WO2023147767A1 - 网络校验的方法和装置 - Google Patents

网络校验的方法和装置 Download PDF

Info

Publication number
WO2023147767A1
WO2023147767A1 PCT/CN2023/073668 CN2023073668W WO2023147767A1 WO 2023147767 A1 WO2023147767 A1 WO 2023147767A1 CN 2023073668 W CN2023073668 W CN 2023073668W WO 2023147767 A1 WO2023147767 A1 WO 2023147767A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
identification information
network device
information
mac value
Prior art date
Application number
PCT/CN2023/073668
Other languages
English (en)
French (fr)
Inventor
李飞
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN202210134671.1A external-priority patent/CN116600290A/zh
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023147767A1 publication Critical patent/WO2023147767A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security

Definitions

  • the embodiments of the present application relate to the communication field, and more specifically, relate to a method and device for network verification.
  • the relevant rules for UE network selection are proposed, for example, the public land mobile network ID (public land mobile network ID, PLMN ID) is configured on the UE After receiving broadcast signals from multiple networks, the UE determines to access a certain network according to the priorities of these networks. However, some networks may broadcast wrong network IDs, causing UEs to access wrong networks, resulting in illegal charging or data loss. For example, a low-priority network may broadcast the ID of a high-priority network, thereby attracting UEs to access the low-priority network.
  • the public land mobile network ID public land mobile network ID
  • PLMN ID public land mobile network ID
  • a low-priority network may broadcast the ID of a high-priority network, thereby attracting UEs to access the low-priority network.
  • the service network when the UE accesses the PLMN network, the service network will send network selection information including network selection rules to the UE and the home network, for example, send a service network name (service network, SN name).
  • the UE and the home network use the fifth generation (5th generation, 5G) authentication and key agreement (5G authentication and key agreement, 5G AKA) and EAP' authentication and key agreement (extensible authentication protocol-authentication and key agreement, EAP-AKA ) method to verify whether the received SN name is consistent.
  • 5G fifth generation
  • 5G AKA 5G authentication and key agreement
  • EAP' authentication and key agreement extensible authentication protocol-authentication and key agreement
  • NPN non-public network
  • Embodiments of the present application provide a network verification method and device to ensure that a UE accesses a legitimate network.
  • a method for verifying a network comprising: a first terminal device receiving a first MAC value and identification information of a network from a first network device, wherein the first MAC value is based on the determined by the identification information of the network where the first network device is located and the key information corresponding to the first terminal device; the first terminal device generates a second MAC value according to the identification information and the key information; the The first terminal device determines whether the first MAC value matches the second MAC value.
  • the first terminal device The key information generates a second MAC value.
  • the first terminal device can generate a second MAC value according to the received identification information and key information, and then can determine whether the first MAC value matches the second MAC value, so that It can be checked whether the identification information of the network received by the first network device is consistent with the identification information of the network received by the UE itself, so that the service network can be prevented from being deceived into accessing the network, thereby preventing illegal billing or data theft.
  • the first terminal device can generate the second message authentication code according to the identification information and key information obtained from the network where the network device is located, and then can determine whether the first MAC value matches the second MAC value, and the first MAC value It is generated according to the identifier of the network where the network device is located, so that the first terminal device can check whether the identification information of the network received by the UE itself is consistent with the identification information of the network where the network device is located according to whether the two MAC values match, Therefore, it is possible to prevent the first terminal device from being deceived into accessing the network by the service network, thereby preventing illegal billing or data theft.
  • the first network device and the first terminal device perform extensible authentication protocol (extensible authentication protocol, EAP) authentication, thereby completing mutual authentication.
  • EAP extensible authentication protocol
  • the key information includes master session key information or extended master session key information.
  • the key information includes master session key (master session key, MSK) information or extended master session key (extend master session key, EMSK) information.
  • the identification information of the one network includes: the service network name of the one network, the identity of the public land mobile network, the network identity, the identity of the public land mobile network, and the network identity , and at least one of single network slice selection auxiliary information.
  • the network identity may be a network identity (network ID, NID)
  • the single network slice selection assistance information may be single network slice selection assistance information (single network slice selection assistance information, S-NSSAI).
  • a method for sending information comprising: a first network device in a first network determines identification information of a second network including a second network device; the first network device The information and the key information corresponding to the first terminal device generate a MAC value; the first network device sends the MAC value to the second network device.
  • the first network device can determine the identification information of the second network of the second network device and further generate a MAC value based on the identification information and the key information corresponding to the first terminal device, and convert the MAC value to The value is sent to the second network device, which is used by the terminal device to check whether the network identification information received by the first network device is consistent with the network identification information received by the UE itself, so as to prevent the terminal device from being cheated by the service network to access The network is illegally billed or data is stolen.
  • the first network device sends the MAC value to the second network device, which can then be used by the first terminal device to determine whether the first MAC value matches the second MAC value, and further verify the MAC value received by the UE itself. Whether the identification information of the network is consistent with the identification information of the network received by the first network device, so as to prevent the first terminal device from being illegally billed or stealing data due to being deceived by the service network to access the network.
  • the second network may be any network device that can receive broadcast signals within the area where the first terminal device is located.
  • the second network device may determine the first network device according to the identification information of the first terminal device, and further, the second network device may send the identification information of the second network and the identification information of the first terminal device to to the first network device.
  • the identification information of the first terminal device may be a subscription permanent identifier (SUPI) or a subscription concealed identifier (SUCI).
  • SUPI subscription permanent identifier
  • SUCI subscription concealed identifier
  • the first network device determining the identification information includes: the first network device determining the identification information according to local configuration; or, the first network device obtaining the identification information from the first network device The second network device acquires the identification information.
  • the determining, by the first network device, the identification information of the second network includes: obtaining, by the first network device, the identification information of the second network from the second network device; The method further includes: the first network device obtaining the IP address and/or certificate of the second network device; the first network device obtaining the IP address and/or certificate according to the IP address and/or certificate, and the IP address and/or certificate The corresponding relationship with the identification information of the network determines the identification information corresponding to the IP address and/or certificate; the first network device determines that the identification information of the second network corresponds to the IP address and/or certificate The identification information is the same.
  • the local configuration of the first network device includes the correspondence between the IP address and/or certificate of the second network and the identification information of the network.
  • the key information includes master session key information or extended master session key information.
  • the identification information of the second network includes: a service network name of the second network, an identity of a public land mobile network, a network identity, an identity of a public land mobile network, and a network At least one of an identity mark and single network slice selection auxiliary information.
  • the first network device sends the first MAC value to the second network device, and may also send MSK or EMSK.
  • the first terminal device receives the first MAC value and identification information of a network through the second network device, generates a second MAC value according to the identification information and key information corresponding to the first terminal device, and compares the second MAC value Whether the MAC value is consistent with the first MAC value.
  • the first terminal device receives identification information of a network through the second network device, generates a second MAC value according to the identification information and key information corresponding to the first terminal device, and passes the second network device The second MAC value is sent to the first network device, and correspondingly, the first network device compares whether the second MAC value is consistent with the first MAC value.
  • an apparatus for verifying a network which includes: a receiving module configured to receive a first MAC value and identification information of a network from a first network device, wherein the first MAC value is based on Determined by the identification information of the network where the first network device is located and the key information corresponding to the first terminal device; a processing module, configured to generate a second MAC value according to the identification information and the key information; the The processing module is further configured to determine whether the first MAC value matches the second MAC value.
  • the processing module generates the second MAC value specifically according to the identification information of the one network and the key information corresponding to the first terminal device.
  • the processing module in the device for verifying the network can generate the second MAC value according to the identification information and key information obtained from the network of the network device, and then can determine the difference between the first MAC value and the Whether the second MAC value matches, so that the processing module can check whether the identification information of the network received by the UE itself is consistent with the identification information of the network received by the network device according to whether the two MAC values match, so that the second MAC value can be prevented.
  • a terminal device is deceived by the service network to access the network, thereby preventing illegal billing or data theft.
  • the key information includes master session key information or extended master session key information.
  • the identification information of the one network includes: a service network name of the one network At least one of name, public land mobile network identity, network identity, public land mobile network identity and network identity, and single network slice selection auxiliary information.
  • an information sending device which includes: a determining module, configured to determine identification information of a second network including a second network device; a processing module, configured to use the identification information and the first terminal The key information corresponding to the device generates a MAC value; a sending module, configured to send the MAC value to the second network device.
  • the processing module can determine the identification information of the second network of the second network device and further generate a MAC value based on the identification information and the key information corresponding to the first terminal device, and send the MAC value to For the second network device, it can be used by the first terminal device to determine whether the first MAC value matches the second MAC value, and further check the identification information of the network received by the UE itself and the network address of the network device. Whether the identification information is consistent is used to further check whether the identification information of the network received by the UE itself is consistent with the identification information of the network received by the first network device, so as to prevent the first terminal device from being cheated by the service network to access The network is illegally billed or data is stolen.
  • the determining module is specifically configured to: determine the identification information according to local configuration; or obtain the identification information from the second network device.
  • the determination module is specifically configured to: obtain the IP address and/or certificate of the second network device; according to the IP address and/or certificate, and the IP address and/or certificate and The correspondence between the identification information of the network determines the identification information corresponding to the IP address and/or certificate; determines that the identification information of the second network is the same as the identification information corresponding to the IP address and/or certificate.
  • the key information includes master session key information or extended master session key information.
  • the identification information of the second network includes: a service network name of the second network, an identity of a public land mobile network, a network identity, an identity of a public land mobile network, and a network At least one of an identity mark and single network slice selection auxiliary information.
  • a device for network verification including a module or unit for implementing the method according to any one of claims 1-3.
  • an information sending device including: a module or unit for implementing the method according to any one of claims 4-8.
  • a device for network verification including a processor and a memory, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the communication device executes the first or second The network verification method in the second aspect and various possible implementation manners thereof.
  • processors there are one or more processors, and one or more memories.
  • the memory can be integrated with the processor, or the memory can be set separately from the processor.
  • a computer-readable storage medium stores program code for execution by a device, and the program code includes the method for executing the first aspect or the second aspect.
  • a computer program product including instructions is provided, and when the computer program product is run on a computer, the computer is made to execute the method in any one of the implementation manners in the foregoing aspects.
  • a chip in a tenth aspect, includes a processor and a data interface, and the processor reads instructions stored in the memory through the data interface, and executes the method in any one of the above aspects.
  • the chip may further include a memory, the memory stores instructions, the processor is configured to execute the instructions stored in the memory, and when the instructions are executed, the processor is configured to execute the above-mentioned square A method in any of the implementations in the surface.
  • the aforementioned chip may specifically be a field-programmable gate array (field-programmable gate array, FPGA) or an application-specific integrated circuit (application-specific integrated circuit, ASIC).
  • FPGA field-programmable gate array
  • ASIC application-specific integrated circuit
  • FIG. 1 shows a schematic diagram of a communication system architecture 100 applicable to the embodiment of the present application.
  • FIG. 2 shows a schematic diagram of a network architecture 200 applicable to the communication system provided by the embodiment of the present application.
  • Fig. 3 shows a schematic block diagram applicable to a method for verifying a network provided by an embodiment of the present application.
  • Fig. 4 shows another schematic block diagram applicable to the method for verifying a network provided by the embodiment of the present application.
  • FIG. 5 shows a schematic interaction diagram applicable to the method for verifying a network provided by the embodiment of the present application.
  • FIG. 6 shows another schematic block diagram applicable to the method for verifying a network provided by the embodiment of the present application.
  • FIG. 7 shows another schematic interaction diagram applicable to the method for verifying a network provided by the embodiment of the present application.
  • FIG. 8 shows a schematic block diagram of an apparatus suitable for verifying a network provided by an embodiment of the present application.
  • FIG. 9 shows a schematic architecture diagram of a device suitable for verifying a network provided by an embodiment of the present application.
  • the technical solution of the embodiment of the present application can be applied to various communication systems, such as: Global System of Mobile communication (Global System of Mobile communication, GSM) system, code division multiple access (Code Division Multiple Access, CDMA) system, broadband code division multiple access (Wideband Code Division Multiple Access, WCDMA) system, General Packet Radio Service (GPRS), Long Term Evolution (LTE) system, LTE Frequency Division Duplex (FDD) system, LTE Time Division Duplex (TDD), Universal Mobile Telecommunication System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX) communication system, 5th Generation (5G) system or new radio (New Radio, NR), or future evolved systems, etc.
  • GSM Global System of Mobile communication
  • CDMA code division multiple access
  • WCDMA Wideband Code Division Multiple Access
  • GPRS General Packet Radio Service
  • LTE Long Term Evolution
  • FDD Frequency Division Duplex
  • TDD Time Division Duplex
  • UMTS Universal Mobile Telecommunication System
  • WiMAX Worldwide Interoperability for
  • the terminal equipment in the embodiment of the present application may refer to user equipment, access terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent, or user device.
  • the terminal equipment can also be a cellular phone, a cordless phone, a Session Initiation Protocol (Session Initiation Protocol, SIP) phone, a wireless local loop (Wireless Local Loop, WLL) station, a personal digital processing (Personal Digital Assistant, PDA), a wireless communication Functional handheld devices, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, terminal devices in the future 5G network or future evolution of the public land mobile network (Public Land Mobile Network, PLMN)
  • SIP Session Initiation Protocol
  • WLL Wireless Local Loop
  • PDA Personal Digital Assistant
  • the network device in the embodiment of the present application may be a device for communicating with a terminal device, and the network device may be a Global System of Mobile communication (GSM) system or a code division multiple access (Code Division Multiple Access, CDMA)
  • GSM Global System of Mobile communication
  • CDMA Code Division Multiple Access
  • the base station (Base Transceiver Station, BTS) in the wideband code division multiple access (WCDMA) system (NodeB, NB) can also be the evolved base station (Evolutionary Base Station) in the LTE system NodeB, eNB or eNodeB), can also be a cloud
  • the network devices in the network are not limited in this embodiment of the present application.
  • the communication system 100 may include a terminal device, such as the terminal device 110 shown in Figure 1, and the communication system 100 may also include a plurality of network devices, such as the network device 121 shown in 122 and network equipment 123.
  • the terminal device 110 may communicate with any network of the network device 121 , the network device 122 and the network device 123 .
  • the terminal device 110 may select a network for communication according to connection requirements.
  • the terminal device 110 may select which network to access according to the priorities of the three network devices.
  • the above-mentioned network device may be a PLMN, and a priority list of PLMN IDs is configured on the terminal device 110.
  • the terminal device 110 receives the broadcast signals of PLMN1, PLMN2 and PLMN3, the UE will preferentially select PLMN1 according to the priority, or When only broadcast signals from PLMN2 and PLMN3 are received, PLMN2 will be selected first.
  • FIG. 2 shows a schematic diagram of a network architecture 200 of the communication system of the present application.
  • the network architecture of the communication system includes but not limited to the following network elements:
  • User equipment The user equipment in the embodiment of the present application may also be called: user equipment (user equipment, UE), mobile station (mobile station, MS), mobile terminal (mobile terminal, MT), access Terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, subscriber terminal, terminal, wireless communication device, user agent or user device, etc.
  • the user equipment may be a device that provides voice/data connectivity to the user, for example, a handheld device with a wireless connection function, a vehicle-mounted device, and the like.
  • some terminals are: mobile phone (mobile phone), tablet computer, notebook computer, palmtop computer, mobile internet device (mobile internet device, MID), wearable device, virtual reality (virtual reality, VR) device, augmented reality (augmented reality, AR) equipment, wireless terminals in industrial control, wireless terminals in self driving, wireless terminals in remote medical surgery, smart grid Wireless terminals in transportation safety, wireless terminals in smart city, wireless terminals in smart home, cellular phones, cordless phones, session initiation protocol , SIP) telephone, wireless local loop (wireless local loop, WLL) station, personal digital assistant (personal digital assistant, PDA), handheld device with wireless communication function, computing device or other processing device connected to a wireless modem, vehicle Devices, wearable devices, user equipment in the future 5G network or user equipment in the future evolved public land mobile network (public land mobile network, PLMN), etc
  • the user equipment may also be a wearable device.
  • Wearable devices can also be called wearable smart devices, which is a general term for the application of wearable technology to intelligently design daily wear and develop wearable devices, such as glasses, gloves, watches, clothing and shoes.
  • a wearable device is a portable device that is worn directly on the body or integrated into the user's clothing or accessories. Wearable devices are not just a hardware device, but Powerful functions are realized through software support, data interaction, and cloud interaction.
  • Generalized wearable smart devices include full-featured, large-sized, complete or partial functions without relying on smart phones, such as smart watches or smart glasses, etc., and only focus on a certain type of application functions, and need to cooperate with other devices such as smart phones Use, such as various smart bracelets and smart jewelry for physical sign monitoring.
  • the user equipment may also be a user equipment in an Internet of Things (Internet of Things, IoT) system.
  • IoT Internet of Things
  • Its main technical feature is to connect objects to the network through communication technology, so as to realize the intelligent network of human-machine interconnection and object interconnection.
  • the IOT technology can achieve massive connections, deep coverage, and terminal power saving through, for example, narrow band NB technology.
  • the NB may include one resource block (resource block, RB), that is, the bandwidth of the NB is only 180KB.
  • resource block resource block
  • terminals must be discrete in terms of access. According to the communication method of the embodiment of the application, it can effectively solve the congestion problem of IOT technology mass terminals when accessing the network through NB.
  • the access device in this embodiment of the present application may be a device for communicating with user equipment, and the access device may also be called an access network device or a wireless access network device.
  • the access device may be an LTE system
  • the evolved base station (evolved NodeB, eNB or eNodeB) in the network can also be a wireless controller in a cloud radio access network (cloud radio access network, CRAN) scenario, or the access device can be a relay station, access point, Vehicle-mounted devices, wearable devices, access devices in the future 5G network or access devices in the future evolved PLMN network, etc., can be the access point (access point, AP) in the WLAN, or the new wireless system (new The gNB in the radio (NR) system is not limited in this embodiment of the present application.
  • the user equipment may also communicate with user equipment in other communication systems, for example, communication between devices.
  • the user equipment may also perform time synchronization message transmission (for example, send and/or receive) with user equipment in other communication systems.
  • Access device may be a device used to communicate with user equipment, and the access device may also be called an access network device or a wireless access network device.
  • the access device may be an evolved base station (evolved NodeB, eNB or eNodeB) in the LTE system, or a wireless controller in a cloud radio access network (cloud radio access network, CRAN) scenario, or the access device
  • the device can be a relay station, an access point, a vehicle-mounted device, a wearable device, an access device in a 5G network or an access device in a future evolved PLMN network, etc., and it can be an access point (AP) in a WLAN.
  • AP access point
  • WLAN wireless local area network
  • gNB in the NR system. This embodiment of the present application is not limited.
  • the access device is a device in the RAN, or in other words, a RAN node that connects the user equipment to the wireless network.
  • gNB transmission reception point
  • eNB evolved node B
  • RNC radio network controller
  • node B Node B, NB
  • base station controller base station controller
  • base transceiver station base transceiver station
  • BTS home base station
  • home evolved NodeB or home Node B, HNB
  • base band unit base band unit
  • BBU wireless fidelity (wireless fidelity, Wifi) access point (access point, AP), etc.
  • the network device may include a centralized unit (centralized unit, CU) node, or a distributed unit (distributed unit, DU) node, or a RAN device including a CU node and a DU node, or a control plane CU node (CU -CP node) and RAN equipment of user plane CU node (CU-UP node) and DU node.
  • a centralized unit centralized unit, CU
  • DU distributed unit
  • RAN device including a CU node and a DU node, or a control plane CU node (CU -CP node) and RAN equipment of user plane CU node (CU-UP node) and DU node.
  • the access device provides services for the cell, and the user equipment uses transmission resources (for example, frequency domain resources, In other words, the spectrum resource) communicates with the access device,
  • the cell may be a cell corresponding to the access device (such as a base station), and the cell may belong to a macro base station or a base station corresponding to a small cell (small cell), where the small cell Cells may include: metro cells, micro cells, pico cells, femto cells, etc. These small cells have the characteristics of small coverage and low transmission power, and are suitable for Provide high-speed data transmission services.
  • multiple cells can work at the same frequency on the carrier in the LTE system or 5G system at the same time.
  • the concept of the above-mentioned carrier and cell can also be considered to be equivalent.
  • a carrier aggregation (carrier aggregation, CA) scenario when a secondary carrier is configured for the UE, the carrier index of the secondary carrier and the cell identification (cell identification, Cell ID) of the secondary cell working on the secondary carrier will be carried at the same time.
  • the concepts of a carrier and a cell are equivalent, for example, accessing a carrier by a user equipment is equivalent to accessing a cell.
  • the communication system of the present application may also be applicable to vehicle to everything (V2X) technology, that is, the user equipment of the present application may also be a car, for example, a smart car or an automatic driving car.
  • V2X vehicle to everything
  • V2X represents different communication targets.
  • V2X can include but not limited to: vehicle to vehicle (vehicle to vehicle, V2V), vehicle to infrastructure (V2I), vehicle to network (vehicle to network, V2N), and vehicle to pedestrian (V2P).
  • the access device can configure a "zone" for the UE.
  • the area may also be referred to as a geographical area.
  • the area When the area is configured, the world will be divided into multiple areas, which are defined by the reference point, length, and width.
