WO2023109865A1 - 一种密钥生成方法、装置、设备及可读存储介质 - Google Patents

一种密钥生成方法、装置、设备及可读存储介质 Download PDF

Info

Publication number
WO2023109865A1
WO2023109865A1 PCT/CN2022/139007 CN2022139007W WO2023109865A1 WO 2023109865 A1 WO2023109865 A1 WO 2023109865A1 CN 2022139007 W CN2022139007 W CN 2022139007W WO 2023109865 A1 WO2023109865 A1 WO 2023109865A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
request
session
group
aanf
Prior art date
Application number
PCT/CN2022/139007
Other languages
English (en)
French (fr)
Inventor
黄晓婷
庄小君
田野
Original Assignee
中国移动通信有限公司研究院
中国移动通信集团有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国移动通信有限公司研究院, 中国移动通信集团有限公司 filed Critical 中国移动通信有限公司研究院
Publication of WO2023109865A1 publication Critical patent/WO2023109865A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H04L9/0833—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] involving conference or group key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/66—Trust-dependent, e.g. using trust scores or trust relationships

Definitions

  • the present disclosure relates to the technical field of communications, and in particular, to a key generation method, device, equipment, and readable storage medium.
  • AKMA Authentication and Key Management for Applications
  • the same edge node has multiple business servers, and these business servers belong to the same trust domain or belong to the same vertical industry application.
  • the AKMA process is executed between the terminal and each service server, so that the core network (AKMA Anchor Function (AAnF)) executes the AKMA process and generates the final key (K AF ) for each service server respectively.
  • AAA AKMA Anchor Function
  • Embodiments of the present disclosure provide a key generation method, device, device, and readable storage medium, so as to save signaling resources.
  • the embodiment of the present disclosure provides a method for generating a key, which is applied to AF, including:
  • a corresponding session key K AS is generated for one or more ASs according to the group key K AF and preset parameters.
  • the one or more ASs belong to the same trust domain.
  • the method also includes:
  • the method before generating the corresponding session key K AS for one or more ASs according to the group key K AF and preset parameters, the method further includes:
  • the obtaining the group key K AF includes:
  • the terminal receiving a first request from the terminal, where the first request includes a key identifier corresponding to the intermediate key K AKMA ;
  • the group key K AF is obtained from the AAnF, or the group key K AF is obtained from the AF itself.
  • the obtaining the group key K AF includes:
  • the group key K AF is obtained from the application layer authentication and session key management anchor function AAnF, or the group key K AF is obtained from the AF itself.
  • the group key K AF is obtained from the application layer authentication and session key management anchor function AAnF, including:
  • the preset parameters include the AS identifier AS_ID; and generating corresponding session keys K AS for one or more ASs according to the group key K AF and preset parameters includes:
  • a corresponding session key K AS is generated for the one or more ASs according to the group key K AF and the AS_IDs of the one or more ASs.
  • the session key K AS is generated according to the following formula:
  • K AS KDF(K AF , AS_ID);
  • KDF represents a preset key derivation function
  • K AF represents a group key
  • AS_ID represents an ID of an AS.
  • the AS_ID is sent to the AF by the one or more ASs.
  • the embodiment of the present disclosure provides a method for generating a key, which is applied to an AS, including:
  • the session key K AS is obtained from the AF; wherein, the session key K AS is generated by the AF according to the group key K AF and preset parameters.
  • the acquisition of the session key K AS from the AF includes:
  • an embodiment of the present disclosure provides a method for generating a key, which is applied to a terminal, including:
  • a session key K AS is generated according to the group key K AF and preset parameters.
  • the method further includes: triggering the AS to acquire the session key K AS .
  • the triggering the AS to obtain the session key K AS includes any of the following:
  • the sixth request includes the key identifier corresponding to the intermediate key K AKMA , and the sixth request is used to trigger the AAnF to provide the AS with the group key K AF and preset parameters Generate the corresponding session key K AS ;
  • the preset parameters include the AS identification AS_ID; the session key K AS is generated according to the following formula:
  • K AS KDF(K AF , AS_ID);
  • KDF represents a preset key derivation function
  • K AF represents a group key
  • AS_ID represents an AS identifier
  • an embodiment of the present disclosure provides a key generation device, which is applied to an AF, including:
  • the first generation module is used to generate corresponding session keys K AS for one or more ASs according to the group key K AF and preset parameters when the AS and the terminal need to establish a service connection.
  • the one or more ASs belong to the same trust domain.
  • the device also includes:
  • the first sending module is configured to send the corresponding session key K AS to the one or more ASs.
  • the device also includes:
  • a first obtaining module configured to obtain the group key K AF .
  • the first acquisition module includes:
  • the first receiving submodule is configured to receive a first request from the terminal, where the first request includes a key identifier corresponding to the intermediate key K AKMA ;
  • the first obtaining submodule is configured to obtain the group key K AF from the application layer authentication and session key management anchor function AAnF according to the key identifier, or obtain the group key K AF from the AF itself .
  • the first acquisition module includes:
  • the first receiving submodule is configured to receive a second request from the AS, where the second request includes a key identifier corresponding to the intermediate key K AKMA ;
  • the first obtaining submodule is configured to obtain the group key K AF from the application layer authentication and session key management anchor function AAnF according to the key identifier, or obtain the group key K AF from the AF itself .
  • the first acquisition submodule includes:
  • a first sending unit configured to send a third request to the AAnF, where the third request includes the key identifier and the AF identifier AF_ID;
  • the first receiving unit is used for the group key K AF sent by the AAnF according to the third request.
  • the preset parameters include the AS identification AS_ID; the first generation module is used to generate corresponding session key K AS .
  • the first generation module is used to generate the session key K AS according to the following formula:
  • K AS KDF(K AF , AS_ID);
  • KDF represents a preset key derivation function
  • K AF represents a group key
  • AS_ID represents an AS identifier
  • an embodiment of the present disclosure provides a key generation device, which is applied to an AS, including:
  • the first obtaining module is used to obtain the session key K AS from the AF when a service connection needs to be established with the terminal; wherein, the session key K AS is generated by the AF according to the group key K AF and preset parameters .
  • the first acquisition module includes:
  • the first receiving submodule is configured to receive a fourth request sent by the terminal, where the fourth request includes a key identifier corresponding to the intermediate key K AKMA ;
  • the first sending submodule is configured to send a fifth request to the AF according to the key identifier, where the fifth request includes the key identifier and the AS_ID of the AS;
  • the first acquiring submodule is configured to receive the session key K AS sent by the AF.
  • an embodiment of the present disclosure provides a key generation device applied to a terminal, including:
  • the first generating module is configured to generate a session key K AS according to the group key K AF and preset parameters when establishing a service connection with the AS.
  • the device also includes:
  • the first triggering module is configured to trigger the AS to obtain the session key K AS .
  • the first trigger module is used to perform any of the following:
  • the sixth request includes the key identifier corresponding to the intermediate key K AKMA , and the sixth request is used to trigger the AAnF to provide the AS with the group key K AF and preset parameters Generate the corresponding session key K AS ;
  • the preset parameters include the AS identification AS_ID; the first generating module is configured to generate the session key K AS according to the following formula:
  • K AS KDF(K AF , AS_ID);
  • KDF represents a preset key derivation function
  • K AF represents a group key
  • AS_ID represents an AS identifier
  • an embodiment of the present disclosure provides a key generation device, which is applied to an AF, and includes: a processor and a transceiver;
  • the processor is configured to generate a corresponding session key K AS for one or more ASs according to the group key K AF and preset parameters when the AS and the terminal need to establish a service connection.
  • the one or more ASs belong to the same trust domain.
  • the transceiver is configured to send the corresponding session key K AS to the one or more ASs.
  • the processor is further configured to: acquire the group key K AF .
  • processor is also used for:
  • the terminal receiving a first request from the terminal, where the first request includes a key identifier corresponding to the intermediate key K AKMA ;
  • the group key K AF is obtained from the application layer authentication and session key management anchor function AAnF, or the group key K AF is obtained from the AF itself.
  • processor is also used for:
  • the group key K AF is obtained from the application layer authentication and session key management anchor function AAnF, or the group key K AF is obtained from the AF itself.
  • processor is also used for:
  • the preset parameters include the AS identifier AS_ID; the processor is further configured to:
  • a corresponding session key K AS is generated for the one or more ASs according to the group key K AF and the AS_IDs of the one or more ASs.
  • the processor is further configured to generate the session key K AS according to the following formula:
  • K AS KDF(K AF , AS_ID);
  • KDF represents a preset key derivation function
  • K AF represents a group key
  • AS_ID represents an AS identifier
  • an embodiment of the present disclosure provides a key generation device, which is applied to an AS, and includes: a processor and a transceiver;
  • the processor is configured to obtain a session key K AS from the AF when a service connection needs to be established with the terminal; wherein, the session key K AS is generated by the AF according to the group key K AF and preset parameters .
  • processor is also used for:
  • an embodiment of the present disclosure provides a key generation device, which is applied to a terminal, and includes: a processor and a transceiver;
  • the processor is configured to generate a session key K AS according to the group key K AF and preset parameters when a service connection needs to be established with the AS.
  • the processor is further configured to trigger the AS to obtain the session key K AS .
  • processor is also configured to perform any of the following:
  • the sixth request includes the key identifier corresponding to the intermediate key K AKMA , and the sixth request is used to trigger the AAnF to provide the AS with the group key K AF and preset parameters Generate the corresponding session key K AS ;
  • the preset parameters include the AS identification AS_ID; where the processor is further configured to generate the session key K AS according to the following formula:
  • K AS KDF(K AF , AS_ID);
  • KDF represents a preset key derivation function
  • K AF represents a group key
  • AS_ID represents an AS identifier
  • the embodiment of the present disclosure also provides a communication device, including: a transceiver, a memory, a processor, and a program stored in the memory and operable on the processor, and the processor implements the above when executing the program. Steps in the key generation method.
  • the embodiments of the present disclosure further provide a readable storage medium, on which a program is stored, and when the program is executed by a processor, the steps in the key generation method as described above are implemented.
  • the session key K AS is generated by the AF for one or more ASs. Therefore, using the solutions of the embodiments of the present disclosure avoids multiple ASs from repeatedly requesting the AKMA process of the core network, thereby saving signaling resources.
  • FIG. 1 is a schematic diagram of an AKMA key hierarchy in an embodiment of the present disclosure
  • Fig. 2 is one of the flowcharts of the method for generating a key provided by an embodiment of the present disclosure
  • Fig. 3 is the second flowchart of the key generation method provided by the embodiment of the present disclosure.
  • Fig. 4 is the third flowchart of the method for generating a key provided by an embodiment of the present disclosure
  • FIG. 5 is the fourth flowchart of the method for generating a key provided by an embodiment of the present disclosure
  • Fig. 6 is the fifth flowchart of the key generation method provided by the embodiment of the present disclosure.
  • Fig. 7 is one of the structural diagrams of the key generation device provided by the embodiment of the present disclosure.
