WO2023197273A1

WO2023197273A1 - Authentication method and device

Info

Publication number: WO2023197273A1
Application number: PCT/CN2022/086929
Authority: WO
Inventors: 商正仪; 陆伟
Original assignee: 北京小米移动软件有限公司
Priority date: 2022-04-14
Filing date: 2022-04-14
Publication date: 2023-10-19
Also published as: CN117597960A

Abstract

The present invention relates to the field of communications and provides an authentication method and device. The technical solution of the present application is mainly that: an AUSF network element sends an AMF network element information acquisition request to a UDM network element so as to obtain from the UDM network element an AMF network element information acquisition response for indicating an AMF network element providing service to a UE, and sends an authentication notification message to the AMF network element to notify the AMF network element of performing a network authentication process regarding the UE, such that the mechanism of triggering by a network side the network authentication process regarding the UE is implemented, and the continuity and security of the network service can be greatly improved.

Description

Authentication methods and devices

Technical field

The present disclosure relates to the field of mobile communication technology, and in particular to an authentication method and device.

Background technique

In the mobile network communication system, the user equipment (User Equipment, UE) can initiate a network authentication process to achieve two-way authentication between the UE side and the network side and provide information required for subsequent security processes, such as the Authentication Server Function (Authentication Server Function) )AUSF network element key. However, in the current mobile network communication system, the network side does not have a mechanism to trigger the network authentication process for the UE. Therefore, when the information required for the security process needs to be updated, it is possible that the UE fails to initiate network authentication in time. The process causes the interruption of network services.

Contents of the invention

The present disclosure proposes an authentication method and device, and provides a mechanism for triggering the network authentication process on the UE from the network side, thereby greatly improving the continuity and security of network services.

The first aspect embodiment of the present disclosure provides an authentication method, which is executed by an AUSF network element. The method includes: sending an access and mobility management function (Access and Mobility Management Function) to a Unified Data Management (Unified Data Management, UDM) network element. Mobility Mangement Function (AMF) network element information acquisition request, wherein the AMF network element information acquisition request includes the identification of the UE corresponding to the AUSF network element; receiving the AMF network element information acquisition response fed back by the UDM network element, Wherein, the AMF network element information acquisition response is used to indicate the AMF network element that provides services for the UE; and an authentication notification message is sent to the AMF network element, wherein the authentication notification message includes the identity of the UE. , and the authentication notification message is used to notify the AMF network element to perform a network authentication process on the UE.

Optionally, the authentication notification message also includes access type information. The access type information is used to indicate the access type applicable to the initiated network authentication process. The access type includes the third generation partnership plan. (3rd Generation Partnership Project, 3GPP) access and/or non-3GPP access.

Optionally, the authentication notification message also includes an authentication reason for the AUSF network element to send the authentication notification message. The authentication reason includes at least one of the following: roaming manipulation count reaches an upper limit; and UE parameter update count The upper limit value is reached.

Optionally, the authentication notification message also includes a confirmation request indication for requesting an authentication notification confirmation message from the AMF network element, and the authentication notification confirmation message is used to indicate that the AMF network element has requested the UE to perform the requested operation. Describe the network authentication process.

Optionally, the method further includes: after confirming that the network authentication process is completed, generating a new AUSF network element key, and resetting the roaming manipulation count and the UE parameter update count.

An embodiment of the second aspect of the present disclosure provides an authentication method, which is executed by a UDM network element. The method includes: receiving an access and mobility management function AMF network element information acquisition request from an AUSF network element, wherein: The AMF network element information acquisition request includes the identification of the UE corresponding to the AUSF network element; and according to the identification of the UE, an AMF network element information acquisition response is fed back to the AUSF network element, wherein the AMF network element information The acquisition response is used to indicate the AMF network element that provides services for the UE to be able to perform a network authentication process on the UE.

A third aspect embodiment of the present disclosure provides an authentication method, the method is executed by an AMF network element, the method includes: receiving an authentication notification message from the authentication server function AUSF network element, wherein in the authentication notification message Including the identification of the UE, and the authentication notification message is used to notify the AMF network element to perform a network authentication process on the UE; through the non-access (Non Access Stratum) between the AMF network element and the UE, NAS) connection, sending an authentication request to the UE, where the authentication request is used to request the UE to perform the network authentication process; and receiving an authentication response fed back by the UE, where the authentication response includes performing the Describe the information required for the network authentication process.

Optionally, the method further includes: sending a paging message to the UE to create the NAS connection.

Optionally, the authentication notification message also includes a confirmation request indication for requesting an authentication notification confirmation message from the AMF network element, and the method further includes: sending the authentication notification confirmation message to the AUSF network element, wherein , the authentication notification confirmation message is used to indicate that the AMF network element has requested the UE to perform the network authentication process.

Optionally, the method further includes: performing security protection on the authentication request according to a locally stored NAS security context.

Optionally, the method further includes: after the network authentication process is completed, updating the locally stored NAS security context.

Optionally, the authentication request and the authentication notification message also include access type information, the access type information is used to indicate the access type applicable to the initiated network authentication process, and the access type includes 3GPP access and/or non-3GPP access.

A fourth aspect embodiment of the present disclosure provides an authentication method, which is executed by a UE. The method includes: receiving an authentication request from an AMF network element, wherein the authentication request is used to request the UE to perform network authentication. The process; and feeding back an authentication response to the AMF network element, where the authentication response includes information required to perform the network authentication process.

Optionally, the method further includes: receiving a paging message from the AMF network element to create a NAS connection with the AMF network element.

Optionally, the method further includes: security protecting the authentication response according to a locally stored NAS security context.

Optionally, the authentication request includes access type information. The access type information is used to indicate the access type to which the initiated network authentication process is applicable. The access type includes 3GPP access and/or non-3GPP access. access.

The fifth aspect of the present disclosure provides an authentication method. The method includes: the AUSF network element obtains AMF network element related information from the UDM network element, wherein the AMF network element related information is used to indicate that it is related to the The AMF network element that the UE corresponding to the AUSF network element provides services; the AUSF network element sends an authentication notification message to the AMF network element, where the authentication notification message is used to notify the AMF network element to perform operations related to the UE. Network authentication process; the AMF network element sends an authentication request to the UE, where the authentication request is used to request the UE to perform the network authentication process; and the AMF network element receives an authentication response fed back by the UE , wherein the authentication response includes information required to perform the network authentication process.

Optionally, the AUSF network element obtains AMF network element related information from the UDM network element including: the AUSF network element sends an AMF network element information acquisition request to the UDM network element, wherein the AMF network element information acquisition request including the identification of the UE; receiving an AMF network element information acquisition response fed back by the UDM network element, wherein the AMF network element information acquisition response includes the AMF network element related information.

Optionally, the authentication notification message includes a confirmation request indication for requesting an authentication notification confirmation message from the AMF network element, and the method further includes: the AMF network element sending the authentication notification to the AUSF network element. Confirmation message, wherein the authentication notification confirmation message is used to indicate that the AMF network element has requested the UE to perform the network authentication process.

Optionally, the method further includes: after the network authentication process is completed, the AUSF network element generates a new AUSF network element key, and resets the roaming manipulation count and the UE parameter update count.

Optionally, the authentication notification message also includes access type information. The access type information is used to indicate the access type applicable to the initiated network authentication process. The access type includes the third generation partnership plan. 3GPP access and/or non-3GPP access.

A sixth embodiment of the present disclosure provides an authentication device for an AUSF network element, including: a transceiver module for sending an AMF network element information acquisition request to a UDM network element, wherein the AMF network element information acquisition request including the identification of the UE corresponding to the AUSF network element; receiving an AMF network element information acquisition response fed back by the UDM network element, wherein the AMF network element information acquisition response is used to indicate the AMF network that provides services for the UE. element; and sending an authentication notification message to the AMF network element, wherein the authentication notification message includes the identity of the UE, and the authentication notification message is used to notify the AMF network element to perform network operations related to the UE. certification process.

A seventh embodiment of the present disclosure provides an authentication device for a UDM network element, including: a transceiver module, configured to receive an AMF network element information acquisition request from an AUSF network element, wherein the AMF network element information acquisition request including the identity of the UE corresponding to the AUSF network element; and feeding back an AMF network element information acquisition response to the AUSF network element according to the identity of the UE, wherein the AMF network element information acquisition response is used to indicate that the AMF network element information acquisition response is the The UE provides services to AMF network elements capable of performing network authentication procedures with respect to the UE.

An eighth embodiment of the present disclosure provides an authentication device for an AMF network element, including: a transceiver module configured to receive an authentication notification message from an AUSF network element, where the authentication notification message includes an identification of the UE, And the authentication notification message is used to notify the AMF network element to perform a network authentication process on the UE; sending an authentication request to the UE through the NAS connection between the AMF network element and the UE, wherein, The authentication request is used to request the UE to perform the network authentication process; and to receive an authentication response fed back by the UE, where the authentication response includes information required to perform the network authentication process.

