WO2023143411A1

WO2023143411A1 - Device authentication methods, apparatus and communication device

Info

Publication number: WO2023143411A1
Application number: PCT/CN2023/073272
Authority: WO
Inventors: 李欢; 谢振华
Original assignee: 维沃移动通信有限公司
Priority date: 2022-01-27
Filing date: 2023-01-20
Publication date: 2023-08-03
Also published as: CN116567626A

Abstract

The present application belongs to the technical field of communications. Disclosed are device authentication methods, an apparatus and a communication device. A device authentication method in an embodiment of the present application comprises: a first terminal acquires identification information of a second terminal; and the first terminal sends a first message to a first network element, the first message comprising the identification information of the second terminal, and the first message being used for triggering an authentication process for the second terminal.

Description

Device authentication method, device and communication device

Cross References to Related Applications

This application claims priority to Chinese Patent Application No. 202210102685.5 filed in China on January 27, 2022, the entire contents of which are hereby incorporated by reference.

technical field

The present application belongs to the technical field of communication, and in particular relates to a device authentication method, device and communication device.

Background technique

In related technologies, the mobile phone can set up a WiFi hotspot for other devices, such as enabling a notebook to access the Internet through the mobile phone. But the notebook is a non-third generation partnership project (3rd Generation Partnership Project, 3GPP) device, and the communication network cannot know that the notebook is surfing the Internet, so the legitimacy of the notebook cannot be verified. If a rogue device accesses the network through a mobile phone, the secure communication between the mobile phone and the network is at risk. The related art does not describe how the non-3GPP equipment accesses the core network through a 3GPP equipment. In the scenario of personal IoT and fixed-mobile convergence, how to securely connect non-3GPP devices to the core network is an urgent problem to be solved.

Contents of the invention

The embodiment of the present application provides a device authentication method, device and communication device, which can solve the problem of how to securely allow non-3GPP devices to access the core network.

In the first aspect, a device authentication method is provided, including:

The first terminal acquires the identification information of the second terminal;

The first terminal sends a first message to the first network element, where the first message includes identification information of the second terminal, and the first message is used to trigger an authentication procedure for the second terminal.

In the second aspect, a device authentication method is provided, including:

receiving, by the first network element, a first message sent by the first terminal, where the first message includes identification information of the second terminal;

The first network element triggers an authentication procedure for the second terminal according to the first message.

In a third aspect, a device authentication device is provided, including:

a first obtaining module, configured to obtain identification information of the second terminal;

A first sending module, configured to send a first message to a first network element, where the first message includes identification information of the second terminal, and the first message is used to trigger authentication of the second terminal process.

In a fourth aspect, a device authentication device is provided, including:

A first receiving module, configured to receive a first message sent by a first terminal, where the first message includes identification information of the second terminal;

A processing module, configured to trigger an authentication procedure for the second terminal according to the first message.

In a fifth aspect, a terminal is provided, the terminal includes a processor and a memory, the memory stores programs or instructions that can run on the processor, and when the programs or instructions are executed by the processor, the following The steps of the method in one aspect.

In a sixth aspect, a terminal is provided, including a processor and a communication interface, wherein the processor is configured to obtain identification information of a second terminal, and the communication interface is configured to send a first message to a first network element, the The first message includes identification information of the second terminal, and the first message is used to trigger an authentication procedure for the second terminal.

In a seventh aspect, a network-side device is provided, the network-side device includes a processor and a memory, the memory stores programs or instructions that can run on the processor, and the programs or instructions are executed by the processor When realizing the steps of the method as described in the second aspect.

In an eighth aspect, there is provided a network side device, including a processor and a communication interface, wherein the communication interface is used to receive a first message sent by a first terminal, and the first message includes an identifier of the second terminal Information; the processor is configured to trigger an authentication procedure for the second terminal according to the first message.

A ninth aspect provides a device authentication system, including: a terminal and a network-side device, the terminal can be used to perform the steps of the device authentication method described in the first aspect, and the network-side device can be used to perform steps such as The steps of the device authentication method described in the second aspect.

In a tenth aspect, a readable storage medium is provided, and a program or an instruction is stored on the readable storage medium, and when the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented, or the steps of the method as described in the first aspect are implemented, or the The steps of the method described in the second aspect.

In an eleventh aspect, a chip is provided, the chip includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is used to run a program or an instruction to implement the method described in the first aspect. method, or implement the method as described in the second aspect.

In a twelfth aspect, a computer program product is provided, the computer program product is stored in a storage medium, and the computer program product is executed by at least one processor to implement the steps of the method described in the first aspect, or Implement the method as described in the second aspect.

In this embodiment of the present application, the first terminal obtains the identification information of the second terminal, and sends a first message containing the identification information of the second terminal to the first network element, and triggers the authentication of the second terminal through the first message In order to achieve the purpose of assisting the second terminal (non-3GPP terminal) to access the core network through the first terminal (3GPP terminal) to perform authentication, in the scenario where the non-3GPP device accesses the communication network through the personal Internet of Things network or home network In this way, the security of communication can be effectively guaranteed.

Description of drawings

FIG. 1 shows a structural diagram of a communication system applicable to an embodiment of the present application;

FIG. 2 shows one of the schematic flow diagrams of the device authentication method in the embodiment of the present application;

FIG. 3 shows the second schematic flow diagram of the device authentication method in the embodiment of the present application;

FIG. 4 shows one of the interactive schematic diagrams of the device authentication method in the embodiment of the present application;

FIG. 5 shows the second interactive schematic diagram of the device authentication method according to the embodiment of the present application;

FIG. 6 shows the third interactive schematic diagram of the device authentication method according to the embodiment of the present application;

FIG. 7 shows the fourth interactive schematic diagram of the device authentication method according to the embodiment of the present application;

FIG. 8 shows one of the module schematic diagrams of the device authentication device according to the embodiment of the present application;

FIG. 9 shows a structural block diagram of a communication device according to an embodiment of the present application;

FIG. 10 shows a structural block diagram of a terminal in an embodiment of the present application;

FIG. 11 shows the second schematic diagram of the modules of the device authentication device according to the embodiment of the present application;

FIG. 12 shows the second structural block diagram of the network side device according to the embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the application will be clearly described below in conjunction with the accompanying drawings in the embodiments of the application. Obviously, the described embodiments are part of the embodiments of the application, not all of them. Example. All other embodiments obtained by persons of ordinary skill in the art based on the embodiments in this application belong to the protection scope of this application.