  • FIG. 8 is the second structural diagram of the key generation device provided by the embodiment of the present disclosure.
  • FIG. 9 is the third structural diagram of the key generation device provided by the embodiment of the present disclosure.
  • FIG. 10 is a fourth structural diagram of a key generation device provided by an embodiment of the present disclosure.
  • Fig. 11 is the fifth structural diagram of the key generation device provided by the embodiment of the present disclosure.
  • FIG. 12 is the sixth structural diagram of the key generation device provided by the embodiment of the present disclosure.
  • the technology described in this paper is not limited to the New Radio (NR) system and the Long Time Evolution (LTE)/LTE evolution (LTE-Advanced, LTE-A) system, and can also be used in various wireless communications systems, such as Code Division Multiple Access (CDMA), Time Division Multiple Access (Time Division Multiple Access, TDMA), Frequency Division Multiple Access (Frequency Division Multiple Access, FDMA), Orthogonal Frequency Division Multiple Access (Orthogonal Frequency Division Multiple Access, OFDMA), Single-carrier Frequency-Division Multiple Access (Single-carrier Frequency-Division Multiple Access, SC-FDMA) and other systems.
  • CDMA Code Division Multiple Access
  • Time Division Multiple Access Time Division Multiple Access
  • FDMA Frequency Division Multiple Access
  • OFDMA Orthogonal Frequency Division Multiple Access
  • SC-FDMA Single-carrier Frequency-Division Multiple Access
  • SC-FDMA Single-carrier Frequency-Division Multiple Access
  • SC-FDMA Single-carrier
  • the CDMA system can implement radio technologies such as CDMA2000, Universal Terrestrial Radio Access (UTRA) and the like.
  • UTRA includes Wideband CDMA (Wideband Code Division Multiple Access, WCDMA) and other CDMA variants.
  • a TDMA system implements a radio technology such as Global System for Mobile Communication (GSM).
  • GSM Global System for Mobile Communication
  • the OFDMA system can realize radios such as UltraMobile Broadband (UltraMobile Broadband, UMB), Evolution-UTRA (Evolution-UTRA, E-UTRA), IEEE 802.21 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20, Flash-OFDM, etc. technology.
  • UTRA and E-UTRA are part of the Universal Mobile Telecommunications System (UMTS).
  • LTE and LTE-Advanced are new UMTS releases that use E-UTRA.
  • UTRA, E-UTRA, UMTS, LTE, LTE-A and GSM are described in documents from an organization named "3rd Generation Partnership Project” (3GPP).
  • CDMA2000 and UMB are described in documents from an organization named "3rd Generation Partnership Project 2" (3GPP2).
  • the techniques described herein may be used for the systems and radio technologies mentioned above as well as other systems and radio technologies.
  • NR systems for example purposes, and NR terminology is used in much of the following description, although the techniques are applicable to applications other than NR system applications as well.
  • Figure 1 shows the key hierarchy for subsequent key derivation using the intermediate key K AUSF in the fifth-generation mobile communication technology (5th-Generation, 5G) key architecture, where ME represents the mobile equipment (Mobile Equipment ), HPLMN (Home Public Land Mobile Network) means home public land mobile network (Public Land Mobile Network, PLMN), and AUSF means authentication server function (Authentication Server Function).
  • ME represents the mobile equipment (Mobile Equipment )
  • HPLMN Home Public Land Mobile Network
  • PLMN Public Land Mobile Network
  • AUSF authentication server function
  • one AF may correspond to multiple ASs, and multiple ASs belong to the same trust domain or belong to the same vertical industry application.
  • KAF is used as the root key or group key of a certain trust domain to perform key derivation for related ASs in the trust domain.
  • the specific method is as follows:
  • K AS KDF(K AF , AS_ID), where KDF is a key derivation function, and AS_ID may be a fully qualified domain name (Fully Qualified Domain Name, FQDN) of the AS.
  • FIG. 2 is a flowchart of a key generation method provided by an embodiment of the present disclosure, which is applied to AF, as shown in FIG. 2, and includes the following steps:
  • Step 201 when the AS and the terminal need to establish a service connection, generate corresponding session keys K AS for one or more ASs according to the group key K AF and preset parameters.
  • the one or more ASs belong to the same trust domain. Different ASs may have different session keys K AS .
  • the group key K AF may be stored by the AF itself, or may be obtained from the AAnF. Optionally, before step 201, the AF acquires a group key K AF .
  • the AF obtains the group key according to the request of the terminal, and may also obtain the group key according to the request of the AS.
  • the group key may also be referred to as a root key.
  • the AF may receive the first request from the terminal, the first request includes the key identifier (AKMA-Key Identifier, A-KID) corresponding to the intermediate key K AKMA , and according to the key identifier, from AAnF obtains the group key K AF , or obtains the group key K AF from the AF itself.
  • A-KID key identifier
  • the first request may be, for example, an application session establishment request (Application Session Establishment Request).
  • Application Session Establishment Request Application Session Establishment Request
  • the AF may obtain the group key K AF from the AAnF. If the AF determines according to the key identifier that it has an activation context associated with the A-KID, then the AF may acquire the group key K AF from the AF itself.
  • the AF may also receive the second request from the AS, the second request includes the key identifier (A-KID) corresponding to the intermediate key K AKMA , and obtains the group key K from AAnF according to the key identifier AF , alternatively, obtains the group key K AF from AF itself.
  • A-KID key identifier
  • the second request may be, for example, a key request. If the AF determines according to the key identifier that it does not have an activation context associated with the A-KID, the AF may obtain the group key K AF from the AAnF. If the AF determines according to the key identifier that it has an activation context associated with the A-KID, then the AF may acquire the group key K AF from the AF itself.
  • the AF may send a third request to the AAnF, the third request includes the key ID and the AF ID AF_ID, and receives the Three requests to send the group key K AF .
  • the AF may send an AKMA application key acquisition request (Naanf_AKMA_ApplicationKey_Get Request) message to the AAnF, and acquire the group key K AF from the AAnF.
  • AKMA application key acquisition request Naanf_AKMA_ApplicationKey_Get Request
  • the preset parameters include the AS identifier AS_ID.
  • AS_ID may be sent to the AF by the one or more ASs after receiving the service establishment request from the terminal, or may be sent by the AF according to the pre-stored ID after receiving the key request from the AS. Information is determined.
  • the AF can generate the session key K AS according to the following formula:
  • K AS KDF(K AF , AS_ID);
  • KDF represents a preset key derivation function
  • K AF represents a group key
  • AS_ID represents an AS identifier
  • the AS ID may be the FQDN of the AS.
  • the AF may also send the corresponding session key K AS to the one or more ASs, so that the ASs complete the establishment of the service connection with the terminal.
  • the AF may directly send the session key K AS to the AS after generating it, or may send the session key K AS to the AS at the request of the AS.
  • the session key K AS is generated by the AF for one or more ASs. Therefore, using the solutions of the embodiments of the present disclosure avoids multiple ASs from repeatedly requesting the AKMA process of the core network, thereby saving signaling resources.
  • FIG. 3 is a flowchart of a key generation method provided by an embodiment of the present disclosure, which is applied to an AS, as shown in FIG. 3, and includes the following steps:
  • Step 301 when it is necessary to establish a service connection with the terminal, obtain the session key K AS from the AF; wherein, the session key K AS is generated by the AF according to the group key K AF and preset parameters.
  • the AS when receiving a service establishment request from a terminal, the AS can obtain the session key K AS from the AF.
  • the AS may receive the fourth request sent by the terminal, the fourth request includes the key identifier corresponding to the intermediate key K AKMA , and send the fifth request to the AF according to the key identifier, so The fifth request includes the key identifier and the AS_ID of the AS.
  • the fourth request may be, for example, a service establishment request
  • the fifth request may be, for example, a key acquisition request.
  • the session key K AS is generated by the AF for belonging to one or more ASs. Therefore, using the solutions of the embodiments of the present disclosure avoids multiple ASs from repeatedly requesting the AKMA process of the core network, thereby saving signaling resources.
  • FIG. 4 is a flowchart of a key generation method provided by an embodiment of the present disclosure, which is applied to a terminal, as shown in FIG. 4, and includes the following steps:
  • Step 401 when it is necessary to establish a service connection with the AS, generate a session key K AS according to the group key K AF and preset parameters.
  • the preset parameters include the AS identifier AS_ID.
  • the terminal can generate the session key K AS according to the following formula:
  • K AS KDF(K AF , AS_ID);
  • KDF represents a preset key derivation function
  • K AF represents a group key
  • AS_ID represents an AS identifier
  • the terminal may also trigger the AS to obtain the session key K AS .
  • the terminal may directly trigger the AF to generate a session key for the AS, or may also trigger the AS to obtain the session key from the AF.
  • the terminal may send a sixth request to the AAnF, where the sixth request includes the key identifier corresponding to the intermediate key K AKMA , and the sixth request is used to trigger the AAnF to perform the key identification according to the group key K AF and preset parameters , generating a corresponding session key K AS for the AS.
  • the sixth request may be, for example, an Application Session Establishment Request (application session establishment request).
  • the terminal may send a seventh request to the AS, where the seventh request includes a key identifier corresponding to the intermediate key K AKMA , and the seventh request is used to trigger the AS to obtain the corresponding session from the AAnF Key K AS .
  • the seventh request may be, for example, a service establishment request.
  • the session key K AS is generated by the AF for one or more ASs. Therefore, using the solutions of the embodiments of the present disclosure avoids multiple ASs from repeatedly requesting the AKMA process of the core network, thereby saving signaling resources.
  • KAF is used as the root key or group key of a certain trust domain to perform key derivation for related ASs in the trust domain.
  • the specific method is as follows:
  • K AS KDF(K AF , AS_ID), where KDF is a key derivation function, and AS_ID may be the FQDN of the AS.
  • FIG. 5 is a flowchart of a key generation method provided by an embodiment of the present disclosure, which may include:
  • Step 501 When a UE (User Equipment, user equipment) starts communication with an AKMA AF (AF), an Application Session Establishment Request (Application Session Establishment Request) message includes an A-KID. The UE may derive KAF before or after sending this message.
  • AKMA AF Application Session Establishment Request
  • UE derives K AKMA and A-KID (key identifier) from K AUSF before interacting with the AKMA application server.
  • Step 502. If there is no activation context associated with A-KID in AKMA AF, AF sends AKMA Application Key Get Request (Naanf_AKMA_ApplicationKey_Get Request) message to AAnF to request K AF of UE.
  • the message carries A-KID and AF_ID.
  • the AF_ID includes the FQDN of the AF and the Ua* protocol identifier, wherein the Ua* protocol identifier is used to identify the security protocol used between the AF and the UE. If AKMA AF has an activation context associated with A-KID, then AKMA AF directly acquires K AF in the activation context.
  • Step 503 AAnF acquires K AF .
  • the AAnF can use the AF_ID to check whether the AAnF can provide services to the AF according to the configured local policy or the authorization information or policy provided by the Network Repository Function (NRF). At the same time, AAnF can determine whether the user is authorized to use AKMA by verifying whether the corresponding K AKMA can be found through A-KID.
  • NRF Network Repository Function
  • AAnF can provide services to AF and determines that the user is authorized to use AKMA, perform the following procedures; otherwise, AAnF refuses to perform subsequent procedures and sends an error response.
  • AAnF can derive K AF from K AKMA ; otherwise, the existing K AF can be used directly.
  • Step 504 AAnF sends an AKMA application key acquisition response (Naanf_AKMA_ApplicationKey_Get Response) message to the AKMA AF, and the response message carries the K AF and the life cycle.
  • the AAnF sends a Naanf_AKMA_ApplicationKey_Get Response message to the AKMA AF, and the response message indicates that the AKMA key request fails.
  • Step 505 AKMA AF sends Application Session Establishment Response message to UE.
  • step 504 If the information in step 504 indicates that the AKMA key request fails, the AF should reject the application session establishment request, and carry the error reason in the application session establishment response (Application Session Establishment Response). Afterwards, the UE may initiate a new application session establishment request to the AF, carrying the latest A-KID