A ninth aspect of the present disclosure provides an authentication device for a UE, including: a transceiver module configured to receive an authentication request from an AMF network element, where the authentication request is used to request the UE to perform a network authentication process. ; And feed back an authentication response to the AMF network element, where the authentication response includes information required to perform the network authentication process.

A tenth aspect embodiment of the present disclosure provides an authentication system, including: an AUSF network element, a UDM network element, and an AMF network element, wherein the AUSF network element is used to obtain from the UDM network element an indication that it is related to the AMF network element related information of the AMF network element that the UE corresponding to the AMF network element provides services, and sends an authentication notification message to the AMF network element, where the authentication notification message is used to notify the AMF network element to perform the relevant Describe the network authentication process of the UE; the UDM network element is used to receive the AMF network element information acquisition request sent from the AUSF network element, and feedback the AMF network element information acquisition request to the AUSF network element in response to the AMF network element information acquisition request. AMF network element related information, wherein the AMF network element information acquisition request includes the identification of the UE corresponding to the AUSF network element; the AMF network element sends an authentication request to the UE and receives an authentication response from the UE, where, The authentication request is used to request the UE to perform the network authentication process and the authentication response includes information required to perform the network authentication process.

An eleventh aspect embodiment of the present disclosure provides a communication device, including: a transceiver; a memory; and a processor, respectively connected to the transceiver and the memory, configured to execute a computer executable program on the memory. Instructions control the wireless signal transmission and reception of the transceiver, and can implement the authentication method of the above-mentioned first aspect embodiment, second aspect embodiment, third aspect embodiment or fourth aspect embodiment.

A twelfth aspect embodiment of the present disclosure provides a computer storage medium, wherein the computer storage medium stores computer-executable instructions; after the computer-executable instructions are executed by a processor, the above-mentioned first aspect embodiment can be realized Or the authentication method of the embodiment of the second aspect, the embodiment of the third aspect, or the embodiment of the fourth aspect.

Embodiments of the present disclosure provide an authentication method and device. The AUSF network element sends an AMF network element information acquisition request to the UDM network element to obtain an AMF network element information acquisition response from the UDM network element indicating the AMF network element that provides services for the UE. , and sends an authentication notification message to the AMF network element to notify the AMF network element to perform the network authentication process on the UE, thereby realizing a mechanism for the network side to trigger the network authentication process on the UE, which can greatly improve the continuity and quality of network services. safety.

Additional aspects and advantages of the disclosure will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the disclosure.

Description of the drawings

The above and/or additional aspects and advantages of the present disclosure will become apparent and readily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

Figure 1 is a schematic flowchart of an authentication method according to an embodiment of the present disclosure;

Figure 2 is a schematic flow chart of an authentication method according to an embodiment of the present disclosure;

Figure 3 is a schematic flowchart of an authentication method according to an embodiment of the present disclosure;

Figure 4 is a schematic flowchart of an authentication method according to an embodiment of the present disclosure;

Figure 5 is a schematic flow chart of an authentication method according to an embodiment of the present disclosure;

Figure 6 is a schematic flowchart of an authentication method according to an embodiment of the present disclosure;

Figure 7 is a schematic flow chart of an authentication method according to an embodiment of the present disclosure;

Figure 8 is a schematic flow chart of an authentication method according to an embodiment of the present disclosure;

Figure 9 is a schematic flow chart of an authentication method according to an embodiment of the present disclosure;

Figure 10 is a schematic flowchart of an authentication method according to an embodiment of the present disclosure;

Figure 11 is a schematic flow chart of an authentication method according to an embodiment of the present disclosure;

Figure 12 is a schematic flow chart of an authentication method according to an embodiment of the present disclosure;

Figure 13 is a schematic flow chart of an authentication method according to an embodiment of the present disclosure;

Figure 14 is a schematic flowchart of an authentication method according to an embodiment of the present disclosure;

Figure 15 is a block diagram of an authentication device according to an embodiment of the present disclosure;

Figure 16 is a block diagram of an authentication device according to an embodiment of the present disclosure;

Figure 17 is a block diagram of an authentication device according to an embodiment of the present disclosure;

Figure 18 is a block diagram of an authentication device according to an embodiment of the present disclosure;

Figure 19 is a block diagram of an authentication device according to an embodiment of the present disclosure;

Figure 20 is a block diagram of an authentication device according to an embodiment of the present disclosure;

Figure 21 is a block diagram of an authentication device according to an embodiment of the present disclosure;

Figure 22 is a schematic structural diagram of a communication device provided by an embodiment of the present disclosure;

Figure 23 is a schematic structural diagram of a chip provided by an embodiment of the present disclosure.

Detailed ways

Embodiments of the present disclosure are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present disclosure and are not to be construed as limitations of the present disclosure.

In order to protect the Steering of Roaming (SoR)/UE Parameter Update (UE Parameter Update, UPU) service, the Authentication Server Function (Authentication Sever Function) AUSF network element and UE need to use the AUSF network element key K during the _AUSF usage period. Internally maintain roaming operation count Counter _SoR /UE parameter update count Counter _UPU . When the newly generated K _AUSF is stored, Counter _SoR is set to 0x00 0x01, Counter _UPU is set to 0x00 0x01, and will be updated with the hash value of each AUSF network element side SoR message SoR-MAC-I _AUSF /UPU The hash value of the message UPU-MAC-I _AUSF is calculated and incremented. Once the Counter _SoR /Counter _UPU associated with K _AUSF reaches the upper limit, the AUSF network element will not be able to provide SoR/UPU protection services for the UE. Only when a new K _AUSF is regenerated for the UE, the Counter _SoR /Counter _UPU is reset, and the AUSF network element can resume the SoR/UPU protection service for the UE. Therefore, it is very necessary to refresh K _AUSF in time before K _AUSF becomes invalid.

The network authentication process can realize two-way authentication between the UE side and the network side and provide information required for subsequent security processes. After successful completion of the network authentication process, a new K _AUSF can be generated. In the current mobile communication network, the network side does not have a mechanism to trigger the network authentication process on the UE. The UE can use the same K _AUSF to attach to the network for a long time without refreshing the K _AUSF , but this will lead to SoR/UPU protection services and even network Interruption of Service. For security reasons, there is an urgent need for a mechanism that enables the network side to trigger the network authentication process for the UE to solve the introduced security threats. Triggering the network authentication process on the UE on the network side can greatly improve the continuity and security of network services.

When Counter _SoR /Counter _UPU reaches the upper limit, some network functions (NF) on the core network side (such as AUSF network, UDM network element, AMF network element, etc.) can detect the unavailability of K _AUSF and notify the UE to run the network authentication process without suspending the SoR/UPU protection service for the UE. However, in the current mobile network communication system, the UE mainly initiates the network authentication process by sending a registration request to the access and mobility management function (Access and Mobility Management Function, AMF) network element. The NF on the core network side does not have a mechanism to trigger the network authentication process on the UE, so it is possible to introduce additional security threats and reduce service quality.

To this end, the present disclosure proposes an authentication method and device, which provides a mechanism for the network side to trigger the network authentication process for the UE, thereby greatly improving the continuity and security of network services.

The authentication method and device provided by this application will be introduced in detail below with reference to the accompanying drawings.

Figure 1 shows a schematic flowchart of an authentication method according to an embodiment of the present disclosure. As shown in Figure 1, the method can be executed by the AUSF network element and can include the following steps.

S101. Send an AMF network element information acquisition request to the UDM network element.

The AMF network element information acquisition request includes the identification of the UE corresponding to the AUSF network element.

In this implementation, the AUSF network element may send an AMF network element information acquisition request to the UDM network element to obtain relevant information of the AMF network element serving the UE corresponding to the AUSF network element.

For example, when the AUSF network element determines that it needs to regenerate the AUSF network element key K _AUSF , such as when the current K _AUSF is invalid, it sends an AMF network element carrying the identity of the UE corresponding to the AUSF network element to the UDM network element. Information acquisition request to obtain relevant information of the AMF network element that provides services for the UE from the UDM network element.

Among them, the identity of the UE can be a general public user identity (Generic Public Subscription Identifier, GPSI) or a user permanent identity (Subscription Permanent Identifier, SUPI).

S102. Receive the AMF network element information acquisition response fed back by the UDM network element.

The AMF network element information acquisition response is used to indicate the AMF network element that provides services for the UE.

After receiving the AMF network element information acquisition request sent by the AUSF network element, the UDM network element can feed back the AMF network element information acquisition response to the AUSF network element according to the UE identification carried in the AMF network element information acquisition request, so as to provide the UE with The relevant information of the AMF network element that provides the service (for example, the identification of the AMF network element) is provided to the AUSF network element.

