; in another example, before receiving the registration
  • the terminal device 30 uses the first security context as the current security context.
  • the terminal device 30 After the terminal device 30 generates the new key Kamf', it maintains the first security context and the second security context, wherein the second security context includes the Kamf' and the NAS key, and the NAS key is based on the Kamf' generate.
  • the NAS keys may include NAS encryption keys and NAS integrity keys.
  • the terminal device 30 after the terminal device 30 generates a new key Kamf', it continues to use the first security context as the current security context, and saves the second security context, that is, the terminal device network maintains the first security context
  • the context is the current security context.
  • the first security context is the current security context, which means that after the terminal device deduces the new Kamf', it will not immediately set the new security context (second security context) as the current context. , but continue to maintain the first security context as the current security context, and after the registration process is successful, set the new security context as the current security context and delete the first security context.
  • the terminal device when the registration process fails, if the reason for the registration process failure is that the terminal device receives a registration rejection message, and the registration rejection message causes the security context to be deleted, the terminal device deletes the first security context and the second security context. security context. If the failure of the registration process does not cause the terminal device to delete the security context, the terminal device 30 continues to use the first security context as the current security context and delete the second security context. If the registration is successful, the terminal device 30 sets the second security context as the current security context, and deletes the first security context. For example, after the terminal device 30 uses the second security context to successfully verify the security of the NAS security mode command message, it sends a NAS security mode completion message to the target mobility management network element 10.
  • the terminal device 30 If the security mode completion message is sent successfully, or the terminal device 30 receives a message from A registration acceptance message of the target mobility management network element 10, the registration acceptance message is used to indicate that the terminal device 30 has successfully registered to the network, then the terminal device 30 sets the second security context as the current security context, and deletes the first security context.
  • the terminal device 30 After the terminal device 30 generates a new key Kamf', it saves the first security context, and sets the second security context as the current security context.
  • setting the second security context here as the current security context means that after the terminal device generates a new security context (the second security context), it sets the new security context as the current security context while saving the old security context (the second security context) A security context), if it is determined that the registration process fails, the current security context is rolled back, that is, the first security context is re-set as the current security context.
  • the terminal device deletes the first security context and the second security context. Two security contexts. If the failure of the registration process does not cause the terminal device to delete the security context, the terminal device 30 sets the first security context as the current security context and deletes the second security context. If the registration is successful, the terminal device 30 deletes the first security context.
  • the terminal device 30 re-initiates the registration process.
  • the terminal device 30 sends a registration request message to another target mobility management network element, the registration request message includes the identifier of the terminal device 30, and the registration request message is secured by the first security context.
  • the further target mobility management network element may be the same as or may be different from the target mobility management network element 10 .
  • the target mobility management network element 10 After the target mobility management network element 10 receives the registration request message from the terminal device 30, according to the registration request message, the target mobility management network element 10 sends a context request message to the source mobility management network element 20, and the context request message is used to request to obtain The context of the terminal device 30 .
  • the second target mobility management network element 10 carries the complete registration request message received from the terminal device 30 in the context request message.
  • the source mobility management network element 20 receives the context request message from the second target mobility management network element 10, and then, the source mobility management network element 20 uses the first security context to secure the registration request message carried in the context request message. verify. If the verification is passed, the source mobility management network element 20 continues to perform subsequent procedures. It should be understood that the registration process here is similar to the processes in 301 to 303, and for the sake of brevity, repeated content will not be repeated.
  • the source mobility management network element 20 sets the second security context as the current security context.
  • the source mobility management network element 20 After the source mobility management network element 20 generates the new key Kamf', it sets the second security context as the current security context, and the second security context includes the new key Kamf' and deduced NASkeys.
  • 309 may be performed before 304 or after 304, which is not limited in this application.
  • the source mobility management network element 20 deletes the first security context.
  • the terminal device 30 sets the second security context as the current security context.
  • the terminal device 30 After the terminal device 30 generates a new key Kamf', it sets the second security context as the current security context.
  • the source mobility management network element 20 uses the new key Kamf' and the selected algorithm to derive a new NAS key.
  • the terminal device 30 deletes the first security context.
  • the terminal device 30 sends a security mode completion message to the target mobility management network element 10, and the NAS security mode completion message is used to respond to the NAS security mode command message.
  • the terminal device 30 may re-initiate the registration process. For example, the terminal device 30 sends a registration request message to the target mobility management network element 10, where the registration request message includes the identifier of the terminal device 30. The terminal device 30 performs integrity protection on the registration request message through the second security context.
  • the second target mobility management network element 10 sends a second context request message to the source mobility management network element 20 according to the registration request message, and the second context request message carries the received complete registration request message.
  • the source mobility management network element 20 uses the second security context to perform security verification on the registration request message. If the verification is passed, proceed to the subsequent process.
  • the source mobility management network element 20 maintains the first security context and the second security context.
  • the source mobility management network element 20 after the source mobility management network element 20 generates a new key kamf', it maintains the first security context and the second security context. For example, the source mobility management network element 20 continues to use the first security context as the current security context between the mobility management network element and the terminal device 30, and saves the second security context. For another example, the source mobility management network element 20 saves the first security context, and uses the second security context as the current security context between the source mobility management network element 20 and the terminal device 30
  • the terminal device 30 maintains the first security context as the current security context, or sets the second security context as the current security context.
  • the terminal device 30 maintains the first security context as the current security context after generating the new key Kamf', and saves the second security context.
  • the terminal device 30 deletes the second security context; or the terminal device 30 saves the first security context after generating a new key Kamf', and sets the second security context as the current security context.
  • the terminal device 30 sets the first security context as the current security context, and delete the second security context. That is, the terminal device 30 can implement the solution performed by 308 in solution 1; or, as another possible implementation, after the terminal device 30 uses the first security context to perform horizontal key derivation to obtain the second security context, set the second security context.
  • the security context is the current security context, and the first security context is deleted. That is, the terminal device 30 may execute the solution performed by 310 in solution 2.
  • the terminal device 30 may re-initiate the registration process.
  • the terminal device 30 sends a security-protected registration request message to the target mobility management network element 10 .
  • the target mobility management network element 10 receives the registration request message, and according to the registration request message, the target mobility management network element 10 sends a context request message to the source mobility management network element 20, and carries the received The complete registration request message.