  • the UE When determining an area identifier (identifier, ID), the UE will use the length and width of the area, the number of areas above the length, the number of areas above the width, and reference points to perform other operations.
  • ID area identifier
  • the foregoing information may be configured by the access device.
  • V2X services can be provided in two ways: namely, based on Proximity-based Services Communication 5 (PC5) interface and based on Uu interface.
  • PC5 interface is an interface defined on the basis of a sidelink. Using this interface, communication devices (for example, automobiles) can directly perform communication transmission.
  • the PC5 interface can be used both out of coverage (OOC) and in coverage (IC), but only authorized communication devices can use the PC5 interface for transmission.
  • Access and mobility management function (Access and Mobility Management Function, AMF) network element: mainly used for mobility management and access management, etc., can be used to realize the mobility management entity (mobility management entity, MME) in the LTE system Functions other than session management, such as lawful interception and access authorization/authentication.
  • AMF Access and Mobility Management Function
  • MME mobility management entity
  • the AMF network element provides services for the session in the user equipment, it will provide the session with storage resources on the control plane to store the session ID, the SMF network element ID associated with the session ID, and the like.
  • it can be used to implement functions of access and mobility management network elements.
  • Session Management Function network element: mainly used for session management, network interconnection protocol (internet protocol, IP) address allocation and management of user equipment, selection and management of user plane functions, policy control, or The endpoint of the charging function interface and the notification of downlink data, etc. In the embodiment of the present application, it can be used to realize the function of the session management network element.
  • network interconnection protocol internet protocol, IP
  • Policy control Policy Control Function
  • PCF Policy Control Function
  • Unified data management (UDM) network element mainly responsible for the subscription data of the UE processing, including storage and management of user IDs, user subscription data, authentication data, etc.
  • User Plane Function (UPF) network element It can be used for packet routing and forwarding, or quality of service (QoS) processing of user plane data.
  • User data can be connected to a data network (data network, DN) through the network element, and user data can also be received from the data network and transmitted to the user equipment through the access network equipment.
  • the transmission resources and scheduling functions that provide services for user equipment in the UPF network element are managed and controlled by the SMF network element. In the embodiment of the present application, it can be used to realize the functions of the user plane network element.
  • Network Exposure Function Network element: It is used to securely open the services and capabilities provided by the 3GPP network function to the outside, and mainly supports the secure interaction between the 3GPP network and third-party applications.
  • Application function Application Function, AF
  • network element used for data routing affected by applications, access to network open function network elements, or interact with the policy framework for policy control, etc., such as affecting data routing decisions, policy control functions Or provide some third-party services to the network side.
  • NSF Network Slice Selection Function
  • AUSF Authentication Server Function
  • Network Repository Function (NRF) network element: supports the registration and discovery of network functions.
  • Unified Data Repository (UDR) network element store and obtain contract data used by UDM and PCF.
  • the N2 interface is the reference point between the RAN and the AMF entity, which is used for sending NAS (Non-Access Stratum, non-access stratum) messages, etc.
  • the N3 interface is the reference point between the RAN and UPF network elements, Used to transmit user plane data, etc.
  • the N4 interface is the reference point between the SMF network element and the UPF network element, and is used to transmit such information as the tunnel identification information of the N3 connection, data cache indication information, and downlink data notification messages.
  • the UE, (R)AN, UPF, and DN in FIG. 2 are generally referred to as data plane network functions and entities, and user data traffic can be transmitted through the PDU session established between the UE and the DN, and the transmission will pass through ( R)
  • the two network functional entities of AN and UPF; the other parts are called control plane network functions and entities, which are mainly responsible for functions such as authentication and authentication, registration management, session management, mobility management, and policy control. Realize reliable and stable transmission of user layer traffic.
  • (R)AN and AMF may be referred to as serving networks, and AUSF and UDM may be referred to as home networks.
  • the above-mentioned service network can be understood as a network that provides services for the terminal device
  • the home network can be understood as a function or network that stores or manages credentials of the terminal device.
  • the above-mentioned network architecture applied to the embodiment of the present application is only an example of a network architecture described from the perspective of a traditional point-to-point architecture and a service-oriented architecture, and the network architecture applicable to the embodiment of the present application is not limited thereto. Any network architecture capable of implementing the functions of the foregoing network elements is applicable to this embodiment of the present application.
  • the name of the interface between network elements in FIG. 2 is just an example, and the name of the interface in a specific implementation may be another name, which is not specifically limited in this application.
  • the transmitted messages (or The name of the signaling) is only an example, and does not constitute any limitation on the function of the message itself.
  • network element may also be referred to as an entity, device, device, or module, etc., which are not specifically limited in this application.
  • SMF SMF network element
  • SMF SMF network element
  • the above entity or function may be a network element in a hardware device, a software function running on dedicated hardware, or a virtualization function instantiated on a platform (eg, a cloud platform).
  • the first network device is an example of the home network
  • the second network device is an example of the service network of the second network.
  • the first network device is the home entity of the first terminal device, and the first network device may refer to the home entity of the first terminal device by AAA, or may be a certificate holder (credential holder) or DCS or AUSF/UDM .
  • the attribution entity of the first terminal device may be a different network entity or be referred to by a different name according to different scenarios. This embodiment of the present application does not limit it.
  • the network accessed by the first terminal device may be called an NPN network, may also be called an onboarding network, or may be called a service network.
  • FIG. 3 is a schematic block diagram of a network verification method provided in an embodiment of the present application.
  • the method 300 may include the following steps:
  • the first terminal device receives the first MAC value and identification information of a network from the network device.
  • the first terminal device receives the first MAC value and identification information of the second network including the second network device from the second network device.
  • the first network device may send the first MAC value to the first terminal device through the second network device.
  • the identification information of the one network may be at least one of service network name, public land mobile network identity, network identity, public land mobile network identity and network identity, and single network slice selection auxiliary information, It can also be any information that can identify the identity of the network.
  • the identification information of a network may be understood as network selection information when the first terminal device selects a network connection, that is, when the first terminal device selects a network, it may verify the identification information of the network.
  • the one network may be any network device that can receive broadcast signals within the area where the first terminal device is located, for example, it may be the second network.
  • the first terminal device generates a second MAC value according to the identification information of the one network and key information corresponding to the first terminal device.
  • the key information of the first terminal device may be a master session key (master session key, MSK) or an extended master session key (extend master session key, EMSK).
  • master session key master session key, MSK
  • extended master session key extend master session key, EMSK
  • the second MAC value generated by the above-mentioned first terminal device can be understood as that the first terminal device generates a network address based on the MSK or EMSK of the first terminal device, or other keys combined with the received identification information of a network. MAC value.
  • step S320 the first terminal device needs to authenticate with the first network device.
  • the first network device and the first terminal device perform EAP authentication.
  • the first terminal device determines whether the first MAC value matches the second MAC value.
  • the verification is successful, that is, it means that the network is determined to be a legal network, and the first terminal device can access the network correspondingly, when the first MAC value does not match the second MAC value generated by the first terminal device, the verification fails, and the network is determined to be an illegal network, and the first terminal device cannot access the network network devices in .
  • the first terminal device can generate a second MAC value according to the identification information and key information obtained from the network device, and then can determine whether the first MAC value matches the second MAC value,
  • the first MAC value is generated according to the identity of the network where the network device is located, so that the first terminal device can check whether the identification information of the network received by the UE itself and the identity of the network where the network device is located according to whether the two MAC values match Whether the information is consistent can prevent the first terminal device from being deceived by the service network to access the network, thereby preventing illegal billing or data theft.
  • FIG. 4 is a schematic block diagram of a network verification method provided by an embodiment of the present application.
  • the method 400 may include the following steps:
  • the first network device determines identification information of the second network including the second network device.
  • the first network device may receive the identification information of the second network from the second network device.
  • the second network device sends the identification information of the second network device to the first network device.
  • the identification information of the second network may be at least one of SN name, PLMN ID, NID, PLMN ID+NID, and S-NSSAI, and may also be any information that can identify a network identity.
  • the identification information of the second network may be understood as network selection information when the first terminal device selects a network connection, that is, the first terminal device may verify the identification information of the second network when selecting a network.
  • the second network may be any network device that can receive broadcast signals within the area where the first terminal device is located.
  • the second network device may determine the first network device according to the identification information of the first terminal device, and further, the second network device may send the identification information of the second network and the identification information of the first terminal device to the first network equipment.
  • the identification information of the first terminal device may be SUPI.
  • the identification information of the first terminal device may be SUCI.
  • the first network device may also verify the identification information of the second network according to local configuration.
  • the first network device determines whether the second network has a corresponding relationship with the identification information according to the local configuration, and the corresponding relationship may be It is understood that the second network has the right to use the identification information.
  • the first network device may obtain the IP address and/or certificate of the second network device, and determine the identity corresponding to the IP address and/or certificate according to the correspondence between the IP address and/or certificate and network identification information Further, when the first network device determines that the identification information of the second network is the same as the identification information corresponding to the IP address and/or certificate, it may verify that the identification information of the second network is correct.
  • the local configuration of the first network device includes the correspondence between the IP address and/or certificate of the second network and the identification information of the network.
  • the first network device may obtain the certificate of the second network device, verify the identification information according to the PLMN ID carried in the certificate, and determine whether the PLMN ID carried in the certificate is the same as the identification information of the second network, Then it may be checked whether the identification information of the second network is correct.
  • the local configuration of the first network device includes the PLMN ID of the second network.
  • the first network device may also obtain the identification information of the second network according to local configuration.
  • the first network device directly determines the identification information of the second network device according to the local configuration.
  • the first network device can directly find the correspondence between the IP address and/or certificate of the second network device and the identification information of the network according to the local configuration, so as to determine the identification information of the network where the second network device is located.
  • the local configuration of the first network device includes the correspondence between the IP address and/or certificate of the second network and the identification information of the network.
  • the first network device can find the certificate of the second network device according to the local configuration, and obtain the PLMN ID of the network where the second network device is located from the certificate.
  • the local configuration of the first network device includes the PLMN ID of the second network.
  • the first network device generates a MAC value according to the identification information and key information corresponding to the first terminal device.
  • the first network device determines the key information corresponding to the first terminal device according to the identification information of the first terminal device, further, the first network device determines the key information corresponding to the first terminal device according to the identification information of the second network and the first terminal The key information corresponding to the device generates a MAC value.
  • the MAC value generated by the first network device according to the identification information of the second network including the second network device and the key information corresponding to the first terminal device may be recorded as the first MAC value.
  • the key information of the first terminal device may be a master session key (master session key, MSK).
  • the key information of the first terminal device may also be an extended master session key (extend master session key, EMSK).
  • first MAC value generated by the first network device can be understood as that the first network device generates a service network ( The MAC value of the network where the second network device is located).
  • step S420 the first network device and the first terminal device need to authenticate each other.
  • the first network device and the first terminal device perform EAP authentication.
  • the first network device sends the MAC value to the second network device.
  • the first network device may also receive the second MAC value sent by the first terminal device.
  • the first network device sends the first MAC value to the second network device, and correspondingly, the second network device receives the first MAC value.
  • the first network device receives the second MAC value sent by the first terminal device through the second network device, and correspondingly, the first terminal device sends the second MAC value to the first network device through the second network device. the second MAC value.
  • the first network device sends the first MAC value to the second network device, and may also send MSK or EMSK.
  • the first terminal device receives the first MAC value and identification information of a network through the second network device, generates a second MAC value according to the identification information and key information corresponding to the first terminal device, and compares the second MAC value Whether the MAC value is consistent with the first MAC value.
  • the first terminal device generates the MAC value in the same manner as the first network device generates the MAC value.
  • the first network device may send the first MAC value to the first terminal device through the second network device, and the first MAC value is carried in an EAP message, or may be carried by other signaling, for example, through a A separate message carries the first MAC value; for another example, it is carried in an EAP authentication interaction message.
  • the first terminal device receives identification information of a network, generates a second MAC value according to the identification information and key information corresponding to the first terminal device, and sends the second MAC value to the first network device through the second network device.
  • the second MAC value is sent, and correspondingly, the first network device compares whether the second MAC value is consistent with the first MAC value.
  • the first terminal device may calculate the second MAC value and send it to the first network device through the second network device for verification.
  • the verification is successful, that is, it means that the second network is determined to be a legitimate network, and the first terminal The device can access the second network device in the second network; correspondingly, when the first MAC value generated by the first network device does not match the second MAC value generated by the first terminal device, the verification fails, and it is determined
  • the second network is an illegal network, and the first terminal device cannot access the second network device in the second network.
  • the first network device can determine the second network identification information and combine the key information of the first terminal device to generate the first MAC value, and the first terminal device can use the received identification information and The key information generates a second MAC value, and then by sending each other and verifying each other, it can be determined whether the first MAC value matches the second MAC value, so that the identification information of the network received by the first network device and the UE can be verified Whether the identification information of the network received by itself is consistent, so that the first terminal device can be prevented from being deceived by the service network to access the network, thereby preventing illegal billing or data theft.
  • Fig. 5 is a schematic interaction diagram of a method for network inspection provided by an embodiment of the present application.
  • the method 500 in FIG. 5 is a specific implementation step corresponding to the method 300 in FIG. 3 .
  • the method shown in Figure 5 may include the following steps:
  • the UE initiates a registration request, carrying a user identifier SUCI or SUPI.
  • the UE sends a request message #A to the AMF/SEAF of the serving network, the request message #A is used to initiate a registration request to the UE, and the request message #A carries the UE's user identifier SUCI or SUPI.
  • the AMF requests authentication from the AUSF.
  • the AMF sends a request message #B to the AUSF, where the request message #B is used to request primary authentication of the UE.
  • the request message #B carries the user identity SUCI or SUPI of the UE, and the user identity is used by the AMF to select the AUSF.
  • the AUSF sends a request message #C to the UDM, where the request message #C is used to start a Nudm_UEAuthentication_Get service operation.
  • the request message #C carries the user identity SUCI or SUPI of the UE, and the user identity is used by the AUSF to select UDM.
  • the UDM parses the SUCI into a SUPI.
  • the UDM sends a response message #A to the AUSF, where the message #A includes the SUPI of the UE.
  • step S503-step S505 is for the AUSF to obtain the SUPI from the UDM, and this step is an optional step.
  • AUSF carries SUPI/SUCI to request authentication from NSSAAF, and optionally carries SN name.
  • the AUSF sends a request message #D to the NSSAF, and the request message #D is used to request authentication from the NSSAAF and initiate the Nnssaaf_AIWF_Authenticate service operation.
  • the request message #D carries SUPI/SUCI.
  • the identifier #a may also be carried.
  • the identifier #a is an example of network identification information including the service network.
  • the network identification information may be the name of the service network, the identity of the public land mobile network, the network identity, the public land mobile network At least one of the identity of the mobile network, the network identity, and the single network slice selection auxiliary information may also be any information that can identify the network identity.
  • NSSAAF carries SUPI/SUCI to request authentication from AAA, and optionally carries SN name.
  • the NSSAAF sends a request message #E to the AAA server.
  • the request message #E is used to request authentication from the AAA server.
  • the request message #E carries SUPI/SUCI, and optionally carries the identifier #a. It should be understood that the NSSAAF may select an AAA server according to the SUPI, perform related protocol conversion, and then send the request message #E to the AAA server.
  • the NSSAAF will send the identity #a to the AAA server only after judging that the AAA server supports identification of the identity #a.
  • the request message #E may be sent through an AAA message.
  • the AAA server determines the identifier #a according to the request message #E.
  • AAA verifies the received SN name according to the local configuration (such as the local configuration IP, the corresponding relationship between the certificate and the SN name, or the PLMN ID carried in the certificate). If the 7th step does not carry the SN name, AAA obtains the SN name according to the local configuration (for example, if the local configuration IP, the corresponding relationship between the certificate and the SN name, or the certificate contains the PLMN ID, the SN name can be obtained through the peer IP or certificate) .
  • the local configuration such as the local configuration IP, the corresponding relationship between the certificate and the SN name, or the PLMN ID carried in the certificate.
  • the AAA server determines the identification information of the network including the serving network. Including two ways:
  • Mode 1 the request message #E carries the identifier #a, and the AAA server determines whether the identifier #a has a corresponding relationship with the service network according to the local configuration.
  • the AAA server may determine the identification information corresponding to the IP address and/or certificate according to the correspondence between the IP address and/or certificate of the service network and the identification information of the network. Further, the AAA If the server determines that the identification #a is the same as the identification information corresponding to the IP address and/or the certificate, it may verify whether the identification #a is correct.
  • the local configuration of the AAA server includes the correspondence between the IP address of the serving network and/or the certificate and the identification information of the network.
  • the AAA server verifies the identification information according to the PLMN ID carried in the certificate of the service network, determines whether the PLMN ID carried in the certificate is the same as the identification #a, and then can verify whether the identification #a is correct.
  • the local configuration of the AAA server includes the PLMN ID of the serving network.
  • Method 2 The request message #E does not carry the identifier #a, and the AAA server obtains the identifier #a of the service network according to the local configuration.
  • the AAA server directly determines the identification information of the service network according to the local configuration.
  • the AAA server can directly find out the correspondence between the IP address of the service network and/or the certificate and the identification information of the network according to the local configuration, so as to determine the identification information of the network where the service network is located.
  • the local configuration of the AAA server includes the correspondence between the IP address of the serving network and/or the certificate and the identification information of the network.
  • the AAA server can find the certificate of the service network according to the local configuration, and obtain the PLMN ID of the network where the service network is located from the certificate.
  • the local configuration of the AAA server includes the PLMN ID of the serving network.
  • UE and AAA server need to be authenticated.
  • the AAA server and the UE perform EAP authentication to complete mutual authentication.
  • the AAA server generates the first MAC value by using the MSK or EMSK or other generated keys and the identifier #a.
  • AAA uses MSK or EMSK or other generated keys and SN name to generate new keys (example name MSK*), then send MSK* to AUSF.
  • the AAA server uses MSK or EMSK or other generated keys and SN name to generate a new key, and the new key can also be a MAC value, and then sends the MAC value to AUSF.
  • AAA server can also send the MAC value to the AUSF, calculate Kausf and Kseaf and send it to the AMF serving the network.
  • the AMF sends the first MAC value to the UE through the NAS message #A.
  • the UE receives the first MAC value.
  • the UE side generates the second MAC value in the same manner.
  • the UE obtains Kausf through steps S510-S513, and the UE generates the second MAC value by using MSK or EMSK or other generated keys and the identifier #b.
  • the identifier #b is an example of the network identification information of the serving network received by the UE from the serving network, and the network identification information may be the name of the serving network, the identity of the public land mobile network, the network identity, or the identity of the public land mobile network and at least one of the network identity identifier and the single-network slice selection auxiliary information, or any information that can identify the network identity.
  • the UE determines whether the first MAC value matches the second MAC value.
  • the UE generates the MAC value in the same manner as the AAA server generates the MAC value.
  • the UE receives an identification information ID #b of a network through the serving network, generates a second MAC value according to the ID #b and MSK/EMSK or other key information corresponding to the UE, and sends the MAC value to the UE through the serving network.
  • the AAA server sends the second MAC value, and correspondingly, the AAA server performs verification to compare whether the second MAC value matches the first MAC value.
  • the UE may calculate the second MAC value and send it to the AAA server for verification.
  • the UE needs to configure an indication of whether to use the network identification information (identity #b) to generate the MAC value, and then determine whether to perform the generation of the MAC value according to the indication.
  • identity #b network identification information
  • the verification is successful, that is, it means that the UE can access the network device in the serving network; correspondingly, when the AAA When the first MAC value generated by the server does not match the second MAC value generated by the UE, the verification fails, and the UE cannot access the network device in the serving network.
  • NSSAAF will send the SN name to AAA only if it judges that AAA supports SN name identification.
  • an indication of whether to use the SN name to generate the MAC value is configured on the UE. Then determine whether to execute according to the instructions.
  • adding the identification information (SN name) of the network into the key generation method of the home party can ensure that the UE and the home party perceive the SN name, thereby implicitly checking whether the received SN name is unanimous.
  • the home network can determine the network identification information sent by the serving network, and generate the first MAC value in combination with the key information of the UE, and the UE can generate the second MAC value according to the received identification information and key information, and then through mutual Sending and checking each other can determine whether the first MAC value matches the second MAC value, so as to check whether the identification information of the network received by the UE itself is legal, so it can prevent the service network from being deceived into accessing the network, thereby preventing Illegal billing or data theft.