S103. Send an authentication notification message to the AMF network element.

The authentication notification message includes the identity of the UE, and the authentication notification message is used to notify the AMF network element to perform a network authentication process on the UE.

After learning the AMF network element that provides services for the UE, the AUSF network element can send an authentication notification message to the AMF network element to notify the AMF network element to perform the network authentication process for the UE.

For specific implementation of the network authentication process of the UE, reference may be made to the network authentication process in the prior art. For example, the specific implementation of the network authentication process shown in this application is similar to the implementation of the network authentication process initiated by the UE by sending a registration request to the AMF network element, and will not be described again here.

According to the authentication method of the embodiment of the present disclosure, the AUSF network element sends an AMF network element information acquisition request to the UDM network element to obtain an AMF network element information acquisition response indicating an AMF network element that provides services for the UE from the UDM network element, and sends the AMF network element information acquisition response to the UDM network element. The AMF network element sends an authentication notification message to notify the AMF network element to perform the network authentication process on the UE, thereby realizing a mechanism for the network side to trigger the network authentication process on the UE, which can greatly improve the continuity and security of network services.

In some embodiments, the authentication notification message sent by the AUSF network element to the AMF network element may also include access type information. The access type information is used to indicate the access type applicable to the initiated network authentication process. The access type Including 3rd Generation Partnership Project (3GPP) access and/or non-3GPP access.

For example, if the access type information in the authentication notification message received by the AMF network element indicates 3GPP access, the AMF network element can confirm that the initiated network authentication process is only for 3GPP access.

For another example, if the access type information in the authentication notification message received by the AMF network element indicates non-3GPP access, the AMF network element can confirm that the initiated network authentication process is only for non-3GPP access.

For another example, if the access type information in the authentication notification message received by the AMF network element indicates 3GPP access and non-3GPP access, the AMF network element can confirm that the initiated network authentication process is for both 3GPP access and non-3GPP access. 3GPP access is in progress.

In some embodiments, the authentication notification message sent by the AUSF network element to the AMF network element may also include the authentication reason for the authentication notification message sent by the AUSF network element. The authentication reason includes at least one of the following: the roaming manipulation count reaches the upper limit; and The UE parameter update count reaches the upper limit.

K _AUSF invalidation may be caused by the roaming manipulation count reaching the upper limit and/or the UE parameter update count reaching the upper limit. Therefore, the reason why the AUSF network element sends an authentication notification message to trigger the network authentication process for the UE may be roaming manipulation. The count reaches the upper limit and/or the UE parameter update count reaches the upper limit.

In some embodiments, the authentication notification message sent by the AUSF network element to the AMF network element may also include a confirmation request indication for requesting an authentication notification confirmation message from the AMF network element. The authentication notification confirmation message is used to indicate that the AMF network element has requested the UE Go through the network authentication process.

The authentication notification message sent by the ASF network element to the AMF network element may also include a confirmation request indication, which is used to request from the AMF network element an authentication notification confirmation message indicating that the AMF network element has requested the UE to perform a network authentication process, thereby After receiving the authentication notification confirmation message, the AUSF network element can confirm that the AMF network element has requested the UE to perform the network authentication process, that is, the AUSF network element can understand whether this triggering of the UE's network authentication process has been implemented.

For example, if the authentication notification message includes a confirmation request indication, and the AUSF network element does not receive the authentication notification confirmation message sent by the AMF network element within a preset time period after sending the authentication notification message, the AUSF network element can confirm the information about the UE. This trigger of the network authentication process could not be implemented.

Figure 2 shows a schematic flowchart of an authentication method according to an embodiment of the present disclosure. The method can be executed by the AUSF network element, based on the embodiment shown in Figure 1, as shown in Figure 2, and the method can include the following steps.

S201. Send an AMF network element information acquisition request to the UDM network element.

S202: Receive the AMF network element information acquisition response fed back by the UDM network element.

S203: Send an authentication notification message to the AMF network element.

For the description and specific details of the above steps S201-S203, please refer to the relevant description and details of the above steps S101-S103.

S204: After confirming that the network authentication process is completed, generate a new AUSF network element key, and reset the roaming operation count and UE parameter update count.

After confirming that the network authentication process is completed, the AUSF network element can generate a new AUSF network element key K _AUSF and reset the roaming operation count and UE parameter update count, that is, set Counter _SoR to 0x00 0x01 and Counter _UPU to 0x00 0x01.

According to the authentication method of the embodiment of the present disclosure, the AUSF network element sends an AMF network element information acquisition request to the UDM network element to obtain an AMF network element information acquisition response indicating an AMF network element that provides services for the UE from the UDM network element, and sends the AMF network element information acquisition response to the UDM network element. The AMF network element sends an authentication notification message to notify the AMF network element to perform the network authentication process on the UE. After the network authentication process is completed, a new AUSF network element key can be generated and the roaming operation count and UE parameter update count can be reset, thereby Implementing a mechanism for triggering the network authentication process on the UE from the network side can greatly improve the continuity and security of network services.

In some embodiments, the authentication notification message sent by the AUSF network element to the AMF network element may also include access type information. The access type information is used to indicate the access type applicable to the initiated network authentication process. The access type Including 3GPP access and/or non-3GPP access.

Figure 3 shows a schematic flowchart of an authentication method according to an embodiment of the present disclosure. As shown in Figure 3, this method can be executed by a UDM network element and can include the following steps.

S301. Receive an AMF network element information acquisition request from the AUSF network element.

In this embodiment, the UDM network element may receive an AMF network element information acquisition request that carries the identity of the UE corresponding to the AUSF network element from the AUSF network element, so that the AUSF network element obtains the AMF network that provides services for the UE from the UDM network element. Yuan related information.

For example, when the AUSF network element determines that it needs to regenerate the AUSF network element key K _AUSF , such as when the current K _AUSF is invalid, the AUSF network element can send the AMF network element information acquisition request to the UDM network element.

The identity of the UE may be GPSI or SUPI.

S302: Feed back the AMF network element information acquisition response to the AUSF network element according to the UE identification.

The AMF network element information acquisition response is used to indicate the AMF network element that provides services for the UE to enable the network authentication process for the UE to be performed.

After receiving the AMF network element information acquisition request sent by the AUSF network element, the UDM network element can feed back the AMF network element information acquisition response to the AUSF network element according to the UE identification carried in the AMF network element information acquisition request, so as to provide the UE with The service is provided to provide relevant information of the AMF network element (for example, the identification of the AMF network element) to the AUSF network element that can perform the network authentication process on the UE. Therefore, the AUSF network element can learn from the UDM network element the AMF network element that can provide services for the UE to perform the network authentication process on the UE, so that the AUSF network element can send the authentication notification message to the AMF network element to trigger the network authentication process on the UE. certification process.

According to the authentication method of the embodiment of the present disclosure, the UDM network element can receive the AMF network element information acquisition request from the AUSF network element and feed back the AMF network element information acquisition response to the AUSF network element to indicate the AMF network element that provides services for the UE, Therefore, the AUSF network element can send an authentication notification message to the AMF network element to trigger the network authentication process for the UE. This can implement a mechanism for the network side to trigger the network authentication process for the UE, which can greatly improve the continuity and quality of network services. safety.

Figure 4 shows a schematic flowchart of an authentication method according to an embodiment of the present disclosure. As shown in Figure 4, the method can be executed by an AMF network element and can include the following steps.

S401. Receive the authentication notification message from the AUSF network element.

In this embodiment, the AMF network element may receive an authentication notification message carrying the identity of the UE corresponding to the AUSF network element from the AUSF network element, so that the network side triggers a network authentication process for the UE.

For example, when the AUSF network element determines that it needs to regenerate the AUSF network element key K _AUSF , such as when the current K _AUSF is invalid, the AUSF network element can learn from the UDM network element to provide services for the UE corresponding to the AUSF network element. AMF network element, and sends an authentication notification message to the AMF network element to notify the AMF network element to perform the network authentication process on the UE.

The identity of the UE may be GPSI or SUPI.

S402: Send an authentication request to the UE through the non-access (Non Access Stratum, NAS) connection between the AMF network element and the UE.

The authentication request is used to request the UE to perform a network authentication process.

After receiving the authentication notification message, the AMF network element can send an authentication request to the UE through the NAS connection between the AMF network element and the UE to request the UE to perform a network authentication process.

S403: Receive the authentication response fed back by the UE.

Among them, the authentication response includes information required for the network authentication process.

After receiving the authentication request from the AMF network element, the UE can feed back the authentication response to the AMF network element to provide the AMF network element with the information required for the network authentication process.