  • the source mobility management network element 20 uses the first security context and the second security context to perform security verification on the registration request message.
  • the source mobility management network element 20 When the source mobility management network element 20 uses the first security context to successfully verify the registration request message, the source mobility management network element 20 deletes the second security context; when the source mobility management network element 20 uses the second When the security verification of the registration request message by the security context succeeds, the source mobility management network element 20 sets the second security context as the current security context, and deletes the first security context. If the source mobility management network element 20 fails to verify the registration request message using the first security context and the second security context, the source mobility management network element 20 may delete the first security context and the second security context.
  • the source mobility management network element 20 uses the new key Kamf' and the selected algorithm to derive a new NAS key.
  • this application does not limit the sequence of security verification using the first security context and the second security context, that is, the source mobility management network element 20 can first use the first security Context to verify.
  • the source mobility management network element 20 after the source mobility management network element 20 successfully authenticates the registration request message using one of the security contexts, it may not need to use another security context for authentication. For example, the source mobility management network element 20 first uses the first security context to perform security verification on the registration request message. If the verification is successful, it may no longer use the second security context to verify the registration request message, and may delete the second security context. Context; if the verification fails, the source mobility management network element 20 can then use the second security context to perform security verification on the registration request message, and if the verification is successful, the source mobility management network element 20 sets the second security context as the current security context, And delete the first security context.
  • the new security context (such as the second security context in the above embodiment) and the old security context (such as the above embodiment
  • the processing method of the first security context can avoid that the registration request of the terminal device cannot pass the integrity protection check of the NAS at the source mobility management network element due to the inconsistency of the security contexts on the terminal side and the network side, so that the terminal device has already
  • the established security context cannot be migrated to the target mobility management network element, thereby avoiding the release of the previously activated PDU session of the terminal device and affecting user experience.
  • it can avoid the problem of increasing signaling overhead due to the identity authentication and re-authentication process caused by the registration request of the terminal device failing to pass the integrity protection check of the NAS at the source mobility management network element.
  • FIG. 4 shows an exemplary flow chart of a method 400 for managing a security context provided by an embodiment of the present application.
  • the method 400 includes:
  • the UE sends a registration request message to a target AMF.
  • the UE triggers a Registration Request message to the network. For example, the UE moves to a new AMF area (denoted as the target AMF), and the registration request message of the UE is delivered to the target AMF.
  • the UE sends a registration request (registration request, RR) message to a target AMF (target AMF), and the RR message carries an identifier of the UE, such as a 5G globally unique temporary user equipment identity (5G generation globally unique temporary user equipment identity, 5G-GUTI).
  • 5G globally unique temporary user equipment identity 5G generation globally unique temporary user equipment identity, 5G-GUTI
  • the UE has protected the integrity of the RR message through the current NAS security context
  • the current NAS security context is the NAS security context used by the UE to protect the NAS message transmitted between the UE and the source AMF before the registration process
  • the current security context is the current security context of the NAS used by the source AMF before performing horizontal K AMF deduction in 403 .
  • the target AMF sends a UE context transfer request message to the source AMF.
  • the target AMF receives the registration request message from the UE, and according to the GUTI carried in the message, determines the AMF that served the UE last time (referred to as the source AMF). Then the target AMF calls the UE context transfer service (Namf_Communication_UEContextTransfer) operation provided by the source AMF to request the context information of the UE.
  • the Namf_Communication_UEContextTransfer includes the identity of the UE (such as 5G-GUTI), and the Namf_Communication_UEContextTransfer also includes the complete RR message received by the target AMF, that is, the target AMF sends the RR message received in 401 in the Namf_Communication_UEContextTransfer.
  • the source AMF performs horizontal deduction according to the local policy to generate a new security context #1.
  • the source AMF after the source AMF receives the UE context transfer request message, it obtains the data of the UE (including the current NAS security context corresponding to the UE) in the database according to the identifier of the UE, and the source AMF uses the current security context to verify the received Integrity of RR messages. If the integrity verification of the RR message passes, the source AMF decides whether to derive a new security context according to the local policy. If the source AMF decides to deduce a new security context, the source AMF uses the Kamf in the old security context to perform horizontal Kamf deduction to obtain a new key Kamf', thereby generating a new security context #1, the new security context# 1 includes the new key Kamf'.
  • the source AMF uses the currently activated Kamf and the uplink NAScount carried in the registration request message to perform horizontal deduction to obtain a new key Kamf'.
  • the new key Kamf' is included in the security context of the new NAS.
  • the new security context #1 here is relative to the current NAS security context before the source AMF performs horizontal deduction. Therefore, the NAS security context before the source AMF performs horizontal deduction can be recorded as the old security context.
  • the source AMF sends a UE context transfer response message to the target AMF.
  • the source AMF finds the data corresponding to the UE in the database, and performs horizontal key derivation according to the local policy, the source AMF sends a UE context transfer response (Namf_Communication_UEContextTransfer Response) message to the target AMF, and the UE context transfer response message Carries UE context, SUPI, horizontal K AMF derivation indication (keyAmfHDerivationInd indication).
  • the UE context includes a security context. If the source AMF has deduced the horizontal K AMF according to the local policy, the UE context carried in the response message is the new security context #1 derived by the source AMF in 403 .
  • the source AMF maintains the old security context as the current security context.
  • the source AMF maintains the old security context as the current security context between the source AMF and the UE, In other words, the source AMF continues to use the old security context as the current security context between the source AMF and the UE, that is, the source AMF does not delete the old security context and the non-current security context, and does not change the security context between the source AMF and the UE.
  • the current security context is the old security context as the current security context between the source AMF and the UE.
  • the source AMF may not need to maintain the new security context #1, that is, after 403, the source AMF may delete the new security context #1.
  • the target AMF sends a security mode command message to the UE.
  • the target AMF receives the UE context transfer response message from the source AMF, and if the UE context transfer response message carries the SUPI of the UE, the target AMF saves the new NAS security context# carried in the UE context transfer response message 1. If the target AMF activates the security context carried in the response message according to the local policy, that is, the new security context #1 deduced by the source AMF, the target AMF initiates a non access stratum security mode command (non access stratum security mode command, NAS SMC) message to the UE to establish the NAS security context between the UE and the target AMF.