The terms "first", "second" and the like in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific sequence or sequence. It is to be understood that the terms so used are interchangeable under appropriate circumstances such that the embodiments of the application are capable of operation in sequences other than those illustrated or described herein and that "first" and "second" distinguish objects. It is usually one category, and the number of objects is not limited. For example, there may be one or more first objects. In addition, "and/or" in the description and claims means at least one of the connected objects, and the character "/" generally means that the related objects are an "or" relationship.

It is worth noting that the technology described in the embodiment of this application is not limited to the Long Term Evolution (Long Term Evolution, LTE)/LTE-Advanced (LTE-Advanced, LTE-A) system, and can also be used in other wireless communication systems, such as code Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency Division Multiple Access, OFDMA), Single-carrier Frequency Division Multiple Access (Single-carrier Frequency Division Multiple Access, SC-FDMA) and other systems. The terms "system" and "network" in the embodiments of the present application are often used interchangeably, and the described technology can be used for the above-mentioned system and radio technology, and can also be used for other systems and radio technologies. The following description describes the New Radio (New Radio, NR) system for example purposes, and uses NR terminology in most of the following descriptions, but these techniques can also be applied to applications other than NR system applications, such as the 6th generation (6th Generation , 6G) communication system.

Fig. 1 shows a block diagram of a wireless communication system to which the embodiment of the present application is applicable. The wireless communication system includes a terminal 11 and a network side device 12 . Wherein, the terminal 11 can be a mobile phone, a tablet computer (Tablet Personal Computer), a laptop computer (Laptop Computer) or a notebook computer, a personal digital assistant (Personal Digital Assistant, PDA), a palmtop computer, a netbook, a super mobile personal computer (ultra-mobile personal computer, UMPC), mobile Internet device (Mobile Internet Device, MID), augmented reality (augmented reality, AR) / virtual reality (virtual reality, VR) equipment, robot, wearable device (Wearable Device) , Vehicle User Equipment (VUE), Pedestrian User Equipment (PUE), intelligent Home (household equipment with wireless communication functions, such as refrigerators, TVs, washing machines or furniture, etc.), game consoles, personal computers (personal computers, PCs), teller machines or self-service machines and other terminal-side devices, wearable devices include: smart watches , smart bracelets, smart headphones, smart glasses, smart jewelry (smart bracelets, smart bracelets, smart rings, smart necklaces, smart anklets, smart anklets, etc.), smart wristbands, smart clothing, etc. It should be noted that, the embodiment of the present application does not limit the specific type of the terminal 11 . The network side device 12 may include an access network device or a core network device, where the access network device 12 may also be called a radio access network device, a radio access network (Radio Access Network, RAN), a radio access network function, or Wireless access network unit. The access network device 12 may include a base station, a wireless local area network (Wireless Local Area Networks, WLAN) access point or a WiFi node, etc., and the base station may be called a node B, an evolved node B (eNB), an access point, or a base transceiver station (Base Transceiver Station, BTS), radio base station, radio transceiver, Basic Service Set (BSS), Extended Service Set (Extended Service Set, ESS), Home Node B, Home Evolved Node B, sending and receiving point (Transmitting Receiving Point, TRP) or some other appropriate term in the field, as long as the same technical effect is achieved, the base station is not limited to specific technical terms. It should be noted that in the embodiment of this application, only the NR system The base station in the example is introduced as an example, and the specific type of the base station is not limited. The core network equipment may include but not limited to at least one of the following: core network node, core network function, mobility management entity (Mobility Management Entity, MME), access mobility management function (Access and Mobility Management Function, AMF), session management function (Session Management Function, SMF), user plane function (User Plane Function, UPF), policy control function (Policy Control Function, PCF), policy and charging rules function unit (Policy and Charging Rules Function, PCRF), edge application service Discovery function (Edge Application Server Discovery Function, EASDF), unified data management (Unified Data Management, UDM), unified data warehouse (Unified Data Repository, UDR), home subscriber server (Home Subscriber Server, HSS), centralized network configuration ( Centralized network configuration, CNC), network storage function (Network Repository Function, NRF), network exposure function (Network Exposure Function, NEF), local NEF (Local NEF, or L-NEF), binding support function (Binding Support Function, BSF), Application Function (Application Function, AF), etc. It should be noted that in the embodiment of this application, only the core network equipment in the NR system is introduced as an example, and the core network equipment is not limited. specific type of . It should be noted that the functions of the above-mentioned core network device may be realized by multiple devices, or the functions of multiple core network devices may be realized by one device, which is not limited in this embodiment of the present application. In the embodiment of the present application, if the functions of multiple core network devices are implemented by one device, the interaction among the multiple core network devices in the embodiment of the present application is an internal operation of the device.

In order to enable those skilled in the art to better understand the embodiments of the present application, the following descriptions are given first.

1. Personal IoT Network (PIN).

PIN is a group consisting of at least one PIN element (PIN Element, PINE), wherein at least one PIN element is a terminal (User Equipment, UE). PIN elements communicate with each other. Two PIN elements can communicate through a direct connection between them, or indirectly through a communication network.

A PIN element is a UE or a non-3GPP device. A PIN element can also be a non-5G-Capable over WLAN (N5CW) device on a wireless local area network. Non-3GPP devices refer to devices that do not use credentials defined by 3GPP, devices that do not support NAS protocols defined by 3GPP, or devices that do not support 3GPP access technologies (such as 3G/4G/5G air interface technology) but only support non-3GPP access technologies (such as WiFi, fixed network, Bluetooth and other access technologies) equipment. It is worth noting that when the PIN element is UE, when it accesses the communication network through PEGC, it can also execute the process of non-3GPP equipment or N5CW equipment, for example, the NAS of UE is not used to interact with the communication network. The solutions described in the embodiments of this application can also be used.

A PIN can have one or more PIN elements with gateway capability (PIN Element With Gateway Capability, PEGC). The PIN elements in the PIN can communicate with each other directly or through PEGC. The PIN element in the PIN can communicate with other devices or application servers outside the PIN through the PEGC. PEGC can be a gateway in a smart home scenario, or a mobile phone in a wearable device scenario.

2. Fixed-Mobile Convergence (Wireline Wireless Convergence, WWC).

The current 3GPP 5G core network supports fixed network access, including support for residential gateways (Residential Gateway, RG) to access the 5G core network through fixed networks and 3GPP networks, and also includes 3GPP terminal devices accessing 5G core networks through residential gateways.