  • FIG. 6 is another schematic block diagram of a method for network verification provided by an embodiment of the present application.
  • the method 500 may include the following steps:
  • the first network device determines identification information of the second network including the second network device.
  • the first network device may receive the identification information of the second network from the second network device.
  • the second network device sends the identification information of the second network device to the first network device.
  • the identification information of the second network may be at least one of SN name, PLMN ID, NID, PLMN ID+NID, and S-NSSAI, and may also be any information that can identify a network identity.
  • the identification information of the second network may be understood as network selection information when the first terminal device selects a network connection, that is, the first terminal device may verify the identification information of the second network when selecting a network.
  • the second network may be any network device that can receive broadcast signals within the area where the first terminal device is located.
  • the second network device may determine the first network device according to the identification information of the first terminal device, and further, the second network device may send the identification information of the second network and the identification information of the first terminal device to the first network equipment.
  • the identification information of the first terminal device may be SUPI.
  • the identification information of the first terminal device may also be SUCI.
  • the first network device may also verify the identification information of the second network according to local configuration.
  • the first network device determines whether the second network has a corresponding relationship with the identification information according to the local configuration, and the corresponding relationship may be It is understood that the second network has the right to use the identification information.
  • the first network device may obtain the IP address and/or certificate of the second network device, and determine the identity corresponding to the IP address and/or certificate according to the correspondence between the IP address and/or certificate and network identification information Further, when the first network device determines that the identification information of the second network is the same as the identification information corresponding to the IP address and/or certificate, it may verify that the identification information of the second network is correct.
  • the local configuration of the first network device includes the correspondence between the IP address and/or certificate of the second network and the identification information of the network.
  • the first network device may obtain the certificate of the second network device, verify the identification information according to the PLMN ID carried in the certificate, and determine whether the PLMN ID carried in the certificate is the same as the identification information of the second network, Then it may be checked whether the identification information of the second network is correct.
  • the local configuration of the first network device includes the PLMN ID of the second network.
  • the first network device may also obtain the identification information of the second network according to local configuration.
  • the first network device directly determines the identification information of the second network device according to the local configuration.
  • the first network device can directly find the IP address and/or certificate of the second network device according to the local configuration The corresponding relationship with the identification information of the network, so as to determine the identification information of the network where the network device of the second network is located.
  • the local configuration of the first network device includes the correspondence between the IP address and/or certificate of the second network and the identification information of the network.
  • the first network device can find the certificate of the second network device according to the local configuration, and obtain the PLMN ID of the network where the second network device is located from the certificate.
  • the local configuration of the first network device includes the PLMN ID of the second network.
  • the first network device generates MSK information according to the identification information and key information corresponding to the first terminal device.
  • the MSK information generated by the first network device according to the identification information and key information corresponding to the first terminal device may be first MSK* information.
  • the first network device determines the key information corresponding to the first terminal device according to the identification information of the first terminal device, further, the first network device determines the key information corresponding to the first terminal device according to the identification information of the second network and the first terminal The key information corresponding to the device generates MSK information.
  • the key information of the first terminal device may be MSK or EMSK.
  • the updated key information generated by the above-mentioned first network device can be understood as that the first network device generates a service network key information based on the MSK or EMSK of the first terminal device, or other keys combined with the identification information of the second network.
  • Another key information (of the second network device) the key information may be MSK information, and the following embodiments take the first MSK* information as an example for description.
  • step S620 the first network device and the first terminal device need to authenticate each other.
  • the first network device and the first terminal device perform EAP authentication to complete mutual authentication.
  • the first network device sends the MSK information to the second network device.
  • the first network device sends the first MSK* information to the second network device, and correspondingly, the second network device receives the first MSK* information.
  • the first network device sends the first MSK* information, MSK or EMSK, to the second network device.
  • the first terminal device receives the first MSK* information and identification information of a network through the second network device, generates second MSK* information according to the identification information and key information corresponding to the first terminal device, and compares the Whether the second MSK* information is consistent with the first MSK* information.
  • the first terminal device generates the second MSK* information in the same manner as the first network device generates the first MSK* information.
  • the first network device may send the first MSK* information to the first terminal device through the second network device, and the first MSK* information is carried in an EAP message, or may be carried by other signaling, for example,
  • the first MSK* information is carried in a separate message; for another example, it is carried in an EAP authentication interaction message.
  • the verification is successful, that is, it means that the first terminal device can access the second MSK* information.
  • the second network device in the network correspondingly, when the first MSK* information generated by the first network device does not match the second MSK* information generated by the first terminal device, the verification fails, and the first terminal device cannot access the second network device in the second network.
  • the first network device can determine the second network identification information and generate new key information in combination with the key information of the first terminal device, and the first terminal device can use the received identification information and The key information generates new key information, and then the first terminal device can check whether the key information generated by itself is consistent with the identification information of the network where the network device is located according to whether the two new key information match. Verify whether the identification information of the network received by the UE itself is legal, so it can prevent the service network from being deceived into accessing the network, thereby preventing illegal billing or data theft.
  • Fig. 7 is a schematic interaction diagram of a method for network inspection provided by an embodiment of the present application.
  • the method 700 in FIG. 7 is a specific implementation step corresponding to the method 600 in FIG. 6 .
  • MSK or EMSK or other generated keys and SN name are used to generate a MAC value of an SN, and then the MAC value is sent to the UE via the serving network for verification.
  • the NPN scenario is taken as an example, where the UE is an example of the first terminal device, the second network device includes network entities such as AMF/SEAF, AUSF, UDM, and NSSAF, and the first network device uses an AAA server as an example to perform illustrate.
  • the UE is an example of the first terminal device
  • the second network device includes network entities such as AMF/SEAF, AUSF, UDM, and NSSAF
  • the first network device uses an AAA server as an example to perform illustrate.
  • the method shown in Figure 7 may include the following steps:
  • the UE sends a request message #A to the AMF/SEAF of the serving network, where the request message #A is used to initiate a registration request, and the request message #A carries the user identifier SUCI or SUPI of the UE.
  • the AMF sends a request message #B to the AUSF, where the request message #B is used to request primary authentication of the UE.
  • the request message #B carries the user identity SUCI or SUPI of the UE, and the user identity is used by the AMF to select the AUSF.
  • the AUSF sends a request message #C to the UDM, where the request message #C is used to start a Nudm_UEAuthentication_Get service operation.
  • the request message #C carries the user identity SUCI or SUPI of the UE, and the user identity is used by the AUSF to select UDM.
  • the UDM parses the SUCI into a SUPI.
  • the UDM sends a response message #A to the AUSF, where the message #A includes the SUPI of the UE.
  • step S703-step S705 is for the AUSF to obtain the SUPI from the UDM, and this step is an optional step.
  • the AUSF sends a request message #D to the NSSAF, where the request message #D is used to request authentication from the NSSAAF, and initiates a Nnssaaf_AIWF_Authenticate service operation.
  • the request message #D carries SUPI/SUCI.
  • the identifier #a may also be carried.
  • the identifier #a is an example of network identification information including the service network.
  • the network identification information may be the name of the service network, the identity of the public land mobile network, the network identity, the public land mobile network At least one of the identity of the mobile network, the network identity, and the single network slice selection auxiliary information may also be any information that can identify the network identity.
  • the NSSAAF sends a request message #E to the AAA server.
  • the request message #E is used to request authentication from the AAA server.
  • the request message #E carries SUPI/SUCI, and optionally carries the identifier #a. It should be understood that the NSSAAF may select an AAA server according to the SUPI, perform related protocol conversion, and then send the request message #E to the AAA server.
  • the NSSAAF will send the identity #a to the AAA server only after judging that the AAA server supports identification of the identity #a.
  • the request message #E may be sent through an AAA message.
  • the AAA server determines the identifier #a according to the request message #E.
  • the AAA server determines the identification information of the network including the service network. Including two ways:
  • Mode 1 the request message #E carries the identifier #a, and the AAA server determines whether the identifier #a has a corresponding relationship with the service network according to the local configuration.
  • the AAA server may determine the identification information corresponding to the IP address and/or certificate according to the correspondence between the IP address and/or certificate of the service network and the identification information of the network. Further, the AAA If the server determines that the identification #a is the same as the identification information corresponding to the IP address and/or the certificate, it may verify whether the identification #a is correct.
  • the local configuration of the AAA server includes the correspondence between the IP address of the serving network and/or the certificate and the identification information of the network.
  • the AAA server verifies the identification information according to the PLMN ID carried in the certificate of the service network, determines whether the PLMN ID carried in the certificate is the same as the identification #a, and then can verify whether the identification #a is correct.
  • the local configuration of the AAA server includes the PLMN ID of the serving network.
  • Method 2 The request message #E does not carry the identifier #a, and the AAA server obtains the identifier #a of the service network according to the local configuration.
  • the AAA server directly determines the identification information of the service network according to the local configuration.
  • the AAA server can directly find out the correspondence between the IP address of the service network and/or the certificate and the identification information of the network according to the local configuration, so as to determine the identification information of the network where the service network is located.
  • the local configuration of the AAA server includes the correspondence between the IP address of the serving network and/or the certificate and the identification information of the network.
  • the AAA server can find the certificate of the service network according to the local configuration, and obtain the PLMN ID of the network where the service network is located from the certificate.
  • the local configuration of the AAA server includes the PLMN ID of the serving network.
  • UE and AAA server need to be authenticated.
  • the AAA server and the UE perform EAP authentication to complete mutual authentication.
  • the AAA server uses the MSK or EMSK or other generated keys and the identifier #a to generate the first MSK* information.
  • the AAA server sends the first MSK* information to the AUSF in the service network, and the AUSF calculates Kseaf according to the first MSK* information, and sends it to the AMF in the service network.
  • the AMF sends the Kseaf calculated according to the first MSK* information to the UE through the NAS message #a.
  • the UE receives the Kseaf calculated according to the first MSK* information.
  • the UE uses the same method to generate the second MSK* information, and calculates the corresponding Kseaf.
  • the UE obtains Kausf through steps S710-S713, and the UE generates second MSK* information by using MSK or EMSK or other generated keys and the identifier #b.
  • the identifier #b is an example of the network identification information of the serving network received by the UE from the serving network, and the network identification information may be the name of the serving network, the identity of the public land mobile network, the network identity, or the identity of the public land mobile network and at least one of the network identity identifier and the single-network slice selection auxiliary information, or any information that can identify the network identity.
  • the UE determines whether the Kseaf calculated from the first MSK* information matches the Kseaf calculated from the second MSK* information.
  • the UE generates the MSK* information in the same manner as the AAA server generates the MSK* information.
  • the SN_MAC can be carried in the manner shown in the figure, or can be carried by other processes, for example, AAA sends a message to the UE separately, and the message carries the SN_MAC, or it can be carried in the EAP authentication interaction message.
  • AAA sends a message to the UE separately, and the message carries the SN_MAC, or it can be carried in the EAP authentication interaction message.
  • the above is just an example approach.
  • MSK* information can be carried in the manner shown in the figure, or it can be carried in other processes, such as AAA sends a message to UE separately, and SN_MAC is carried in the message, or carried in an EAP authentication interaction message.
  • AAA sends a message to UE separately
  • SN_MAC is carried in the message, or carried in an EAP authentication interaction message.
  • the UE calculates the SN_MAC and sends it to the AAA for verification.
  • an indication of whether to use network identification information (identity #b) to generate MSK* information needs to be configured on the UE, and then determine whether to execute according to the indication.
  • the verification is successful, that is, it means that the UE can access the network device in the service network; correspondingly, when the AAA server generates When the MSK* information of the UE does not match the MSK* information generated by the UE, the verification fails, and the UE cannot access the network equipment in the serving network.
  • the difference from method 500 is that the verification of the SN name can also be completed by using an explicit method to send the SN name received by the home party to the UE for verification, or the UE reports the received SN name to AAA for verification .
  • the home network can determine the network identification information sent by the serving network and combine the key information of the UE to generate new key information (first MSK* information), which can then be used for the first terminal device Determine whether the new secret key information generated by the home network matches the new secret key information generated by the UE, and further check whether the network identification information received by the UE itself is consistent with the network identification information received by the home network, thereby It can verify whether the identification information of the network received by the UE itself is legal, so it can prevent the service network from being deceived into accessing the network, thereby preventing illegal billing or data theft.
  • first MSK* information new key information
  • module may be a combination of software and/or hardware that realizes a predetermined function.
  • devices described in the following embodiments are preferably implemented in software, implementations in hardware, or a combination of software and hardware are also possible and contemplated.
  • Fig. 8 is a schematic block diagram of a network inspection device provided by an embodiment of the present application.
  • the testing device 800 includes a transceiver unit 810 and a processing unit 820 .
  • the transceiver unit 810 can implement corresponding communication functions, and the processing unit 820 can read instructions and/or data in the storage unit, so that the communication device implements the aforementioned method embodiments.
  • the transceiver unit 810 may also be called a communication interface or a communication unit.
  • the network verification device 800 may also include a storage unit, which may be used to store instructions and/or data.
  • the network verification device 800 can be used to perform the actions performed by the terminal equipment (UE) in the above method embodiments.
  • the network verification device 800 can be a terminal device or a component that can be configured in the terminal device.
  • the transceiver unit 810 is configured to perform operations related to transceiving on the terminal device side in the method embodiments above
  • the processing unit 820 is configured to perform operations related to processing on the terminal device side in the method embodiments above.
  • the network verification apparatus 800 can be used to execute the actions performed by the network devices (the first network device and the second network device) in the method embodiments above, and the transceiver unit 810 is used to execute the first network device in the method embodiments above.
  • the processing unit 820 is configured to perform operations related to processing on the side of the first network device and the second network device in the above method embodiments.
  • the embodiment of the present application further provides a network verification device 900 .
  • the network verification device 900 includes a processor 910, the processor 910 is coupled with a memory 920, the memory 920 is used to store computer programs or instructions and/or data, and the processor 910 is used to execute the computer programs or instructions and/or stored in the memory 920
  • the data also includes a transceiver 930, which is used for receiving and/or sending signals.
  • the processor 910 is configured to control the transceiver 930 to receive and/or send signals. The methods in the above method embodiments are executed.
  • the network verification apparatus 900 includes one or more processors 910 .
  • the network verification apparatus 900 may further include a memory 920 .
  • the network verification apparatus 900 may include one or more memories 920 .
  • the memory 920 may be integrated with the processor 910, or set separately.
  • the network verification apparatus 900 is used to implement the operations performed by the terminal equipment (UE) in the above method embodiments.
  • the processor 910 is used to implement the processing-related operations performed by the terminal equipment (UE) in the above method embodiments
  • the transceiver 930 is used to implement the transceiving-related operations performed by the terminal equipment (UE) in the above method embodiments operate.
  • the network verification apparatus 900 is configured to implement the operations performed by the network devices (the first network device and the second network device) in the above method embodiments.
  • the processor 910 is used to implement the processing-related operations performed by the network devices (the first network device and the second network device) in the method embodiments above
  • the transceiver 930 is used to implement the processing-related operations performed by the network devices in the method embodiments above. Operations related to sending and receiving performed by (the first network device and the second network device).
  • processor 910 and memory 920 may be combined into one processing device, and the processor 910 is configured to execute program codes stored in the memory 920 to implement the foregoing functions.
  • the memory 920 may also be integrated in the processor 910 , or be independent of the processor 910 .
  • the processor 1110 may also correspond to each processing unit in the previous network verification device, and the transceiver 930 may correspond to each receiving unit and sending unit in the previous network verification device.
  • the transceiver 930 may include a receiver (or called a receiver) and a transmitter (or called a transmitter).
  • the transceiver may further include antennas, and the number of antennas may be one or more.
  • a transceiver may also be a communication interface or interface circuit.
  • the network verification apparatus 900 may correspond to the terminal device and the network device according to the method 300 to the method 700 according to the embodiment of the present application.
  • the network verification apparatus 900 may include units of the methods performed by the terminal device and the network device in methods 500 and 700 , and units that execute the methods performed by the network device and the terminal device in methods 500 and 700 .
  • the specific process of each module performing the above corresponding steps has been described in detail in the above method embodiments, and the corresponding beneficial effects can also refer to the above method embodiments, and for the sake of brevity, details are not repeated here.
  • the chip may be a communication chip that can be used in the device, and is used to implement related functions of the processor 910 in the device.
  • the chip device can be a field programmable gate array for realizing relevant functions, an application-specific integrated chip, a system chip, a central processing unit, a network processor, a digital signal processing circuit, a microcontroller, or a programmable controller or other integrated chips .
  • the chip may optionally include one or more memories for storing program codes, which enable the processor to implement corresponding functions when the codes are executed.
  • the memory and the processor involved in the foregoing embodiments may be physically independent units, or, Memory can also be integrated with the processor.
  • the embodiment of the present application also provides a computer-readable storage medium, on which a computer program for implementing the method in the above method embodiment is stored.
  • a computer program for implementing the method in the above method embodiment is stored.
  • the computer program runs on the computer, the computer can implement the methods in the above method embodiments.
  • the present application provides a computer program product, including a computer program, and when the computer program is run on a computer, the computer can execute the methods in the above method embodiments.
  • the present application further provides a system, which includes the foregoing one or more terminal devices and one or more network devices.
  • the network equipment in the above-mentioned various apparatus embodiments completely corresponds to the network equipment or terminal equipment in the terminal equipment and method embodiments, and the corresponding steps are executed by corresponding modules or units.
  • the functions of specific units refer to the corresponding method embodiments.
  • each step of the above method can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software.
  • the steps of the methods disclosed in connection with the embodiments of the present application may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware. To avoid repetition, no detailed description is given here.
  • the processor in the embodiment of the present application may be an integrated circuit chip, which has a signal processing capability.
  • each step of the above-mentioned method embodiments may be completed by an integrated logic circuit of hardware in a processor or instructions in the form of software.
  • the above-mentioned processor can be a general-purpose processor, a digital signal processor (digital signal processor, DSP), an application-specific integrated circuit (application-specific integrated circuit, ASIC), a field-programmable gate array (field-programmable gate array, FPGA) or Other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.
  • DSP digital signal processor
  • ASIC application-specific integrated circuit
  • FPGA field-programmable gate array
  • Other programmable logic devices discrete gate or transistor logic devices, discrete hardware components.
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the steps of the method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware.
  • the memory in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory.
  • RAM random access memory
  • static RAM static random access memory
  • dynamic RAM dynamic random access memory
  • DRAM dynamic random access memory
  • synchronous dynamic random access memory synchronous DRAM, SDRAM
  • double data rate synchronous dynamic random access memory double data rate SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • synchronous connection dynamic random access memory direct ram-bus RAM, DR RAM
  • direct ram-bus RAM direct ram-bus RAM
  • the present application also provides a computer program product, the computer program product stores computer program code, and when the computer program code runs on the computer, the computer executes the communication method of the present application. method.
  • the present application also provides a computer-readable medium, the computer-readable medium stores program code, and when the program code is run on the computer, the computer is made to execute the communication method of the present application .
  • the present application further provides a system, which includes the foregoing apparatus or device.
  • all or part of them may be implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server or data center by wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a high-density digital video disc (digital video disc, DVD)), or a semiconductor medium (for example, a solid state disk (solid state disc, SSD)) etc.
  • a magnetic medium for example, a floppy disk, a hard disk, a magnetic tape
  • an optical medium for example, a high-density digital video disc (digital video disc, DVD)
  • a semiconductor medium for example, a solid state disk (solid state disc, SSD)
  • the network-side equipment in each of the above device embodiments corresponds to the terminal equipment and the network-side equipment or terminal equipment in the method embodiments, and the corresponding modules or units perform corresponding steps, for example, the communication unit (transceiver) executes the receiving method in the method embodiments. Or the step of sending, other steps besides sending and receiving may be performed by a processing unit (processor). For the functions of the specific units, reference may be made to the corresponding method embodiments. Wherein, there may be one or more processors.
  • a component may be, but is not limited to being, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer.
  • an application running on a computing device and the computing device can be components.
  • One or more components can reside within a process and/or thread of execution and a component can be localized on one computer and/or distributed between two or more computers.
  • these components can execute from various computer readable media having various data structures stored thereon.
  • a component may, for example, be based on a signal having one or more packets of data (e.g., data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet via a signal interacting with other systems). Communicate through local and/or remote processes.
  • packets of data e.g., data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet via a signal interacting with other systems.
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供了一种校验网络的方法，该方法包括：第一终端设备从第一网络设备接收第一MAC值和一个网络的标识信息，其中，所述第一MAC值为根据所述第一网络设备所在网络的标识信息及所述第一终端设备对应的密钥信息确定的；所述第一终端设备根据所述标识信息及所述密钥信息生成第二MAC值；所述第一终端设备确定所述第一MAC值与所述第二MAC值是否匹配。从而确保UE接入合法的网络，避免被服务网络欺骗接入网络，被非法计费或窃取数据。