  • Step 506)/506'//506 UE sends a service establishment request to the edge computing service server (AS_1/AS_2/AS_N), carrying A-KID.
  • Step 507)/507'/507 the edge computing service server (AS_1/AS_2/AS_N) sends a key acquisition request (Key request) to the AF, carrying A-KID and AS_ID.
  • step 508)/508'//508" the AF deployed on the edge node respectively generates the corresponding K AS according to the key derivation method described above.
  • Step 509)/509'//509 the AF deployed on the edge node sends the corresponding K AS to the AS through a key response (Key response).
  • Step 510)/510'//510 the AS replies to the UE with a service establishment response, and completes the establishment of the secure channel.
  • FIG. 6 is a flowchart of a method for generating a key provided in an embodiment of the present disclosure.
  • the method may include:
  • Step 601 UE derives K AKMA and A-KID from K AUSF before interacting with the AKMA application server.
  • the UE communicates with the AS (take AS1 as an example), and includes the A-KID in a service establishment request (Application Session Establishment Request) message.
  • Step 602 if there is no K AS associated with the A-KID in the AKMA AS, the AS makes a key request (Key request) to the AF. AS sends a key request to AF, carrying A-KID.
  • Key request a key request to the AF.
  • Step 603 If the AF does not have the key K AF corresponding to the A-KID, the AF sends an AKMA application key acquisition request (Naanf_AKMA_ApplicationKey_Get Request) message to the AAnF, carrying A-KID and AF_ID.
  • AKMA application key acquisition request Naanf_AKMA_ApplicationKey_Get Request
  • Step 604 AAnF derives K AF and returns it to AF.
  • Step 605 AAnF sends an AKMA application key acquisition response (Naanf_AKMA_ApplicationKey_Get Response) message to the AKMA AF, and the response message carries the K AF and the life cycle.
  • AKMA application key acquisition response Naanf_AKMA_ApplicationKey_Get Response
  • Step 606 AF derives K AS_1 according to K AF .
  • Step 607 AF returns K AS_1 to AS_1.
  • step 608 the AS returns a service establishment response to the UE, and completes the establishment of the secure channel.
  • Step 609-Step 613 when the UE communicates with other ASs in the trust domain, the other ASs directly request K AF from the AF, and the AF deduces the corresponding K AS , thereby completing the establishment of a secure channel between the UE and other ASs and protection.
  • AF can derive K AS based on K AF for ASs in the same trust domain, thereby saving the signaling interaction process of the core network and avoiding problems from the same edge computing.
  • the service server of the node repeatedly requests the AKMA process of the core network; at the same time, for delay-sensitive business scenarios, using the solution of the embodiment of the present disclosure saves interaction delay and makes it easier to meet service delay requirements.
  • FIG. 7 is a structural diagram of a key generation device provided by an embodiment of the present disclosure. As shown in Figure 7, the key generation device 700 includes:
  • the first generation module 701 is configured to generate corresponding session keys K AS for one or more ASs according to the group key K AF and preset parameters when the AS and the terminal need to establish a service connection.
  • the one or more ASs belong to the same trust domain.
  • the apparatus may further include: a first sending module, configured to send the corresponding session key K AS to the one or more ASs.
  • a first sending module configured to send the corresponding session key K AS to the one or more ASs.
  • the device further includes: a first obtaining module, configured to obtain the group key K AF .
  • the first acquisition module includes:
  • the first receiving submodule is configured to receive a first request from the terminal, where the first request includes a key identifier corresponding to the intermediate key K AKMA ;
  • the first obtaining submodule is configured to obtain the group key K AF from the application layer authentication and session key management anchor function AAnF according to the key identifier, or obtain the group key K AF from the AF itself .
  • the first acquisition module includes:
  • the first receiving submodule is configured to receive a second request from the AS, where the second request includes a key identifier corresponding to the intermediate key K AKMA ;
  • the first obtaining submodule is configured to obtain the group key K AF from the application layer authentication and session key management anchor function AAnF according to the key identifier, or obtain the group key K AF from the AF itself .
  • the first acquisition submodule includes:
  • a first sending unit configured to send a third request to the AAnF, where the third request includes the key identifier and the AF identifier AF_ID;
  • the first receiving unit is used for the group key K AF sent by the AAnF according to the third request.
  • the preset parameters include the AS identification AS_ID; the first generation module is used to generate corresponding session key K AS .
  • the first generation module is used to generate the session key K AS according to the following formula:
  • K AS KDF(K AF , AS_ID);
  • KDF represents a preset key derivation function
  • K AF represents a group key
  • AS_ID represents an AS identifier
  • the device provided by the embodiments of the present disclosure can execute the above-mentioned method embodiments, and its implementation principles and technical effects are similar, and details will not be repeated here in this embodiment.
  • FIG. 8 is a structural diagram of a key generation device provided by an embodiment of the present disclosure. As shown in Figure 8, the key generation device 800 includes:
  • the first obtaining module 801 is used to obtain the session key K AS from the AF when it is necessary to establish a service connection with the terminal; wherein, the session key K AS is generated by the AF according to the group key K AF and preset parameters of.
  • the first acquisition module includes:
  • the first receiving submodule is configured to receive a fourth request sent by the terminal, where the fourth request includes a key identifier corresponding to the intermediate key K AKMA ;
  • the first sending submodule is configured to send a fifth request to the AF according to the key identifier, where the fifth request includes the key identifier and the AS_ID of the AS;
  • the first acquiring submodule is configured to receive the session key K AS sent by the AF.
  • the device provided by the embodiments of the present disclosure can execute the above-mentioned method embodiments, and its implementation principles and technical effects are similar, and details will not be repeated here in this embodiment.
  • FIG. 9 is a structural diagram of a key generation device provided by an embodiment of the present disclosure.
  • the key generation device 900 includes:
  • the first generating module 901 is configured to generate a session key K AS according to the group key K AF and preset parameters when a service connection needs to be established with the AS.
  • the device may also include:
  • the first triggering module is configured to trigger the AS to obtain the session key K AS .
  • the first trigger module is used to perform any of the following:
  • the sixth request includes the key identifier corresponding to the intermediate key K AKMA , and the sixth request is used to trigger the AAnF to provide the AS with the group key K AF and preset parameters Generate the corresponding session key K AS ;
  • the preset parameters include the AS identification AS_ID; the first generating module is configured to generate the session key K AS according to the following formula:
  • K AS KDF(K AF , AS_ID);
  • KDF represents a preset key derivation function
  • K AF represents a group key
  • AS_ID represents an AS identifier
  • the device provided by the embodiments of the present disclosure can execute the above-mentioned method embodiments, and its implementation principles and technical effects are similar, and details will not be repeated here in this embodiment.
  • each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.
  • the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a processor-readable storage medium.
  • the essence of the technical solution of the present disclosure or the part that contributes to the related technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium.
  • a computer device which may be a personal computer, a server, or a network device, etc.
  • a processor processor
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disc and other media that can store program codes. .
  • An embodiment of the present disclosure provides a key generation device, which is applied to AF, as shown in FIG. 10 , including: a processor 1001 and a transceiver 1002;
  • the processor 1001 is configured to generate a corresponding session key K AS for one or more ASs according to the group key K AF and preset parameters when the AS and the terminal need to establish a service connection.
  • the one or more ASs belong to the same trust domain
  • the transceiver 1002 is configured to send the corresponding session key K AS to the one or more ASs.
  • the processor 1001 is further configured to: acquire the group key K AF .
  • processor 1001 is also used for:
  • the terminal receiving a first request from the terminal, where the first request includes a key identifier corresponding to the intermediate key K AKMA ;
  • the group key K AF is obtained from the application layer authentication and session key management anchor function AAnF, or the group key K AF is obtained from the AF itself.
  • processor 1001 is also used for:
  • the group key K AF is obtained from the application layer authentication and session key management anchor function AAnF, or the group key K AF is obtained from the AF itself.
  • processor 1001 is also used for:
  • the preset parameters include the AS identifier AS_ID; the processor is further configured to:
  • a corresponding session key K AS is generated for the one or more ASs according to the group key K AF and the AS_IDs of the one or more ASs.
  • the processor 1001 is further configured to generate the session key K AS according to the following formula:
  • K AS KDF(K AF , AS_ID);
  • KDF represents a preset key derivation function
  • K AF represents a group key
  • AS_ID represents an AS identifier
  • the device provided by the embodiments of the present disclosure can execute the above-mentioned method embodiments, and its implementation principles and technical effects are similar, and details will not be repeated here in this embodiment.
  • An embodiment of the present disclosure provides a key generation device, which is applied to an AS, as shown in FIG. 11 , including: a processor 1101 and a transceiver 1102;
  • the processor 1101 is configured to obtain a session key K AS from the AF when a service connection needs to be established with the terminal; wherein, the session key K AS is generated by the AF according to the group key K AF and preset parameters of.
  • processor 1101 is also used for:
  • the device provided by the embodiments of the present disclosure can execute the above-mentioned method embodiments, and its implementation principles and technical effects are similar, and details will not be repeated here in this embodiment.
  • An embodiment of the present disclosure provides a key generation device, which is applied to a terminal, as shown in FIG. 12 , including: a processor 1201 and a transceiver 1202;
  • the processor 1201 is configured to generate a session key K AS according to the group key K AF and preset parameters when establishing a service connection with the AS.
  • the processor 1201 is further configured to trigger the AS to obtain the session key K AS .
  • processor 1201 is further configured to perform any of the following:
  • the sixth request includes the key identifier corresponding to the intermediate key K AKMA , and the sixth request is used to trigger the AAnF to provide the AS with the group key K AF and preset parameters Generate the corresponding session key K AS ;
  • the preset parameters include the AS identification AS_ID; where the processor is further configured to generate the session key K AS according to the following formula:
  • K AS KDF(K AF , AS_ID);
  • KDF represents a preset key derivation function
  • K AF represents a group key
  • AS_ID represents an AS identifier
  • the device provided by the embodiments of the present disclosure can execute the above-mentioned method embodiments, and its implementation principles and technical effects are similar, and details will not be repeated here in this embodiment.
  • An embodiment of the present disclosure provides a communication device, including: a memory, a processor, and a program stored in the memory and operable on the processor; the processor is used to read the program in the memory to implement Steps in the key generation method as previously described.
  • Embodiments of the present disclosure also provide a readable storage medium, on which a program is stored, and when the program is executed by a processor, each process of the above key generation method embodiment can be achieved, and the same technical effect can be achieved. To avoid repetition, I won't go into details here.
  • the readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor memory (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state drive (SSD)), etc.
  • magnetic storage such as floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.
  • optical storage such as CD, DVD, BD, HVD, etc.
  • semiconductor memory such as ROM, EPROM, EEPROM, non-volatile