The device authentication method provided by the embodiment of the present application will be described in detail below through some embodiments and application scenarios with reference to the accompanying drawings.

As shown in Figure 2, the embodiment of this application provides a device authentication method, including:

Step 201: the first terminal acquires the identification information of the second terminal.

In this embodiment of the application, the first terminal is a personal Internet of Things gateway, and the second terminal is a device that cannot use the NAS protocol. As an optional implementation, the second terminal is a non-3GPP device or a personal Internet of Things device. As another optional implementation, the second terminal is a 3GPP device, and the connection between the second terminal and the first terminal The connection does not support NAS protocol transfers.

Optionally, the above-mentioned first terminal may also be a home gateway. A connection may be established between the first terminal and the second terminal through WiFi, Bluetooth or passive Internet of Things (for example, passive Internet of Things (Passive IoT)) technology. It is worth noting that when the first terminal and the second terminal establish a connection through the passive Internet of Things, the second terminal can be a 3GPP device or a non-3GPP device, and the passive Internet of Things technology can also be a 3GPP access technology or a non-3GPP access technology. into technology.

Step 202: The first terminal sends a first message to the first network element, the first message includes identification information of the second terminal, and the first information is used to trigger authentication of the second terminal rights process.

Wherein, the first network element is a mobility management network element or a session management network element, if the mobility management network element is an access and mobility management function (Access and Mobility Management Function, AMF), the session management network element It is the Session Management Function (SMF).

In the embodiment of the present application, the first terminal obtains the identification information of the second terminal, and sends a first message containing the identification information of the second terminal to the first network element, and triggers an authentication process for the second terminal through the first message , so as to achieve the purpose of assisting the second terminal (non-3GPP terminal) to access the core network through the first terminal (3GPP terminal) to perform authentication. , which can effectively guarantee the security of communication.

Optionally, the first message indicates that the second terminal requests to access the first network element, or the first message requests to establish a session for the second terminal.

Optionally, the first terminal sends a first request to the first network element, including:

The first terminal sends the first message through a non-access stratum (Non Access Stratum, NAS) connection between the first terminal and the first network element.

Optionally, the first message further includes at least one of the following:

Identification information of the first terminal;

Non-3GPP equipment indication information;

N5CW instruction;

An indication to request access for a terminal that does not support NAS;

Personal IoT indication information;

Passive IoT Instructions.

Optionally, the non-3GPP device indication information is non-3GPP device registration type information.

Optionally, the personal Internet of Things indication information is registration type information of a personal Internet of Things element PINE.

Optionally, the identification information of the second terminal includes at least one of the following:

The Media Access Control (Medium Access Control, MAC) address of the second terminal;

The device identification of the second terminal;

International Mobile Subscriber Identity (IMSI) of the second terminal;

Subscription Permanent Identifier (SUPI) of the second terminal;

Subscription Concealed Identifier (SUCI) of the second terminal;

The general public subscription identifier (Generic Public Subscription Identifier, GPSI) of the second terminal.

As a first optional implementation manner, the acquisition of the identification information of the second terminal by the first terminal includes:

During the process of establishing a connection (for example, an L2 connection) with the second terminal, the first terminal acquires the identification information of the second terminal.

Alternatively, the first terminal acquires the identification information of the second terminal through an authentication procedure for the second terminal. Optionally, the second terminal is associated with or connected to a wireless local area network (Wireless Local Area Network, WLAN) of the first terminal. Exemplarily, the first terminal and the second terminal use an EAP authentication process.

Exemplarily, the above authentication process may specifically include:

The first terminal sends an EAP-Req/Identity message to the second terminal, and the second terminal sends an EAP-Res/Identity message to the first terminal, where the EAP-Res/Identity message includes identification information of the second terminal. Wherein, the identity information of the second terminal may be sent through a network access identity (Network Access Identity, NAI). Optionally, the second terminal may indicate that it does not support using the NAS access core The core network, or wants to access the core network without NAS. For example, the NAI can contain the field 5gc-nn to indicate that it does not support NAS access to 5GC, or it wishes to access 5GC without NAS.

The identification information of the second terminal may be used to identify the second terminal in the PIN or in the 5G system.

As a second optional implementation manner, the acquisition of the identification information of the second terminal by the first terminal includes:

The first terminal obtains the first target request message sent by the second terminal, where the first target request message is used to establish a secure connection with the first terminal device. Exemplarily, the first target request message may be an Internet Key Exchange (Internet Key Exchange, IKE)_AUTH request message, and the first target request message includes the identification information of the second terminal.

In this implementation, before the first terminal obtains the first target request message sent by the second terminal, an L2 connection is established between the first terminal and the second terminal, the second terminal obtains an IP address, and the first terminal and the second The terminal establishes an IP security association (IPsec Security Association, IPSec SA).

Exemplarily, the second terminal associates or connects to the WLAN of the first terminal, and obtains an IP address from the WLAN of the first terminal, and the second terminal may use a Dynamic Host Configuration Protocol (Dynamic Host Configuration Protocol, DHCP) request or other The request message requests to obtain an IP address.

Optionally, the first terminal may authenticate the second terminal first, and then assign an IP address to the second terminal after authentication.

In this implementation, as a possible implementation, the second terminal sends a second target request message to the first terminal, the second target request message may be specifically an IKE_AUTH request message, and the second target request message does not carry The AUTH parameter indicates that EAP authentication is required. The first terminal sends a response message, such as an IKE_AUTH response message, to the second terminal, and the response message includes the EAP request message. The second terminal sends an IKE_AUTH request message to the first terminal, which includes an EAP response message, including identification information of the second terminal.

As shown in Figure 3, the embodiment of the present application also provides a device authentication method, including:

Step 301: The first network element receives a first message sent by a first terminal, where the first message includes identification information of the second terminal.

Step 302: The first network element triggers an authentication procedure for the second terminal according to the first message.

Exemplarily, the first terminal is a personal Internet of Things gateway, and the second terminal is a device that cannot use the NAS protocol. As an optional implementation manner, the second terminal is a non-3GPP device or a personal Internet of Things device. , as another optional implementation manner, the second terminal is a 3GPP device, and the connection between the second terminal and the first terminal does not support NAS protocol transmission. The above-mentioned first terminal may also be a home gateway. A connection can be established between the first terminal and the second terminal through WiFi, Bluetooth or passive Internet of Things (Passive IoT) technology. It is worth noting that when the first terminal and the second terminal establish a connection through the passive Internet of Things, the second terminal can be a 3GPP device or a non-3GPP device, and the passive Internet of Things technology can also be a 3GPP access technology or a non-3GPP access technology. into technology.