Description

网络校验的方法和装置
本申请要求于2022年2月7日提交中国专利局、申请号为202210116589.6、申请名称为“网络校验的方法和装置”的中国专利申请的优先权及2022年2月14日提交中国专利局、申请号为202210134671.1、申请名称为“网络校验的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信领域，并且更具体地，涉及一种网络校验的方法和装置。
背景技术
在第三代合作伙伴计划(3rd generation partnership project，3GPP)中，提出了UE进行选网的相关规则，例如，在UE上配置公共陆地移动网络的身份标识(public land mobile network ID，PLMN ID)的优先级列表，UE收到多个网络的广播信号后，根据这些网络的优先级来确定接入某个网络。但有的网络可能广播错误的网络ID，导致UE接入错误的网络，造成非法计费或数据丢失。例如，低优先级网络可能广播高优先级网络的ID，进而可以吸引UE接入该低优先级网络。
现有技术中，UE在访问PLMN网络时，服务网络会向UE和归属网络发送包括选网规则的选网信息，例如，发送服务网络名称(service network，SN name)。UE和归属网络使用第五代(5th generation，5G)认证和密钥协商(5G authentication and key agreement，5G AKA)和EAP’认证和密钥协商(extensible authentication protocol-authentication and key agreement，EAP-AKA)方法认证收到的SN name是否一致。比如，UE可以通过判断自身根据SN name生成的密钥与归属网络生成的密钥是否相同来验证UE和归属网络收到的SN name是否一致。但在非公共网络(non-public network，NPN)场景中，UE和归属网络无法使用该方法对SN name进行校验，导致服务网络可以用高优先级PLMN ID欺骗UE接入，非法获取商业利益或获取UE的通信数据。
因此，亟需一种校验服务网络的机制，以确保UE接入合法的网络，防止被服务网络欺骗接入网络，从而避免被非法计费或窃取数据。
发明内容
本申请实施例提供一种网络校验的方法和装置，确保UE接入合法的网络。
第一方面，提供了一种校验网络的方法，该方法包括：第一终端设备从第一网络设备接收第一MAC值和一个网络的标识信息，其中，所述第一MAC值为根据所述第一网络设备所在网络的标识信息及所述第一终端设备对应的密钥信息确定的；所述第一终端设备根据所述标识信息及所述密钥信息生成第二MAC值；所述第一终端设备确定所述第一MAC值与所述第二MAC值是否匹配。
可以理解，所述第一终端设备根据所述一个网络的标识信息及所述第一终端设备对应 的密钥信息生成第二MAC值。
根据本申请实施例提供的技术方案，第一终端设备可以根据收到的该标识信息和密钥信息生成第二MAC值，进而可以确定第一MAC值与所述第二MAC值是否匹配，从而可以校验第一网络设备收到的网络的标识信息和UE自身收到的网络的标识信息是否一致，因此可以防止被服务网络欺骗接入网络，从而防止被非法计费或窃取数据。
可以理解，第一终端设备可以根据从网络设备所在网络获取的标识信息和密钥信息生成第二消息认证码，进而可以确定第一MAC值与所述第二MAC值是否匹配，第一MAC值是根据该网络设备所在网络的标识生成的，从而该第一终端设备可以根据两个MAC值是否匹配来校验UE自身收到的网络的标识信息与该网络设备所在网络的标识信息是否一致，因此可以防止该第一终端设备被服务网络欺骗接入网络，从而防止被非法计费或窃取数据。
在一种实现方式中，第一网络设备和第一终端设备进行可扩展验证协议(extensible authentication protocol，EAP)认证，从而完成相互认证。
可选的一种实施方式中，所述密钥信息包括主会话密钥信息或扩展主会话密钥信息。
可以理解，所述密钥信息包括主会话密钥(master session key，MSK)信息或扩展主会话密钥(extend master session key，EMSK)信息。
可选的一种实施方式中，所述一个网络的标识信息包括：所述一个网络的服务网络名称、公共陆地移动网络的身份标识、网络身份标识、公共陆地移动网络的身份标识和网络身份标识、及单网络片选择辅助信息中的至少一个。
应理解，网络身份标识可以为网络身份标识(network ID，NID)，单网络片选择辅助信息可以是单网络片选择辅助信息(single network slice selection assistance information，S-NSSAI)。
第二方面，提供了一种信息发送的方法，该方法包括：第一网络中的第一网络设备确定包括第二网络设备的第二网络的标识信息；所述第一网络设备根据所述标识信息及第一终端设备对应的密钥信息生成MAC值；所述第一网络设备向所述第二网络设备发送所述MAC值。
根据本申请实施例提供的技术方案，第一网络设备可以确定第二网络设备的第二网络的标识信息并进一步根据该标识信息以及第一终端设备对应的密钥信息生成MAC值，并将MAC值发送给第二网络设备，用于终端设备校验第一网络设备收到的网络的标识信息和UE自身收到的网络的标识信息是否一致，从而可以防止终端设备因被服务网络欺骗接入网络而被非法计费或窃取数据。
可以理解，第一网络设备将MAC值发送给第二网络设备，进而可以用于第一终端设备确定第一MAC值与所述第二MAC值是否匹配，进一步的来校验UE自身收到的网络的标识信息和第一网络设备收到的网络的标识信息是否一致，从而可以防止该第一终端设备因被服务网络欺骗接入网络而被非法计费或窃取数据。
在一种实现方式中，该第二网络可以是第一终端设备所在区域内可以收到广播信号的任意网络设备。
在一种实现方式中，第二网络设备可以根据第一终端设备的标识信息确定第一网络设备，进一步的，第二网络设备可以将第二网络的标识信息及第一终端设备的标识信息发送给第一网络设备。
其中，第一终端设备的标识信息可以是用户永久标识(subscription permanent identifier，SUPI)或用户隐藏标识(subscription concealed identifier，SUCI)。
可选的一种实施方式中，所述第一网络设备确定所述标识信息，包括：所述第一网络设备根据本地配置确定所述标识信息；或者，所述第一网络设备从所述第二网络设备获取所述标识信息。
可选的一种实施方式中，所述第一网络设备确定所述第二网络的标识信息，包括：所述第一网络设备从所述第二网络设备获取所述第二网络的标识信息；所述方法还包括：所述第一网络设备获取所述第二网络设备的IP地址和/或证书；所述第一网络设备根据所述IP地址和/或证书，以及IP地址和/或证书与网络的标识信息的对应关系，确定所述IP地址和/或证书所对应的标识信息；所述第一网络设备确定所述第二网络的标识信息与所述IP地址和/或证书所对应的标识信息相同。
可以理解，第一网络设备的本地配置包括第二网络的IP地址和/或证书与网络的标识信息的对应关系。
可选的一种实施方式中，所述密钥信息包括主会话密钥信息或扩展主会话密钥信息。
可选的一种实施方式中，所述第二网络的标识信息包括：所述第二网络的服务网络名称、公共陆地移动网络的身份标识、网络身份标识、公共陆地移动网络的身份标识和网络身份标识、及单网络片选择辅助信息中的至少一个。
可选的一种实施方式中，第一网络设备向第二网络设备发送所述第一MAC值，还可以发送MSK或EMSK。相应的，第一终端设备通过第二网络设备接收所述第一MAC值和一个网络的标识信息，根据该标识信息和第一终端设备对应的密钥信息生成第二MAC值，比较该第二MAC值和第一MAC值是否一致。
可选的一种实施方式中，第一终端设备通过第二网络设备接收一个网络的标识信息，根据该标识信息和第一终端设备对应的密钥信息生成第二MAC值，通过第二网络设备向第一网络设备发送该第二MAC值，相应的，第一网络设备比较该第二MAC值和第一MAC值是否一致。
第三方面，提供了一种校验网络的装置，该装置包括：接收模块，用于从第一网络设备接收第一MAC值和一个网络的标识信息，其中，所述第一MAC值为根据所述第一网络设备所在网络的标识信息及所述第一终端设备对应的密钥信息确定的；处理模块，用于根据所述标识信息及所述密钥信息生成第二MAC值；所述处理模块，还用于确定所述第一MAC值与所述第二MAC值是否匹配。
可以理解，处理模块具体根据所述一个网络的标识信息及所述第一终端设备对应的密钥信息生成第二MAC值。
根据本申请实施例提供的技术方案，该校验网络的装置中处理模块可以根据从网络设备所述网络获取的标识信息和密钥信息生成第二MAC值，进而可以确定第一MAC值与所述第二MAC值是否匹配，从而该处理模块可以根据两个MAC值是否匹配来校验UE自身收到的网络的标识信息与该网络设备收到的网络的标识信息是否一致，因此可以防止第一终端设备被服务网络欺骗接入网络，从而防止被非法计费或窃取数据。
可选的一种实施方式中，所述密钥信息包括主会话密钥信息或扩展主会话密钥信息。
可选的一种实施方式中，所述一个网络的标识信息包括：所述一个网络的服务网络名 称、公共陆地移动网络的身份标识、网络身份标识、公共陆地移动网络的身份标识和网络身份标识、及单网络片选择辅助信息中的至少一个。
第四方面，提供了一种信息发送的装置，该装置包括：确定模块，用于确定包括第二网络设备的第二网络的标识信息；处理模块，用于根据所述标识信息及第一终端设备对应的密钥信息生成MAC值；发送模块，用于向所述第二网络设备发送所述MAC值。
根据本申请实施例提供的技术方案，处理模块可以确定第二网络设备的第二网络的标识信息并进一步根据该标识信息以及第一终端设备对应的密钥信息生成MAC值，并将MAC值发送给第二网络设备，进而可以用于第一终端设备确定第一MAC值与所述第二MAC值是否匹配，进一步的来校验UE自身收到的网络的标识信息与该网络设备所在网络的标识信息是否一致，用进一步的来校验UE自身收到的网络的标识信息和第一网络设备收到的网络的标识信息是否一致，从而可以防止该第一终端设备因被服务网络欺骗接入网络而被非法计费或窃取数据。
可选的一种实施方式中，所述确定模块具体用于：根据本地配置确定所述标识信息；或者，从所述第二网络设备获取所述标识信息。
可选的一种实施方式中，所述确定模块具体用于：获取所述第二网络设备的IP地址和/或证书；根据所述IP地址和/或证书，以及IP地址和/或证书与网络的标识信息的对应关系，确定所述IP地址和/或证书所对应的标识信息；确定所述第二网络的标识信息与所述IP地址和/或证书所对应的标识信息相同。
可选的一种实施方式中，所述密钥信息包括主会话密钥信息或扩展主会话密钥信息。
可选的一种实施方式中，所述第二网络的标识信息包括：所述第二网络的服务网络名称、公共陆地移动网络的身份标识、网络身份标识、公共陆地移动网络的身份标识和网络身份标识、及单网络片选择辅助信息中的至少一个。
第五方面，提供了一种网络校验的装置，包括，用于实现权利要求1-3项中任一项所述的方法的模块或单元。
第六方面，提供了一种信息发送的装置，包括：用于实现权利要求4-8项中任一项所述的方法的模块或单元。
第七方面，提供了一种网络校验的装置，包括，处理器，存储器，该存储器用于存储计算机程序，该处理器用于从存储器中调用并运行该计算机程序，使得该通信设备执行第或第二方面及其各种可能实现方式中的网络校验方法。
可选地，该处理器为一个或多个，该存储器为一个或多个。
可选地，该存储器可以与该处理器集成在一起，或者该存储器与处理器分离设置。
第八方面，提供了一种计算机可读存储介质，其特征在于，该计算机可读介质存储用于设备执行的程序代码，该程序代码包括用于执行第一方面或第二方面的方法。
第九方面，提供一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行上述各方面中的任意一种实现方式中的方法。
第十方面，提供一种芯片，该芯片包括处理器与数据接口，该处理器通过该数据接口读取存储器上存储的指令，执行上述各方面中的任意一种实现方式中的方法。
可选地，作为一种实现方式，该芯片还可以包括存储器，该存储器中存储有指令，该处理器用于执行该存储器上存储的指令，当该指令被执行时，该处理器用于执行上述各方 面中的任意一种实现方式中的方法。
上述芯片具体可以是现场可编程门阵列(field-programmable gate array，FPGA)或者专用集成电路(application-specific integrated circuit，ASIC)。
附图说明
图1示出了适用于本申请实施例的通信系统架构100的示意图。
图2示出了适用于本申请实施例提供的通信系统的一种网络架构200示意图。
图3示出了适用于本申请实施例提供的校验网络的方法的一种示意性框图。
图4示出了适用于本申请实施例提供的校验网络的方法的又一种示意性框图。
图5示出了适用于本申请实施例提供的校验网络的方法的一种示意性交互图。
图6示出了适用于本申请实施例提供的校验网络的方法的又一种示意性框图。
图7示出了适用于本申请实施例提供的校验网络的方法的又一种示意性交互图。
图8示出了适用于本申请实施例提供的校验网络的装置的示意性框图。
图9示出了种适用于本申请实施例提供的校验网络的装置的一种示意性架构图。
具体实施方式
下面将结合附图，对本申请实施例中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如：全球移动通讯(Global System of Mobile communication，GSM)系统、码分多址(Code Division Multiple Access，CDMA)系统、宽带码分多址(Wideband Code Division Multiple Access，WCDMA)系统、通用分组无线业务(General Packet Radio Service，GPRS)、长期演进(Long Term Evolution，LTE)系统、LTE频分双工(Frequency Division Duplex，FDD)系统、LTE时分双工(Time Division Duplex，TDD)、通用移动通信系统(Universal Mobile Telecommunication System，UMTS)、全球互联微波接入(Worldwide Interoperability for Microwave Access，WiMAX)通信系统、第五代(5th Generation，5G)系统或新无线(New Radio，NR)、或未来演进的系统等。
本申请实施例中的终端设备可以指用户设备、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。终端设备还可以是蜂窝电话、无绳电话、会话启动协议(Session Initiation Protocol，SIP)电话、无线本地环路(Wireless Local Loop，WLL)站、个人数字处理(Personal Digital Assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，未来5G网络中的终端设备或者未来演进的公用陆地移动通信网络(Public Land Mobile Network，PLMN)中的终端设备等，本申请实施例对此并不限定。
本申请实施例中的网络设备可以是用于与终端设备通信的设备，该网络设备可以是全球移动通讯(Global System of Mobile communication，GSM)系统或码分多址(Code Division Multiple Access，CDMA)中的基站(Base Transceiver Station，BTS)，也可以是宽带码分多址(Wideband Code Division Multiple Access，WCDMA)系统中的基站(NodeB，NB)，还可以是LTE系统中的演进型基站(Evolutional NodeB，eNB或eNodeB)，还可以是云 无线接入网络(Cloud Radio Access Network，CRAN)场景下的无线控制器，或者该网络设备可以为中继站、接入点、车载设备、可穿戴设备以及未来5G网络中的网络设备或者未来演进的PLMN网络中的网络设备等，本申请实施例并不限定。
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
为便于理解本申请实施例，对于相关术语及中英文解释进行如下定义：