  • the security mode command message carries a horizontal derivation parameter (horizontal derivation parameter, HDP).
  • the HDP may be K_AMF_change_flag with a value of 1, wherein the K_AMF_change_flag with a value of 1 is used to instruct the UE to perform horizontal K AMF derivation.
  • the NASSMC message may also include selected NAS algorithms, including NAS encryption algorithms and NAS integrity protection algorithms. It should be understood that the target AMF performs integrity protection on the security mode command message through the new security context #1.
  • the UE horizontally deduces and generates a new security context #1.
  • the UE receives a security mode command message from the target AMF, and performs K AMF derivation according to the horizontal K AMF derivation indication carried in the security mode command message, that is, the UE performs Kamf derivation generation according to the key Kamf in the current security context A new key Kamf' is obtained, so as to obtain a new security context #1, and the new security context #1 includes the new key Kamf'.
  • the UE uses the new security context #1 to check the integrity of the security mode command message, and if the integrity check of the security mode command message passes, the UE sends a security mode completion message to the target AMF.
  • the UE maintains the old security context and the new security context #1.
  • the UE after successfully verifying the security mode command message using the new security context #1, the UE saves the old security context, and then sets the new security context #1 as the current security context; or, in another In the implementation manner, after the UE successfully verifies the security model command message through the new security context #1, it saves the new security context #1, and at the same time, the UE continues to maintain the old security context as the current security context.
  • the UE After 408, if the UE receives a registration acceptance message from the target AMF, if the UE saves the old security context at 408 and sets the new security context #1 as the current security context, then according to the registration acceptance message, the UE deletes the old security context If the UE saves the new security context #1 in 408 and maintains the old security context as the current security context, according to the registration acceptance message, the UE sets the second security context as the current security context and deletes the first Security context, that is, when the second security context is used for the current access, the UE deletes the stored old security context (and Kamf).
  • the UE sends a registration request message to the target AMF.
  • the UE saves the old security context at 408, and sets the new security context #1 as the current security context, in this case, if the registration process is not successfully completed, or if the registration process fails, or That is, if the security mode completion message fails to be sent, the UE sets the old security context as the current security context (or the UE maintains Kamf and the NAS security context associated with Kamf), or the UE uses the old security context as the current security context, In other words, the UE makes the old security context the current security context, and the UE deletes the new security context #1.
  • the old security context here can also be referred to as the previous security context, or the security context before horizontal deduction, or the security context used before registration; if the UE saves the new security context #1 at 408 and maintains the old security context The context is the current security context. In this case, if the registration process is not successfully completed, or if the registration process fails, or the security mode completion message fails to be sent, the UE deletes the new security context #1.
  • the UE may re-initiate the registration procedure, for example, the UE sends a registration request message to the target AMF. It should be understood that the UE performs integrity protection on the registration request message through the old security context. It should also be understood that the target AMF here may be different from the target AMF receiving the registration request message in step 401, that is, the UE may have moved to the area of another target AMF.
  • the UE deletes the new security context #1, and sets the old security context as the current security context;
  • the UE receives a registration rejection message from the network. If the registration rejection message causes the security context to be deleted, the UE deletes the new security context #1 and the old security context; if the registration rejection message does not cause the security context to be deleted , the UE deletes the new security context #1, and sets the old security context as the current security context;
  • the UE deletes the new security context #1 and sets the old security context as the current security context.
  • the target AMF sends a UE context transfer request message to the source AMF.
  • the target AMF receives the registration request message from the UE, and according to the GUTI carried in the message, determines the AMF that served the UE last time (referred to as the source AMF). Then the target AMF calls the UE context transfer service (Namf_Communication_UEContextTransfer) operation provided by the source AMF to request the context information of the UE.
  • the Namf_Communication_UEContextTransfer includes the complete RR message received by the target AMF, that is, the target AMF sends the RR message received in 409 in the Namf_Communication_UEContextTransfer.
  • the source AMF performs horizontal deduction according to the local policy to generate a new security context #2.
  • the source AMF uses the old security context to verify the integrity of the RR message in the UE context transfer request message. If the integrity verification of the RR message passes, the source AMF decides whether to derive a new security context according to the local policy. If the source AMF decides to deduce a new security context, the source AMF performs horizontal K AMF deduction to obtain a new security context #2.
  • the source AMF sends a UE context transfer response message to the target AMF.
  • the source AMF in response to the UE context transfer request message, sends a UE context transfer response (Namf_Communication_UEContextTransfer Response) message to the target AMF, and the UE context transfer response message carries the UE context, SUPI, and horizontal K AMF derivation indication (keyAmfHDerivationInd indication) .
  • the UE context includes a security context. If the source AMF has deduced the horizontal K AMF according to the local policy, the UE context carried in the response message is the new security context #2 derived by the source AMF in step 411 .
  • the target AMF sends a security mode command message to the UE.
  • the target AMF receives the UE context transfer response message from the source AMF, and if the UE context transfer response message carries the SUPI of the UE, the target AMF saves the new NAS security context# carried in the UE context transfer response message 2. If the target AMF activates the security context carried in the response message according to the local policy, that is, the new security context #2 deduced by the source AMF, the target AMF initiates a non-access stratum security mode command message to the UE to establish UE and NAS security context between target AMFs.
  • the security mode command message carries a horizontal derivation parameter (horizontal derivation parameter, HDP).
  • the HDP may be K_AMF_change_flag with a value of 1, wherein the K_AMF_change_flag with a value of 1 is used to instruct the UE to perform horizontal K AMF derivation. It should be understood that the target AMF performs integrity protection on the security mode command message through the new security context #2.
  • the UE horizontally deduces to obtain a new security context.
  • the UE receives a security mode command message from the target AMF, performs K AMF derivation according to the horizontal K AMF derivation indication carried in the security mode command message, and generates a new security context #2.
  • the UE uses the new security context #2 to check the integrity of the security mode command message.
  • the UE sends a security mode completion message to the target AMF.
  • the UE sends a security mode completion message to the target AMF.
  • the UE sets new security context #2 as the current security context.