In this embodiment of the present application, the first network element receives the first message containing the identification information of the second terminal sent by the first terminal, and triggers an authentication procedure for the second terminal based on the first message, so as to realize the authentication through the first terminal. The purpose of the terminal (3GPP terminal) assisting the second terminal (non-3GPP terminal) to access the core network for authentication is to effectively guarantee the security of communication in the scenario where a non-3GPP device accesses the communication network through a personal IoT network or a home network sex.

Optionally, the first network element receiving the first message sent by the first terminal includes:

The first network element receives the first message through the NAS connection between the first terminal and the first network element.

Optionally, the first message further includes at least one of the following:

Identification information of the first terminal;

Non-3GPP equipment indication information;

Personal IoT indication information;

N5CW instruction;

An indication to request access for a terminal that does not support NAS;

Passive IoT Instructions.

The media access control MAC address of the second terminal;

The device identification of the second terminal;

the International Mobile Subscriber Identity IMSI of the second terminal;

The subscription permanent identification SUPI of the second terminal;

The subscription encryption identity SUCI of the second terminal;

The general public subscription identity GPSI of the second terminal.

Optionally, the first network element triggers an authentication procedure for the second terminal according to the first message, including:

The first network element sends a second message to a second network element according to the first message, where the second message is used to request authentication of the second terminal.

Optionally, the first network element is a mobility management network element, and the second network element is an authentication server network element;

Alternatively, the first network element is a session management network element, and the second network element is a mobility management network element.

In an embodiment of the present application, it is assumed that the above-mentioned first terminal is PEGC, and the above-mentioned second terminal is PINE. As shown in FIG. 4, the above-mentioned device authentication method includes:

Step 401: An L2 connection is established between PINE and PEGC.

Exemplarily, the PINE is associated with or connected to the WLAN of the PEGC.

Step 402: The PEGC initiates an authentication process to obtain the identification information of the PINE.

PINE sends its own identification information to PEGC.

Exemplarily, PEGC and PINE use the EAP authentication process. For example, PEGC sends an EAP-Req/Identity message to PINE. PINE sends an EAP-Res/Identity message to PEGC, which includes its own identity. The identifier of PINE may be a Network Access Identity (Network Access Identity, sent in the form of NAI). Optionally, PINE can indicate that it does not support NAS access to 5GC, or that it wishes to access 5GC without NAS. For example, the field 5gc-nn may be included in the NAI to indicate that it does not support NAS access to 5GC, or it wishes to access 5GC without NAS.

Exemplarily, the NAI sent by PINE may be type1.rid678.schid0.useriduser17@nai.5gc-nn.mnc123.mcc45.3gppnetwork.org.

The identification information of the PINE is used to identify the PINE in the PIN or in the 5G system, for example, it may be the MAC address of the PINE, the device identifier of the PINE, IMSI, SUPI, SUCI, or GPSI.

Step 403: The PEGC sends a NAS message to the AMF, indicating to connect the PINE to the core network.

Exemplarily, the PEGC sends a registration request message to the AMF, including at least one of the registration type, the ID of the PEGC, and the ID of the PINE. Wherein, the registration type may indicate PINE registration, or indicate non-3GPP device registration. The registration request message may also be a PINE registration request message or a non-3GPP device registration request message, indicating to access the PINE to the core network. The identity of the PINE itself may also indicate that the PINE needs to be connected to the core network. Alternatively, the N5CW indication or the passive IoT indication may also be carried in the NAS message, indicating that the N5CW device or the passive IoT device requests access. Or the NAS message may also include an indication of requesting access for a terminal that does not support NAS, indicating that a device that does not support NAS requests access when accessing the 5GC through the PEGC.

The PEGC can send the above NAS message through the NAS connection between itself and the AMF. The AMF is an AMF serving PEGC.

Step 404: After receiving the NAS message in step 3, the AMF triggers the core network's authentication procedure for the PINE.

Exemplarily, the AMF sends an authentication request to the AUSF, which includes a PIN indication or a non-3GPP indication. The EAP authentication process is executed between PINE and the Authentication Server Function (AUSF). After successful authentication, AUSF sends EAP-Success message to AMF.

Step 405: The AMF sends a NAS message to the PEGC to instruct the PINE to successfully access the core network.

In the embodiment of the present application, the above registration request message may also be other NAS messages, which are not specifically limited here.

In this embodiment, the PEGC can be replaced by a residential gateway (Residential Gateway, RG), and the PINE can also be replaced by other non-3GPP devices. In addition, in the embodiment of this application, the core network is sometimes called 5G core Heart network (5G Core network, 5GC) or 5G system (5G System, 5GS). The access core network may also be referred to as an access communication network.

It should be noted that the authentication of the PINE by the communication system may also be optional. For example, if the communication system trusts the PEGC, the communication system may not authenticate the PINE accessed through the PEGC. Therefore, step 404 is optional. Optionally, step 404 may be replaced by, after receiving the NAS message, the AMF determines not to perform authentication on the PINE according to the instruction to access the PINE to the core network. In the embodiment of the present application, in step 2, the PEGC may only obtain the identification information of the PINE, instead of initiating an authentication process for the PINE.

In another embodiment of the present application, it is assumed that the above-mentioned first terminal is PEGC, and the above-mentioned second terminal is PINE. As shown in FIG. 5, the above-mentioned device authentication method includes:

Step 501: A connection is established between PINE and PEGC, and an IP address is obtained.

Exemplarily, the PINE associates or connects to the WLAN of the PEGC, and obtains an IP address from the WLAN of the PEGC. The PINE may use a DHCP request or other messages to request to obtain an IP address, which is not specifically limited in this embodiment of the present application.

Optionally, the PEGC may first authenticate the PINE and then assign an IP address to the PINE. What information is used by the PEGC to authenticate the PINE is not specifically limited in this embodiment of the application.

Step 502: PINE establishes IP security association with PEGC.

Exemplarily, IKE initial messages are exchanged between PINE and PEGC to establish an IP security association.

Step 503: PINE sends an IKE_AUTH request message to PEGC.