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本公开公开了一种密钥生成方法、装置、设备及可读存储介质，涉及通信技术领域，以节约信令资源。该方法包括：当AS和终端需要建立业务连接时，根据组密钥K AF和预设参数，为一个或多个AS生成对应的会话密钥K AS。

Description

一种密钥生成方法、装置、设备及可读存储介质
相关申请的交叉引用
本申请主张在2021年12月14日在中国提交的中国专利申请号No.202111527694.0的优先权，其全部内容通过引用包含于此。
技术领域
本公开涉及通信技术领域，尤其涉及一种密钥生成方法、装置、设备及可读存储介质。
背景技术
标准中定义了应用层认证和密钥管理(Authentication and Key Management for Applications，AKMA)的架构和流程。AKMA技术可用于边缘计算场景下终端和边缘计算服务器之间的认证和授权、以及终端和边缘计算服务器之间业务通道的安全保护。
在边缘计算等应用场景中，同一个边缘节点会有多个业务服务器，而这些业务服务器属于同一个信任域或属于同一个垂直行业应用者。在这种情况下，终端和各业务服务器之间执行AKMA流程，使得核心网(AKMA锚点功能(AKMA Anchor Function，AAnF))为各业务服务器分别执行AKMA流程和生成最终密钥(K AF)。
由此可以看出，相关技术中，针对每一个应用功能(Application Function，AF)对AAnF的请求，AAnF都要执行AKMA流程并为AF生成相应的最终密钥，从而造成核心网资源和信令流程的浪费。
发明内容
本公开实施例提供一种密钥生成方法、装置、设备及可读存储介质，以节约信令资源。
第一方面，本公开实施例提供了一种密钥生成方法，应用于AF，包括：
当应用服务器(Application Service，AS)和终端需要建立业务连接时， 根据组密钥K AF和预设参数，为一个或多个AS生成对应的会话密钥K AS。
其中，所述一个或多个AS属于同一个信任域。
其中，所述方法还包括：
向所述一个或多个AS发送对应的会话密钥K AS。
其中，在所述根据组密钥K AF和预设参数，为一个或多个AS生成对应的会话密钥K AS之前，所述方法还包括：
获取所述组密钥K AF。
其中，所述获取所述组密钥K AF，包括：
接收所述终端的第一请求，所述第一请求包括中间密钥K AKMA对应的密钥标识；
根据所述密钥标识，从AAnF获取组密钥K AF，或者，从AF自身获取所述组密钥K AF。
其中，所述获取所述组密钥K AF，包括：
接收AS的第二请求，所述第二请求包括中间密钥K AKMA对应的密钥标识；
根据所述密钥标识，从应用层认证和会话密钥管理锚点功能AAnF获取所述组密钥K AF，或者，从AF自身获取所述组密钥K AF。
其中，根据所述密钥标识，从应用层认证和会话密钥管理锚点功能AAnF获取所述组密钥K AF，包括：
向所述AAnF发送第三请求，所述第三请求包括所述密钥标识和AF标识AF_ID；
接收所述AAnF根据所述第三请求发送的组密钥K AF。
其中，所述预设参数包括AS标识AS_ID；所述根据所述组密钥K AF和预设参数，为一个或多个AS生成对应的会话密钥K AS，包括：
根据所述组密钥K AF和所述一个或多个AS的AS_ID，为所述一个或多个AS生成对应的会话密钥K AS。
其中，按照以下公式生成会话密钥K AS：
K AS＝KDF(K AF，AS_ID)；
其中，KDF表示预设的密钥推衍函数，K AF表示组密钥，AS_ID表示AS 的标识。
其中，所述AS_ID由所述一个或多个AS发送给所述AF。
第二方面，本公开实施例提供了一种密钥生成方法，应用于AS，包括：
当需要和终端建立业务连接时，从AF获取会话密钥K AS；其中，所述会话密钥K AS是所述AF根据组密钥K AF和预设参数生成的。
其中，所述从AF获取会话密钥K AS，包括：
接收所述终端发送的第四请求，所述第四请求包括中间密钥K AKMA对应的密钥标识；
根据所述密钥标识，向所述AF发送第五请求，所述第五请求包括所述密钥标识以及所述AS的AS_ID；
接收所述AF发送的会话密钥K AS。
第三方面，本公开实施例提供了一种密钥生成方法，应用于终端，包括：
当需要和AS建立业务连接时，根据组密钥K AF和预设参数，生成会话密钥K AS。
其中，所述方法还包括：触发所述AS获取会话密钥K AS。
其中，所述触发所述AS获取会话密钥K AS，包括以下任意一项：
向AAnF发送第六请求，所述第六请求包括中间密钥K AKMA对应的密钥标识，所述第六请求用于触发所述AAnF根据组密钥K AF和预设参数，为所述AS生成对应的会话密钥K AS；
向所述AS发送第七请求，所述第七请求包括中间密钥K AKMA对应的密钥标识，所述第七请求用于触发所述AS从所述AAnF获取对应的会话密钥K AS。
其中，所述预设参数包括AS标识AS_ID；按照以下公式生成会话密钥K AS：
K AS＝KDF(K AF，AS_ID)；
其中，KDF表示预设的密钥推衍函数，K AF表示组密钥，AS_ID表示AS的标识。
第四方面，本公开实施例提供了一种密钥生成装置，应用于AF，包括：
第一生成模块，用于当AS和终端需要建立业务连接时，根据组密钥K AF 和预设参数，为一个或多个AS生成对应的会话密钥K AS。
其中，所述一个或多个AS属于同一个信任域。
其中，所述装置还包括：
第一发送模块，用于向所述一个或多个AS发送对应的会话密钥K AS。
其中，所述装置还包括：
第一获取模块，用于获取所述组密钥K AF。
其中，所述第一获取模块包括：
第一接收子模块，用于接收所述终端的第一请求，所述第一请求包括中间密钥K AKMA对应的密钥标识；
第一获取子模块，用于根据所述密钥标识，从应用层认证和会话密钥管理锚点功能AAnF获取所述组密钥K AF，或者，从AF自身获取所述组密钥K AF。
其中，所述第一获取模块包括：
第一接收子模块，用于接收AS的第二请求，所述第二请求包括中间密钥K AKMA对应的密钥标识；
第一获取子模块，用于根据所述密钥标识，从应用层认证和会话密钥管理锚点功能AAnF获取所述组密钥K AF，或者，从AF自身获取所述组密钥K AF。
其中，所述第一获取子模块包括：
第一发送单元，用于向所述AAnF发送第三请求，所述第三请求包括所述密钥标识和AF标识AF_ID；
第一接收单元，用于所述AAnF根据所述第三请求发送的组密钥K AF。
其中，所述预设参数包括AS标识AS_ID；所述第一生成模块用于，根据所述组密钥K AF和所述一个或多个AS的AS_ID，为所述一个或多个AS生成对应的会话密钥K AS。
其中，所述第一生成模块用于，按照以下公式生成会话密钥K AS：
K AS＝KDF(K AF，AS_ID)；
其中，KDF表示预设的密钥推衍函数，K AF表示组密钥，AS_ID表示AS的标识。
第五方面，本公开实施例提供了一种密钥生成装置，应用于AS，包括：
第一获取模块，用于当需要和终端建立业务连接时，从AF获取会话密钥K AS；其中，所述会话密钥K AS是所述AF根据组密钥K AF和预设参数生成的。
其中，所述第一获取模块包括：
第一接收子模块，用于接收所述终端发送的第四请求，所述第四请求包括中间密钥K AKMA对应的密钥标识；
第一发送子模块，用于根据所述密钥标识，向所述AF发送第五请求，所述第五请求包括所述密钥标识以及所述AS的AS_ID；
第一获取子模块，用于接收所述AF发送的会话密钥K AS。
第六方面，本公开实施例提供了一种密钥生成装置，应用于终端，包括：
第一生成模块，用于当需要和AS建立业务连接时，根据组密钥K AF和预设参数，生成会话密钥K AS。
其中，所述装置还包括：
第一触发模块，用于触发所述AS获取会话密钥K AS。
其中，所述第一触发模块用于执行以下任意一项：
向AAnF发送第六请求，所述第六请求包括中间密钥K AKMA对应的密钥标识，所述第六请求用于触发所述AAnF根据组密钥K AF和预设参数，为所述AS生成对应的会话密钥K AS；
向所述AS发送第七请求，所述第七请求包括中间密钥K AKMA对应的密钥标识，所述第五请求用于触发所述AS从所述AAnF获取对应的会话密钥K AS。
其中，所述预设参数包括AS标识AS_ID；所述第一生成模块，用于按照以下公式生成会话密钥K AS：
K AS＝KDF(K AF，AS_ID)；
其中，KDF表示预设的密钥推衍函数，K AF表示组密钥，AS_ID表示AS的标识。
第七方面，本公开实施例提供了一种密钥生成装置，应用于AF，包括：处理器和收发器；
所述处理器，用于当AS和终端需要建立业务连接时，根据组密钥K AF和预设参数，为一个或多个AS生成对应的会话密钥K AS。
其中，所述一个或多个AS属于同一个信任域。
其中，所述收发器，用于向所述一个或多个AS发送对应的会话密钥K AS。
其中，所述处理器还用于：获取所述组密钥K AF。
其中，所述处理器还用于：
接收所述终端的第一请求，所述第一请求包括中间密钥K AKMA对应的密钥标识；
根据所述密钥标识，从应用层认证和会话密钥管理锚点功能AAnF获取所述组密钥K AF，或者，从AF自身获取所述组密钥K AF。
其中，所述处理器还用于：
接收AS的第二请求，所述第二请求包括中间密钥K AKMA对应的密钥标识；
根据所述密钥标识，从应用层认证和会话密钥管理锚点功能AAnF获取所述组密钥K AF，或者，从AF自身获取所述组密钥K AF。
其中，所述处理器还用于：
向所述AAnF发送第三请求，所述第三请求包括所述密钥标识和AF标识AF_ID；