Network devices involved in the network authentication process, such as AMF network elements, AUSF network elements, and UDM network elements, can interact with each other so that the network devices involved can obtain the information required for the network authentication process, so that they can perform information about the UE. Network authentication process.

According to the authentication method of the embodiment of the present disclosure, the AMF network element can receive the authentication notification message from the AUSF network element, send an authentication request to the UE, and obtain an authentication response including the information required for the network authentication process from the UE to trigger the network on the UE. The authentication process enables the network side to trigger the network authentication process for the UE, which can greatly improve the continuity and security of network services.

In some embodiments, the authentication notification message received from the AUSF network element may also include the authentication reason for the authentication notification message sent by the AUSF network element. The authentication reason includes at least one of the following: roaming manipulation count reaches the upper limit; and UE parameter update The count reaches the upper limit value.

In some embodiments, the authentication notification message received from the AUSF network element and the authentication request sent to the UE may also include access type information. The access type information is used to indicate the access to which the initiated network authentication process is applicable. Type, the access type includes 3rd Generation Partnership Project (3GPP) access and/or non-3GPP access.

For example, if the access type information in the authentication notification message received by the AMF network element indicates 3GPP access, the AMF network element can confirm that the initiated network authentication process is only for 3GPP access, and the AMF network element sends The access type information is carried in the authentication request so that the UE can confirm that the network authentication process is only performed for 3GPP access.

For another example, if the access type information in the authentication notification message received by the AMF network element indicates non-3GPP access, the AMF network element can confirm that the initiated network authentication process is only for non-3GPP access, and the AMF network element The access type information is carried in the authentication request sent to the UE, so that the UE can confirm that the network authentication process is only performed for non-3GPP access.

For another example, if the access type information in the authentication notification message received by the AMF network element indicates 3GPP access and non-3GPP access, the AMF network element can confirm that the initiated network authentication process is for both 3GPP access and non-3GPP access. 3GPP access is performed, and the authentication request sent by the AMF network element to the UE carries the access type information, so that the UE can confirm that the network authentication process is performed for both 3GPP access and non-3GPP access.

Figure 5 shows a schematic flowchart of an authentication method according to an embodiment of the present disclosure. The method can be executed by the AMF network element, based on the embodiment shown in Figure 4, as shown in Figure 5, and the method can include the following steps.

S501. Receive the authentication notification message from the AUSF network element.

For the description and specific details of the above step S501, please refer to the relevant description and details of the above step S401.

S502: Send a paging message to the UE to create a NAS connection.

After the AMF network element receives the authentication communication message carrying the UE's identity, if it is found that there is no NAS connection between the UE and the AMF network element, the 5G core network will page the UE. If the UE is in the registered (RM) -REGISTERED) and CM-IDLE state, the AMF can send a paging message to the UE via the 5G Radio Access Network (NG-RAN) node to create a NAS connection with the UE. If the UE is in the CM-CONNECTED state, it indicates that the NAS connection between the UE and the AMF network element already exists, and this step S502 can be omitted.

S503: Send an authentication request to the UE through the NAS connection between the AMF network element and the UE.

S504: Receive the authentication response fed back by the UE.

For the description and specific details of the above steps S503-S504, please refer to the relevant description and details of the above steps S402-S403.

In some embodiments, the authentication notification message received from the AUSF network element and the authentication request sent to the UE may also include access type information. The access type information is used to indicate the access to which the initiated network authentication process is applicable. Type, the access type includes 3GPP access and/or non-3GPP access.

Figure 6 shows a schematic flowchart of an authentication method according to an embodiment of the present disclosure. The method can be executed by the AMF network element, based on the embodiment shown in Figure 4, as shown in Figure 6, and the method can include the following steps.

S601. Receive the authentication notification message from the AUSF network element.

S602: Send an authentication request to the UE through the NAS connection between the AMF network element and the UE.

For the description and specific details of the above steps S601-S602, please refer to the relevant description and details of the above steps S401-S402.

S603: Send an authentication notification confirmation message to the AUSF network element.

The authentication notification confirmation message is used to indicate that the AMF network element has requested the UE to perform a network authentication process.

The authentication notification message received from the AUSF network element may also include a confirmation request indication for requesting an authentication notification confirmation message from the AMF network element. If the authentication notification message includes a confirmation request indication, the AMF network element, after sending the authentication request to the UE, can send an authentication notification confirmation message to the ASUF network element to notify the ASUF network element that the network authentication process for the UE has been triggered. If the AMF network element fails to send an authentication request to the UE, it will not send the authentication notification confirmation message to the AUSF network element. If the AUSF network element fails to receive the authentication notification confirmation message within the preset time period, it can confirm that the UE This triggering of the network authentication process failed to take place.

S604: Receive the authentication response fed back by the UE.

For the description and specific details of the above step S604, please refer to the relevant description and details of the above step S403.

It should be noted that although the embodiment shown in Figure 6 is only described based on the embodiment shown in Figure 4, similarly, the embodiment shown in Figure 6 can also be based on the embodiment shown in Figure 5, for example, Figure 6 Step S603 of can also be combined with steps S501-S504 of Figure 5, which will not be described again here.

Figure 7 shows a schematic flowchart of an authentication method according to an embodiment of the present disclosure. The method can be executed by the AMF network element, based on the embodiment shown in Figure 4, as shown in Figure 7, and the method can include the following steps.

S701: Receive the authentication notification message from the AUSF network element.

For the description and specific details of the above step S701, please refer to the relevant description and details of the above step S401.

S702, perform security protection on the authentication request according to the locally stored NAS security context.

For security reasons, the AMF network element can securely protect the authentication request based on the locally stored NAS security context, for example, encrypt it, and then send the securely protected authentication request to the UE. After receiving the security-protected authentication request, the UE can parse the security-protected authentication request according to the NAS security context stored locally in the UE to obtain the content of the authentication request.

S703: Send a security-protected authentication request to the UE through the NAS connection between the AMF network element and the UE.

S704: Receive the authentication response fed back by the UE.

For the description and specific details of the above steps S703-S704, please refer to the relevant description and details of the above steps S402-S403.

It should be noted that although the embodiment shown in Figure 7 is only described based on the embodiment shown in Figure 4, similarly, the embodiment shown in Figure 7 can also be based on the embodiment shown in Figures 5 and 6, for example , step S702 in Figure 7 can also be combined with steps S501-S504 in Figure 5 and steps S601-S604 in Figure 6, which will not be described again.

Figure 8 shows a schematic flowchart of an authentication method according to an embodiment of the present disclosure. The method can be executed by the AMF network element, based on the embodiment shown in Figure 7, as shown in Figure 8, and the method can include the following steps.

S801. Receive the authentication notification message from the AUSF network element.

S802: Security protect the authentication request according to the locally stored NAS security context.

S803: Send a security-protected authentication request to the UE through the NAS connection between the AMF network element and the UE.

S804: Receive the authentication response fed back by the UE.

For the description and specific details of the above steps S801-S804, please refer to the relevant description and details of the above steps S701-S704.

S805: After the network authentication process is completed, update the locally stored NAS security context.

After the AMF network element confirms that the network authentication process is completed, it can update the locally stored NAS security context, so that after completing the NAS security model command process to activate the updated NAS security context, it can use the updated NAS security context to respond to the specified message. For security protection.

Figure 9 shows a schematic flowchart of an authentication method according to an embodiment of the present disclosure. As shown in Figure 9, the method may be performed by the UE and may include the following steps.

S901: Receive an authentication request from the AMF network element.

In this embodiment, the UE may receive an authentication request from the AMF network element for requesting the UE to perform a network authentication process.

For example, the AMF network element may send an authentication request to the UE after receiving an authentication notification message from the AUSF network element for notifying the AMF network element to perform a network authentication process on the UE.

S902: Feed back the authentication response to the AMF network element.

According to the authentication method of the embodiment of the present disclosure, the UE can receive the authentication request from the AMF network element and feed back the authentication response including the information required for the network authentication process to the AMF network element to trigger the network authentication process for the UE, thereby enabling Implementing a mechanism that triggers the network authentication process for UEs by network equipment can greatly improve the continuity and security of network services.

In some embodiments, the authentication request received from the AMF network element may include access type information. The access type information is used to indicate the access type applicable to the initiated network authentication process. The access type includes 3GPP access. and/or non-3GPP access.

For example, if the access type information in the authentication request received by the UE indicates 3GPP access, the UE can confirm that the network authentication process is only performed for 3GPP access.

For another example, if the access type information in the authentication request received by the UE indicates non-3GPP access, the UE can confirm that the network authentication process is only performed for non-3GPP access.

For another example, if the access type information in the authentication request received by the UE indicates 3GPP access and non-3GPP access, the UE can confirm that the network authentication process is performed for both 3GPP access and non-3GPP access.