  • the UE After the UE passes the integrity check of the security mode command message using the new security context #2, it saves the old security context, and then sets the new security context #2 as the current security context. It should be understood that 416 may be performed before 415 or after 415, which is not limited in this application.
  • the target AMF sends a registration acceptance message to the UE.
  • the target AMF sends a registration acceptance message to the UE. It should be understood that the target AMF uses the new security context #2 deduced at 414 to perform integrity protection on the registration acceptance message.
  • the UE deletes the old security context.
  • the UE determines that the registration is successful, and then the UE deletes the old security context.
  • the source mobility management network element maintains the first security context as the current security context after performing horizontal key derivation, and the terminal device maintains or sets The first security context is the current security context, thereby avoiding the problem that the security contexts maintained by the terminal side and the network side are inconsistent, which may lead to subsequent failure of the registration process.
  • FIG. 5 shows an exemplary flow chart of a method 500 for managing security context provided by an embodiment of the present application.
  • Method 500 includes:
  • the UE sends a registration request message to a target AMF.
  • the target AMF sends a UE context transfer request message to the source AMF.
  • the source AMF performs horizontal deduction according to the local policy to generate a new security context #1.
  • the source AMF sends a UE context transfer response message to the target AMF.
  • steps 501 to 504 are similar to steps 401 to 404 of the method 400, and for the sake of brevity, no detailed description is given.
  • the source AMF sets new security context #1 as the current security context.
  • the source AMF after the source AMF obtains the new key Kamf' through derivation, or after the source AMF obtains the new security context #1, it sets the new security context #1 as the current security context.
  • the source AMF deletes the old security context and the non-current security context.
  • 505 may be performed before 504, may be performed after 504, or may be performed at the same time, which is not limited in this application.
  • the target AMF sends a security mode command message to the UE.
  • the UE performs horizontal derivation to obtain a new security context #1.
  • steps 506 to 507 are similar to steps 406 to 407 in the method 400 and will not be repeated here.
  • the UE sets new security context #1 as the current security context.
  • the UE after obtaining the new security context #1 through horizontal derivation, the UE sets the new security context #1 as the current security context.
  • the UE deletes the old security context and the non-current security context.
  • the UE sends a registration request message to the target AMF.
  • the UE may re-initiate the registration procedure. For example, the UE sends a registration request message to the target AMF. It should be understood that the UE performs integrity protection on the registration request message through the new security context #1. It should also be understood that the present application does not limit the reasons for UE registration failure.
  • the target AMF sends a UE context transfer request message to the source AMF.
  • the target AMF receives the registration request message from the UE, and according to the GUTI carried in the message, determines the AMF that served the UE last time (referred to as the source AMF). Then the target AMF calls the UE context transfer service (Namf_Communication_UEContextTransfer) operation provided by the source AMF to request the context information of the UE.
  • the Namf_Communication_UEContextTransfer includes the complete RR message received by the target AMF, that is, the target AMF sends the RR message received at 510 in the Namf_Communication_UEContextTransfer.
  • the source AMF performs horizontal deduction according to the local policy to generate a new security context #2.
  • the source AMF uses the old security context to verify the integrity of the received RR message. If the integrity verification of the RR message passes, the source AMF decides whether to derive a new security context according to the local policy. If the source AMF decides to deduce a new security context, the source AMF performs horizontal K AMF deduction to obtain a new security context #2.
  • the source AMF Since in this embodiment, the source AMF has obtained the new security context #1 by performing horizontal K AMF derivation in step 503, and in step 505, the source AMF sets the new security context #1 as the current security context, therefore, the source The AMF may also not perform step 511 .
  • the source AMF sends a UE context transfer response message to the target AMF
  • the source AMF in response to the UE context transfer request message, sends a UE context transfer response (Namf_Communication_UEContextTransfer Response) message to the target AMF, and the UE context transfer response message carries UE context and SUPI.
  • the UE context includes a security context. If the source AMF executes step 511, the security context is the new security context #2 obtained by the source AMF through horizontal derivation in step 511, and the response message also carries a horizontal K AMF derivation indication (keyAmfHDerivationInd indication); if the source AMF If step 511 is not executed, the security context is the new security context #1 obtained by the source AMF through horizontal derivation in step 503 .
  • the target AMF sends a security mode command message to the UE.
  • the target AMF receives the UE context transmission response message from the source AMF, and obtains the new security context deduced by the source AMF from the response message. If the source AMF executes step 511, the new security context is new security context #2; if the source AMF does not execute step 511, then the new security context is new security context #1.
  • the target AMF initiates a non-access stratum security mode command message to the UE for establishing a NAS security context between the UE and the target AMF.
  • the security mode command message carries a horizontal derivation parameter (horizontal derivation parameter, HDP), and the HDP includes K_AMF_change_flag with a value of 1, which is used to instruct the UE to perform horizontal K AMF derivation.
  • HDP horizontal derivation parameter
  • K_AMF_change_flag K_AMF_change_flag with a value of 1, which is used to instruct the UE to perform horizontal K AMF derivation.
  • the UE performs horizontal deduction to generate a new security context.
  • the UE receives a security mode command message from the target AMF, and if the security mode command message carries a horizontal K AMF derivation indication, the UE performs horizontal K AMF derivation to generate a new security context #2.
  • the UE sends a security mode completion message to the target AMF.
  • the UE uses the new security context #2 to perform integrity verification on the security mode command message; if the UE does not perform step 514, the UE uses the new security context #1 to verify the security mode command messages for integrity verification. If the verification is passed, the UE sends a security mode completion message to the target AMF.
  • the UE If the UE successfully verifies the integrity of the security mode complete message through the new security context #2, the UE sets the new security context #2 as the current security context. And the UE deletes the old security context.
  • the target AMF uses the new security context to send a registration acceptance message to the UE.
  • the source mobility management network element sets the second security context as the current security context after performing horizontal key derivation, and the terminal device also sets the second security context as the current security context after performing horizontal key derivation, so that To avoid the inconsistency of the security context maintained on the terminal side and the network side, resulting in the possible subsequent failure of the registration process.
  • FIG. 6 shows an exemplary flowchart of a method 600 for managing a full context provided by an embodiment of the present application.
  • Method 600 includes:
  • the UE sends a registration request message to a target AMF.