接收所述AAnF根据所述第三请求发送的组密钥K AF。
其中，所述预设参数包括AS标识AS_ID；所述处理器还用于：
根据所述组密钥K AF和所述一个或多个AS的AS_ID，为所述一个或多个AS生成对应的会话密钥K AS。
其中，所述处理器还用于按照以下公式生成会话密钥K AS：
K AS＝KDF(K AF，AS_ID)；
其中，KDF表示预设的密钥推衍函数，K AF表示组密钥，AS_ID表示AS的标识。
第八方面，本公开实施例提供了一种密钥生成装置，应用于AS，包括：处理器和收发器；
所述处理器，用于当需要和终端建立业务连接时，从AF获取会话密钥 K AS；其中，所述会话密钥K AS是所述AF根据组密钥K AF和预设参数生成的。
其中，所述处理器还用于：
接收所述终端发送的第四请求，所述第四请求包括中间密钥K AKMA对应的密钥标识；
根据所述密钥标识，向所述AF发送第五请求，所述第五请求包括所述密钥标识以及所述AS的AS_ID；
接收所述AF发送的会话密钥K AS。
第九方面，本公开实施例提供了一种密钥生成装置，应用于终端，包括：处理器和收发器；
所述处理器，用于当需要和AS建立业务连接时，根据组密钥K AF和预设参数，生成会话密钥K AS。
其中，所述处理器还用于触发所述AS获取会话密钥K AS。
其中，所述处理器还用于执行以下任意一项：
向AAnF发送第六请求，所述第六请求包括中间密钥K AKMA对应的密钥标识，所述第六请求用于触发所述AAnF根据组密钥K AF和预设参数，为所述AS生成对应的会话密钥K AS；
向所述AS发送第五请求，所述第五请求包括中间密钥K AKMA对应的密钥标识，所述第七请求用于触发所述AS从所述AAnF获取对应的会话密钥K AS。
其中，所述预设参数包括AS标识AS_ID；其中，所述处理器还用于按照以下公式生成会话密钥K AS：
K AS＝KDF(K AF，AS_ID)；
其中，KDF表示预设的密钥推衍函数，K AF表示组密钥，AS_ID表示AS的标识。
第十方面，本公开实施例还提供一种通信设备，包括：收发机、存储器、处理器及存储在存储器上并可在处理器上运行的程序，所述处理器执行所述程序时实现如上所述的密钥生成方法中的步骤。
第十一方面，本公开实施例还提供一种可读存储介质，所述可读存储介质上存储程序，所述程序被处理器执行时实现如上所述的密钥生成方法中的 步骤。
在本公开实施例中，由AF为一个或者多个AS生成会话密钥K AS。因此，利用本公开实施例的方案，避免了多个AS对核心网AKMA流程的重复请求，从而节约了信令资源。
附图说明
图1是本公开实施例的AKMA密钥层级体系的示意图；
图2是本公开实施例提供的密钥生成方法的流程图之一；
图3是本公开实施例提供的密钥生成方法的流程图之二；
图4是本公开实施例提供的密钥生成方法的流程图之三；
图5是本公开实施例提供的密钥生成方法的流程图之四；
图6是本公开实施例提供的密钥生成方法的流程图之五；
图7是本公开实施例提供的密钥生成装置的结构图之一；
图8是本公开实施例提供的密钥生成装置的结构图之二；
图9是本公开实施例提供的密钥生成装置的结构图之三；
图10是本公开实施例提供的密钥生成装置的结构图之四；
图11是本公开实施例提供的密钥生成装置的结构图之五；
图12是本公开实施例提供的密钥生成装置的结构图之六。
具体实施方式
本公开实施例中术语“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。
本公开实施例中术语“多个”是指两个或两个以上，其它量词与之类似。
本文所描述的技术不限于新空口(New Radio，NR)系统以及长期演进型(Long Time Evolution，LTE)/LTE的演进(LTE-Advanced，LTE-A)系统，并且也可用于各种无线通信系统，诸如码分多址(Code Division Multiple Access，CDMA)、时分多址(Time Division Multiple Access，TDMA)、频分多址(Frequency Division Multiple Access，FDMA)、正交频分多址(Orthogonal  Frequency Division Multiple Access，OFDMA)、单载波频分多址(Single-carrier Frequency-Division Multiple Access，SC-FDMA)和其他系统。术语“系统”和“网络”常被可互换地使用。CDMA系统可实现诸如CDMA2000、通用地面无线电接入(Universal Terrestrial Radio Access，UTRA)等无线电技术。UTRA包括宽带CDMA(Wideband Code Division Multiple Access，WCDMA)和其他CDMA变体。TDMA系统可实现诸如全球移动通信系统(Global System for Mobile Communication，GSM)之类的无线电技术。OFDMA系统可实现诸如超移动宽带(UltraMobile Broadband，UMB)、演进型UTRA(Evolution-UTRA，E-UTRA)、IEEE 802.21(Wi-Fi)、IEEE 802.16(WiMAX)、IEEE 802.20、Flash-OFDM等无线电技术。UTRA和E-UTRA是通用移动电信系统(Universal Mobile Telecommunications System，UMTS)的部分。LTE和更高级的LTE(如LTE-A)是使用E-UTRA的新UMTS版本。UTRA、E-UTRA、UMTS、LTE、LTE-A以及GSM在来自名为“第三代伙伴项目”(3rd Generation Partnership Project，3GPP)的组织的文献中描述。CDMA2000和UMB在来自名为“第三代伙伴项目2”(3GPP2)的组织的文献中描述。本文所描述的技术既可用于以上提及的系统和无线电技术，也可用于其他系统和无线电技术。然而，以下描述出于示例目的描述了NR系统，并且在以下大部分描述中使用NR术语，尽管这些技术也可应用于NR系统应用以外的应用。
以下描述提供示例而并非限定权利要求中阐述的范围、适用性或者配置。可以对所讨论的要素的功能和布置作出改变而不会脱离本公开的精神和范围。各种示例可恰适地省略、替代、或添加各种规程或组件。例如，可以按不同于所描述的次序来执行所描述的方法，并且可以添加、省去、或组合各种步骤。另外，参照某些示例所描述的特征可在其他示例中被组合。
图1示出了使用第五代移动通信技术(5th-Generation，5G)密钥架构中的中间密钥K AUSF进行后续密钥推衍的密钥层级体系，其中，ME表示移动设备(Mobile Equipment)，HPLMN(Home Public Land Mobile Network)表示归属公共陆地移动网(Public Land Mobile Network，PLMN)，AUSF表示鉴权服务功能(Authentication Server Function)。其中，一个AF可对应于多个 AS，多个AS属于同一个信任域或者属于同一个垂直行业应用者。
在本公开实施例中，利用K AF作为某个信任域的根密钥或者组密钥，进行用于该信任域下相关的AS的密钥派生。具体方法如下：
K AS＝KDF(K AF,AS_ID)，其中，KDF为密钥推衍函数，AS_ID可以为AS的全限定域名(Fully Qualified Domain Name，FQDN)。
以下，结合不同的实施例详细描述一下本公开实施例的具体实现过程。
参见图2，图2是本公开实施例提供的密钥生成方法的流程图，应用于AF，如图2所示，包括以下步骤：
步骤201、当AS和终端需要建立业务连接时，根据组密钥K AF和预设参数，为一个或多个AS生成对应的会话密钥K AS。
其中，所述一个或多个AS属于同一个信任域。不同的AS可具有不同的会话密钥K AS。
其中，所述组密钥K AF可以是AF本身存储有的，也可以是从AAnF获取的。可选地，在步骤201之前，所述AF获取组密钥K AF。
具体的，所述AF根据终端的请求获取组密钥，也可根据AS的请求获取组密钥。其中，所述组密钥也可称为根密钥。
具体的，AF可接收所述终端的第一请求，所述第一请求包括中间密钥K AKMA对应的密钥标识(AKMA-Key Identifier，A-KID)，并根据所述密钥标识，从AAnF获取组密钥K AF，或者，从AF自身获取所述组密钥K AF。
其中，所述第一请求例如可以是应用会话建立请求(Application Session Establishment Request)。如果所述AF根据所述密钥标识确定本身没有与A-KID相关联的激活上下文，那么，AF可从AAnF获取组密钥K AF。如果所述AF根据所述密钥标识确定本身具有与A-KID相关联的激活上下文，那么，AF可从AF自身获取所述组密钥K AF。
具体的，AF还可接收AS的第二请求，所述第二请求包括中间密钥K AKMA对应的密钥标识(A-KID)，并根据所述密钥标识，从AAnF获取组密钥K AF，或者，从AF自身获取所述组密钥K AF。
其中，所述第二请求例如可以是密钥请求。如果所述AF根据所述密钥标识确定本身没有与A-KID相关联的激活上下文，那么，AF可从AAnF获 取组密钥K AF。如果所述AF根据所述密钥标识确定本身具有与A-KID相关联的激活上下文，那么，AF可从AF自身获取所述组密钥K AF。