Figure 10 shows a schematic flowchart of an authentication method according to an embodiment of the present disclosure. The method may be executed by the UE. Based on the embodiment shown in Figure 9, as shown in Figure 10, the method may include the following steps.

S1001: Receive a paging message from the AMF network element to create a NAS connection with the AMF network element.

The AMF network element can exchange information with the UE through the NAS connection. If there is no NAS connection between the UE and the AMF network element, the 5G core network will page the UE. If the UE is in the registered (RM-REGISTERED) and CM If the UE is idle (CM-IDLE), the AMF can send a paging message to the UE via the 5G Radio Access Network (NG-RAN) node to create a NAS connection with the UE. If the UE is in the CM-CONNECTED state, it indicates that the NAS connection between the UE and the AMF network element already exists, and this step S1001 can be omitted.

S1002: Receive the authentication request from the AMF network element through the NAS connection.

S1003: Feed back the authentication response to the AMF network element.

For the description and specific details of the above steps S1002-S1003, please refer to the relevant description and details of the above steps S901-S902.

Figure 11 shows a schematic flowchart of an authentication method according to an embodiment of the present disclosure. The method may be executed by the UE. Based on the embodiment shown in Fig. 9, as shown in Fig. 11, the method may include the following steps.

S1101. Receive an authentication request from the AMF network element.

For the description and specific details of the above step S1101, please refer to the relevant description and details of the above step S901.

S1102, perform security protection on the authentication response according to the locally stored NAS security context.

After receiving the authentication request, the UE can send an authentication response to the AMF network element through the NAS connection between the AMF network element and the UE to provide the information required for the network authentication process.

For security reasons, the UE can securely protect the authentication response based on the locally stored NAS security context, for example, encrypt it, and then send the securely protected authentication response to the AMF network element. After the AMF network element receives the security-protected authentication response, it can parse the security-protected authentication response according to the NAS security context stored locally on the AMF network element to obtain the content of the authentication response.

S1103: Feed back the security-protected authentication response to the AMF network element.

For the description and specific details of the above step S1103, please refer to the relevant description and details of the above step S902.

It should be noted that although the embodiment shown in FIG. 11 is only described based on the embodiment shown in FIG. 9 , similarly, the embodiment shown in FIG. 11 may also be based on the embodiment shown in FIG. 10 , for example, FIG. 11 Step S1102 of can also be combined with steps S1001-S1003 of Figure 10, which will not be described again here.

Figure 12 shows a schematic flowchart of an authentication method according to an embodiment of the present disclosure. The method may be executed by the UE. Based on the embodiment shown in Figure 9, as shown in Figure 12, the method may include the following steps.

S1201. Receive an authentication request from the AMF network element.

S1202, perform security protection on the authentication response according to the locally stored NAS security context.

S1203: Feed back the security-protected authentication response to the AMF network element.

For the description and specific details of the above steps S1201-S1203, please refer to the relevant description and details of the above steps S1101-S1103.

S1204: After the network authentication process is completed, update the locally stored NAS security context.

After confirming that the network authentication process is completed, the UE can update the locally stored NAS security context, so that after completing the NAS security model command process to activate the updated NAS security context, the UE can use the updated NAS security context to secure the specified message. Protect.

Figure 13 shows a schematic flowchart of an authentication method according to an embodiment of the present disclosure. This method can be executed by interaction between UE, AMF network element, AUSF network element and UDM network element, as shown in Figure 13, and the method can include the following steps.

S1301. The AUSF network element obtains AMF network element related information from the UDM network element.

The AMF network element related information is used to indicate the AMF network element that provides services for the UE corresponding to the AUSF network element.

In some embodiments, the AUSF network element sends an AMF network element information acquisition request to the UDM network element and receives an AMF network element information acquisition response fed back by the UDM network element. The AMF network element information acquisition request includes the identification of the UE corresponding to the AUSF network element, and the AMF network element information acquisition response is used to indicate the AMF network element that provides services for the UE. The identity of the UE can be a Generic Public Subscription Identifier (GPSI) or a User Permanent Identifier (Subscription Permanent Identifier, SUPI).

S1302. The AUSF network element sends an authentication notification message to the AMF network element.

S1303. The AMF network element sends an authentication request to the UE.

Wherein, the authentication request is used to request the UE to perform the network authentication process.

After receiving the authentication notification message, the AMF network element can send an authentication request to the UE through the Non Access Stratum (NAS) connection between the AMF network element and the UE to request the UE to perform the network authentication process.

After the MF network element receives the authentication communication message carrying the UE's identity, if it is found that there is no NAS connection between the UE and the AMF network element, the 5G core network will page the UE. If the UE is in the registered (RM) -REGISTERED) and CM-IDLE state, the AMF can send a paging message to the UE via the 5G Radio Access Network (NG-RAN) node to create a NAS connection with the UE. If the UE is in the CM-CONNECTED state, it indicates that the NAS connection between the UE and the AMF network element already exists. The AMF network element communicates with the UE through the NAS connection.

S1304. The AMF network element receives the authentication response fed back by the UE.

According to the authentication method of the embodiment of the present disclosure, the AUSF network element obtains the AMF network element related information indicating the AMF network element that provides services for the UE from the UDM network element, and sends an authentication notification message to the AMF network element to notify the AMF network element to perform relevant procedures. In the UE's network authentication process, the AMF network element sends an authentication request to the UE after receiving the authentication notification message from the AUSF network element and obtains an authentication response from the UE that includes the information required for the network authentication process to trigger the network authentication process for the UE. This implements a mechanism for the network side to trigger the network authentication process for the UE, which can greatly improve the continuity and security of network services.

In some embodiments, the authentication notification message sent by the AUSF network element may also include the authentication reason for the authentication notification message sent by the AUSF network element. The authentication reason includes at least one of the following: roaming manipulation count reaches the upper limit; and UE parameter update count The upper limit value is reached.

In some embodiments, the authentication notification message sent by the AUSF network element and the authentication request sent by the AMF network element to the UE may also include access type information. The access type information is used to indicate that the initiated network authentication process is applicable. Access type, the access type includes 3rd Generation Partnership Project (3GPP) access and/or non-3GPP access.

In some embodiments, the authentication notification message includes a confirmation request indication for requesting an authentication notification confirmation message from the AMF network element. The authentication method may also include the AMF network element sending an authentication notification confirmation message to the AUSF network element, wherein the authentication notification confirmation message The message is used to indicate that the AMF network element has requested the UE to perform the network authentication process.

The authentication notification message sent by the AUSF network element may also include a confirmation request indication for requesting an authentication notification confirmation message from the AMF network element. If the authentication notification message includes a confirmation request indication, the AMF network element, after sending the authentication request to the UE, can send an authentication notification confirmation message to the ASUF network element to notify the ASUF network element that the network authentication process for the UE has been triggered. If the AMF network element fails to send an authentication request to the UE, it will not send the authentication notification confirmation message to the AUSF network element. If the AUSF network element fails to receive the authentication notification confirmation message within the preset time period, it can confirm that the UE This triggering of the network authentication process failed to take place.

In some embodiments, the authentication method may also include, after the network authentication process is completed, the AUSF network element generates a new AUSF network element key, and resets the roaming manipulation count and the UE parameter update count.

Figure 14 shows a schematic flowchart of an authentication method according to an embodiment of the present disclosure. This method can be implemented through interaction between UE, AMF network element, AUSF network element, and UDM network element. As shown in Figure 14, the method can include the following steps.

S1401. The AUSF network element sends an AMF network element information acquisition request Nudm_UECM_Get Request to the UDM network element. The request may include the identity of the UE, such as GPSI or SUPI.

S1402. The UDM network element retrieves the UE's subscription data according to the UE's identity to determine the AMF network element that provides services for the UE, and feeds back the AMF network element information acquisition response Nudm_UECM_Get Response to the AUSF network element. The response carries the AMF network element's identity.

S1403. The AUSF network element sends an authentication notification message (for example, Nausf_UECM_AuthenticationNotification) to the AMF network element. The authentication notification message may include SUPI, access type, authentication reason, etc. The certification reason can be that Counter _SoR reaches the upper limit and/or Counter _UPU reaches the upper limit. The access type may indicate whether the authentication process applies to 3GPP access, non-3GPP access, or both.

S1404: Considering that there may be no NAS connection between the UE and the AMF network element, the 5G core network can page the UE. If the UE is in the registered (RM-REGISTERED) and CM idle (CM-IDLE) states, that is, reachable via 3GPP access, the AMF can send a paging message to the UE via the 5G Radio Access Network (NG-RAN) node , to create a NAS connection with the UE. If the UE is in the CM-CONNECTED state, this step can be omitted.