As a possible implementation manner, the IKE_AUTH request message includes the identification information of the PINE. For the identification information of PINE, reference may be made to the description in step 402 .

As another possible implementation manner, the PINE sends an IKE_AUTH request message to the PEGC, which does not carry the AUTH parameter, indicating that EAP authentication is required. PEGC sends IKE_AUTH response message to PINE, which includes EAP request message. The PINE sends an IKE_AUTH request message to the PEGC, which includes an EAP response message, including the identification information of the PINE.

Step 504: The PEGC sends a NAS message to the AMF to connect the PINE to the core network.

For details, refer to the description of step 403 in the foregoing embodiment.

Step 505: After receiving the NAS message, the AMF triggers the core network's authentication procedure for the PINE.

This step can refer to the description of the above step 404, the difference is that PINE and PEGC use The IKE message transmits authentication process interaction information.

Step 506: The AMF sends a NAS message to the PEGC to indicate that the PINE has successfully accessed the core network.

The registration request message in this embodiment may also be replaced with other NAS messages, which is not specifically limited in this embodiment.

It should be noted that the authentication of the PINE by the communication system may also be optional. For example, if the communication system trusts the PEGC, the communication system may not authenticate the PINE accessed through the PEGC. Therefore, step 505 is optional. Optionally, step 404 may be replaced by, after receiving the NAS message, the AMF determines not to perform authentication on the PINE according to the instruction to access the PINE to the core network.

In yet another embodiment of the present application, it is assumed that the above-mentioned first terminal is PEGC, and the above-mentioned second terminal is PINE. As shown in FIG. 6, the above-mentioned device authentication method includes:

Step 601: An L2 connection is established between PINE and PEGC.

Step 602: The PEGC initiates an authentication process to obtain the identification information of the PINE.

For steps 601 and 602, reference may be made to the description of steps 401 and 402, which will not be repeated here.

Step 603: The PEGC sends a NAS message to the AMF to connect the PINE to the core network.

The NAS message includes the registration type, at least one of the identifier of the PEGC and the identifier of the PINE. Wherein, the registration type may indicate PINE registration, or indicate non-3GPP device registration. The NAS message may also be a PINE registration request message or a non-3GPP device registration request message. The identity of the PINE itself may also indicate that the PINE needs to be connected to the core network. Alternatively, the N5CW indication or the passive IoT indication may also be carried in the NAS message, indicating that the N5CW device or the passive IoT device requests access. Or the NAS message may also include an indication of requesting access for a terminal that does not support NAS, indicating that a device that does not support NAS requests access when accessing the 5GC through the PEGC.

Optionally, the NAS message includes an N1 session management (Session Management, SM) message. It is used to instruct the SMF to connect the PINE to the core network.

The N1 SM message can be a PDU session establishment request message or other N1 SM messages.

The above registration type, at least one of the PEGC identifier and the PINE identifier may be included in the N1 SM message.

The PEGC can send the above NAS message through the NAS connection between itself and the AMF. Should AMF is an AMF serving PEGC.

Step 604: The AMF sends an N11 message to the SMF to connect the PINE to the core network.

The N11 message includes at least one of the registration type, the ID of the PEGC, and the ID of the PINE.

If the N1 SM message is included in step 603, the AMF sends the N1 SM message to the SMF.

Exemplarily, the N11 message may be a PINE session establishment request message.

The N11 message in this step may also indicate establishing a session channel or allocating network resources for PINE.

Step 605: The SMF sends a response message of the N11 message to the AMF, so as to trigger the authentication procedure for the PINE.

The PINE identifier may be included in the response message of the N11 message. Optionally, the logo of PEGC may also be included.

The SMF may be a session management network element serving the PEGC. It can be determined that the PINE needs to be authenticated according to the PEGC subscription and the operator's policy.

Exemplarily, the response message of the N11 message may be a PINE authentication request message.

Step 606: The AMF triggers the core network to authenticate the PINE.

For step 606, reference may be made to the description of step 404.

Step 607: AMF sends N11 message to SMF, indicating PINE authentication is successful.

Exemplarily, the N11 message may be a PINE authentication response message.

In this embodiment of the application, steps 605 to 607 are optional steps.

Optionally, the SMF sends an N11 message to the AMF, indicating that the PINE session is established successfully.

Exemplarily, the N11 message may be a PINE session establishment response message.

Optionally, the AMF sends a NAS message to the PEGC, indicating that the PINE access is successful.

Exemplarily, the NAS message may be a PINE registration or a non-3GPP device registration request message.

Optionally, the SMF allocates user plane resources or session resources to the PINE. In this solution, a NAS message in step 603 can simultaneously trigger authentication and session establishment, saving network resources.

Through the above steps, PINE successfully connected to 5GC. It can also be considered that the session channel of the PINE is established or the network has successfully allocated resources for the PINE.

It should be noted that the authentication of the PINE by the communication system may also be optional. For example, if the communication system trusts the PEGC, the communication system may not authenticate the PINE accessed through the PEGC. Therefore, steps 605-607 may not be performed, or step 606 may not be performed. optional Yes, step 605 may be replaced by, after receiving the N11 message, the SMF determines not to perform authentication on the PINE according to the instruction to access the PINE to the core network. Alternatively, step 606 may be replaced by, after receiving the response message of the N11 message, the AMF determines not to perform authentication on the PINE according to the identifier of the PINE and/or the identifier of the PEGC. In the embodiment of the present application, the PEGC in step 602 may also just obtain the identification information of the PINE, rather than initiating an authentication process for the PINE.

In yet another embodiment of the present application, it is assumed that the above-mentioned first terminal is PEGC, and the above-mentioned second terminal is PINE. As shown in FIG. 7, the above-mentioned device authentication method includes:

Step 701: A connection is established between PINE and PEGC, and an IP address is obtained.

For details, refer to the description of step 501 .

Step 702: PINE establishes IP security association with PEGC.

Step 703: PINE sends an IKE_AUTH request message to PEGC.

For details, refer to the description of step 503 .

Step 704: The PEGC sends a NAS message to the AMF to connect the PINE to the core network.

Step 705: The AMF sends an N11 message to the SMF to connect the PINE to the core network.

Step 706: The SMF sends a response message of the N11 message to the AMF to trigger the authentication procedure for the PINE.

Step 707: The AMF triggers the core network to authenticate the PINE.

Step 708: The AMF sends an N11 message to the SMF, indicating that the PINE authentication is successful.