在AF从AAnF获取组密钥K AF的过程中，AF可向所述AAnF发送第三请求，所述第三请求包括所述密钥标识和AF标识AF_ID，并接收所述AAnF根据所述第三请求发送的组密钥K AF。例如，AF可向AAnF发送AKMA应用密钥获取请求(Naanf_AKMA_ApplicationKey_Get Request)消息，并从AAnF获取组密钥K AF。
在本公开实施例中，所述预设参数包括AS标识AS_ID。其中，所述AS_ID可以是由所述一个或多个AS在接收到终端的业务建立请求之后发送给所述AF的，也可以是由AF在接收到AS的密钥请求后，根据预先存储的信息确定的。
具体的，AF可按照以下公式生成会话密钥K AS：
K AS＝KDF(K AF，AS_ID)；
其中，KDF表示预设的密钥推衍函数，K AF表示组密钥，AS_ID表示AS的标识。
其中，所述AS ID可以为AS的FQDN。
可选地，AF还可向所述一个或多个AS发送对应的会话密钥K AS，从而由AS完成与终端的业务连接的建立。具体的，AF可在生成会话密钥K AS后直接将其发送给AS，也可应AS的请求将会话密钥K AS发送给AS。
在本公开实施例中，由AF为一个或者多个AS生成会话密钥K AS。因此，利用本公开实施例的方案，避免了多个AS对核心网AKMA流程的重复请求，从而节约了信令资源。
参见图3，图3是本公开实施例提供的密钥生成方法的流程图，应用于AS，如图3所示，包括以下步骤：
步骤301、当需要和终端建立业务连接时，从AF获取会话密钥K AS；其中，所述会话密钥K AS是所述AF根据组密钥K AF和预设参数生成的。
在实际应用中，当接收到终端的业务建立请求时，AS可从AF获取会话密钥K AS。
具体的，AS可接收所述终端发送的第四请求，所述第四请求包括中间密 钥K AKMA对应的密钥标识，并根据所述密钥标识，向所述AF发送第五请求，所述第五请求包括所述密钥标识以及所述AS的AS_ID。
其中，所述第四请求例如可以是业务建立请求，第五请求例如可以是密钥获取请求等。
在本公开实施例中，由AF为属于一个或者多个AS生成会话密钥K AS。因此，利用本公开实施例的方案，避免了多个AS对核心网AKMA流程的重复请求，从而节约了信令资源。
参见图4，图4是本公开实施例提供的密钥生成方法的流程图，应用于终端，如图4所示，包括以下步骤：
步骤401、当需要和AS建立业务连接时，根据组密钥K AF和预设参数，生成会话密钥K AS。
其中，所述预设参数包括AS标识AS_ID。所述终端可按照以下公式生成会话密钥K AS：
K AS＝KDF(K AF，AS_ID)；
其中，KDF表示预设的密钥推衍函数，K AF表示组密钥，AS_ID表示AS的标识。
在以上实施例中，终端还可触发所述AS获取会话密钥K AS。其中，终端可直接触发AF为AS生成会话密钥，或者，也可触发AS从AF获取会话密钥。
具体的，终端可向AAnF发送第六请求，所述第六请求包括中间密钥K AKMA对应的密钥标识，所述第六请求用于触发所述AAnF根据组密钥K AF和预设参数，为所述AS生成对应的会话密钥K AS。其中，所述第六请求例如可以是Application Session Establishment Request(应用会话建立请求)。
具体的，终端可向所述AS发送第七请求，所述第七请求包括中间密钥K AKMA对应的密钥标识，所述第七请求用于触发所述AS从所述AAnF获取对应的会话密钥K AS。其中，所述第七请求例如可以是业务建立请求。
在本公开实施例中，由AF为一个或者多个AS生成会话密钥K AS。因此，利用本公开实施例的方案，避免了多个AS对核心网AKMA流程的重复请求，从而节约了信令资源。
在本公开实施例中，利用K AF作为某个信任域的根密钥或者组密钥，进行用于该信任域下相关的AS的密钥派生。具体方法如下：
K AS＝KDF(K AF,AS_ID)，其中，KDF为密钥推衍函数，AS_ID可以为AS的FQDN。
在以下的实施例中，假设终端和核心网已经完成了K AKMA密钥的建立。
参见图5，图5是本公开实施例提供的密钥生成方法的流程图，该方法可包括：
步骤501、当UE(User Equipment，用户设备)启动与AKMA AF(AF)的通信时，在应用会话建立请求(Application Session Establishment Request)消息包括A-KID。UE可在发送该消息之前或之后推衍K AF。
其中，UE在与AKMA应用服务器交互之前，从K AUSF推衍出K AKMA和A-KID(密钥标识)。
步骤502、如果AKMA AF中没有与A-KID相关联的激活上下文，则AF向AAnF发送AKMA应用密钥获取请求(Naanf_AKMA_ApplicationKey_Get Request)消息，请求UE的K AF，消息携带A-KID和AF_ID。其中，AF_ID包括AF的FQDN和Ua*协议标识符，其中Ua*协议标识符用于标识AF与UE之间使用的安全协议。如果AKMA AF中具有与A-KID相关联的激活上下文，那么，AKMA AF直接获取激活上下文中的K AF。
步骤503、AAnF获取K AF。
AAnF可根据配置的本地策略或网络存储功能(Network Repository Function，NRF)提供的授权信息或策略，使用AF_ID检查AAnF是否可以向AF提供服务。同时，AAnF可通过验证是否能够通过A-KID来找到相对应的K AKMA来确定用户是否被授权使用AKMA。
当AAnF可以向AF提供服务且确定用户被授权使用AKMA时，执行以下流程；否则AAnF拒绝执行后续流程，并发送错误响应。
如果AAnF没有K AF的话，则AAnF由K AKMA推衍出K AF；否则，可直接利用已有K AF。
步骤504、AAnF向AKMA AF发送AKMA应用密钥获取响应(Naanf_AKMA_ApplicationKey_Get Response)消息，该响应消息中携带K AF 和生命周期。或者，AAnF向AKMA AF发送Naanf_AKMA_ApplicationKey_Get Response消息，响应消息表明AKMA密钥请求失败。
步骤505、AKMA AF向UE发送Application Session Establishment Response消息。
如果步骤504的信息中表明了AKMA密钥请求失败，则AF应拒绝应用会话建立请求，并在应用会话建立响应(Application Session Establishment Response)中携带错误原因。之后，UE可能会向AF发起新的应用会话建立请求，携带最新的A-KID
步骤506)/506’//506”、UE向边缘计算业务服务器(AS_1/AS_2/AS_N)发送业务建立请求，携带A-KID。
步骤507)/507’/507”、边缘计算业务服务器(AS_1/AS_2/AS_N)向AF发送密钥获取请求(Key request)，携带A-KID，AS_ID。
步骤508)/508’//508”、部署在该边缘节点的AF根据前述描述的密钥推衍方法分别生成对应的K AS。
步骤509)/509’//509”、部署在该边缘节点的AF通过密钥响应(Key response)将对应的K AS发送给AS。
步骤510)/510’//510”、AS回复UE业务建立响应，完成安全通道的建立。
参见图6，图6是本公开实施例提供的密钥生成方法的流程图，该方法可包括：
步骤601、UE在与AKMA应用服务器交互之前，从K AUSF推衍出K AKMA和A-KID。UE与AS(以AS1为例)通信，在业务建立请求(Application Session Establishment Request)消息包括A-KID。
步骤602、如果AKMA AS中没有与A-KID相关联的K AS，则AS向AF进行密钥请求(Key request)。AS向AF发送密钥请求，携带A-KID。
步骤603、AF如果没有与A-KID相对应的密钥K AF的话，则AF向AAnF发送AKMA应用密钥获取请求(Naanf_AKMA_ApplicationKey_Get Request)消息，携带A-KID，AF_ID。
步骤604、AAnF推衍K AF并返给AF。
步骤605、AAnF向AKMA AF发送AKMA应用密钥获取响应(Naanf_AKMA_ApplicationKey_Get Response)消息，响应消息中携带K AF和生命周期。
步骤606、AF根据K AF推衍K AS_1。
步骤607、AF将K AS_1返回给AS_1。
步骤608、AS向UE回复业务建立响应，完成安全通道的建立。
步骤609-步骤613、UE与信任域下的其他AS通信时，其他AS直接向AF请求K AF，AF并进行相应的K AS的推衍，从而完成UE与其他AS之间的安全通道的建立和保护。
通过以上描述可以看出，利用本公开实施例的方案，由AF为同一信任域中的AS基于K AF推衍K AS，从而节省了核心网的信令交互流程，避免了来自同一个边缘计算节点的业务服务器对核心网AKMA流程的重复请求；同时，对时延敏感的业务场景来说，利用本公开实施例的方案，节省了交互时延，更容易满足业务时延需求。
本公开实施例还提供了一种密钥生成装置，应用于AF。参见图7，图7是本公开实施例提供的密钥生成装置的结构图。如图7所示，密钥生成装置700包括：
第一生成模块701，用于当AS和终端需要建立业务连接时，根据组密钥K AF和预设参数，为一个或多个AS生成对应的会话密钥K AS。
其中，所述一个或多个AS属于同一个信任域。
可选地，所述装置还可包括：第一发送模块，用于向所述一个或多个AS发送对应的会话密钥K AS。
其中，所述装置还包括：第一获取模块，用于获取所述组密钥K AF。