为便于理解本申请实施例，首先结合图1简要说明本申请实施例的一种通信系统100的结构示意图。如图1所示，该通信系统100可以包括一个终端设备，例如图1所示的终端设备110，该通信系统100还可以包括多个网络设备，例如图1所示的网络设备121、网络设备122及网络设备123。其中，终端设备110可以与网络设备121、网络设备122及网络设备123任一网络进行通信连接。例如，当终端设备110所在区域可以收到这三个网络设备的广播信号时，终端设备110可以根据连接需求选择网络进行通信。
可能的一种方式中，终端设备110在所在区域收到上述三个网络设备的广播信号时，终端设备110可以根据三个网络设备的优先级来选择接入哪一个网络。例如，上述网络设备可以是PLMN，在该终端设备110上配置有PLMN ID的优先级列表，当终端设备110接收到PLMN1，PLMN2及PLMN3的广播信号时，UE会按优先级优先选择PLMN1，或者只收到PLMN2和PLMN3的广播信号时，则会优先选择PLMN2。
图2示出了本申请通信系统的一种网络架构200示意图。
如图2所示，该通信系统的网络架构包括但不限于以下网元：
1、用户设备(UE)：本申请实施例中的用户设备也可以称为：用户设备(user equipment，UE)、移动台(mobile station，MS)、移动终端(mobile terminal，MT)、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置等。
用户设备可以是一种向用户提供语音/数据连通性的设备，例如，具有无线连接功能的手持式设备、车载设备等。目前，一些终端的举例为：手机(mobile phone)、平板电脑、笔记本电脑、掌上电脑、移动互联网设备(mobile internet device，MID)、可穿戴设备，虚拟现实(virtual reality，VR)设备、增强现实(augmented reality，AR)设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程手术(remote medical surgery)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端、蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，未来5G网络中的用户设备或者未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中的用户设备等，本申请实施例对此并不限定。
作为示例而非限定，在本申请实施例中，该用户设备还可以是可穿戴设备。可穿戴设备也可以称为穿戴式智能设备，是应用穿戴式技术对日常穿戴进行智能化设计、开发出可以穿戴的设备的总称，如眼镜、手套、手表、服饰及鞋等。可穿戴设备即直接穿在身上，或是整合到用户的衣服或配件的一种便携式设备。可穿戴设备不仅仅是一种硬件设备，更 是通过软件支持以及数据交互、云端交互来实现强大的功能。广义穿戴式智能设备包括功能全、尺寸大、可不依赖智能手机实现完整或者部分的功能，例如：智能手表或智能眼镜等，以及只专注于某一类应用功能，需要和其它设备如智能手机配合使用，如各类进行体征监测的智能手环、智能首饰等。
此外，在本申请实施例中，用户设备还可以是物联网(internet of things，IoT)系统中的用户设备。IoT是未来信息技术发展的重要组成部分，其主要技术特点是将物品通过通信技术与网络连接，从而实现人机互连，物物互连的智能化网络。
在本申请实施例中，IOT技术可以通过例如窄带(narrow band)NB技术，做到海量连接，深度覆盖，终端省电。例如，NB可以包括一个资源块(resource block，RB)，即，NB的带宽只有180KB。要做到海量接入，必须要求终端在接入上是离散的，根据本申请实施例的通信方法，能够有效解决IOT技术海量终端在通过NB接入网络时的拥塞问题。
另外，本申请实施例中的接入设备可以是用于与用户设备通信的设备，该接入设备也可以称为接入网设备或无线接入网设备，例如，接入设备可以是LTE系统中的演进型基站(evolved NodeB，eNB或eNodeB)，还可以是云无线接入网络(cloud radio access network，CRAN)场景下的无线控制器，或者该接入设备可以为中继站、接入点、车载设备、可穿戴设备以及未来5G网络中的接入设备或者未来演进的PLMN网络中的接入设备等，可以是WLAN中的接入点(access point，AP),可以是新型无线系统(new radio，NR)系统中的gNB本申请实施例并不限定。
另外，在本申请实施例中，用户设备还可与其他通信系统的用户设备进行通信，例如，设备间通信等。例如，该用户设备还可以与其他通信系统的用户设备进行时间同步报文的传输(例如，发送和/或接受)。
2、接入设备(AN/RAN)：本申请实施例中的接入设备可以是用于与用户设备通信的设备，该接入设备也可以称为接入网设备或无线接入网设备，例如，接入设备可以是LTE系统中的演进型基站(evolved NodeB，eNB或eNodeB)，还可以是云无线接入网络(cloud radio access network，CRAN)场景下的无线控制器，或者该接入设备可以为中继站、接入点、车载设备、可穿戴设备以及5G网络中的接入设备或者未来演进的PLMN网络中的接入设备等，可以是WLAN中的接入点(access point，AP)，可以是NR系统中的gNB本申请实施例并不限定。
另外，在本申请实施例中，接入设备是RAN中的设备，或者说，是将用户设备接入到无线网络的RAN节点。例如，作为示例而非限定，作为接入设备，可以列举：gNB、传输接收点(transmission reception point，TRP)、演进型节点B(evolved Node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(Node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved NodeB，或home Node B，HNB)、基带单元(base band unit，BBU)，或无线保真(wireless fidelity，Wifi)接入点(access point，AP)等。在一种网络结构中，网络设备可以包括集中单元(centralized unit，CU)节点、或分布单元(distributed unit，DU)节点、或包括CU节点和DU节点的RAN设备、或者控制面CU节点(CU-CP节点)和用户面CU节点(CU-UP节点)以及DU节点的RAN设备。
接入设备为小区提供服务，用户设备通过该小区使用的传输资源(例如，频域资源， 或者说，频谱资源)与接入设备进行通信，该小区可以是接入设备(例如基站)对应的小区，小区可以属于宏基站，也可以属于小小区(small cell)对应的基站，这里的小小区可以包括：城市小区(metro cell)、微小区(micro cell)、微微小区(pico cell)、毫微微小区(femto cell)等，这些小小区具有覆盖范围小、发射功率低的特点，适用于提供高速率的数据传输服务。
此外，LTE系统或5G系统中的载波上可以同时有多个小区同频工作，在某些特殊场景下，也可以认为上述载波与小区的概念等同。例如在载波聚合(carrier aggregation，CA)场景下，当为UE配置辅载波时，会同时携带辅载波的载波索引和工作在该辅载波的辅小区的小区标识(cell indentification，Cell ID)，在这种情况下，可以认为载波与小区的概念等同，比如用户设备接入一个载波和接入一个小区是等同的。
本申请的通信系统还可以适用于车联网(vehicle to everything，V2X)技术，即，本申请的用户设备还可以是汽车，例如，智能汽车或自动驾驶汽车。
V2X中的“X”代表不同的通信目标，V2X可以包括但不限于：汽车对汽车(vehicle to vehicl，V2V)，汽车对路标设(vehicle to infrastructure，V2I)，汽车对网络(vehicle to network，V2N)，和汽车对行人(vehicle to pedestrian，V2P)。
在V2X中，接入设备可以为UE配置“区域(zone)”。其中，该区域也可以称为地理区域。当区域配置了以后，世界将被分成多个区域，这些区域由参考点、长、宽来进行定义。UE在进行区域标识(identifier，ID)确定的时候，会使用区域的长、宽、长度上面的区域数量、宽度上面的区域数量以及参考点进行余的操作。上述信息可以由接入设备进行配置。
V2X的业务可以通过两种方式提供：即，基于邻近服务通信(Proximity-based Services Communication 5，PC5)接口的方式和基于Uu接口的方式。其中PC5接口是在直通链路(sidelink)基础上定义的接口，使用这种接口，通信设备(例如，汽车)之间可以直接进行通信传输。PC5接口可以在覆盖外(out of coverage，OOC)和覆盖内(in coverage，IC)下使用，但只有得到授权的通信设备才能使用PC5接口进行传输。
3、接入和移动性管理功能(Access and Mobility Management Function，AMF)网元：主要用于移动性管理和接入管理等，可以用于实现LTE系统中移动性管理实体(mobility management entity，MME)功能中除会话管理之外的其它功能，例如，合法监听以及接入授权/鉴权等功能。AMF网元为用户设备中的会话提供服务的情况下，会为该会话提供控制面的存储资源，以存储会话标识、与会话标识关联的SMF网元标识等。在本申请实施例中，可用于实现接入和移动管理网元的功能。
4、会话管理功能(Session Management Function，SMF)网元：主要用于会话管理、用户设备的网络互连协议(internet protocol，IP)地址分配和管理、选择和管理用户平面功能、策略控制、或收费功能接口的终结点以及下行数据通知等。在本申请实施例中，可用于实现会话管理网元的功能。
5、策略控制(Policy Control Function，PCF)网元：用于指导网络行为的统一策略框架，为控制平面功能网元(例如AMF，SMF网元等)提供策略规则信息以及基于流量的计费控制功能等。
6、统一数据管理(unified data management，UDM)网元：主要负责UE的签约数据 的处理，包括用户标识的存储和管理、用户签约数据、鉴权数据等。
7、用户面功能(User Plane Function，UPF)网元：可用于分组路由和转发、或用户面数据的服务质量(quality of service，QoS)处理等。用户数据可通过该网元接入到数据网络(data network，DN)，还可以从数据网络接收用户数据，通过接入网设备传输给用户设备。UPF网元中为用户设备提供服务的传输资源和调度功能由SMF网元管理控制的。在本申请实施例中，可用于实现用户面网元的功能。
8、网络能力开放功能(Network Exposure Function，NEF)网元：用于安全地向外部开放由3GPP网络功能提供的业务和能力等，主要支持3GPP网络和第三方应用安全的交互。
9、应用功能(Application Function，AF)网元：用于进行应用影响的数据路由，接入网络开放功能网元，或，与策略框架交互进行策略控制等，例如影响数据路由决策，策略控制功能或者向网络侧提供第三方的一些服务。
10、网络切片选择功能(Network Slice Selection Function，NSSF)网元：主要负责网络切片选择，根据UE的切片选择辅助信息、签约信息等确定UE允许接入的网络切片实例。
11、认证服务器功能(Authentication Server Function，AUSF)网元：支持3GPP和非3GPP的接入认证。
12、网络存储功能(Network Repository Function,NRF)网元：支持网络功能的注册和发现。
13、统一数据存储功能(Unified Data Repository,UDR)网元：存储和获取UDM和PCF使用的签约数据。
在该网络架构中，N2接口为RAN和AMF实体的参考点，用于NAS(Non-Access Stratum，非接入层)消息的发送等；N3接口为RAN和UPF网元之间的参考点，用于传输用户面的数据等；N4接口为SMF网元和UPF网元之间的参考点，用于传输例如N3连接的隧道标识信息，数据缓存指示信息，以及下行数据通知消息等信息。
应理解，图2中的UE、(R)AN、UPF和DN一般被称为数据面网络功能和实体，用户的数据流量可以通过UE和DN之间建立的PDU会话进行传输，传输会经过(R)AN和UPF这两个网络功能实体；而其他的部分则被称为控制面网络功能和实体，主要负责认证和鉴权、注册管理、会话管理、移动性管理以及策略控制等功能，从而实现用户层流量可靠稳定的传输。
需要说明的是，本申请实施例中，(R)AN、AMF可以称为服务网络，AUSF和UDM可以称为归属网络。
本申请中，上述服务网络可以理解为终端设备提供服务的网络，归属网络可以理解为存储或者管理终端设备的凭据的功能或者网络。
应理解，上述应用于本申请实施例的网络架构仅是举例说明的从传统点到点的架构和服务化架构的角度描述的网络架构，适用本申请实施例的网络架构并不局限于此，任何能够实现上述各个网元的功能的网络架构都适用于本申请实施例。
应理解，图2中的各个网元之间的接口名称只是一个示例，具体实现中接口的名称可能为其他的名称，本申请对此不作具体限定。此外，上述各个网元之间的所传输的消息(或 信令)的名称也仅仅是一个示例，对消息本身的功能不构成任何限定。
需要说明的是，上述“网元”也可以称为实体、设备、装置或模块等，本申请并未特别限定。并且，在本申请中，为了便于理解和说明，在对部分描述中省略“网元”这一描述，例如，将SMF网元简称SMF，此情况下，该“SMF”应理解为SMF网元或SMF实体，以下，省略对相同或相似情况的说明。
可以理解的是，上述实体或者功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。
下面以具体的实施例对本申请的技术方案进行详细说明。下面这几个具体的实施例可以相互结合，对于相同或相似的概念或过程可能在某些实施例中不再赘述。
下图实施例，第一网络设备作为归属网络的一例，第二网络设备作为第二网络的服务网络的一例。
其中，第一网络设备作为第一终端设备的归属实体，第一网络设备可以是以AAA指代第一终端设备的归属实体，也可以是证书持有者(credential holder)或DCS或AUSF/UDM。
应理解，第一终端设备的归属实体根据不同场景可以是不同的网络实体，也可以是不同的名称指代。本申请实施例对此不作限定。
本申请中第一终端设备接入的网络可以叫做NPN网络，也可以叫做onboarding网络，也可以叫做服务网络。
图3是本申请实施例提供的网络校验的方法的一种示意性框图，方法300可以包括如下步骤：
S310，第一终端设备从网络设备接收第一MAC值和一个网络的标识信息。
一种可能的实施方式中，第一终端设备从第二网络设备接收第一MAC值和包括第二网络设备的第二网络的标识信息。相应的，第一网络设备可以通过第二网络设备向第一终端设备发送第一MAC值。
其中，该一个网络的标识信息可以是服务网络名称、公共陆地移动网络的身份标识、网络身份标识、公共陆地移动网络的身份标识和网络身份标识、及单网络片选择辅助信息中的至少一个，也可以是任意包括可以标识网络身份的信息。
应理解，该一个网络的标识信息可以理解为第一终端设备选择网络连接时的选网信息，即，第一终端设备在选择网络时，可以校验该网络的标识信息。
应理解，该一个网络可以是第一终端设备所在区域内可以收到广播信号的任意网络设备，例如，可以是第二网络。
S320，所述第一终端设备根据所述一个网络的标识信息及所述第一终端设备对应的密钥信息生成第二MAC值。
其中，第一终端设备的密钥信息可以是主会话密钥(master session key，MSK)或扩展主会话密钥(extend master session key，EMSK)。
应理解，上述第一终端设备生成的第二MAC值可以理解为，第一终端设备根据第一终端设备的MSK或EMSK，或其他密钥结合收到的一个网络的标识信息生成了一个该网络的MAC值。
应理解，在步骤S320之前，第一终端设备需要和第一网络设备相互认证。
一种可能的实施方式中，第一网络设备和第一终端设备进行EAP认证。
S330，所述第一终端设备确定所述第一MAC值与所述第二MAC值是否匹配。
当从一个网络接收的第一MAC值和第一终端设备生成的第二MAC值匹配时，校验成功，即，意味着，确定该网络为合法网络，该第一终端设备可以接入该网络中的网络设备；相应的，当第一MAC值和第一终端设备生成的第二MAC值不匹配时，校验失败，则确定该网络为非法网络，该第一终端设备不能接入该网络中的网络设备。
根据本申请实施例提供的技术方案，第一终端设备可以根据从网络设备获取的标识信息和密钥信息生成第二MAC值，进而可以确定第一MAC值与所述第二MAC值是否匹配，第一MAC值是根据该网络设备所在网络的标识生成的，从而该第一终端设备可以根据两个MAC值是否匹配来校验UE自身收到的网络的标识信息与该网络设备所在网络的标识信息是否一致，因此可以防止该第一终端设备被服务网络欺骗接入网络，从而防止被非法计费或窃取数据。
图4是本申请实施例提供的网络校验的方法的一种示意性框图，方法400可以包括如下步骤：
S410，第一网络设备确定包括第二网络设备的第二网络的标识信息。
一种可能的实施方式中，第一网络设备可以从第二网络设备接收所述第二网络的标识信息。相应的，第二网络设备向第一网络设备发送所述第二网络设备的标识信息。
其中，第二网络的标识信息可以是SN name、PLMN ID、NID、PLMN ID+NID及S-NSSAI中的至少一个，也可以是任意包括可以标识网络身份的信息。
应理解，该第二网络的标识信息可以理解为第一终端设备选择网络连接时的选网信息，即，第一终端设备在选择网络时，可以校验第二网络的标识信息。
应理解，该第二网络可以是第一终端设备所在区域内可以收到广播信号的任意网络设备。
具体的，第二网络设备可以根据第一终端设备的标识信息确定第一网络设备，进一步的，第二网络设备可以将第二网络的标识信息及第一终端设备的标识信息发送给第一网络设备。
其中，第一终端设备的标识信息可以是SUPI。
可以理解，第一终端设备的标识信息可以是SUCI。
可选的，第一网络设备还可以根据本地配置校验所述第二网络的标识信息。
具体的，第一网络设备从所述第二网络设备获取所述第二网络的标识信息后，第一网络设备根据本地配置确定该第二网络是否和该标识信息具有对应关系，该对应关系可以理解为第二网络有使用该标识信息的权限。
例如，第一网络设备可以获取第二网络设备的IP地址和/或证书，根据该IP地址和/或证书与网络的标识信息的对应关系，确定所述IP地址和/或证书所对应的标识信息，进一步的，第一网络设备确定所述第二网络的标识信息与所述IP地址和/或证书所对应的标识信息相同，则可以校验所述第二网络的标识信息正确。
可以理解，第一网络设备的本地配置包括第二网络的IP地址和/或证书与网络的标识信息的对应关系。
再例如，第一网络设备可以获取第二网络设备的证书，根据该证书中携带的PLMN ID来验证标识信息，确定所述证书中携带的PLMN ID与所述第二网络的标识信息是否相同， 则可以校验所述第二网络的标识信息是否正确。
可以理解，第一网络设备的本地配置包括第二网络的PLMN ID。
另一种可能的实施方式中，第一网络设备还可以根据本地配置获取该第二网络的标识信息。
具体的，第一网络设备根据本地配置直接确定第二网络设备的标识信息。
例如，第一网络设备根据本地配置可以直接查找到第二网络设备的IP地址和/或证书与网络的标识信息的对应关系，从而确定出第二网络网络设备所在网络的标识信息。
可以理解，第一网络设备的本地配置包括第二网络的IP地址和/或证书与网络的标识信息的对应关系。
再例如，第一网络设备根据本地配置可以查找到第二网络设备的证书，并从证书中获取第二网络设备所在网络的PLMN ID。
可以理解，第一网络设备的本地配置包括第二网络的PLMN ID。
S420，第一网络设备根据所述标识信息及第一终端设备对应的密钥信息生成MAC值。
具体的，第一网络设备根据所述第一终端设备的标识信息确定第一终端设备对应的密钥信息，进一步的，第一网络设备根据所述第二网络的标识信息和所述第一终端设备对应的密钥信息生成MAC值。
本申请中，第一网络设备根据所述包括第二网络设备的第二网络的标识信息和所述第一终端设备对应的密钥信息生成的MAC值可以记为第一MAC值。
其中，第一终端设备的密钥信息可以是主会话密钥(master session key，MSK)。
可以理解，该第一终端设备的密钥信息也可以是扩展主会话密钥(extend master session key，EMSK)。
应理解，上述第一网络设备生成的第一MAC值可以理解为，第一网络设备根据第一终端设备的MSK或EMSK，或其他密钥结合第二网络的标识信息生成了一个该服务网络(第二网络设备所在网络)的MAC值。
应理解，在步骤S420之前，第一网络设备需要和第一终端设备相互认证。
一种可能的实施方式中，第一网络设备和第一终端设备进行EAP认证。
S430，第一网络设备向第二网络设备发送所述MAC值。
本申请中，第一网络设备也可以接收第一终端设备发送的第二MAC值。
具体的，第一网络设备向第二网络设备发送所述第一MAC值，相应的，第二网络设备接收所述第一MAC值。或者，第一网络设备通过所述第二网络设备接收所述第一终端设备发送的第二MAC值，相应的，第一终端设备通过所述第二网络设备向所述第一网络设备发送所述第二MAC值。
一种可能的实施方式中，第一网络设备向第二网络设备发送所述第一MAC值，还可以发送MSK或EMSK。相应的，第一终端设备通过第二网络设备接收所述第一MAC值和一个网络的标识信息，根据该标识信息和第一终端设备对应的密钥信息生成第二MAC值，比较该第二MAC值和第一MAC值是否一致。
应理解，第一终端设备生成MAC值和第一网络设备生成MAC值的方式相同。
需要说明的是，第一网络设备可以通过第二网络设备向第一终端设备发送该第一MAC值，该第一MAC值承载在EAP消息中，也可以通过其他信令承载，例如，通过一 条单独的消息携带该第一MAC值；再例如，在EAP认证交互消息中承载。
另一种可能的实施方式中，第一终端设备接收一个网络的标识信息，根据该标识信息和第一终端设备对应的密钥信息生成第二MAC值，通过第二网络设备向第一网络设备发送该第二MAC值，相应的，第一网络设备比较该第二MAC值和第一MAC值是否一致。
应理解，第一终端设备可以在进行EAP认证交互中，计算好所述第二MAC值并通过第二网络设备发送给第一网络设备进行校验。
可以理解，当第一网络设备生成的第一MAC值和第一终端设备生成的第二MAC值匹配时，校验成功，即，意味着，确定该第二网络为合法网络，该第一终端设备可以接入该第二网络中的第二网络设备；相应的，当第一网络设备生成的第一MAC值和第一终端设备生成的第二MAC值不匹配时，校验失败，则确定该第二网络为非法网络，该第一终端设备不能接入该第二网络中的第二网络设备。
根据本申请实施例提供的技术方案，第一网络设备可以确定第二网络标识信息并结合第一终端设备的密钥信息生成第一MAC值，第一终端设备可以根据收到的该标识信息和密钥信息生成第二MAC值，进而通过互相发送并互相校验可以确定第一MAC值与所述第二MAC值是否匹配，从而可以校验第一网络设备收到的网络的标识信息和UE自身收到的网络的标识信息是否一致，因此可以防止该第一终端设备被服务网络欺骗接入网络，从而防止被非法计费或窃取数据。
图5是本申请实施例提供的一种网络检验的方法的一种示意性交互图。图5的方法500是对应于图3的方法300的具体实施步骤。图5所示的方法可以包括如下步骤：
S501，UE发起注册请求，携带用户标识SUCI或SUPI。
具体的，UE向服务网络的AMF/SEAF发送请求消息#A，该请求消息#A用于向UE发起注册请求，该请求消息#A携带该UE的用户标识SUCI或SUPI。
S502，AMF向AUSF请求认证。
具体的，AMF向AUSF发送请求消息#B，该请求消息#B用于请求UE的主认证。
该请求消息#B携带UE的用户标识SUCI或SUPI，该用户标识用于AMF选择AUSF。
S503-S505，AUSF向UDM获取SUPI(该步骤可以省略。)
S503，AUSF向UDM发送请求消息#C，该请求消息#C用于启动一个Nudm_UEAuthentication_Get服务操作。
该请求消息#C携带UE的用户标识SUCI或SUPI，该用户标识用于AUSF选择UDM。
S504，UDM将SUCI解析为SUPI。
S505，UDM向AUSF发送响应消息#A，该消息消息#A包括所述UE的SUPI。
可以理解，步骤S503-步骤S505为AUSF向UDM获取SUPI，该步骤为可选的步骤。
S506，AUSF携带SUPI/SUCI向NSSAAF请求认证，可选携带SN name。
AUSF向NSSAF发送请求消息#D，该请求消息#D用于向NSSAAF请求认证，发起Nnssaaf_AIWF_Authenticate服务操作。该请求消息#D携带SUPI/SUCI。
可选的，还可以携带标识#a，该标识#a为包括服务网络的网络标识信息的一例，该网络标识信息可以是服务网络名称、公共陆地移动网络的身份标识、网络身份标识、公共陆地移动网络的身份标识和网络身份标识、及单网络片选择辅助信息中的至少一个，也可以是任意包括可以标识网络身份的信息。
S507，NSSAAF携带SUPI/SUCI向AAA请求认证，可选携带SN name。
NSSAAF向AAA服务器发送请求消息#E，该请求消息#E用于向AAA服务器请求认证，该请求消息#E携带SUPI/SUCI，可选的携带标识#a。应理解，NSSAAF可以根据SUPI选择AAA服务器，并进行相关的协议转换，再将请求消息#E发送给AAA服务器。
需要说明的是，NSSAAF判断AAA服务器支持标识#a的识别，才会将标识#a发送给AAA服务器。
一种可能的实现方式中，该请求消息#E可以通过AAA消息发送。
S508，AAA服务器根据请求消息#E确定标识#a。