S1405. Once the NAS connection between the UE and the AMF network element has been established, the AMF network element can send an authentication request HN-triggered Authentication Request to the UE. The request can include the access type, and the request can be securely protected via the NAS security context.

S1406. If the AUSF network element has requested authentication notification confirmation from the AMF network element, the AMF network element sends the authentication notification confirmation message Authentication Notification ACK to the AUSF network element.

S1407. The UE feeds back the authentication response HN-triggered Authentication Response to the AMF network element. The response may include information required for the network authentication process, such as the UE's own capability information.

S1408, the Security Anchor Function (SEAF) network element triggers the authentication service by sending the authentication request message Nausf_UEAuthentication_Authenticate Request to the AUSF network element. The message may include SUCI or SUPI, service network name and other information.

S1409, the AUSF network element sends an authentication acquisition request message Nudm_UEAuthentication_Get Request to the UDM network element. The message may include SUPI, service network name and other information. The UDM network element can select an authentication method based on SUPI.

S1410, based on the authentication method selected by the UDM network element, perform the Improved Extensible Authentication Protocol-Authentication and Key Agreement (EAP-AKA’) or 5G-AKA process.

S1411, the AUSF network element generates and stores a new K _AUSF , and uses the authentication result confirmation request Nudm_UEAuthentication_ResultConfirmation Request to notify the UDM network element of the result and time of the network authentication process. In addition, the AUSF network element resets the Counter _SoR and Counter _UPU .

S1412. The UDM network element stores the authentication status information of the UE, including SUPI, an authentication result indicating the authentication result or failure, a timestamp indicating the time when the network authentication process is performed, and the service network name.

S1413. The UDM network element feeds back the authentication result confirmation response Nudm_UEAuthentication_ResultConfirmation Response to the AUSF network element to indicate that the authentication result confirmation request has been received.

In the above embodiments provided by the present application, the methods provided by the embodiments of the present application are introduced from the perspectives of network equipment and user equipment respectively. In order to implement each function in the method provided by the above embodiments of the present application, network equipment and user equipment may include hardware structures and software modules to implement the above functions in the form of hardware structures, software modules, or hardware structures plus software modules. A certain function among the above functions can be executed by a hardware structure, a software module, or a hardware structure plus a software module.

Corresponding to the authentication methods provided by the above-mentioned embodiments, the present disclosure also provides an authentication device. Since the authentication device provided by the embodiments of the present disclosure corresponds to the authentication methods provided by the above-mentioned embodiments, the implementation of the authentication method It is also applicable to the authentication device provided in this embodiment, and will not be described in detail in this embodiment.

Figure 15 is a schematic structural diagram of an authentication device 1500 provided by an embodiment of the present disclosure. The authentication device 1500 can be used in AUSF network elements.

As shown in Figure 15, the device 1500 may include a transceiver module 1501.

The transceiver module 1501 is configured to send an AMF network element information acquisition request to the UDM network element, where the AMF network element information acquisition request includes the identification of the UE corresponding to the AUSF network element; the AMF network that receives feedback from the UDM network element meta information acquisition response, wherein the AMF network element information acquisition response is used to indicate the AMF network element that provides services for the UE; and sends an authentication notification message to the AMF network element, wherein the authentication notification message includes The identity of the UE and the authentication notification message are used to notify the AMF network element to perform a network authentication process on the UE.

According to the authentication device of the embodiment of the present disclosure, the AUSF network element sends an AMF network element information acquisition request to the UDM network element to obtain an AMF network element information acquisition response indicating an AMF network element that provides services for the UE from the UDM network element, and sends the AMF network element information acquisition response to the UDM network element. The AMF network element sends an authentication notification message to notify the AMF network element to perform the network authentication process on the UE, thereby realizing a mechanism for the network side to trigger the network authentication process on the UE, which can greatly improve the continuity and security of network services.

In some embodiments, the authentication notification message also includes access type information. The access type information is used to indicate the access type applicable to the initiated network authentication process. The access type includes third generation cooperation. Partner Program (3rd Generation Partnership Project, 3GPP) access and/or non-3GPP access.

In some embodiments, the authentication notification message also includes the authentication reason for the AUSF network element to send the authentication notification message. The authentication reason includes at least one of the following: roaming manipulation count reaches the upper limit; and UE parameters The update count has reached the upper limit.

In some embodiments, the authentication notification message also includes a confirmation request indication for requesting an authentication notification confirmation message from the AMF network element, and the authentication notification confirmation message is used to indicate that the AMF network element has requested the UE Perform the network authentication process.

In some embodiments, as shown in Figure 16, the device 1500 also includes a processing module 1502, which is configured to generate a new AUSF network element key after confirming that the network authentication process is completed, and perform roaming The manipulation count and UE parameter update count are reset.

Figure 17 is a schematic structural diagram of an authentication device 1700 provided by an embodiment of the present disclosure. The authentication device 1700 can be used for UDM network elements.

As shown in Figure 17, the device 1700 may include a transceiver module 1701.

The transceiver module 1701 is configured to receive an access and mobility management function AMF network element information acquisition request from the AUSF network element, where the AMF network element information acquisition request includes the identification of the UE corresponding to the AUSF network element; and according to the The identity of the UE is fed back to the AUSF network element an AMF network element information acquisition response, where the AMF network element information acquisition response is used to indicate that services are provided for the UE to enable the network authentication process regarding the UE to be performed. AMF network element.

According to the authentication device of the embodiment of the present disclosure, the UDM network element can receive the AMF network element information acquisition request from the AUSF network element and feed back the AMF network element information acquisition response to the AUSF network element indicating the AMF network element that provides services for the UE, Therefore, the AUSF network element can send an authentication notification message to the AMF network element to trigger the network authentication process for the UE. This can implement a mechanism for the network side to trigger the network authentication process for the UE, which can greatly improve the continuity and quality of network services. safety.

Figure 18 is a schematic structural diagram of an authentication device 1800 provided by an embodiment of the present disclosure. The authentication device 1800 can be used for AMF network elements.

As shown in Figure 18, the device 1800 may include a transceiver module 1801.

The transceiver module 1801 is configured to receive an authentication notification message from the authentication server function AUSF network element, where the authentication notification message includes the identity of the UE, and the authentication notification message is used to notify the AMF network element to perform operations related to the UE. The network authentication process; sending an authentication request to the UE through the NAS connection between the AMF network element and the UE, wherein the authentication request is used to request the UE to perform the network authentication process; and receiving The authentication response fed back by the UE, wherein the authentication response includes information required to perform the network authentication process

According to the authentication device of the embodiment of the present disclosure, the AMF network element can receive the authentication notification message from the AUSF network element, send an authentication request to the UE, and obtain an authentication response including the information required for the network authentication process from the UE, so as to trigger the network authentication of the UE. The authentication process enables the network side to trigger the network authentication process for the UE, which can greatly improve the continuity and security of network services.

In some embodiments, the transceiving module 1801 is also configured to send a paging message to the UE to create the NAS connection.

In some embodiments, the authentication notification message also includes a confirmation request indication for requesting an authentication notification confirmation message from the AMF network element, and the transceiver module 1801 is also used to: send the authentication to the AUSF network element. Notification confirmation message, wherein the authentication notification confirmation message is used to indicate that the AMF network element has requested the UE to perform the network authentication process.

In some embodiments, as shown in Figure 19, the device 1800 further includes a processing module 1802, which is configured to perform security protection on the authentication request according to the locally stored NAS security context.

In some embodiments, the processing module 1802 is also configured to update the locally stored NAS security context after the network authentication process is completed.

In some embodiments, the authentication request and the authentication notification message also include access type information. The access type information is used to indicate the access type applicable to the initiated network authentication process. The access type Including 3GPP access and/or non-3GPP access.

Figure 20 is a schematic structural diagram of an authentication device 2000 provided by an embodiment of the present disclosure. The authentication device 2000 can be used for UE.

As shown in Figure 20, the device 2000 may include a transceiver module 2001.

The transceiver module 2001 is configured to receive an authentication request from an AMF network element, where the authentication request is used to request the UE to perform a network authentication process; and to feed back an authentication response to the AMF network element, where the authentication response includes Information required to conduct the network authentication process described.

According to the authentication device of the embodiment of the present disclosure, the UE can receive the authentication request from the AMF network element and feed back the authentication response including the information required for the network authentication process to the AMF network element to trigger the network authentication process for the UE, thereby enabling Implementing a mechanism that triggers the network authentication process for UEs by network equipment can greatly improve the continuity and security of network services.

In some embodiments, the transceiver module 2001 is also configured to: receive a paging message from the AMF network element to create a NAS connection with the AMF network element.

In some embodiments, as shown in Figure 21, the device 2000 further includes a processing module 2002, which is configured to perform security protection on the authentication response according to the locally stored NAS security context.