In this embodiment of the present application, the foregoing steps 706 to 708 are optional steps.

For the above step 704 to step 708, reference may be made to the description of the above step 603 to step 607.

Optionally, the SMF allocates user plane resources or session resources to the PINE. In this solution, a NAS message in step 703 can simultaneously trigger authentication and session establishment, saving network resources.

In the embodiment of this application, the 3GPP terminal device assists the non-3GPP device to access the 5G core network for authentication, and the communication security is guaranteed in the scenario where the non-3GPP device accesses the communication network through a personal Internet of Things network or a home network.

It should be noted that the authentication of the PINE by the communication system may also be optional. For example, if the communication system trusts the PEGC, the communication system may not authenticate the PINE accessed through the PEGC. Therefore, steps 706-708 may not be performed, or step 707 may not be performed. Optionally, step 706 may be replaced by, after receiving the N11 message, the SMF determines not to perform authentication on the PINE according to the instruction to access the PINE to the core network. Alternatively, step 707 may be replaced by, after receiving the response message of the N11 message, the AMF determines not to perform authentication on the PINE according to the identifier of the PINE and/or the identifier of the PEGC.

The device authentication method provided in the embodiment of the present application may be executed by a device authentication device. In the embodiment of the present application, the device authentication method performed by the device authentication device is taken as an example to illustrate the device authentication device provided in the embodiment of the present application.

As shown in Figure 8, the embodiment of the present application provides a device authentication device 800, which is applied to the first terminal, and the device includes:

The first acquiring module 801 is configured to acquire the identification information of the second terminal;

The first sending module 802 is configured to send a first message to a first network element, where the first message includes identification information of the second terminal, and the first message is used to trigger authentication of the second terminal rights process.

Optionally, the first sending module is configured to send the first message through a non-access stratum NAS connection between the first terminal and the first network element.

Optionally, the first message further includes at least one of the following:

Identification information of the first terminal;

Non-3GPP equipment indication information;

Personal IoT indication information;

N5CW instruction;

An indication to request access for a terminal that does not support NAS;

Passive IoT Instructions.

The media access control MAC address of the second terminal;

The device identification of the second terminal;

the International Mobile Subscriber Identity IMSI of the second terminal;

The subscription permanent identification SUPI of the second terminal;

The subscription encryption identity SUCI of the second terminal;

The general public subscription identity GPSI of the second terminal.

Optionally, the first network element is a mobility management network element or a session management network element.

Optionally, the first terminal is a personal Internet of Things gateway.

Optionally, the second terminal is a non-3GPP device or a personal Internet of Things device.

The device authentication apparatus in the embodiment of the present application may be an electronic device, such as an electronic device with an operating system, or a component in the electronic device, such as an integrated circuit or a chip. The electronic device may be a terminal, or other devices other than the terminal. Exemplarily, the terminal may include, but not limited to, the types of terminal 11 listed above, and other devices may be servers, Network Attached Storage (NAS), etc., which are not specifically limited in this embodiment of the present application.

The device authentication device provided by the embodiment of the present application can realize each process realized by the method embodiment in FIG. 2 and achieve the same technical effect. To avoid repetition, details are not repeated here.

Optionally, as shown in FIG. 9 , this embodiment of the present application also provides a communication device 900, including a processor 901 and a memory 902, and the memory 902 stores programs or instructions that can run on the processor 901, such as , when the communication device 900 is a terminal, the program or instruction is executed by the processor 901 During execution, each step of the above embodiment of the device authentication method applied to the first terminal is realized, and the same technical effect can be achieved. When the communication device 900 is a network-side device (such as a first network element), when the program or instruction is executed by the processor 901, each step of the above-mentioned embodiment of the device authentication method applied to the first network element can be achieved, and the same To avoid repetition, the technical effects will not be repeated here.

The embodiment of the present application also provides a terminal, including a processor and a communication interface, the processor is used to obtain the identification information of the second terminal; the communication interface is used to send a first message to the first network element, and the first message includes the The identification information of the second terminal, and the first message is used to trigger an authentication process for the second terminal. This terminal embodiment corresponds to the above-mentioned terminal-side method embodiment, and each implementation process and implementation mode of the above-mentioned method embodiment can be applied to this terminal embodiment, and can achieve the same technical effect. Specifically, FIG. 10 is a schematic diagram of a hardware structure of a terminal implementing an embodiment of the present application.

The terminal 1000 includes, but is not limited to: a radio frequency unit 1001, a network module 1002, an audio output unit 1003, an input unit 1004, a sensor 1005, a display unit 1006, a user input unit 1007, an interface unit 1008, a memory 1009, and a processor 1010. At least some parts.

Those skilled in the art can understand that the terminal 1000 can also include a power supply (such as a battery) for supplying power to various components, and the power supply can be logically connected to the processor 1010 through the power management system, so as to manage charging, discharging, and power consumption through the power management system. Management and other functions. The terminal structure shown in FIG. 10 does not constitute a limitation on the terminal, and the terminal may include more or fewer components than shown in the figure, or combine certain components, or arrange different components, which will not be repeated here.

It should be understood that, in the embodiment of the present application, the input unit 1004 may include a graphics processing unit (Graphics Processing Unit, GPU) 10041 and a microphone 10042, and the graphics processor 10041 can be used by the image capture device ( Such as the image data of the still picture or video obtained by the camera) for processing. The display unit 1006 may include a display panel 10061, and the display panel 10061 may be configured in the form of a liquid crystal display, an organic light emitting diode, or the like. The user input unit 1007 includes at least one of a touch panel 10071 and other input devices 10072 . The touch panel 10071 is also called a touch screen. The touch panel 10071 may include two parts, a touch detection device and a touch controller. Other input devices 10072 may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, switch buttons, etc.), trackballs, mice, and joysticks, which will not be repeated here.

In the embodiment of this application, after the radio frequency unit 1001 receives the downlink data from the network side equipment, it can The data is transmitted to the processor 1010 for processing; in addition, the radio frequency unit 1001 may send uplink data to the network side device. Generally, the radio frequency unit 1001 includes, but is not limited to, an antenna, an amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, and the like.