例如，如果第7步携带SN name，则AAA根据本地配置(比如本地配置IP、证书与SN name的对应关系，或证书中携带PLMN ID)校验收到的SN name。如果第7步不携带SN name，则AAA根据本地配置获取SN name(比如本地配置IP、证书与SN name的对应关系，或证书中携带PLMN ID，则可以通过对端IP或证书获取SN name)。
具体的，AAA服务器确定包括服务网络的网络的标识信息。包括两种方式：
方式一：请求消息#E携带了标识#a，则AAA服务器根据本地配置确定该标识#a和该服务网络是否具有对应关系。
一种可能的实施方式中，AAA服务器可以根据该服务网络的IP地址和/或证书与网络的标识信息的对应关系，确定所述IP地址和/或证书所对应的标识信息，进一步的，AAA服务器确定所述标识#a与所述IP地址和/或证书所对应的标识信息相同，则可以校验所述标识#a是否正确。
可以理解，AAA服务器的本地配置包括服务网络的IP地址和/或证书与网络的标识信息的对应关系。
再例如，AAA服务器根据服务网络的证书中携带的PLMN ID来验证标识信息，确定所述证书中携带的PLMN ID与所述标识#a是否相同，则可以校验所述标识#a是否正确。
可以理解，AAA服务器的本地配置包括服务网络的PLMN ID。
方式二：请求消息#E没有携带标识#a，AAA服务器根据本地配置获取该服务网络的标识信息标识#a。
具体的，AAA服务器根据本地配置直接确定服务网络的标识信息。
例如，AAA服务器根据本地配置可以直接查找到服务网络的IP地址和/或证书与网络的标识信息的对应关系，从而确定出服务网络所在网络的标识信息。
可以理解，AAA服务器的本地配置包括服务网络的IP地址和/或证书与网络的标识信息的对应关系。
再例如，AAA服务器根据本地配置可以查找到服务网络的证书，并从证书中获取服务网络所在网络的PLMN ID。
可以理解，AAA服务器的本地配置包括服务网络的PLMN ID。
应理解，UE和AAA服务器需要进行认证。
一种可能的实施方式中，AAA服务器和UE进行EAP认证，完成相互认证。
S509，AAA服务器使用MSK或EMSK或其生成的其他密钥和标识#a生成第一MAC值。
可以理解，AAA使用MSK或EMSK或其生成的其他密钥和SN name生成新的密钥 (示例命名MSK*)，然后将MSK*发送给AUSF。
示例性的，AAA服务器使用MSK或EMSK或其生成的其他密钥和SN name生成新的密钥，该新的密钥也可以是MAC值，然后将MAC值发送给AUSF。
S510-S513，将MSK*发送给AUSF，计算Kausf和Kseaf并发送给UE。
可以理解，AAA服务器也可以将MAC值发送给AUSF，计算Kausf和Kseaf并发送给服务网络的AMF。
S514，AMF通过NAS消息#A向UE发送第一MAC值。
相应的，UE接收该第一MAC值。
S515，UE侧采用相同的方式生成密钥。
例如，UE侧采用相同的方式生成第二MAC值。
具体的，UE通过步骤S510-S513获得Kausf，UE使用MSK或EMSK或其生成的其他密钥和标识#b生成第二MAC值。其中，标识#b为UE从服务网络接收的服务网络的网络标识信息的一例，该网络标识信息可以是服务网络名称、公共陆地移动网络的身份标识、网络身份标识、公共陆地移动网络的身份标识和网络身份标识、及单网络片选择辅助信息中的至少一个，也可以是任意包括可以标识网络身份的信息。
进一步的，UE确定第一MAC值和第二MAC值是否匹配。
应理解，UE生成MAC值和AAA服务器生成MAC值的方式相同。
另一种可能的实施方式中，UE通过服务网络接收一个网络的标识信息标识#b，根据该标识#b和UE对应的MSK/EMSK或其他密钥信息生成第二MAC值，通过服务网络向AAA服务器发送该第二MAC值，相应的，AAA服务器来执行验证，比较该第二MAC值和第一MAC值是否匹配。
应理解，UE可以在进行EAP认证交互中，计算好所述第二MAC值并发送给AAA服务器进行校验。
需要说明的是，UE需要配置是否采用网络标识信息(标识#b)进行MAC值生成的指示，然后根据指示确定是否执行MAC值的生成。
可以理解，当AAA服务器生成的第一MAC值和UE生成的第二MAC值匹配时，校验成功，即，意味着，该UE可以接入该服务网络中的网络设备；相应的，当AAA服务器生成的第一MAC值和UE生成的第二MAC值不匹配时，校验失败，则该UE不能接入该服务网络中的网络设备。
需要说明的是，由于本申请方案需要AAA进行升级，故可能存在无法升级的AAA，此时需要解决兼容性问题：
1、UE上配置是否采用SN name进行MSK*生成的指示。然后根据指示确定是否执行。
2、NSSAAF判断AAA支持SN name识别，才会将SN name发送给AAA。
应理解，UE上配置是否采用SN name进行MAC值生成的指示。然后根据指示确定是否执行。
根据本申请实施例提供的方案，将网络的标识信息(SN name)加入归属方密钥生成的方式，可以保证UE和归属方感知SN name，从而隐式的校验出收到的SN name是否一致。
具体的，归属网络可以确定服务网络发送的网络标识信息，并结合UE的密钥信息生成第一MAC值，UE可以根据收到的该标识信息和密钥信息生成第二MAC值，进而通过互相发送并互相校验可以确定第一MAC值与所述第二MAC值是否匹配，从而可以校验UE自身收到的网络的标识信息是否合法，因此可以防止被服务网络欺骗接入网络，从而防止被非法计费或窃取数据。
图6是本申请实施例提供的网络校验的方法的又一种示意性框图，方法500可以包括如下步骤：
S610，第一网络设备确定包括第二网络设备的第二网络的标识信息。
一种可能的实施方式中，第一网络设备可以从第二网络设备接收所述第二网络的标识信息。相应的，第二网络设备向第一网络设备发送所述第二网络设备的标识信息。
其中，第二网络的标识信息可以是SN name、PLMN ID、NID、PLMN ID+NID及S-NSSAI中的至少一个，也可以是任意包括可以标识网络身份的信息。
应理解，该第二网络的标识信息可以理解为第一终端设备选择网络连接时的选网信息，即，第一终端设备在选择网络时，可以校验第二网络的标识信息。
应理解，该第二网络可以是第一终端设备所在区域内可以收到广播信号的任意网络设备。
具体的，第二网络设备可以根据第一终端设备的标识信息确定第一网络设备，进一步的，第二网络设备可以将第二网络的标识信息及第一终端设备的标识信息发送给第一网络设备。
其中，第一终端设备的标识信息可以是SUPI。
应理解，该第一终端设备的标识信息也可以是SUCI。
可选的，第一网络设备还可以根据本地配置校验所述第二网络的标识信息。
具体的，第一网络设备从所述第二网络设备获取所述第二网络的标识信息后，第一网络设备根据本地配置确定该第二网络是否和该标识信息具有对应关系，该对应关系可以理解为第二网络有使用该标识信息的权限。
例如，第一网络设备可以获取第二网络设备的IP地址和/或证书，根据该IP地址和/或证书与网络的标识信息的对应关系，确定所述IP地址和/或证书所对应的标识信息，进一步的，第一网络设备确定所述第二网络的标识信息与所述IP地址和/或证书所对应的标识信息相同，则可以校验所述第二网络的标识信息正确。
可以理解，第一网络设备的本地配置包括第二网络的IP地址和/或证书与网络的标识信息的对应关系。
再例如，第一网络设备可以获取第二网络设备的证书，根据该证书中携带的PLMN ID来验证标识信息，确定所述证书中携带的PLMN ID与所述第二网络的标识信息是否相同，则可以校验所述第二网络的标识信息是否正确。
可以理解，第一网络设备的本地配置包括第二网络的PLMN ID。
另一种可能的实施方式中，第一网络设备还可以根据本地配置获取该第二网络的标识信息。
具体的，第一网络设备根据本地配置直接确定第二网络设备的标识信息。
例如，第一网络设备根据本地配置可以直接查找到第二网络设备的IP地址和/或证书 与网络的标识信息的对应关系，从而确定出第二网络网络设备所在网络的标识信息。
可以理解，第一网络设备的本地配置包括第二网络的IP地址和/或证书与网络的标识信息的对应关系。
再例如，第一网络设备根据本地配置可以查找到第二网络设备的证书，并从证书中获取第二网络设备所在网络的PLMN ID。
可以理解，第一网络设备的本地配置包括第二网络的PLMN ID。
S620，第一网络设备根据所述标识信息及第一终端设备对应的密钥信息生成MSK信息。
第一网络设备根据所述标识信息及第一终端设备对应的密钥信息生成的MSK信息可以是第一MSK*信息。
具体的，第一网络设备根据所述第一终端设备的标识信息确定第一终端设备对应的密钥信息，进一步的，第一网络设备根据所述第二网络的标识信息和所述第一终端设备对应的密钥信息生成MSK信息。
其中，第一终端设备的密钥信息可以是MSK或EMSK。
应理解，上述第一网络设备生成的更新的密钥信息可以理解为，第一网络设备根据第一终端设备的MSK或EMSK，或其他密钥结合第二网络的标识信息生成了一个该服务网络(第二网络设备)的另一个密钥信息，该密钥信息可以是MSK信息，以下实施例中以第一MSK*信息为例进行说明。
应理解，在步骤S620之前，第一网络设备需要和第一终端设备相互认证。
一种可能的实施方式中，第一网络设备和第一终端设备进行EAP认证，完成相互认证。
S630，第一网络设备向第二网络设备发送所述MSK信息。
具体的，第一网络设备向第二网络设备发送所述第一MSK*信息，相应的，第二网络设备接收所述第一MSK*信息。
一种可能的实施方式中，第一网络设备向第二网络设备发送所述第一MSK*信息，MSK或EMSK。相应的，第一终端设备通过第二网络设备接收所述第一MSK*信息和一个网络的标识信息，根据该标识信息和第一终端设备对应的密钥信息生成第二MSK*信息，比较该第二MSK*信息和第一MSK*信息是否一致。
应理解，第一终端设备生成第二MSK*信息和第一网络设备生成第一MSK*信息的方式相同。
需要说明的是，第一网络设备可以通过第二网络设备向第一终端设备发送该第一MSK*信息，该第一MSK*信息承载在EAP消息中，也可以通过其他信令承载，例如，通过一条单独的消息携带该第一MSK*信息；再例如，在EAP认证交互消息中承载。
可以理解，当第一网络设备生成的第一MSK*信息和第一终端设备生成的第二MSK*信息匹配时，校验成功，即，意味着，该第一终端设备可以接入该第二网络中的第二网络设备；相应的，当第一网络设备生成的第一MSK*信息和第一终端设备生成的第二MSK*信息不匹配时，校验失败，则该第一终端设备不能接入该第二网络中的第二网络设备。
根据本申请实施例提供的技术方案，第一网络设备可以确定第二网络标识信息并结合第一终端设备的密钥信息生成新的密钥信息，第一终端设备可以根据收到的该标识信息和 密钥信息生成新的密钥信息，进而第一终端设备可以根据两个新的密钥信息是否匹配来校验自己生成的密钥信息与该网络设备所在网络的标识信息是否一致，从而可以校验UE自身收到的网络的标识信息是否合法，因此可以防止被服务网络欺骗接入网络，从而防止被非法计费或窃取数据。
图7是本申请实施例提供的一种网络检验的方法的一种示意性交互图。图7的方法700是对应于图6的方法600的具体实施步骤。
该实施例中，使用MSK或EMSK或其生成的其他密钥和SN name生成一个SN的MAC值，然后将该MAC值经服务网络发送给UE进行校验。
本实施例中，以NPN场景为例，其中，UE作为第一终端设备的一例，第二网络设备包括AMF/SEAF，AUSF，UDM，NSSAF等网络实体，第一网络设备以AAA服务器为例进行说明。
图7所示的方法可以包括如下步骤：
S701，UE向服务网络的AMF/SEAF发送请求消息#A，该请求消息#A用于发起注册请求，该请求消息#A携带该UE的用户标识SUCI或SUPI。
S702，AMF向AUSF发送请求消息#B，该请求消息#B用于请求UE的主认证。
该请求消息#B携带UE的用户标识SUCI或SUPI，该用户标识用于AMF选择AUSF。
S703，AUSF向UDM发送请求消息#C，该请求消息#C用于启动一个Nudm_UEAuthentication_Get服务操作。
该请求消息#C携带UE的用户标识SUCI或SUPI，该用户标识用于AUSF选择UDM。
S704，UDM将SUCI解析为SUPI。
S705，UDM向AUSF发送响应消息#A，该消息消息#A包括所述UE的SUPI。
可以理解，步骤S703-步骤S705为AUSF向UDM获取SUPI，该步骤为可选的步骤。
S706，AUSF向NSSAF发送请求消息#D，该请求消息#D用于向NSSAAF请求认证，发起Nnssaaf_AIWF_Authenticate服务操作。该请求消息#D携带SUPI/SUCI。
可选的，还可以携带标识#a，该标识#a为包括服务网络的网络标识信息的一例，该网络标识信息可以是服务网络名称、公共陆地移动网络的身份标识、网络身份标识、公共陆地移动网络的身份标识和网络身份标识、及单网络片选择辅助信息中的至少一个，也可以是任意包括可以标识网络身份的信息。
S707，NSSAAF向AAA服务器发送请求消息#E，该请求消息#E用于向AAA服务器请求认证，该请求信息#E携带SUPI/SUCI，可选的携带标识#a。应理解，NSSAAF可以根据SUPI选择AAA服务器，并进行相关的协议转换，再将请求消息#E发送给AAA服务器。
需要说明的是，NSSAAF判断AAA服务器支持标识#a的识别，才会将标识#a发送给AAA服务器。
一种可能的实现方式中，该请求消息#E可以通过AAA消息发送。
S708，AAA服务器根据请求消息#E确定标识#a。
具体的，AAA服务器确定包括服务网络的网络的标识信息。包括两种方式：
方式一：请求消息#E携带了标识#a，则AAA服务器根据本地配置确定该标识#a和该服务网络是否具有对应关系。
一种可能的实施方式中，AAA服务器可以根据该服务网络的IP地址和/或证书与网络的标识信息的对应关系，确定所述IP地址和/或证书所对应的标识信息，进一步的，AAA服务器确定所述标识#a与所述IP地址和/或证书所对应的标识信息相同，则可以校验所述标识#a是否正确。
可以理解，AAA服务器的本地配置包括服务网络的IP地址和/或证书与网络的标识信息的对应关系。
再例如，AAA服务器根据服务网络的证书中携带的PLMN ID来验证标识信息，确定所述证书中携带的PLMN ID与所述标识#a是否相同，则可以校验所述标识#a是否正确。
可以理解，AAA服务器的本地配置包括服务网络的PLMN ID。
方式二：请求消息#E没有携带标识#a，AAA服务器根据本地配置获取该服务网络的标识信息标识#a。
具体的，AAA服务器根据本地配置直接确定服务网络的标识信息。
例如，AAA服务器根据本地配置可以直接查找到服务网络的IP地址和/或证书与网络的标识信息的对应关系，从而确定出服务网络所在网络的标识信息。
可以理解，AAA服务器的本地配置包括服务网络的IP地址和/或证书与网络的标识信息的对应关系。
再例如，AAA服务器根据本地配置可以查找到服务网络的证书，并从证书中获取服务网络所在网络的PLMN ID。
可以理解，AAA服务器的本地配置包括服务网络的PLMN ID。
应理解，UE和AAA服务器需要进行认证。
一种可能的实施方式中，AAA服务器和UE进行EAP认证，完成相互认证。
S709，AAA服务器使用MSK或EMSK或其生成的其他密钥和标识#a生成第一MSK*信息。
S710-S713，AAA服务器将第一MSK*信息发送给服务网络中AUSF，AUSF根据第一MSK*信息计算出Kseaf，并发送给服务网络的AMF。
S714，AMF通过NAS消息#a向UE发送根据第一MSK*信息计算出的Kseaf。
相应的，UE接收该根据第一MSK*信息计算出的Kseaf。
S715，UE使用相同的方法生成第二MSK*信息，并计算出对应的Kseaf。
具体的，UE通过步骤S710-S713获得Kausf，UE使用MSK或EMSK或其生成的其他密钥和标识#b生成第二MSK*信息。其中，标识#b为UE从服务网络接收的服务网络的网络标识信息的一例，该网络标识信息可以是服务网络名称、公共陆地移动网络的身份标识、网络身份标识、公共陆地移动网络的身份标识和网络身份标识、及单网络片选择辅助信息中的至少一个，也可以是任意包括可以标识网络身份的信息。
进一步的，UE确定第一MSK*信息计算出的Kseaf和第二MSK*信息计算出的Kseaf是否匹配。
应理解，UE生成MSK*信息和AAA服务器生成MSK*信息的方式相同。
需要说明的是，SN_MAC的携带可以按图中所示方式，也可以其他流程承载，比如AAA单独给UE发送一条消息，消息中携带SN_MAC，或者在EAP认证交互消息中承载。上述只是一种示例方式。
可以理解，MSK*信息的携带可以按图中所示方式，也可以其他流程承载，比如AAA单独给UE发送一条消息，消息中携带SN_MAC，或者在EAP认证交互消息中承载。上述只是一种示例方式。
另外也可以由UE计算后，发给AAA进行校验，比如在EAP认证交互中，UE计算好SN__MAC后发送给AAA进行校验。
需要说明的是，UE上需要配置是否采用网络标识信息(标识#b)进行MSK*信息生成的指示，然后根据指示确定是否执行。
可以理解，当AAA服务器生成的MSK*信息和UE生成的MSK*信息匹配时，校验成功，即，意味着，该UE可以接入该服务网络中的网络设备；相应的，当AAA服务器生成的MSK*信息和UE生成的MSK*信息不匹配时，校验失败，则该UE不能接入该服务网络中的网络设备。
与方法500不同的是，采用显式的方式，下发归属方收到的SN name给UE校验，或者UE上报收到的SN name给AAA校验，同样能够完成对SN name的校验。
根据本申请实施例提供的技术方案，归属网络可以确定服务网络发送的网络标识信息并结合UE的密钥信息生成新的密钥信息(第一MSK*信息)，进而可以用于第一终端设备确定归属网络生成的新的秘钥信息与UE生成的新的秘钥信息是否匹配，进一步的来校验UE自身收到的网络的标识信息和归属网络收到的网络的标识信息是否一致，从而可以校验UE自身收到的网络的标识信息是否合法，因此可以防止被服务网络欺骗接入网络，从而防止被非法计费或窃取数据。
以上，结合图3至图7详细说明了本申请实施例提供的方法。以下，结合图8至图9详细说明本申请实施例提供的装置。应理解，装置实施例的描述与方法实施例的描述相互对应，因此，未详细描述的内容可以参见上文方法实施例，为了简洁，这里不再赘述。
该装置用于实现上述实施例及相关实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图8是本申请实施例提供的网络检验装置的示意性框图。该检验装置800包括收发单元810和处理单元820。收发单元810可以实现相应的通信功能，处理单元820可以读取存储单元中的指令和/或数据，以使得通信设备实现前述方法实施例。收发单元810还可以称为通信接口或通信单元。
该网络校验装置800还可以包括存储单元，可以用于存储指令和/或数据。
该网络校验装置800可以用于执行上文方法实施例中终端设备(UE)所执行的动作，这时，该网络校验装置800可以为终端设备或者可配置于终端设备的部件，收发单元810用于执行上文方法实施例中终端设备侧的收发相关的操作，处理单元820用于执行上文方法实施例中终端设备侧的处理相关的操作。
或者，该网络校验装置800可以用于执行上文方法实施例中网络设备(第一网络设备和第二网络设备)所执行的动作，收发单元810用于执行上文方法实施例中第一网络设备和第二网络设备的收发相关的操作，处理单元820用于执行上文方法实施例中第一网络设备和第二网络设备侧的处理相关的操作。
应理解，各单元执行相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
如图9所示，本申请实施例还提供一种网络校验装置900。该网络校验装置900包括处理器910，处理器910与存储器920耦合，存储器920用于存储计算机程序或指令和/或数据，处理器910用于执行存储器920存储的计算机程序或指令和/或数据，还包括收发器930，收发器930用于信号的接收和/或发送。例如，处理器910用于控制收发器930进行信号的接收和/或发送。使得上文方法实施例中的方法被执行。
可选地，该网络校验装置900包括的处理器910为一个或多个。
可选地，如图9所示，该网络校验装置900还可以包括存储器920。
可选地，该网络校验装置900包括的存储器920可以为一个或多个。
可选地，该存储器920可以与该处理器910集成在一起，或者分离设置。
作为一种方案，该网络校验装置900用于实现上文方法实施例中由终端设备(UE)执行的操作。
例如，处理器910用于实现上文方法实施例中由终端设备(UE)执行的处理相关的操作，收发器930用于实现上文方法实施例中由终端设备(UE)执行的收发相关的操作。
作为另一种方案，该网络校验装置900用于实现上文方法实施例中由网络设备(第一网络设备和第二网络设备)执行的操作。
例如，处理器910用于实现上文方法实施例中由网络设备(第一网络设备和第二网络设备)执行的处理相关的操作，收发器930用于实现上文方法实施例中由网络设备(第一网络设备和第二网络设备)执行的收发相关的操作。
应理解，上述处理器910和存储器920可以合成一个处理装置，处理器910用于执行存储器920中存储的程序代码来实现上述功能。具体实现时，该存储器920也可以集成在处理器910中，或者独立于处理器910。应理解，处理器1110也可以和前面网络校验装置中的各个处理单元相对应，收发器930可以和前面网络校验装置中的各个接收单元和发送单元相对应。
还应理解，收发器930可以包括接收器(或者称，接收机)和发射器(或者称，发射机)。收发器还可以进一步包括天线，天线的数量可以为一个或多个。收发器还可以是通信接口或者接口电路。
应理解，具体地，该网络校验装置900可对应于根据本申请实施例的方法300至方法700的终端设备和网络设备。该网络校验装置900可以包括方法500和700中的终端设备和网络设备执行的方法的单元，执行方法500和700中的网络设备和终端设备执行的方法的单元。各模块执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，相应的有益效果也可参考前述方法实施例，为了简洁，在此不再赘述。
在一种可能的设计中，该芯片，例如可以为可用于装置中的通信芯片，用于实现装置中处理器910的相关功能。该芯片装置可以为实现相关功能的现场可编程门阵列，专用集成芯片，系统芯片，中央处理器，网络处理器，数字信号处理电路，微控制器，还可以采用可编程控制器或其他集成芯片。该芯片中，可选的可以包括一个或多个存储器，用于存储程序代码，当所述代码被执行时，使得处理器实现相应的功能。
可选的，上述实施例中涉及的存储器与处理器可以是物理上相互独立的单元，或者， 存储器也可以和处理器集成在一起。
本申请实施例还提供了一种计算机可读存储介质，其上存储有用于实现上述方法实施例中的方法的计算机程序。当该计算机程序在计算机上运行时，使得该计算机可以实现上述方法实施例中的方法。
根据本申请实施例提供的方法，本申请提供一种计算机程序产品，包括计算机程序，当该计算机程序在计算机上运行时，使得该计算机可以执行上述方法实施例中的方法。
根据本申请实施例提供的方法，本申请还提供一种系统，其包括前述的一个或多个终端设备以及一个或多个网络设备。
上述各个装置实施例中网络设备与终端设备和方法实施例中的网络设备或终端设备完全对应，由相应的模块或单元执行相应的步骤具体单元的功能可以参考相应的方法实施例。
在实现过程中，上述方法的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
应注意，本申请实施例中的处理器可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(digital signal processor,DSP)、专用集成电路(application-specific integrated circuit,ASIC)、现场可编程门阵列(field-programmable gate array,FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synch-link DRAM， SLDRAM)和直接内存总线随机存取存储器(direct ram-bus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
根据本申请实施例提供的通信方法，本申请还提供一种计算机程序产品，该计算机程序产品上存储有计算机程序代码，当该计算机程序代码在计算机上运行时，使得该计算机执行本申请的通信方法。
根据本申请实施例提供的通信方法，本申请还提供一种计算机可读介质，该计算机可读介质存储有程序代码，当该程序代码在计算机上运行时，使得该计算机执行本申请的通信方法。
根据本申请实施例提供的通信方法，本申请还提供一种系统，其包括前述的装置或设备。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disc，SSD))等。
上述各个装置实施例中网络侧设备与终端设备和方法实施例中的网络侧设备或终端设备对应，由相应的模块或单元执行相应的步骤，例如通信单元(收发器)执行方法实施例中接收或发送的步骤，除发送、接收外的其它步骤可以由处理单元(处理器)执行。具体单元的功能可以参考相应的方法实施例。其中，处理器可以为一个或多个。
在本说明书中使用的术语“部件”、“模块”、“系统”等用于表示计算机相关的实体、硬件、固件、硬件和软件的组合、软件、或执行中的软件。例如，部件可以是但不限于，在处理器上运行的进程、处理器、对象、可执行文件、执行线程、程序和/或计算机。通过图示，在计算设备上运行的应用和计算设备都可以是部件。一个或多个部件可驻留在进程和/或执行线程中，部件可位于一个计算机上和/或分布在2个或更多个计算机之间。此外，这些部件可从在上面存储有各种数据结构的各种计算机可读介质执行。部件可例如根据具有一个或多个数据分组(例如来自与本地系统、分布式系统和/或网络间的另一部件交互的二个部件的数据，例如通过信号与其它系统交互的互联网)的信号通过本地和/或远程进程来通信。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可 以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所述领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (28)