In some embodiments, the processing module 2002 is also configured to update the locally stored NAS security context after the network authentication process is completed.

In some embodiments, the authentication request includes access type information, the access type information is used to indicate the access type to which the initiated network authentication process is applicable, the access type includes 3GPP access and/or Non-3GPP access.

The embodiment of the present application also provides an authentication system, which includes the AUSF network element described in the embodiment of Figures 15-16, the UDM network element described in the embodiment of Figure 17, and the AMF network described in the embodiment of Figures 18-19 Yuan.

Please refer to Figure 22, which is a schematic structural diagram of a communication device 2200 provided by an embodiment of the present application. The communication device 2200 may be a network device, a user equipment, a chip, a chip system, or a processor that supports network equipment to implement the above method, or a chip, a chip system, or a processor that supports user equipment to implement the above method. Processor etc. The device can be used to implement the method described in the above method embodiment. For details, please refer to the description in the above method embodiment.

Communication device 2200 may include one or more processors 2201. The processor 2201 may be a general-purpose processor or a special-purpose processor, or the like. For example, it can be a baseband processor or a central processing unit. The baseband processor can be used to process communication protocols and communication data. The central processor can be used to control communication devices (such as base stations, baseband chips, terminal equipment, terminal equipment chips, DU or CU, etc.) and execute computer programs. , processing data for computer programs.

Optionally, the communication device 2200 may also include one or more memories 2202, on which a computer program 2204 may be stored. The processor 2201 executes the computer program 2204, so that the communication device 2200 performs the steps described in the above method embodiments. method. Optionally, the memory 2202 may also store data. The communication device 2200 and the memory 2202 can be provided separately or integrated together.

Optionally, the communication device 2200 may also include a transceiver 2205 and an antenna 2206. The transceiver 2205 may be called a transceiver unit, a transceiver, a transceiver circuit, etc., and is used to implement transceiver functions. The transceiver 2205 may include a receiver and a transmitter. The receiver may be called a receiver or a receiving circuit, etc., used to implement the receiving function; the transmitter may be called a transmitter, a transmitting circuit, etc., used to implement the transmitting function.

Optionally, the communication device 2200 may also include one or more interface circuits 2207. The interface circuit 2207 is used to receive code instructions and transmit them to the processor 2201. The processor 2201 executes the code instructions to cause the communication device 2200 to perform the method described in the above method embodiment.

In one implementation, the processor 2201 may include a transceiver for implementing receiving and transmitting functions. For example, the transceiver may be a transceiver circuit, an interface, or an interface circuit. The transceiver circuits, interfaces or interface circuits used to implement the receiving and transmitting functions can be separate or integrated together. The above-mentioned transceiver circuit, interface or interface circuit can be used for reading and writing codes/data, or the above-mentioned transceiver circuit, interface or interface circuit can be used for signal transmission or transfer.

In one implementation, the processor 2201 may store a computer program 2203, and the computer program 2203 runs on the processor 2201, causing the communication device 2200 to perform the method described in the above method embodiment. The computer program 2203 may be solidified in the processor 2201, in which case the processor 2201 may be implemented by hardware.

In one implementation, the communication device 2200 may include a circuit, and the circuit may implement the functions of sending or receiving or communicating in the foregoing method embodiments. The processor and transceiver described in this application can be implemented in integrated circuits (ICs), analog ICs, radio frequency integrated circuits RFICs, mixed signal ICs, application specific integrated circuits (ASICs), printed circuit boards ( printed circuit board (PCB), electronic equipment, etc. The processor and transceiver can also be manufactured using various IC process technologies, such as complementary metal oxide semiconductor (CMOS), n-type metal oxide-semiconductor (NMOS), P-type Metal oxide semiconductor (positive channel metal oxide semiconductor, PMOS), bipolar junction transistor (BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.

The communication device described in the above embodiments may be network equipment or user equipment, but the scope of the communication device described in this application is not limited thereto, and the structure of the communication device may not be limited by FIG. 22 . The communication device may be a stand-alone device or may be part of a larger device. For example, the communication device may be:

(1) Independent integrated circuit IC, or chip, or chip system or subsystem;

(2) A collection of one or more ICs. Optionally, the IC collection may also include storage components for storing data and computer programs;

(3)ASIC, such as modem;

(4) Modules that can be embedded in other devices;

(5) Receivers, terminal equipment, intelligent terminal equipment, cellular phones, wireless equipment, handheld devices, mobile units, vehicle-mounted equipment, network equipment, cloud equipment, artificial intelligence equipment, etc.;

(6) Others, etc.

For the case where the communication device may be a chip or a chip system, refer to the schematic structural diagram of the chip shown in FIG. 23 . The chip shown in Figure 23 includes a processor 2301 and an interface 2302. The number of processors 2301 may be one or more, and the number of interfaces 2302 may be multiple.

Optionally, the chip also includes a memory 2303, which is used to store necessary computer programs and data.

Those skilled in the art can also understand that the various illustrative logical blocks and steps listed in the embodiments of this application can be implemented by electronic hardware, computer software, or a combination of both. Whether such functionality is implemented in hardware or software depends on the specific application and overall system design requirements. Those skilled in the art can use various methods to implement the described functions for each specific application, but such implementation should not be understood as exceeding the protection scope of the embodiments of the present application.

This application also provides a readable storage medium on which instructions are stored. When the instructions are executed by a computer, the functions of any of the above method embodiments are implemented.

This application also provides a computer program product, which, when executed by a computer, implements the functions of any of the above method embodiments.

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs. When the computer program is loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program may be stored in or transferred from one computer-readable storage medium to another, for example, the computer program may be transferred from a website, computer, server, or data center Transmission to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that contains one or more available media integrated. The usable media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., high-density digital video discs (DVD)), or semiconductor media (e.g., solid state disks, SSD)) etc.

Persons of ordinary skill in the art can understand that the first, second, and other numerical numbers involved in this application are only for convenience of description and are not used to limit the scope of the embodiments of this application and also indicate the order.

At least one in this application can also be described as one or more, and the plurality can be two, three, four or more, which is not limited by this application. In the embodiment of this application, for a technical feature, the technical feature is distinguished by "first", "second", "third", "A", "B", "C" and "D", etc. The technical features described in "first", "second", "third", "A", "B", "C" and "D" are in no particular order or order.

As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and/or means for providing machine instructions and/or data to a programmable processor ( For example, magnetic disks, optical disks, memories, programmable logic devices (PLD)), including machine-readable media that receive machine instructions as machine-readable signals. The term "machine-readable signal" refers to any signal used to provide machine instructions and/or data to a programmable processor.

The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., A user's computer having a graphical user interface or web browser through which the user can interact with implementations of the systems and technologies described herein), or including such backend components, middleware components, or any combination of front-end components in a computing system. The components of the system may be interconnected by any form or medium of digital data communication (eg, a communications network). Examples of communication networks include: local area network (LAN), wide area network (WAN), and the Internet.

Computer systems may include clients and servers. Clients and servers are generally remote from each other and typically interact over a communications network. The relationship of client and server is created by computer programs running on corresponding computers and having a client-server relationship with each other.

It should be understood that various forms of the process shown above may be used, with steps reordered, added or deleted. For example, each step described in the present disclosure can be executed in parallel, sequentially, or in a different order. As long as the desired results of the technical solutions disclosed in the present disclosure can be achieved, there is no limitation here.

In addition, it should be understood that the various embodiments described in this application can be implemented alone or in combination with other embodiments if the scheme allows.

Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each specific application, but such implementations should not be considered beyond the scope of this application.

Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be described again here.

The above are only specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any person familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application. should be covered by the protection scope of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claims.