其中，所述第一获取模块包括：
第一接收子模块，用于接收所述终端的第一请求，所述第一请求包括中间密钥K AKMA对应的密钥标识；
第一获取子模块，用于根据所述密钥标识，从应用层认证和会话密钥管理锚点功能AAnF获取所述组密钥K AF，或者，从AF自身获取所述组密钥 K AF。
其中，所述第一获取模块包括：
第一接收子模块，用于接收AS的第二请求，所述第二请求包括中间密钥K AKMA对应的密钥标识；
第一获取子模块，用于根据所述密钥标识，从应用层认证和会话密钥管理锚点功能AAnF获取所述组密钥K AF，或者，从AF自身获取所述组密钥K AF。
其中，所述第一获取子模块包括：
第一发送单元，用于向所述AAnF发送第三请求，所述第三请求包括所述密钥标识和AF标识AF_ID；
第一接收单元，用于所述AAnF根据所述第三请求发送的组密钥K AF。
其中，所述预设参数包括AS标识AS_ID；所述第一生成模块用于，根据所述组密钥K AF和所述一个或多个AS的AS_ID，为所述一个或多个AS生成对应的会话密钥K AS。
其中，所述第一生成模块用于，按照以下公式生成会话密钥K AS：
K AS＝KDF(K AF，AS_ID)；
其中，KDF表示预设的密钥推衍函数，K AF表示组密钥，AS_ID表示AS的标识。
本公开实施例提供的装置，可以执行上述方法实施例，其实现原理和技术效果类似，本实施例此处不再赘述。
本公开实施例还提供了一种密钥生成装置，应用于AS。参见图8，图8是本公开实施例提供的密钥生成装置的结构图。如图8所示，密钥生成装置800包括：
第一获取模块801，用于当需要和终端建立业务连接时，从AF获取会话密钥K AS；其中，所述会话密钥K AS是所述AF根据组密钥K AF和预设参数生成的。
其中，所述第一获取模块包括：
第一接收子模块，用于接收所述终端发送的第四请求，所述第四请求包括中间密钥K AKMA对应的密钥标识；
第一发送子模块，用于根据所述密钥标识，向所述AF发送第五请求，所述第五请求包括所述密钥标识以及所述AS的AS_ID；
第一获取子模块，用于接收所述AF发送的会话密钥K AS。
本公开实施例提供的装置，可以执行上述方法实施例，其实现原理和技术效果类似，本实施例此处不再赘述。
本公开实施例还提供了一种密钥生成装置，应用于终端。参见图9，图9是本公开实施例提供的密钥生成装置的结构图。如图9所示，密钥生成装置900包括：
第一生成模块901，用于当需要和AS建立业务连接时，根据组密钥K AF和预设参数，生成会话密钥K AS。
其中，所述装置还可包括：
第一触发模块，用于触发所述AS获取会话密钥K AS。
其中，所述第一触发模块用于执行以下任意一项：
向AAnF发送第六请求，所述第六请求包括中间密钥K AKMA对应的密钥标识，所述第六请求用于触发所述AAnF根据组密钥K AF和预设参数，为所述AS生成对应的会话密钥K AS；
向所述AS发送第七请求，所述第七请求包括中间密钥K AKMA对应的密钥标识，所述第五请求用于触发所述AS从所述AAnF获取对应的会话密钥K AS。
其中，所述预设参数包括AS标识AS_ID；所述第一生成模块，用于按照以下公式生成会话密钥K AS：
K AS＝KDF(K AF，AS_ID)；
其中，KDF表示预设的密钥推衍函数，K AF表示组密钥，AS_ID表示AS的标识。
本公开实施例提供的装置，可以执行上述方法实施例，其实现原理和技术效果类似，本实施例此处不再赘述。
需要说明的是，本公开实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。另外，在本公开各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物 理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个处理器可读取存储介质中。基于这样的理解，本公开的技术方案本质上或者说对相关技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本公开各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
本公开实施例提供了一种密钥生成装置，应用于AF，如图10所示，包括：处理器1001和收发器1002；
所述处理器1001，用于当AS和终端需要建立业务连接时，根据组密钥K AF和预设参数，为一个或多个AS生成对应的会话密钥K AS。
其中，所述一个或多个AS属于同一个信任域；
其中，所述收发器1002，用于向所述一个或多个AS发送对应的会话密钥K AS。
其中，所述处理器1001还用于：获取所述组密钥K AF。
其中，所述处理器1001还用于：
接收所述终端的第一请求，所述第一请求包括中间密钥K AKMA对应的密钥标识；
根据所述密钥标识，从应用层认证和会话密钥管理锚点功能AAnF获取所述组密钥K AF，或者，从AF自身获取所述组密钥K AF。
其中，所述处理器1001还用于：
接收AS的第二请求，所述第二请求包括中间密钥K AKMA对应的密钥标识；
根据所述密钥标识，从应用层认证和会话密钥管理锚点功能AAnF获取所述组密钥K AF，或者，从AF自身获取所述组密钥K AF。
其中，所述处理器1001还用于：
向所述AAnF发送第三请求，所述第三请求包括所述密钥标识和AF标识AF_ID；
接收所述AAnF根据所述第三请求发送的组密钥K AF。
其中，所述预设参数包括AS标识AS_ID；所述处理器还用于：
根据所述组密钥K AF和所述一个或多个AS的AS_ID，为所述一个或多个AS生成对应的会话密钥K AS。
其中，所述处理器1001还用于按照以下公式生成会话密钥K AS：
K AS＝KDF(K AF，AS_ID)；
其中，KDF表示预设的密钥推衍函数，K AF表示组密钥，AS_ID表示AS的标识。
本公开实施例提供的装置，可以执行上述方法实施例，其实现原理和技术效果类似，本实施例此处不再赘述。
本公开实施例提供了一种密钥生成装置，应用于AS，如图11所示，包括：处理器1101和收发器1102；
所述处理器1101，用于当需要和终端建立业务连接时，从AF获取会话密钥K AS；其中，所述会话密钥K AS是所述AF根据组密钥K AF和预设参数生成的。
其中，所述处理器1101还用于：
接收所述终端发送的第四请求，所述第四请求包括中间密钥K AKMA对应的密钥标识；
根据所述密钥标识，向所述AF发送第五请求，所述第五请求包括所述密钥标识以及所述AS的AS_ID；
接收所述AF发送的会话密钥K AS。
本公开实施例提供的装置，可以执行上述方法实施例，其实现原理和技术效果类似，本实施例此处不再赘述。
本公开实施例提供了一种密钥生成装置，应用于终端，如图12所示，包括：处理器1201和收发器1202；
所述处理器1201，用于当需要和AS建立业务连接时，根据组密钥K AF 和预设参数，生成会话密钥K AS。
其中，所述处理器1201还用于触发所述AS获取会话密钥K AS。
其中，所述处理器1201还用于执行以下任意一项：
向AAnF发送第六请求，所述第六请求包括中间密钥K AKMA对应的密钥标识，所述第六请求用于触发所述AAnF根据组密钥K AF和预设参数，为所述AS生成对应的会话密钥K AS；
向所述AS发送第五请求，所述第五请求包括中间密钥K AKMA对应的密钥标识，所述第七请求用于触发所述AS从所述AAnF获取对应的会话密钥K AS。
其中，所述预设参数包括AS标识AS_ID；其中，所述处理器还用于按照以下公式生成会话密钥K AS：
K AS＝KDF(K AF，AS_ID)；
其中，KDF表示预设的密钥推衍函数，K AF表示组密钥，AS_ID表示AS的标识。
本公开实施例提供的装置，可以执行上述方法实施例，其实现原理和技术效果类似，本实施例此处不再赘述。
本公开实施例提供了一种通信设备，包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序；所述处理器，用于读取存储器中的程序实现如前所述的密钥生成方法中的步骤。
本公开实施例还提供一种可读存储介质，可读存储介质上存储有程序，该程序被处理器执行时实现上述密钥生成方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。其中，所述的可读存储介质，可以是处理器能够存取的任何可用介质或数据存储设备，包括但不限于磁性存储器(例如软盘、硬盘、磁带、磁光盘(MO)等)、光学存储器(例如CD、DVD、BD、HVD等)、以及半导体存储器(例如ROM、EPROM、EEPROM、非易失性存储器(NAND FLASH)、固态硬盘(SSD))等。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况 下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。根据这样的理解，本公开的技术方案本质上或者说对相关技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁盘、光盘)中，包括若干指令用以使得一台终端(可以是手机，计算机，服务器，空调器，或者网络设备等)执行本公开各个实施例所述的方法。
上面结合附图对本公开的实施例进行了描述，但是本公开并不局限于上述的具体实施方式，上述的具体实施方式仅仅是示意性的，而不是限制性的，本领域的普通技术人员在本公开的启示下，在不脱离本公开宗旨和权利要求所保护的范围情况下，还可做出很多形式，均属于本公开的保护之内。