  1. 一种网络校验的方法，其特征在于，包括：
    第一终端设备从第一网络设备接收第一MAC值和一个网络的标识信息，其中，所述第一MAC值为根据所述第一网络设备所在网络的标识信息及所述第一终端设备对应的密钥信息确定的；
    所述第一终端设备根据所述标识信息及所述密钥信息生成第二MAC值；
    所述第一终端设备确定所述第一MAC值与所述第二MAC值是否匹配。
  2. 根据权利要求1所述的方法，其特征在于，所述密钥信息包括主会话密钥信息或扩展主会话密钥信息。
  3. 根据权利要求1或2所述的方法，其特征在于，所述一个网络的标识信息包括：所述一个网络的服务网络名称、公共陆地移动网络的身份标识、网络身份标识、公共陆地移动网络的身份标识和网络身份标识、及单网络片选择辅助信息中的至少一个。
  4. 一种信息发送方法，其特征在于，包括：
    第一网络中的第一网络设备确定包括第二网络设备的第二网络的标识信息；
    所述第一网络设备根据所述标识信息及第一终端设备对应的密钥信息生成MAC值；
    所述第一网络设备向所述第二网络设备发送所述MAC值。
  5. 根据权利要求4所述的方法，其特征在于，所述第一网络设备确定所述标识信息，包括：
    所述第一网络设备根据本地配置确定所述标识信息；或者，
    所述第一网络设备从所述第二网络设备获取所述标识信息。
  6. 根据权利要求4或5所述的方法，其特征在于，
    所述第一网络设备确定所述第二网络的标识信息，包括：所述第一网络设备从所述第二网络设备获取所述第二网络的标识信息；
    所述方法还包括：
    所述第一网络设备获取所述第二网络设备的IP地址和/或证书；
    所述第一网络设备根据所述IP地址和/或证书，以及IP地址和/或证书与网络的标识信息的对应关系，确定所述IP地址和/或证书所对应的标识信息；
    所述第一网络设备确定所述第二网络的标识信息与所述IP地址和/或证书所对应的标识信息相同。
  7. 根据权利要求4-6中任一项所述的方法，其特征在于，所述密钥信息包括主会话密钥信息或主扩展会话密钥信息。
  8. 根据权利要求4-7中任一项所述的方法，其特征在于，所述第二网络的标识信息包括：所述第二网络的服务网络名称、公共陆地移动网络的身份标识、网络身份标识、公共陆地移动网络的身份标识和网络身份标识、及单网络片选择辅助信息中的至少一个。
  9. 一种网络校验的装置，其特征在于，包括：
    接收模块，用于从网络设备接收第一MAC值和一个网络的标识信息，其中，所述第一MAC值为根据所述网络设备所在网络的标识信息及第一终端设备对应的密钥信息确定的；
    处理模块，用于根据所述一个网络的标识信息及所述第一终端设备对应的密钥信息生成第二MAC值；
    所述处理模块，还用于确定所述第一MAC值与所述第二MAC值是否匹配。
  10. 根据权利要求9所述的装置，其特征在于，所述密钥信息包括主会话密钥信息或扩展主会话密钥信息。
  11. 根据权利要求9或10所述的装置，其特征在于，所述一个网络的标识信息包括：所述一个网络的服务网络名称、公共陆地移动网络的身份标识、网络身份标识、公共陆地移动网络的身份标识和网络身份标识、及单网络片选择辅助信息中的至少一个。
  12. 一种信息发送装置，其特征在于，包括：
    处理模块，用于确定包括第二网络设备的第二网络的标识信息；
    所述处理模块，还用于根据所述标识信息及第一终端设备对应的密钥信息生成MAC值；
    发送模块，用于向所述第二网络设备发送所述MAC值。
  13. 根据权利要求12所述的装置，其特征在于，所述处理模块具体用于根据本地配置确定所述标识信息；或者，从所述第二网络设备获取所述标识信息。
  14. 根据权利要求12或13所述的装置，其特征在于，所述处理模块具体用于获取所述第二网络设备的IP地址和/或证书；根据所述IP地址和/或证书，以及IP地址和/或证书与网络的标识信息的对应关系，确定所述IP地址和/或证书所对应的标识信息；确定所述第二网络的标识信息与所述IP地址和/或证书所对应的标识信息相同。
  15. 根据权利要求14所述的装置，其特征在于，所述密钥信息包括主会话密钥信息或主扩展会话密钥信息。
  16. 根据权利要求12-15中任一项所述的装置，其特征在于，所述第二网络的标识信息包括：所述第二网络的服务网络名称、公共陆地移动网络的身份标识、网络身份标识、公共陆地移动网络的身份标识和网络身份标识、及单网络片选择辅助信息中的至少一个。
  17. 一种网络校验方法，其特征在于，包括：
    第一网络中的第一网络设备确定包括第二网络设备的第二网络的标识信息；
    所述第一网络设备根据所述标识信息及第一终端设备对应的密钥信息生成MAC值；
    所述第一网络设备向所述第二网络设备发送所述MAC值；
    所述第二网络设备向第一终端设备发送所述MAC值。
  18. 根据权利要求17所述的方法，其特征在于，所述第一网络设备确定所述标识信息，包括：
    所述第一网络设备根据本地配置确定所述标识信息；或者，
    所述第一网络设备从所述第二网络设备获取所述标识信息。
  19. 根据权利要求17或18所述的方法，其特征在于，
    所述第一网络设备确定所述第二网络的标识信息，包括：所述第一网络设备从所述第二网络设备获取所述第二网络的标识信息；
    所述方法还包括：
    所述第一网络设备获取所述第二网络设备的IP地址和/或证书；
    所述第一网络设备根据所述IP地址和/或证书，以及IP地址和/或证书与网络的标识 信息的对应关系，确定所述IP地址和/或证书所对应的标识信息；
    所述第一网络设备确定所述第二网络的标识信息与所述IP地址和/或证书所对应的标识信息相同。
  20. 根据权利要求17-19中任一项所述的方法，其特征在于，所述密钥信息包括主会话密钥信息或主扩展会话密钥信息。
  21. 根据权利要求17-20中任一项所述的方法，其特征在于，所述第二网络的标识信息包括：所述第二网络的服务网络名称、公共陆地移动网络的身份标识、网络身份标识、公共陆地移动网络的身份标识和网络身份标识、及单网络片选择辅助信息中的至少一个。
  22. 根据权利要求17-21中任一项所述的方法，其特征在于，还包括：
    所述第一终端设备根据所述标识信息及所述密钥信息生成第二MAC值。
  23. 根据权利要求17-22中任一项所述的方法，其特征在于，包括：
    所述第一终端设备确定所述第一MAC值与所述第二MAC值是否匹配。
  24. 一种网络校验的装置，其特征在于，包括：与存储器耦合的处理器，所述存储器用于存储程序，所述处理器用于运行所述程序，使得所述装置执行如权利要求1-3中任一项所述的方法。
  25. 一种信息发送的装置，其特征在于，包括：与存储器耦合的处理器，所述存储器用于存储程序，所述处理器用于运行所述程序，使得所述装置执行如权利要求4-8中任一项所述的方法。
  26. 一种通信系统，其特征在于，包括如权利要求12至16中任一项所述的信息发送装置或者如权利要求25所述的信息发送装置，以及第二网络设备。
  27. 一种计算机可读存储介质，其特征在于，其上存储有计算机程序，所述计算机程序用于执行如权利要求1至8中任一项所述的方法。
  28. 一种芯片系统，其特征在于，包括：处理器，所述处理器用于执行存储的计算机程序，所述计算机程序用于执行如权利要求1至8中任一项所述的方法。
PCT/CN2023/073668 2022-02-07 2023-01-29 网络校验的方法和装置 WO2023147767A1 (zh)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN202210116589.6 2022-02-07
CN202210116589 2022-02-07
CN202210134671.1A CN116600290A (zh) 2022-02-07 2022-02-14 网络校验的方法和装置
CN202210134671.1 2022-02-14