  • the target AMF sends a UE context transfer request message to the source AMF.
  • the source AMF performs horizontal deduction according to the local policy to generate a new security context #1.
  • the source AMF sends a UE context transfer response message to the target AMF.
  • steps 601 to 604 are similar to steps 401 to 404 of the method 400, and for the sake of brevity, no detailed description is given.
  • the source AMF saves the old security context and the new security context #1.
  • the source AMF After the source AMF generates the new security context #1 through horizontal deduction, it saves the new security context #1 and the old security context at the same time, or in other words, maintains the new security context #1 and the old security context at the same time, or in other words, saves the new security context #1, retaining the old security context.
  • the source AMF saves the old security context and sets the new security context #1 as the current security context; in another example, the source AMF continues to maintain the old security context as the current security context while saving the new security context # 1.
  • the target AMF sends a security mode command message to the UE.
  • the UE performs horizontal derivation to obtain a new security context #1.
  • steps 606 to 607 are similar to steps 406 to 407 in the method 400 and will not be repeated here.
  • the UE sets new security context #1 as the current security context.
  • the UE after obtaining the new security context #1 through horizontal derivation, the UE sets the new security context #1 as the current security context.
  • the UE deletes the old security context and the non-current security context.
  • the UE sends a registration request message to the target AMF.
  • the UE when the UE fails to register, the UE re-initiates the registration procedure. For example, the UE sends a registration request message to the target AMF. It should be understood that the UE performs integrity protection on the registration request message through the new security context #1. This application does not limit the reasons for UE registration failure.
  • the target AMF sends a UE context transfer request message to the source AMF.
  • the target AMF receives the registration request message from the UE, and according to the GUTI carried in the message, determines the AMF that served the UE last time (referred to as the source AMF). Then the target AMF calls the UE context transfer service (Namf_Communication_UEContextTransfer) operation provided by the source AMF to request the context information of the UE.
  • the Namf_Communication_UEContextTransfer includes the complete RR message received by the target AMF, that is, the target AMF sends the RR message received in 609 in the Namf_Communication_UEContextTransfer.
  • the source AMF uses the new security context and the old security context to check the integrity of the registration request message.
  • the source AMF uses the new security context #1 and the old security context to verify the integrity of the registration request message in the UE context transfer request message.
  • the source AMF If the source AMF successfully checks the integrity of the registration request message using the new security context #1, the source AMF deletes the old security context. If the source AMF sets the old security context as the current security context in step 605, then the source AMF deletes the old security context and sets the new security context #1 as the current security context;
  • the source AMF fails to verify the integrity of the registration request message using the new security context #1, the source AMF uses the old security context to verify the integrity of the registration request message. If the verification is successful, the source AMF Delete the new security context #1, and if the source AMF sets the new security context #1 as the current security context in step 605, then the source AMF sets the old security context as the current security context at this time;
  • the source AMF can delete both the new security context #1 and the old security context.
  • the source AMF returns a UE context transmission response message to the target AMF, where the response message is used to indicate that the temporary identifier 5G-GUTI cannot be obtained.
  • the present application does not limit the sequence of integrity verification using the new security context #1 and the old security context. That is to say, the source AMF can first use the new security context #1 to verify the integrity of the registration request message, or use the old security context to first verify the integrity of the registration request message, which is not limited in this application .
  • the source AMF performs horizontal deduction according to the local policy to generate a new security context #2.
  • the source AMF After the source AMF successfully checks the integrity of the registration request message through the new security context #1 or the old security context, if the source AMF decides to deduce a new security context according to the local policy, the source AMF performs level K AMF Deduction, get the new security context #2.
  • step 612 may not be executed.
  • the source AMF sends a UE context transfer response message to the target AMF.
  • the source AMF in response to the UE context transfer request message, sends a UE context transfer response message to the target AMF, and the response message carries the UE context and SUPI.
  • the UE context includes a security context. If the source AMF executes step 612, the security context is the new security context #2 obtained by the source AMF through horizontal derivation in step 612, and the response message carries the level K AMF derivation indication (keyAmfHDerivationInd indication); if the source AMF does not Step 612 is executed, and the security context is the new security context #1 obtained by the source AMF through horizontal derivation in step 603 .
  • the target AMF sends a security mode command message to the UE.
  • the target AMF receives the UE context transmission response message from the source AMF, and obtains the new security context deduced by the source AMF from the response message. If the source AMF executes 612, the new security context is new security context #2; if the source AMF does not execute 612, then the new security context is new security context #1.
  • the target AMF initiates a non-access stratum security mode command message to the UE for establishing a NAS security context between the UE and the target AMF.
  • the security mode command message carries a horizontal derivation parameter (horizontal derivation parameter, HDP), and the HDP includes K_AMF_change_flag with a value of 1, which is used to instruct the UE to perform horizontal K AMF derivation.
  • HDP horizontal derivation parameter
  • K_AMF_change_flag K_AMF_change_flag with a value of 1, which is used to instruct the UE to perform horizontal K AMF derivation.
  • a new security context is generated through UE horizontal deduction.
  • the UE receives a security mode command message from the target AMF, and if the security mode command message carries a horizontal K AMF derivation indication, the UE performs horizontal K AMF derivation to generate a new security context #2.
  • the UE sends a security mode completion message to the target AMF.
  • the UE uses the new security context #2 to verify the integrity of the security mode command message; if the UE does not perform step 615, the UE uses the new security context #1 to verify the security mode command messages for integrity verification. If the verification is passed, the UE sends a security mode complete message to the target AMF.
  • the UE if the UE successfully verifies the integrity of the security mode command message through the new security context #2, the UE sets the new security context #2 as the current security context. And the UE deletes the old security context.
  • the target AMF uses the new security context to send a registration acceptance message to the UE.
  • the source mobility management network element maintains the first security context and the second security context at the same time after performing horizontal key derivation, so that no matter whether the terminal device side sets the first security context or the second security context as the current security context , can avoid the problem of inconsistency of the security context maintained by the terminal side and the network side.
  • the method for managing the security context provided by the embodiment of the present application is described by taking the registration process applied to the terminal device as an example, but it should be understood that the method is also applicable to scenarios where other network devices perform horizontal key derivation, for example In other processes in the future, the network device performs horizontal key derivation according to the local policy, and the method for managing the security context provided by the embodiment of the present application can be used to solve the problem of inconsistency between the security context maintained by the network side and the terminal side.