Claims

An authentication method, characterized in that the method is executed by the authentication server function AUSF network element, and the method includes:

Send an access and mobility management function AMF network element information acquisition request to the unified data management UDM network element, where the AMF network element information acquisition request includes the identification of the user equipment UE corresponding to the AUSF network element;

Receive an AMF network element information acquisition response fed back by the UDM network element, wherein the AMF network element information acquisition response is used to indicate the AMF network element that provides services for the UE; and

Send an authentication notification message to the AMF network element, where the authentication notification message includes the identity of the UE, and the authentication notification message is used to notify the AMF network element to perform a network authentication process on the UE.
The method of claim 1, wherein the authentication notification message further includes access type information, and the access type information is used to indicate the applicable access type of the initiated network authentication process. Access types include 3rd Generation Partnership Project 3GPP access and/or non-3GPP access.
The method of claim 1 or 2, wherein the authentication notification message further includes an authentication reason for the AUSF network element to send the authentication notification message, and the authentication reason includes at least one of the following:

The roaming manipulation count reaches the upper limit; and

The UE parameter update count reaches the upper limit.
The method according to any one of claims 1 to 3, wherein the authentication notification message further includes a confirmation request indication for requesting an authentication notification confirmation message from the AMF network element, and the authentication notification confirmation message Used to indicate that the AMF network element has requested the UE to perform the network authentication process.
The method according to any one of claims 1-4, further comprising:

After confirming that the network authentication process is completed, a new AUSF network element key is generated, and the roaming operation count and the UE parameter update count are reset.
An authentication method, characterized in that the method is executed by a unified data management UDM network element, and the method includes:

Receive an access and mobility management function AMF network element information acquisition request from the authentication server function AUSF network element, wherein the AMF network element information acquisition request includes the identification of the user equipment UE corresponding to the AUSF network element; and

Feed back an AMF network element information acquisition response to the AUSF network element according to the identity of the UE, where the AMF network element information acquisition response is used to indicate that services are provided for the UE to enable network authentication for the UE. AMF network element of the process.
An authentication method, characterized in that the method is executed by the access and mobility management function AMF network element, and the method includes:

Receive an authentication notification message from the authentication server function AUSF network element, where the authentication notification message includes the identity of the UE, and the authentication notification message is used to notify the AMF network element to perform a network authentication process on the UE;

Send an authentication request to the UE through the NAS connection between the AMF network element and the UE, where the authentication request is used to request the UE to perform the network authentication process; and

Receive an authentication response fed back by the UE, where the authentication response includes information required to perform the network authentication process.
The method of claim 7, further comprising:

A paging message is sent to the UE to create the NAS connection.
The method according to claim 7 or 8, wherein the authentication notification message further includes a confirmation request indication for requesting an authentication notification confirmation message from the AMF network element, and the method further includes:

Send the authentication notification confirmation message to the AUSF network element, where the authentication notification confirmation message is used to indicate that the AMF network element has requested the UE to perform the network authentication process.
The method according to any one of claims 7-9, further comprising:

The authentication request is securely protected according to the locally stored NAS security context.
The method of claim 10, further comprising:

After the network authentication process is completed, the locally stored NAS security context is updated.
The method according to claims 7-11, characterized in that the authentication request and the authentication notification message also include access type information, the access type information is used to indicate that the initiated network authentication process is applicable. Access type, the access type includes 3GPP access and/or non-3GPP access.
The method according to claims 7-12, wherein the authentication notification message further includes an authentication reason for the AUSF network element to send the authentication notification message, and the authentication reason includes at least one of the following:

The roaming manipulation count reaches the upper limit; and

The UE parameter update count reaches the upper limit.
An authentication method, characterized in that the method is executed by user equipment UE, and the method includes:

Receive an authentication request from the access and mobility management function AMF network element, wherein the authentication request is used to request the UE to perform a network authentication process; and

Feed back an authentication response to the AMF network element, where the authentication response includes information required to perform the network authentication process.
The method of claim 14, further comprising:

Receive a paging message from the AMF network element to create a NAS connection with the AMF network element.
The method of claim 14 or 15, further comprising:

The authentication response is securely protected according to the locally stored NAS security context.
The method of claim 16, further comprising:

After the network authentication process is completed, the locally stored NAS security context is updated.
The method according to claims 14-17, wherein the authentication request includes access type information, and the access type information is used to indicate the access type applicable to the initiated network authentication process, and the access type information is used to indicate the applicable access type of the initiated network authentication process. Access types include 3rd Generation Partnership Project 3GPP access and/or non-3GPP access.
An authentication method, characterized by including:

The authentication server function AUSF network element obtains access and mobility management function AMF network element related information from the unified data management UDM network element, where the AMF network element related information is used to indicate the user corresponding to the AUSF network element The AMF network element provided by the device UE;

The AUSF network element sends an authentication notification message to the AMF network element, where the authentication notification message includes the identity of the UE corresponding to the AUSF network element and is used to notify the AMF network element to perform network operations related to the UE. certification process;

The AMF network element sends an authentication request to the UE, where the authentication request is used to request the UE to perform the network authentication process; and

The AMF network element receives an authentication response fed back by the UE, where the authentication response includes information required to perform the network authentication process.
The method of claim 19, wherein the AUSF network element obtains AMF network element related information from the UDM network element including:

The AUSF network element sends an AMF network element information acquisition request to the UDM network element, where the AMF network element information acquisition request includes the identification of the UE;

Receive an AMF network element information acquisition response fed back by the UDM network element, where the AMF network element information acquisition response includes the AMF network element related information.
The method of claim 19 or 20, wherein the authentication notification message includes a confirmation request indication for requesting an authentication notification confirmation message from the AMF network element, and the method further includes:

The AMF network element sends the authentication notification confirmation message to the AUSF network element, where the authentication notification confirmation message is used to indicate that the AMF network element has requested the UE to perform the network authentication process.
The method according to any one of claims 19-21, further comprising:

After the network authentication process is completed, the AUSF network element generates a new AUSF network element key, and resets the roaming manipulation count and the UE parameter update count.
The method according to any one of claims 19 to 22, characterized in that the authentication notification message and the authentication request also include access type information, and the access type information is used to indicate the initiated network Access types to which the authentication process can be applied, including 3GPP access and/or non-3GPP access.
The method according to any one of claims 19 to 23, wherein the authentication notification message also includes an authentication reason for the AUSF network element to send the authentication notification message, and the authentication reason includes at least one of the following: kind:

The roaming manipulation count reaches the upper limit; and

The UE parameter update count reaches the upper limit.
An authentication device, characterized in that it is used to authenticate the server function AUSF network element, including a transceiver module, and the transceiver module is used for:

Send an access and mobility management function AMF network element information acquisition request to the unified data management UDM network element, where the AMF network element information acquisition request includes the identification of the user equipment UE corresponding to the AUSF network element;

Receive an AMF network element information acquisition response fed back by the UDM network element, wherein the AMF network element information acquisition response is used to indicate the AMF network element that provides services for the UE; and

Send an authentication notification message to the AMF network element, where the authentication notification message includes the identity of the UE, and the authentication notification message is used to notify the AMF network element to perform a network authentication process on the UE.
An authentication device, characterized in that it is used for unified data management UDM network elements, including a transceiver module, and the transceiver module is used for:

Receive an access and mobility management function AMF network element information acquisition request from the authentication server function AUSF network element, wherein the AMF network element information acquisition request includes the identification of the user equipment UE corresponding to the AUSF network element; and

Feed back an AMF network element information acquisition response to the AUSF network element according to the identity of the UE, where the AMF network element information acquisition response is used to indicate that services are provided for the UE to enable network authentication for the UE. AMF network element of the process.
An authentication device, characterized in that it is used for access and mobility management function AMF network elements, including a transceiver module, and the transceiver module is used for:

Receive an authentication notification message from the authentication server function AUSF network element, wherein the authentication notification message includes the identity of the user equipment UE, and the authentication notification message is used to notify the AMF network element to perform network authentication on the UE process;

Send an authentication request to the UE through the NAS connection between the AMF network element and the UE, where the authentication request is used to request the UE to perform the network authentication process; and

Receive an authentication response fed back by the UE, where the authentication response includes information required to perform the network authentication process.
An authentication device, characterized in that it is used for user equipment UE and includes a transceiver module, and the transceiver module is used for:

Receive an authentication request from the access and mobility management function AMF network element, wherein the authentication request is used to request the UE to perform a network authentication process; and

Feed back an authentication response to the AMF network element, where the authentication response includes information required to perform the network authentication process.
An authentication system including an authentication server function AUSF network element, a unified data management UDM network element, and an access and mobility management function AMF network element, wherein,

The AUSF network element is configured to obtain, from the UDM network element, AMF network element related information indicating an AMF network element that provides services for the UE corresponding to the AUSF network element, and send an authentication notification to the AMF network element. message, wherein the authentication notification message is used to notify the AMF network element to perform a network authentication process on the UE;

The UDM network element is configured to receive an AMF network element information acquisition request sent from the AUSF network element, and to feed back the AMF network element related information to the AUSF network element in response to the AMF network element information acquisition request, wherein , the AMF network element information acquisition request includes the identification of the UE corresponding to the AUSF network element;

The AMF network element sends an authentication request to the UE and receives an authentication response from the UE, where the authentication request is used to request the UE to perform the network authentication process and the authentication response includes the steps required to perform the network authentication process. Need information.
A communication device, which includes: a transceiver; a memory; and a processor, respectively connected to the transceiver and the memory, and configured to control the wireless operation of the transceiver by executing computer-executable instructions on the memory. Transmit and receive signals, and can implement the method described in any one of claims 1-18.
A computer storage medium, wherein the computer storage medium stores computer-executable instructions; after the computer-executable instructions are executed by a processor, the method described in any one of claims 1-18 can be implemented.