The memory 1009 can be used to store software programs or instructions as well as various data. The memory 1009 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required by at least one function (such as a sound playing function, image playback function, etc.), etc. Furthermore, memory 1009 may include volatile memory or nonvolatile memory, or, memory 1009 may include both volatile and nonvolatile memory. Among them, the non-volatile memory can be read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable programmable read-only memory (Erasable PROM, EPROM), electronically programmable Erase Programmable Read-Only Memory (Electrically EPROM, EEPROM) or Flash. Volatile memory can be random access memory (Random Access Memory, RAM), static random access memory (Static RAM, SRAM), dynamic random access memory (Dynamic RAM, DRAM), synchronous dynamic random access memory (Synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (Double Data Rate SDRAM, DDRSDRAM), enhanced synchronous dynamic random access memory (Enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory (Synch link DRAM , SLDRAM) and Direct Memory Bus Random Access Memory (Direct Rambus RAM, DRRAM). The memory 1009 in the embodiment of the present application includes but is not limited to these and any other suitable types of memory.

The processor 1010 may include one or more processing units; optionally, the processor 1010 integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to the operating system, user interface, and application programs, etc., Modem processors mainly process wireless communication signals, such as baseband processors. It can be understood that the foregoing modem processor may not be integrated into the processor 1010 .

Wherein, the processor 1010 is configured to acquire identification information of the second terminal;

A radio frequency unit 1001, configured to send a first message to a first network element, where the first message includes identification information of the second terminal, and the first message is used to trigger an authentication process for the second terminal .

Optionally, the radio frequency unit 1001 is configured to send the first message through a non-access stratum NAS connection between the first terminal and the first network element.

Optionally, the first message further includes at least one of the following:

Identification information of the first terminal;

Non-3GPP equipment indication information;

Personal IoT indication information;

N5CW instruction;

An indication to request access for a terminal that does not support NAS;

Passive IoT Instructions.

The media access control MAC address of the second terminal;

The device identification of the second terminal;

the International Mobile Subscriber Identity IMSI of the second terminal;

The subscription permanent identification SUPI of the second terminal;

The subscription encryption identity SUCI of the second terminal;

The general public subscription identity GPSI of the second terminal.

Optionally, the first terminal is a personal Internet of Things gateway.

As shown in Figure 11, the embodiment of the present application also provides a device authentication apparatus 1100, including:

The first receiving module 1101 is configured to receive a first message sent by a first terminal, the first message including identification information of the second terminal;

The processing module 1102 is configured to trigger an authentication procedure for the second terminal according to the first message.

Optionally, the first receiving module is configured to receive the first message through a NAS connection between the first terminal and the first network element.

Optionally, the first message further includes at least one of the following:

Identification information of the first terminal;

Non-3GPP equipment indication information;

Personal IoT indication information;

N5CW instruction;

An indication to request access for a terminal that does not support NAS;

Passive IoT Instructions.

The media access control MAC address of the second terminal;

The device identification of the second terminal;

the International Mobile Subscriber Identity IMSI of the second terminal;

The subscription permanent identification SUPI of the second terminal;

The subscription encryption identity SUCI of the second terminal;

The general public subscription identity GPSI of the second terminal.

Optionally, the processing module is configured to send a second message to a second network element according to the first message, where the second message is used to request authentication of the second terminal.

Optionally, the first terminal is a personal Internet of Things gateway.

The embodiment of the present application also provides a network side device (that is, the above-mentioned first network element), including a processor and a communication interface, the communication interface is used to receive a first message sent by the first terminal, and the first message includes the first message. The identification information of the second terminal; the processor is configured to trigger an authentication procedure for the second terminal according to the first message.

The network-side device embodiment corresponds to the above-mentioned network-side device method embodiment, and each implementation process and implementation mode of the above-mentioned method embodiment can be applied to this network-side device embodiment, and can achieve the same technical effect.

Specifically, the embodiment of the present application further provides a network side device (the above-mentioned first network element). As shown in FIG. 12 , the network side device 1300 includes: a processor 1301 , a network interface 1302 and a memory 1303 . Wherein, the network interface 1302 is, for example, a common public radio interface (common public radio interface, CPRI).

Specifically, the network side device 1300 in this embodiment of the present invention further includes: instructions or programs stored in the memory 1303 and executable on the processor 1301, and the processor 1301 invokes the instructions or programs in the memory 1303 to execute the various programs shown in FIG. The method of module execution achieves the same technical effect, so in order to avoid repetition, it is not repeated here.

The embodiment of the present application also provides a readable storage medium, the readable storage medium stores a program or an instruction, and when the program or instruction is executed by a processor, each process of the above embodiment of the device authentication method is implemented, and can achieve The same technical effects are not repeated here to avoid repetition.

Wherein, the processor is the processor in the terminal described in the foregoing embodiments. The readable storage medium includes a computer-readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk, and the like.

The embodiment of the present application further provides a chip, the chip includes a processor and a communication interface, the The communication interface is coupled with the processor, and the processor is used to run programs or instructions to implement the various processes of the above device authentication method embodiments, and can achieve the same technical effect. To avoid repetition, details are not repeated here.

It should be understood that the chip mentioned in the embodiment of the present application may also be called a system-on-chip, a system-on-chip, a system-on-a-chip, or a system-on-a-chip.

An embodiment of the present application further provides a computer program product, the computer program product is stored in a storage medium, and the computer program product is executed by at least one processor to implement the various processes in the above embodiments of the device authentication method, and The same technical effect can be achieved, so in order to avoid repetition, details will not be repeated here.

The embodiment of the present application also provides a device authentication system, including: a terminal and a network-side device, the terminal can be used to perform the steps of the above-mentioned device authentication method applied to the first terminal, and the network-side device It can be used to execute the steps of the device authentication method applied to the first network element as described above.

It should be noted that, in this document, the term "comprising", "comprising" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article or apparatus comprising a set of elements includes not only those elements, It also includes other elements not expressly listed, or elements inherent in the process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus comprising that element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved. Functions are performed, for example, the described methods may be performed in an order different from that described, and various steps may also be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

Through the description of the above embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware, but in many cases the former is better implementation. Based on such an understanding, the technical solution of the present application can be embodied in the form of computer software products, which are stored in a storage medium (such as ROM/RAM, magnetic disk, etc.) , CD-ROM), including several instructions to make a terminal (which can be a mobile phone, a computer, a service server, air conditioner, or network equipment, etc.) to execute the methods described in the various embodiments of the present application.

The embodiments of the present application have been described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementations. The above-mentioned specific implementations are only illustrative and not restrictive. Those of ordinary skill in the art will Under the inspiration of this application, without departing from the purpose of this application and the scope of protection of the claims, many forms can also be made, all of which belong to the protection of this application.