  • FIG. 7 is a schematic block diagram of an apparatus 10 for managing a security context provided by an embodiment of the present application.
  • the device 10 includes a transceiver module 11 and a processing module 12 .
  • the transceiver module 11 can realize corresponding communication functions, the processing module 12 is used for data processing, or the transceiver module 11 is used for performing receiving and sending related operations, and the processing module 12 is used for performing other operations except receiving and sending .
  • the transceiver module 11 can also be called a communication interface or a communication unit.
  • the device 10 may correspond to the mobility management network element in the above method embodiment, for example, the source mobility management network element, or the target mobility management network element (including the first target mobility management network element or the second 2. The target mobility management network element), or the source AMF, or the target AMF.
  • the apparatus 10 may correspond to the target mobility management network element 20 or the source mobility management network element 30 in the method 300 of the embodiment of the present application, or the target AMF or the source AMF in the methods 400 to 600 .
  • the apparatus 10 may include a module for executing the method performed by the target mobility management network element 20 or the source mobility management network element 30 (target AMF or source AMF) in FIGS. 3 to 6 .
  • each unit in the device 10 and the above-mentioned other operations and/or functions are respectively for realizing the corresponding flow of the method shown in FIG. 3 to FIG. 6 .
  • the transceiver module 11 in the device 10 executes the receiving and sending operations performed by the target mobility management network element 20 or the source mobility management network element 30 (target AMF or source AMF) in the above method embodiments, and the processing module 12 then Perform operations other than this receive and send operation.
  • the apparatus 10 may correspond to the terminal device 30 (or UE) in the above method embodiments.
  • the apparatus 10 may correspond to the terminal device 30 in the method 300 of the embodiment of the present application, or the UE in the methods 400 to 600.
  • the apparatus 10 may include modules for executing the methods performed by the terminal device 30 (or UE) in FIG. 3 to FIG. 6 .
  • each unit in the device 10 and the above-mentioned other operations and/or functions are respectively for realizing the corresponding flow of the method shown in FIG. 3 to FIG. 6 .
  • the transceiver module 11 in the apparatus 10 executes the receiving and sending operations performed by the terminal equipment 30 (or UE) in the above method embodiments, and the processing module 12 executes operations other than the receiving and sending operations.
  • FIG. 8 is a schematic diagram of an apparatus 20 for managing a security context provided by an embodiment of the present application.
  • the device 20 may correspond to the target mobility management network element 20 or the source mobility management network element 30 (target AMF or source AMF) in the above method embodiment; in another possible design , the apparatus 10 may correspond to the terminal device 30 (or UE) in the above method embodiments.
  • the device 20 may include a processor 21 (ie, an example of a processing module) and a memory 22 .
  • the memory 22 is used to store instructions
  • the processor 21 is used to execute the instructions stored in the memory 22, so that the device 20 implements the steps performed by the terminal device or the network device in the method corresponding to FIG. 3 to FIG. 6 , the network device It may be the target mobility management network element in methods 300 to 600, or the source mobility management network element, or the target AMF, or the source AMF.
  • the device 20 may also include an input port 23 (ie, an example of a transceiver module) and an output port 24 (ie, another example of a transceiver module).
  • the processor 21 , the memory 22 , the input port 23 and the output port 24 can communicate with each other through internal connection paths, and transmit control and/or data signals.
  • the memory 22 is used to store a computer program, and the processor 21 can be used to call and run the computer program from the memory 22, to control the input port 23 to receive signals, and to control the output port 24 to send signals, so as to complete the terminal equipment or Steps for network devices.
  • the memory 22 can be integrated in the processor 21 or can be set separately from the processor 21 .
  • the input port 23 is a receiver
  • the output port 24 is a transmitter.
  • the receiver and the transmitter may be the same or different physical entities. When they are the same physical entity, they can be collectively referred to as transceivers.
  • the input port 23 is an input interface
  • the output port 24 is an output interface
  • the functions of the input port 23 and the output port 24 may be realized by a transceiver circuit or a dedicated chip for transceiver.
  • the processor 21 may be realized by a dedicated processing chip, a processing circuit, a processor or a general-purpose chip.
  • a general-purpose computer to implement the communication device provided in the embodiment of the present application.
  • the program codes to realize the functions of the processor 21 , the input port 23 and the output port 24 are stored in the memory 22 , and the general processor realizes the functions of the processor 21 , the input port 23 and the output port 24 by executing the codes in the memory 22 .
  • FIG. 9 shows a schematic structural diagram of a simplified network device 30 .
  • the network equipment includes 31 parts and 32 parts.
  • Part 31 is mainly used for the transmission and reception of radio frequency signals and the conversion of radio frequency signals and baseband signals; part 32 is mainly used for baseband processing and control of network equipment.
  • Part 31 may generally be referred to as a transceiver module, a transceiver, a transceiver circuit, or a transceiver.
  • the part 32 is usually the control center of the network device, which can be generally referred to as a processing module, and is used to control the network device to perform the processing operations on the network device side in the foregoing method embodiments.
  • the transceiver module of Part 31, which may also be referred to as a transceiver or transceiver, etc., includes an antenna and a radio frequency circuit, wherein the radio frequency circuit is mainly used for radio frequency processing.
  • the device used to realize the receiving function in Part 31 can be regarded as a receiving module
  • the device used to realize the sending function can be regarded as a sending module, that is, Part 31 includes a receiving module and a sending module.
  • the receiving module may also be called a receiver, receiver, or receiving circuit, etc.
  • the sending module may be called a transmitter, transmitter, or transmitting circuit, etc.
  • Section 32 may include one or more single boards, and each single board may include one or more processors and one or more memories.
  • the processor is used to read and execute programs in the memory to realize baseband processing functions and control of network devices. If there are multiple single boards, each single board can be interconnected to enhance the processing capability. As an optional implementation, it is also possible that multiple single boards share one or more processors, or that multiple single boards share one or more memories, or that multiple single boards share one or more processors at the same time. device.