Publications (1)

Publication Number Publication Date
WO2023147767A1 true WO2023147767A1 (zh) 2023-08-10

Family

ID=87553161

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/073668 WO2023147767A1 (zh) 2022-02-07 2023-01-29 网络校验的方法和装置

Country Status (1)

Country Link
WO (1) WO2023147767A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180013568A1 (en) * 2016-03-10 2018-01-11 Futurewei Technologies, Inc. Authentication Mechanism for 5G Technologies
CN108781366A (zh) * 2016-03-10 2018-11-09 华为技术有限公司 用于5g技术的认证机制
US20200169877A1 (en) * 2017-05-08 2020-05-28 Lg Electronics Inc. Method for securing connection identifier of user equipment in wireless communication system and apparatus therefor
CN111669276A (zh) * 2019-03-07 2020-09-15 华为技术有限公司 一种网络验证方法、装置及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180013568A1 (en) * 2016-03-10 2018-01-11 Futurewei Technologies, Inc. Authentication Mechanism for 5G Technologies
CN108781366A (zh) * 2016-03-10 2018-11-09 华为技术有限公司 用于5g技术的认证机制
US20200169877A1 (en) * 2017-05-08 2020-05-28 Lg Electronics Inc. Method for securing connection identifier of user equipment in wireless communication system and apparatus therefor
CN111669276A (zh) * 2019-03-07 2020-09-15 华为技术有限公司 一种网络验证方法、装置及系统

Similar Documents

Publication Publication Date Title
US10932132B1 (en) Efficient authentication and secure communications in private communication systems having non-3GPP and 3GPP access
US10716002B2 (en) Method and system for authenticating access in mobile wireless network system
TWI745415B (zh) 基於擴展認證協定（eap）程序的執行來推導蜂巢網路的安全金鑰的技術
US9184977B2 (en) System for controlling access to device-to-device communication services in wireless network
ES2696833T3 (es) Comunicaciones inalámbricas que implican una trama de descubrimiento de configuración rápida de enlace inicial, FILS, para señalización de redes
US20150121490A1 (en) Key derivation method and apparatus for local access under control of a cellular network
JP2017538345A (ja) 方法、装置およびシステム
CN113709736B (zh) 网络认证方法及装置、系统
US11956626B2 (en) Cryptographic key generation for mobile communications device
CN109803350B (zh) 一种安全通信方法和装置
WO2021233340A1 (zh) 网络注册的方法和装置
CN114600485B (zh) 签约数据的配置方法及装置
WO2022247812A1 (zh) 一种鉴权方法、通信装置和系统
WO2023011630A1 (zh) 授权验证的方法及装置
CN113873492A (zh) 一种通信方法以及相关装置
CN115244892A (zh) 安全认证方法、装置、设备及存储介质
WO2023147767A1 (zh) 网络校验的方法和装置
CN116600290A (zh) 网络校验的方法和装置
WO2024092444A1 (zh) 一种通信的方法和装置
CN116528234B (zh) 一种虚拟机的安全可信验证方法及装置
WO2023246457A1 (zh) 安全决策协商方法及网元
WO2022001964A1 (zh) 一种通信方法、终端设备和无线接入网设备
US20240179525A1 (en) Secure communication method and apparatus
WO2023093668A1 (zh) 设备鉴权方法及装置
WO2023159603A1 (zh) 一种安全实现方法及装置、终端设备、网元

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23749346

Country of ref document: EP

Kind code of ref document: A1