Claims

A device authentication method, comprising:

The first terminal acquires the identification information of the second terminal;

The first terminal sends a first message to the first network element, where the first message includes identification information of the second terminal, and the first message is used to trigger an authentication procedure for the second terminal.
The method according to claim 1, wherein the first message indicates that the second terminal requests to access the first network element, or the first message requests to establish a session for the second terminal.
The method according to claim 1, wherein the first terminal sending the first request to the first network element comprises:

The first terminal sends the first message through a non-access stratum NAS connection between the first terminal and the first network element.
The method according to claim 1, wherein the first message further includes at least one of the following:

Identification information of the first terminal;

Non-3GPP equipment indication information;

Personal IoT indication information;

There is no 5G capability N5CW indication in the wireless LAN;

An indication to request access for a terminal that does not support NAS;

Passive IoT Instructions.
The method according to claim 4, wherein the non-3GPP device indication information is non-3GPP device registration type information.
The method according to claim 4, wherein the personal internet of things indication information is PINE registration type information of personal internet of things elements.
The method according to claim 1, wherein the identification information of the second terminal includes at least one of the following:

The media access control MAC address of the second terminal;

The device identification of the second terminal;

the International Mobile Subscriber Identity IMSI of the second terminal;

The subscription permanent identification SUPI of the second terminal;

The subscription encryption identity SUCI of the second terminal;

The general public subscription identity GPSI of the second terminal.
The method according to claim 1, wherein the first network element is a mobility management network element or a session management network element.
The method according to claim 1, wherein the first terminal is a personal internet of things gateway.
The method according to claim 1, wherein the second terminal is a non-3GPP device or a personal Internet of Things device.
A device authentication method, comprising:

receiving, by the first network element, a first message sent by the first terminal, where the first message includes identification information of the second terminal;

The first network element triggers an authentication procedure for the second terminal according to the first message.
The method according to claim 11, wherein the first message indicates that the second terminal requests to access the first network element, or the first message requests to establish a session for the second terminal.
The method according to claim 11, wherein the first network element receiving the first message sent by the first terminal comprises:

The first network element receives the first message through the NAS connection between the first terminal and the first network element.
The method according to claim 13, wherein the first message further includes at least one of the following:

Identification information of the first terminal;

Non-3GPP equipment indication information;

Personal IoT indication information;

N5CW instruction;

An indication to request access for a terminal that does not support NAS;

Passive IoT Instructions.
The method according to claim 14, wherein the non-3GPP device indication information is non-3GPP device registration type information.
The method according to claim 14, wherein the personal internet of things indicating information is PINE registration type information of personal internet of things elements.
The method according to claim 11, wherein the identification information of the second terminal includes at least one of the following:

The media access control MAC address of the second terminal;

The device identification of the second terminal;

the International Mobile Subscriber Identity IMSI of the second terminal;

The subscription permanent identification SUPI of the second terminal;

The subscription encryption identity SUCI of the second terminal;

The general public subscription identity GPSI of the second terminal.
The method according to claim 11, wherein the first network element triggers an authentication procedure for the second terminal according to the first message, comprising:

The first network element sends a second message to a second network element according to the first message, where the second message is used to request authentication of the second terminal.
The method according to claim 18, wherein the first network element is a mobility management network element, and the second network element is an authentication server network element;

Alternatively, the first network element is a session management network element, and the second network element is a mobility management network element.
The method according to claim 11, wherein the first terminal is a personal internet of things gateway.
The method according to claim 11, wherein the second terminal is a non-3GPP device or a personal Internet of Things device.
A device authentication device, comprising:

a first obtaining module, configured to obtain identification information of the second terminal;

A first sending module, configured to send a first message to a first network element, where the first message includes identification information of the second terminal, and the first message is used to trigger authentication of the second terminal process.
The apparatus according to claim 22, wherein the first message indicates that the second terminal requests to access the first network element, or the first message requests to establish a session for the second terminal.
The device according to claim 22, wherein the first sending module is configured to A non-access stratum NAS connection between a terminal and the first network element sends the first message.
The apparatus according to claim 22, wherein the first message further includes at least one of the following:

Identification information of the first terminal;

Non-3GPP equipment indication information;

Personal IoT indication information;

N5CW instruction;

An indication to request access for a terminal that does not support NAS;

Passive IoT Instructions.
The apparatus according to claim 22, wherein the identification information of the second terminal includes at least one of the following:

The media access control MAC address of the second terminal;

The device identification of the second terminal;

the International Mobile Subscriber Identity IMSI of the second terminal;

The subscription permanent identification SUPI of the second terminal;

The subscription encryption identity SUCI of the second terminal;

The general public subscription identity GPSI of the second terminal.
An apparatus for authenticating equipment, applied to a first network element, comprising:

A first receiving module, configured to receive a first message sent by the first terminal, where the first message includes identification information of the second terminal;

A processing module, configured to trigger an authentication procedure for the second terminal according to the first message.
The apparatus according to claim 27, wherein the first message indicates that the second terminal requests to access the first network element, or the first message requests to establish a session for the second terminal.
The apparatus according to claim 27, wherein the first receiving module is configured to receive the first message through a NAS connection between the first terminal and the first network element.
The apparatus according to claim 27, wherein the identification information of the second terminal includes at least one of the following:

The media access control MAC address of the second terminal;

The device identification of the second terminal;

the International Mobile Subscriber Identity IMSI of the second terminal;

The subscription permanent identification SUPI of the second terminal;

The subscription encryption identity SUCI of the second terminal;

The general public subscription identity GPSI of the second terminal.
The device according to claim 27, wherein the processing module is configured to send a second message to a second network element according to the first message, and the second message is used to request authentication of the second terminal right.
The device according to claim 31, wherein the first network element is a mobility management network element, and the second network element is an authentication server network element;

Alternatively, the first network element is a session management network element, and the second network element is a mobility management network element.
A terminal, including a processor and a memory, the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the process described in any one of claims 1 to 10 is implemented. Steps of the device authentication method described above.
A network side device, comprising a processor and a memory, the memory stores programs or instructions that can run on the processor, and when the programs or instructions are executed by the processor, any one of claims 11 to 21 can be implemented. The steps of the device authentication method described in item.
A readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the device authentication method according to any one of claims 1 to 10 are implemented, or , realizing the steps of the device authentication method according to any one of claims 11 to 21.