  • the network device shown in FIG. 9 may be any network device shown in the methods shown in FIGS. 3 to 6, such as the source mobility management network element (20), the target mobility management network element (10) etc.
  • the transceiver module of part 31 is used to execute the steps related to the sending and receiving of any network device in the methods shown in Figures 3 to 6; the part 32 is used to execute the steps related to the processing of any network device in the methods shown in Figures 3 to 6 step.
  • FIG. 9 is only an example rather than a limitation, and the foregoing network device including a transceiver module and a processing module may not depend on the structure shown in FIG. 9 .
  • the chip When the device 40 is a chip, the chip includes a transceiver module and a processing module.
  • the transceiver module may be an input-output circuit or a communication interface;
  • the processing module is a processor or a microprocessor or an integrated circuit integrated on the chip.
  • FIG. 10 is a schematic structural diagram of a terminal device 40 provided in the present application.
  • the terminal device 40 includes a processor, a memory, a control circuit, an antenna, and an input and output device.
  • the processor is mainly used to process the communication protocol and communication data, and to control the entire terminal device, execute the software program, and process the data of the software program. described action.
  • the memory is mainly used for storing software programs and data, such as storing the codebook described in the above embodiments.
  • the control circuit is mainly used for conversion of baseband signal and radio frequency signal and processing of radio frequency signal.
  • the control circuit and the antenna can also be called a transceiver, which is mainly used to send and receive radio frequency signals in the form of electromagnetic waves.
  • Input and output devices such as touch screens, display screens, and keyboards, are mainly used to receive data input by users and output data to users.
  • the processor can read the software program in the storage unit, interpret and execute the instructions of the software program, and process the data of the software program.
  • the processor performs baseband processing on the data to be sent, and then outputs the baseband signal to the radio frequency circuit.
  • the radio frequency circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor, and the processor converts the baseband signal into data and processes the data.
  • FIG. 10 only shows a memory and a processor. In an actual terminal device, there may be multiple processors and memories.
  • a storage may also be called a storage medium or a storage device, etc., which is not limited in this embodiment of the present application.
  • the processor may include a baseband processor and a central processing unit, the baseband processor is mainly used to process communication protocols and communication data, and the central processor is mainly used to control the entire terminal device, execute A software program that processes data for a software program.
  • the processor in FIG. 10 integrates the functions of the baseband processor and the central processing unit.
  • the baseband processor and the central processing unit may also be independent processors, interconnected through technologies such as a bus.
  • a terminal device may include multiple baseband processors to adapt to different network standards, a terminal device may include multiple central processors to enhance its processing capability, and various components of the terminal device may be connected through various buses.
  • the baseband processor may also be expressed as a baseband processing circuit or a baseband processing chip.
  • the central processing unit may also be expressed as a central processing circuit or a central processing chip.
  • the function of processing the communication protocol and communication data can be built in the processor, or can be stored in the storage unit in the form of a software program, and the processor executes the software program to realize the baseband processing function.
  • the terminal device 40 includes a transceiver unit 41 and a processing unit 42 .
  • the transceiver unit may also be referred to as a transceiver, a transceiver, a transceiver device, and the like.
  • the device in the transceiver unit 41 for realizing the receiving function can be regarded as a receiving unit
  • the device in the transceiver unit 41 for realizing the sending function can be regarded as a sending unit, that is, the transceiver unit 41 includes a receiving unit and a sending unit.
  • the receiving unit may also be called a receiver, receiver, receiving circuit, etc.
  • the sending unit may be called a transmitter, transmitter, or transmitting circuit, etc.
  • the terminal device shown in FIG. 10 may perform the actions performed by the terminal device in the methods shown in FIGS. 3 to 6 .
  • the terminal device shown in FIG. 10 may perform the actions performed by the terminal device in the methods shown in FIGS. 3 to 6 .
  • detailed descriptions thereof are omitted.
  • the embodiment of the present application further provides a computer-readable storage medium, on which computer instructions for implementing the method executed by the first network device in the above method embodiment are stored.
  • the computer program when executed by a computer, the computer can implement the method performed by the network device in the foregoing method embodiments.
  • the embodiments of the present application also provide a computer program product including instructions, which, when executed by a computer, enable the computer to implement the method executed by the first device or the method executed by the second device in the above method embodiments.
  • An embodiment of the present application further provides a communication system, where the communication system includes the network device in the foregoing embodiments.
  • the network device may include a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer.
  • the hardware layer may include hardware such as a central processing unit (central processing unit, CPU), a memory management unit (memory management unit, MMU), and memory (also called main memory).
  • the operating system of the operating system layer can be any one or more computer operating systems that realize business processing through processes, for example, Linux operating system, Unix operating system, Android operating system, iOS operating system, or windows operating system.
  • the application layer may include applications such as browsers, address books, word processing software, and instant messaging software.
  • the embodiment of the present application does not specifically limit the specific structure of the execution subject of the method provided in the embodiment of the present application, as long as the program that records the code of the method provided in the embodiment of the present application can be executed according to the method provided in the embodiment of the present application Just communicate.
  • the execution subject of the method provided by the embodiment of the present application may be a network device, or a functional module in the network device that can call a program and execute the program.
  • Computer-readable media may include, but are not limited to, magnetic storage devices (such as hard disks, floppy disks, or tapes, etc.), optical disks (such as compact discs (compact disc, CD), digital versatile discs (digital versatile disc, DVD), etc. ), smart cards and flash memory devices (for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.).
  • magnetic storage devices such as hard disks, floppy disks, or tapes, etc.
  • optical disks such as compact discs (compact disc, CD), digital versatile discs (digital versatile disc, DVD), etc.
  • smart cards and flash memory devices for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.
  • Various storage media described herein can represent one or more devices and/or other machine-readable media for storing information.
  • the term "machine-readable medium” may include, but is not limited to, wireless channels and various other media capable of storing, containing and/or carrying instructions and/or data.
  • processors mentioned in the embodiment of the present application may be a central processing unit (central processing unit, CPU), and may also be other general processors, digital signal processors (digital signal processor, DSP), application specific integrated circuits ( application specific integrated circuit (ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the memory mentioned in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be random access memory (RAM).
  • RAM can be used as an external cache.
  • RAM may include the following forms: static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM) , double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory (synchlink DRAM, SLDRAM) and Direct memory bus random access memory (direct rambus RAM, DR RAM).