Claims (24)

  1. 一种密钥生成方法，应用于应用功能AF，包括：
    当应用服务器AS和终端需要建立业务连接时，
    根据组密钥K AF和预设参数，为一个或多个AS生成对应的会话密钥K AS。
  2. 根据权利要求1所述的方法，其中，所述一个或多个AS属于同一个信任域。
  3. 根据权利要求1所述的方法，其中，所述方法还包括：
    向所述一个或多个AS发送对应的会话密钥K AS。
  4. 根据权利要求1所述的方法，其中，所述预设参数包括AS标识AS_ID；所述根据所述组密钥K AF和预设参数，为一个或多个AS生成对应的会话密钥K AS，包括：
    根据所述组密钥K AF和所述一个或多个AS的AS_ID，为所述一个或多个AS生成对应的会话密钥K AS。
  5. 根据权利要求4所述的方法，其中，按照以下公式生成会话密钥K AS：
    K AS＝KDF(K AF，AS_ID)；
    其中，KDF表示预设的密钥推衍函数，K AF表示组密钥，AS_ID表示AS的标识。
  6. 根据权利要求4所述的方法，其中，所述AS_ID由所述一个或多个AS发送给所述AF。
  7. 根据权利要求1所述的方法，其中，在所述根据组密钥K AF和预设参数，为一个或多个AS生成对应的会话密钥K AS之前，所述方法还包括：
    获取所述组密钥K AF。
  8. 根据权利要求7所述的方法，其中，所述获取所述组密钥K AF，包括：
    接收所述终端的第一请求，所述第一请求包括中间密钥K AKMA对应的密钥标识；
    根据所述密钥标识，从应用层认证和会话密钥管理锚点功能AAnF获取所述组密钥K AF，或者，从AF自身获取所述组密钥K AF。
  9. 根据权利要求7所述的方法，其中，所述获取所述组密钥K AF，包括：
    接收AS的第二请求，所述第二请求包括中间密钥K AKMA对应的密钥标识；
    根据所述密钥标识，从应用层认证和会话密钥管理锚点功能AAnF获取所述组密钥K AF，或者，从AF自身获取所述组密钥K AF。
  10. 根据权利要求8或9所述的方法，其中，根据所述密钥标识，从应用层认证和会话密钥管理锚点功能AAnF获取所述组密钥K AF，包括：
    向所述AAnF发送第三请求，所述第三请求包括所述密钥标识和AF标识AF_ID；
    接收所述AAnF根据所述第三请求发送的组密钥K AF。
  11. 一种密钥生成方法，应用于AS，包括：
    当需要和终端建立业务连接时，从AF获取会话密钥K AS；其中，所述会话密钥K AS是所述AF根据组密钥K AF和预设参数生成的。
  12. 根据权利要求11所述的方法，其中，所述从AF获取会话密钥K AS，包括：
    接收所述终端发送的第四请求，所述第四请求包括中间密钥K AKMA对应的密钥标识；
    根据所述密钥标识，向所述AF发送第五请求，所述第五请求包括所述密钥标识以及所述AS的AS_ID；
    接收所述AF发送的会话密钥K AS。
  13. 一种密钥生成方法，应用于终端，包括：
    当需要和AS建立业务连接时，根据组密钥K AF和预设参数，生成会话密钥K AS。
  14. 根据权利要求13所述的方法，其中，所述预设参数包括AS标识AS_ID；按照以下公式生成会话密钥K AS：
    K AS＝KDF(K AF，AS_ID)；
    其中，KDF表示预设的密钥推衍函数，K AF表示组密钥，AS_ID表示AS的标识。
  15. 根据权利要求13所述的方法，其中，所述方法还包括：
    触发所述AS获取会话密钥K AS。
  16. 根据权利要求15所述的方法，其中，所述触发所述AS获取会话密钥K AS，包括以下任意一项：
    向AAnF发送第六请求，所述第六请求包括中间密钥K AKMA对应的密钥标识，所述第六请求用于触发所述AAnF根据组密钥K AF和预设参数，为所述AS生成对应的会话密钥K AS；
    向所述AS发送第七请求，所述第七请求包括中间密钥K AKMA对应的密钥标识，所述第七请求用于触发所述AS从所述AAnF获取对应的会话密钥K AS。
  17. 一种密钥生成装置，应用于AF，包括：
    第一生成模块，用于当AS和终端需要建立业务连接时，根据组密钥K AF和预设参数，为一个或多个AS生成对应的会话密钥K AS。
  18. 一种密钥生成装置，应用于AS，包括：
    第一获取模块，用于当需要和终端建立业务连接时，从AF获取会话密钥K AS；其中，所述会话密钥K AS是所述AF根据组密钥K AF和预设参数生成的。
  19. 一种密钥生成装置，应用于终端，包括：
    第一生成模块，用于当需要和AS建立业务连接时，用于根据组密钥K AF和预设参数，生成会话密钥K AS。
  20. 一种密钥生成装置，应用于AF，其中，包括：处理器和收发器；
    所述处理器，用于当AS和终端需要建立业务连接时，根据组密钥K AF和预设参数，为一个或多个AS生成对应的会话密钥K AS。
  21. 一种密钥生成装置，应用于AS，包括：处理器和收发器；
    所述处理器，用于当需要和终端建立业务连接时，从AF获取会话密钥K AS；其中，所述会话密钥K AS是所述AF根据组密钥K AF和预设参数生成的。
  22. 一种密钥生成装置，应用于终端，包括：处理器和收发器；
    所述处理器，用于当需要和AS建立业务连接时，根据组密钥K AF和预设参数，生成会话密钥K AS。
  23. 一种通信设备，包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序；所述处理器，用于读取存储器中的程序实现如 权利要求1至16中任一项所述的密钥生成方法中的步骤。
  24. 一种可读存储介质，用于存储程序，所述程序被处理器执行时实现如权利要求1至16中任一项所述的密钥生成方法中的步骤。
PCT/CN2022/139007 2021-12-14 2022-12-14 一种密钥生成方法、装置、设备及可读存储介质 WO2023109865A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111527694.0A CN116264688A (zh) 2021-12-14 2021-12-14 一种密钥生成方法、装置、设备及可读存储介质
CN202111527694.0 2021-12-14

Publications (1)

Publication Number Publication Date
WO2023109865A1 true WO2023109865A1 (zh) 2023-06-22

Family

ID=86722267

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/139007 WO2023109865A1 (zh) 2021-12-14 2022-12-14 一种密钥生成方法、装置、设备及可读存储介质

Country Status (2)

Country Link
CN (1) CN116264688A (zh)
WO (1) WO2023109865A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2006072209A1 (fr) * 2005-01-07 2006-07-13 Huawei Technologies Co., Ltd. Procede de negociation d'une cle dans un sous-systeme multimedia ip
US20210051005A1 (en) * 2019-08-16 2021-02-18 Lenovo (Singapore) Pte. Ltd. Security capabilities in an encryption key request
WO2021093170A1 (en) * 2020-01-19 2021-05-20 Zte Corporation Methods and devices for establishing secure communication for applications
CN113518348A (zh) * 2020-06-30 2021-10-19 中国移动通信有限公司研究院 业务处理方法、装置、系统及存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2006072209A1 (fr) * 2005-01-07 2006-07-13 Huawei Technologies Co., Ltd. Procede de negociation d'une cle dans un sous-systeme multimedia ip
US20210051005A1 (en) * 2019-08-16 2021-02-18 Lenovo (Singapore) Pte. Ltd. Security capabilities in an encryption key request
WO2021093170A1 (en) * 2020-01-19 2021-05-20 Zte Corporation Methods and devices for establishing secure communication for applications
CN113518348A (zh) * 2020-06-30 2021-10-19 中国移动通信有限公司研究院 业务处理方法、装置、系统及存储介质

Also Published As

Publication number Publication date
CN116264688A (zh) 2023-06-16

Similar Documents

Publication Publication Date Title
US11722891B2 (en) User authentication in first network using subscriber identity module for second legacy network
EP3487196B1 (en) Privacy managing entity selection in communication system
US10474522B2 (en) Providing a network access failure cause value of a user equipment
US11516310B2 (en) Method and apparatus for invoking application programming interface
PH12018000291A1 (en) Security in intersystem mobility
WO2021197347A1 (zh) 通信系统、方法及装置
JP6962432B2 (ja) 通信方法、コントロールプレーン装置、コントロールプレーン装置もしくは通信端末のための方法、及び通信端末
WO2022170994A1 (zh) Pc5根密钥处理方法、装置、ausf及远程终端
US20230232240A1 (en) Subscription data update method and apparatus, node, and storage medium
US20220174063A1 (en) Communication method, apparatus, and system
CN115004635A (zh) 签约信息获取方法及装置
WO2023109865A1 (zh) 一种密钥生成方法、装置、设备及可读存储介质
TWI827187B (zh) 用於新登處理之使用者裝備與通訊網路間之認證技術
JP2024517897A (ja) Ｎｓｗｏサービスの認証のための方法、デバイス、および記憶媒体
EP4176601A1 (en) User equipment authentication and authorization procedure for edge data network
WO2023216274A1 (zh) 密钥管理方法、装置、设备和存储介质
US20240154803A1 (en) Rekeying in authentication and key management for applications in communication network
US20230354028A1 (en) Method, system, and apparatus for generating key for inter-device communication
TW202341695A (zh) 用以進行應用程式認證及金鑰管理（ａｋｍａ）認證服務之設備、方法及電腦可讀媒體
CN115843447A (zh) 用户装备对边缘数据网络的接入的网络认证

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22906610

Country of ref document: EP

Kind code of ref document: A1