  • static random access memory static random access memory
  • dynamic RAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM synchronous DRAM
  • double data rate SDRAM double data rate SDRAM
  • DDR SDRAM double data rate SDRAM
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous connection dynamic random access memory
  • Direct memory bus random access memory direct rambus RAM, DR RAM
  • the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components
  • the memory storage module may be integrated in the processor.
  • memories described herein are intended to include, but are not limited to, these and any other suitable types of memories.
  • the disclosed devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to implement the solutions provided in this application.
  • each functional unit in each embodiment of the present application may be integrated into one unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer may be a personal computer, a server, or a network device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server, or data center by wired (eg, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium, (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, DVD), or a semiconductor medium (for example, a solid state disk (SSD)).
  • a magnetic medium for example, a floppy disk, a hard disk, a magnetic tape
  • an optical medium for example, DVD
  • a semiconductor medium for example, a solid state disk (SSD)
  • the aforementioned available The medium may include but not limited to: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

La présente demande concerne un procédé et un appareil de gestion d'un contexte de sécurité. Le procédé comprend les étapes au cours desquelles : un dispositif terminal envoie un message de demande d'enregistrement à un élément de réseau de gestion de mobilité cible, le message de demande d'enregistrement contenant un identifiant du dispositif terminal ; le dispositif terminal reçoit un message d'instruction de mode de sécurité d'une strate de non-accès (NAS) provenant de l'élément de réseau de gestion de mobilité cible, le message d'instruction de mode de sécurité de NAS contenant des informations d'indication de dérivation horizontale ; en fonction des informations d'indication de dérivation horizontale, le dispositif terminal génère une nouvelle clé Kamf' en fonction d'une clé Kamf dans un premier contexte de sécurité, le premier contexte de sécurité étant un contexte de sécurité actuel du dispositif terminal ; et, lorsqu'un processus d'enregistrement échoue, le dispositif terminal utilise le premier contexte de sécurité au titre du contexte de sécurité actuel. La solution permet d'éviter le problème de l'incohérence entre les contextes de sécurité d'un UE et d'un côté réseau.
PCT/CN2022/128421 2021-10-30 2022-10-28 Procédé et appareil de gestion d'un contexte de sécurité WO2023072271A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111278501.2 2021-10-30
CN202111278501.2A CN116074828A (zh) 2021-10-30 2021-10-30 管理安全上下文的方法和装置

Publications (1)

Publication Number Publication Date
WO2023072271A1 true WO2023072271A1 (fr) 2023-05-04

Family

ID=86159094

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/128421 WO2023072271A1 (fr) 2021-10-30 2022-10-28 Procédé et appareil de gestion d'un contexte de sécurité

Country Status (2)

Country Link
CN (1) CN116074828A (fr)
WO (1) WO2023072271A1 (fr)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111866967A (zh) * 2019-04-29 2020-10-30 华为技术有限公司 切换的处理方法和装置
WO2020221067A1 (fr) * 2019-04-29 2020-11-05 华为技术有限公司 Procédé et dispositif d'enregistrement mobile
CN112020067A (zh) * 2019-05-31 2020-12-01 华为技术有限公司 获取安全上下文的方法、装置和通信系统
US20200396650A1 (en) * 2017-09-15 2020-12-17 Telefonaktiebolaget Lm Ericsson (Publ) Security Context In A Wireless Communication System
CN112738881A (zh) * 2020-12-30 2021-04-30 展讯通信（上海）有限公司 一种网络注册方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200396650A1 (en) * 2017-09-15 2020-12-17 Telefonaktiebolaget Lm Ericsson (Publ) Security Context In A Wireless Communication System
CN111866967A (zh) * 2019-04-29 2020-10-30 华为技术有限公司 切换的处理方法和装置
WO2020221067A1 (fr) * 2019-04-29 2020-11-05 华为技术有限公司 Procédé et dispositif d'enregistrement mobile
CN112020067A (zh) * 2019-05-31 2020-12-01 华为技术有限公司 获取安全上下文的方法、装置和通信系统
CN112738881A (zh) * 2020-12-30 2021-04-30 展讯通信（上海）有限公司 一种网络注册方法及装置

Also Published As

Publication number Publication date
CN116074828A (zh) 2023-05-05

Similar Documents

Publication Publication Date Title
US11089480B2 (en) Provisioning electronic subscriber identity modules to mobile wireless devices
CN109587688B (zh) 系统间移动性中的安全性
US20200296142A1 (en) User Group Establishment Method and Apparatus
US11812496B2 (en) User group session management method and apparatus
US11470674B2 (en) Communication method and communications apparatus
WO2020135850A1 (fr) Procédé et appareil de communication
WO2021136211A1 (fr) Procédé et dispositif pour déterminer un résultat d'autorisation
JP7506799B2 (ja) プロトコルデータユニットセッションの確立
US20210045050A1 (en) Communications method and apparatus
CN113727342B (zh) 网络注册的方法和装置
US20210168139A1 (en) Network Slice Authentication Method and Communications Apparatus
US20220272533A1 (en) Identity authentication method and communications apparatus
WO2021134719A1 (fr) Dispositif et procédé de communication
CN116723507B (zh) 针对边缘网络的终端安全方法及装置
US20230188519A1 (en) Method and system for invoking application programming interface, and apparatus
US20240224098A1 (en) Network verification method and apparatus
WO2021180209A1 (fr) Procédé de transmission d'informations de radiomessagerie et appareil de communication
WO2023213301A1 (fr) Procédé d'authentification, appareil de communication, et support de stockage lisible par ordinateur
WO2023213177A1 (fr) Procédé et appareil de communication
WO2023016160A1 (fr) Procédé d'établissement de session et appareil associé
US20220330010A1 (en) Online Signup Method and Apparatus
WO2023072271A1 (fr) Procédé et appareil de gestion d'un contexte de sécurité
US20230354028A1 (en) Method, system, and apparatus for generating key for inter-device communication
CN116528234B (zh) 一种虚拟机的安全可信验证方法及装置
WO2023041056A1 (fr) Procédé et appareil de vérification de réseau

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22886146

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE