WO2023213184A1 - 一种通信方法及通信装置 - Google Patents

一种通信方法及通信装置 Download PDF

Info

Publication number
WO2023213184A1
WO2023213184A1 PCT/CN2023/088762 CN2023088762W WO2023213184A1 WO 2023213184 A1 WO2023213184 A1 WO 2023213184A1 CN 2023088762 W CN2023088762 W CN 2023088762W WO 2023213184 A1 WO2023213184 A1 WO 2023213184A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
authentication
authentication information
information
iops
Prior art date
Application number
PCT/CN2023/088762
Other languages
English (en)
French (fr)
Inventor
雷骜
吴义壮
崔洋
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023213184A1 publication Critical patent/WO2023213184A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0055—Transmission or use of information for re-establishing the radio link
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery

Definitions

  • the embodiments of the present application relate to the field of communication technology, and in particular, to a communication method and a communication device.
  • Isolated e-utran operation for public safety (IOPS) technology is introduced into the long term evolution (LTE) system in the 3rd generation mobile communications partnership project (3GPP) R13 version.
  • LTE long term evolution
  • 3GPP 3rd generation mobile communications partnership project
  • the UE When the UE performs primary authentication with the macro network and the IOPS network, it needs to use different international mobile subscriber identity (IMSI) and different root keys when signing with the macro network. That is, the macro network core network will only store the IMSI and root key used when the UE performs primary authentication with the macro network, and the IOPS core network will only store the IMSI and root key used when the UE performs primary authentication with the IOPS network.
  • IMSI international mobile subscriber identity
  • the UE When performing IOPS access authentication, the UE selects the IOPS key on the UE side by switching the USIM app of the macro network to the IOPS USIM app. After the UE side key is switched to the IOPS app, the key in the IOPS app is used. , to achieve subsequent access authentication with the IOPS network. If you need to implement USIM app switching on the UE, there are two optional implementation methods:
  • Method 1 Use a single UICC card to implement the dual USIM app function, that is, install two USIM apps on the same UICC, one serving macro network access and the other dedicated to IOPS network access.
  • the UE needs to switch to the USIM app, it instructs the UICC to activate the corresponding USIM app.
  • Method 2 Use different UICC cards to implement the dual USIM app function, that is, install the USIM app for macro network access on one UICC card, and install the USIM app for IOPS network access on the other UICC card.
  • This application provides a communication method and communication device to reduce the complexity of terminal equipment accessing different networks and improve data processing efficiency.
  • this application provides a communication method, including:
  • the terminal device determines the second authentication information used for access authentication with the second network based on the first authentication information used for access authentication with the first network; the first network is different from the second network; the terminal device receives the second authentication information from the second network. After the authentication request is made, access authentication is performed with the second network based on the second authentication information.
  • the terminal device determines the second authentication information used by the terminal device to perform access authentication with the second network based on the first authentication information used by the terminal device to perform access authentication with the first network. It can be understood that the terminal device refers to the first authentication information. Determine the second authentication information, or obtain the second authentication information based on certain parameters in the first authentication information. This application does not limit how to determine the second authentication information.
  • the first network and the second network are two different networks. Usually, if a terminal can access two networks, it needs to be pre-configured by the operators of the two networks with two different sets of authentication information to access the corresponding networks. Authentication, but in this application, the terminal device can determine the authentication information of another network based on the authentication information of a certain network.
  • the terminal device when the terminal device receives instruction information from the first network for instructing the terminal device to generate second authentication information, the terminal device determines the second authentication information according to accessing the first authentication information; and/ Or, when the terminal device has the ability to access the second network, the second authentication information is determined based on the first authentication information; and/or the terminal device receives the identification information of the second network and determines the method for establishing a connection with the second network. In this case, the second authentication information is determined based on the first authentication information.
  • the terminal device can trigger and determine the second authentication information based on the instruction information of the first network. It can also determine the second authentication information when it is determined that it has the ability to access the second network. It can also determine the second authentication information after receiving the third network. The identification information of the second network.
  • the second authentication information may be determined by a combination of the above three methods. This application is not specifically limited here and can be flexibly determined according to actual needs. Through this In this way, the terminal device can clearly know the timing of determining the second authentication information instead of predetermining the second authentication information, which can ensure the timeliness and reliability of data processing.
  • the fact that the terminal device has the ability to access the second network can be understood as the terminal device supports establishing a connection with the second network, or the terminal device can establish a link with the second network.
  • the terminal device supports establishing a connection with the second network.
  • the terminal device can determine based on internal information. For example, it obtains an indication of supporting the second network from the user identity recognition module, or obtains the contract information of the second network from the user identity recognition module. It may be that the terminal device is pre-configured with capability information to support the second network.
  • the terminal device includes: a mobile device and a user identity recognition module.
  • the mobile device instructs the user identity recognition module to determine the second authentication information based on the first authentication information; the user identity recognition module determines the second authentication information based on the first authentication information. Determine the second authentication information.
  • the second authentication information is determined through the cooperation between the mobile device and the user identity recognition module, which is more suitable for the needs of terminal devices such as mobile phones in actual production and life.
  • the mobile device can directly instruct the user identity recognition module through the instruction information so that the user identity identification module can determine the second authentication information. It can also provide instructions through the instruction information of the context information of the second network, or through other methods. This application is not specifically limited here.
  • the mobile device instructs the user identity recognition module to obtain the second authentication information through the indication information of the context information of the second network.
  • the mobile device can use the instruction information of the context information of the second network to instruct the user identity recognition module to use the context information of the second network for access authentication, and at the same time use the context information of the second network to instruct the user identity recognition module to determine The second authentication information can save signaling.
  • the mobile device after the mobile device receives the authentication request from the second network, the mobile device sends the indication information of the context information of the second network to the user identity recognition module; the user identity recognition module determines the context information of the second network according to the context of the second network.
  • the indication information of the information determines the second authentication information in the context of the second network; the user identity recognition module adopts Use the second authentication information to perform access authentication with the second network.
  • the second authentication information in the context of the second network is determined through the indication information of the context information of the second network, and access authentication with the second network is performed based on the second authentication information, which can improve data processing efficiency.
  • the first authentication information and the second authentication information are stored in the user identity recognition module.
  • both the first authentication information and the second authentication information are stored in the user identity recognition module.
  • the terminal device does not need to set up two UICC cards, nor does it need to deploy two different apps, which can reduce the processing complexity of the terminal device.
  • the user identity recognition module requests the first authentication information from the mobile device; the user identity recognition module determines the second authentication information based on the first authentication information, and uses the second authentication information to access the second network. Certification.
  • the mobile device After receiving the user identity recognition module and requesting the first authentication information, the mobile device determines the second authentication information, which can ensure data processing efficiency.
  • the authentication request of the second network includes: indication information of the second network, and the terminal device performs access authentication with the second network based on the indication information of the second network and the second authentication information.
  • the terminal device performs access authentication with the second network based on the indication information of the second network and the second authentication information in the authentication request of the second network, which can improve data processing efficiency.
  • the terminal device uses the first authentication information as an input parameter of the key derivation function to generate the second authentication information.
  • the key derivation function may be the key derivation function (KDF) function in the existing standard.
  • the terminal device may use the first authentication information as an input parameter of the key derivation function, and use the output of the key derivation function as the second authentication information.
  • KDF key derivation function
  • the second authentication information derived in this way can adapt to the needs of the two networks, avoiding the use of two different sets of authentication information and different networks for access authentication, which can improve data processing efficiency.
  • the first authentication information includes one or more of the following: confidentiality key CK, integrity key IK, sequence number (SQN), AUSF key K AUSF , SEAF Key K SEAF , AMF key K AMF .
  • Including the above parameters in the first authentication information can ensure that the terminal device can deduce the second authentication information.
  • the first network is an IOPS network or a private network
  • the second network is a macro network
  • the first network is a macro network
  • the second network is an IOPS network or a private network
  • embodiments of the present application provide a communication device, which may be a terminal device or a chip provided inside the terminal device.
  • the communication device has the function of implementing any one of the above-mentioned first aspects.
  • the communication device includes a module or unit or means corresponding to executing the steps involved in any one of the above-mentioned first aspects.
  • the function Either unit or means can be implemented by software, or implemented by hardware, or can be implemented by hardware executing corresponding software.
  • the communication device includes a processing unit and a transceiver unit, where the transceiver unit can be used to send and receive signals to achieve communication between the communication device and other devices.
  • the transceiver unit is used to receive signals from Configuration information of the terminal device; the processing unit can be used to perform some internal operations of the communication device.
  • the transceiver unit may be called an input-output unit, a communication unit, etc., the transceiver unit may be a transceiver, and the processing unit may be a processor.
  • the transceiver unit may be an input-output interface, an input-output circuit, or an input-output pin, etc., and may also be called an interface, a communication interface, or an interface circuit, etc.;
  • the processing unit may be a processor, a processing circuit or a logic circuit, etc.
  • the communication device includes a processor and may also include a transceiver, and the transceiver For sending and receiving signals, the processor executes program instructions to complete the method in any possible design or implementation manner in the first aspect.
  • the communication device may further include one or more memories, the memory being used to couple with the processor, and the memory may store necessary computer programs or instructions to implement the functions involved in any of the above-mentioned first aspects.
  • the processor can execute the computer program or instructions stored in the memory. When the computer program or instructions are executed, the communication device implements the method in any possible design or implementation of the first aspect.
  • the communication device includes a processor, which may be coupled to a memory.
  • the memory may store necessary computer programs or instructions to implement the functions involved in any of the above first aspects.
  • the processor can execute the computer program or instructions stored in the memory. When the computer program or instructions are executed, the communication device implements any of the possible designs or implementations of the first to third aspects. method.
  • the communication device includes a processor and an interface circuit, wherein the processor is configured to communicate with other devices through the interface circuit and perform any of the possible designs or implementations of the first aspect. method.
  • the processor can be implemented by hardware or software.
  • the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be implemented by software.
  • the processor may be a general-purpose processor implemented by reading software code stored in memory.
  • the above processors may be one or more, and the memories may be one or more.
  • the memory can be integrated with the processor, or the memory can be provided separately from the processor. During the specific implementation process, the memory and the processor can be integrated on the same chip, or they can be respectively provided on different chips. The embodiments of this application do not limit the type of memory and the arrangement method of the memory and the processor.
  • embodiments of the present application provide a communication system, which includes the terminal device in the first aspect.
  • the present application provides a chip system, which includes a processor and may also include a memory, for implementing the method described in any of the possible designs in the first aspect.
  • the chip system can be composed of chips or include chips and other discrete devices.
  • this application also provides a computer-readable storage medium.
  • Computer-readable instructions are stored in the computer-readable storage medium.
  • the computer-readable instructions When the computer-readable instructions are run on a computer, the computer executes any of the steps in the first aspect.
  • One possible design approach One possible design approach.
  • the present application provides a computer program product containing instructions that, when run on a computer, cause the computer to execute the methods of each embodiment of the first aspect.
  • Figure 1 shows a schematic diagram of a communication system provided by an embodiment of the present application
  • Figure 2A shows a schematic diagram of an application scenario
  • Figure 2B shows a schematic diagram of another application scenario
  • Figure 3 shows a schematic flow chart of UE switching from macro network to IOPS network
  • Figure 4 shows a schematic flowchart of a communication method provided by an embodiment of the present application
  • Figure 5A shows a schematic flowchart of another communication method provided by an embodiment of the present application.
  • Figure 5B shows a schematic flowchart of another communication method provided by an embodiment of the present application.
  • Figure 6 shows a schematic flowchart of another communication method provided by an embodiment of the present application.
  • Figure 7 shows a schematic flowchart of another communication method provided by an embodiment of the present application.
  • Figure 8A shows a schematic flowchart of another communication method provided by an embodiment of the present application.
  • Figure 8B shows a schematic flowchart of another communication method provided by an embodiment of the present application.
  • Figure 9 shows a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • Figure 10 shows a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • Figure 11 shows a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • Figure 1 exemplarily shows a schematic diagram of a mobile communication network architecture.
  • the network architecture includes terminal equipment, access network equipment, access and mobility management functions, session management functions, user plane functions, policy control functions, and network slice selection. Functions, network slice specific authentication and authorization functions, network warehouse functions, network data analysis functions, unified data management functions, unified data storage functions, authentication service functions, network capability opening functions, terminal wireless capability management functions, binding support functions, application functions, and the data network (DN) connecting the operator's network.
  • the terminal device can access the wireless network through the access node at the current location.
  • the terminal device can send service data to the data network through access network equipment and user plane functions, and receive service data from the data network.
  • Access and mobility management functions are mainly used for the attachment of terminal devices in mobile networks, mobility management, tracking area update processes, etc.
  • the access and mobility management function can be the access and mobility management function (AMF).
  • AMF access and mobility management function
  • future communication systems such as 6G communication systems
  • the access and mobility management function It can still be AMF, or it can also have other names, which is not limited by this application.
  • the session management function is mainly used for session management in mobile networks, such as session establishment, modification, and release. Specific functions include assigning Internet protocol addresses to terminal devices and selecting user plane functions that provide packet forwarding functions.
  • the session management function can be a session management function (SMF).
  • SMF session management function
  • the session management function can still be an SMF, or it can have other names. This application is not limited.
  • the user plane function is mainly used to process user messages, such as forwarding and accounting.
  • the user plane function can be user plane function (UPF).
  • UPF user plane function
  • future communication systems such as 6G communication system
  • the user plane function can still be UPF, or it can have other names. This application is not limited.
  • Policy control function including policy control function, billing policy control function, quality of service (QoS) control, etc.
  • the policy control function can be a policy control function (PCF).
  • PCF policy control function
  • the policy control function can still be a PCF, or it can have other names. This application is not limited.
  • the network slice selection function is mainly used to select appropriate network slices for the services of terminal devices.
  • the network slice selection function can be the network slice selection function (NSSF).
  • the network slice selection function can still be the NSSF, or it can With other names, this application is not limited.
  • NSSAAF Network slice-specific authentication and authorization function
  • the network warehouse function is mainly used to provide registration and discovery of network functions or services provided by network functions.
  • the network repository function can be a network repository function (NRF).
  • NRF network repository function
  • the network repository function can still be an NRF, or it can have other names. This application is not limited.
  • the network data analysis function can collect data from various network functions, such as policy control function, session management function, user plane function, access management function, and application function (through the network capability opening function), and conduct analysis and prediction.
  • the network data analysis function can be network data analysis function (NWDAF).
  • NWDAF network data analysis function
  • the unified data management function is mainly used to manage the contract information of terminal devices.
  • the unified data management function can be a unified data management (UDM) function.
  • the unified data management function can still be a UDM function, or it can With other names, this application is not limited.
  • the unified data storage function is mainly used to store structured data information, including contract information, policy information, and network data or business data defined in standard formats.
  • the unified data storage function can be the unified data storage (unified data repository, UDR) function.
  • UDR unified data repository
  • future communication systems such as 6G communication systems
  • the unified data storage function can still be the UDR function, or it can With other names, this application is not limited.
  • the authentication service function is mainly used for security authentication of terminal equipment.
  • the authentication service function can be the authentication server function (AUSF).
  • the authentication service function can still be the AUSF, or it can have other names. , this application is not limited.
  • the network capability exposure function can controlly expose some network functions to applications.
  • the network capability opening function may be NEF.
  • future communication systems such as 6G communication systems
  • the network capability opening function may still be NEF, or may have other names, which is not limited by this application.
  • the terminal wireless capability management function is used to store and manage the wireless capabilities of terminal devices in the network.
  • the terminal radio capability management function can be the terminal radio capability management function (UE radio capability management function, UCMF).
  • UE radio capability management function UE radio capability management function
  • the terminal radio capability management function can still be the UCMF. , or it may also have other names, which is not limited by this application.
  • the binding support function is used to maintain the correspondence between the Internet Protocol (IP) addresses and service functions of the interconnection between user networks.
  • IP Internet Protocol
  • the binding support function may be the binding support function (BSF).
  • BSF binding support function
  • future communication systems such as 6G communication systems
  • the binding support function may still be the BSF, or it may have Other names are not limited by this application.
  • the application function can provide service data of various applications to the control plane function of the operator's communication network, or obtain network data information and control information from the control plane function of the communication network.
  • the application function may be an application function (AF).
  • AF application function
  • the application function may still be an AF, or may have other names. This application does not limited.
  • Data network is mainly used to provide data transmission services for terminal devices.
  • the data network can be a private network such as a central office
  • a domain network can also be a public data network (PDN), such as the Internet, or a private network deployed by an operator, such as a configured IP multimedia core network subsystem (IP multimedia core network subsystem). IMS) service.
  • PDN public data network
  • IMS IP multimedia core network subsystem
  • the terminal that is, terminal equipment
  • the terminal is an entity on the user side that is used to receive or transmit signals, and is used to send uplink signals to network equipment or receive downlink signals from network equipment.
  • Including devices that provide voice and/or data connectivity to users which may include, for example, UEs, handheld devices with wireless connectivity capabilities, or processing devices connected to wireless modems.
  • the terminal device can communicate with the core network via the radio access network (RAN) and exchange voice and/or data with the RAN.
  • RAN radio access network
  • the terminal equipment may include UE, vehicle wireless communication technology (vehicle to X, V2X) terminal equipment, wireless terminal equipment, mobile terminal equipment, device-to-device communication (device-to-device, D2D) terminal equipment, machine-to-machine/ Machine-to-machine/machine-type communications (M2M/MTC) terminal equipment, IoT terminal equipment, subscriber unit (subscriber unit), subscriber station (subscriber station), mobile station (mobile station), remote station ( remote station), AP, remote terminal, access terminal, user terminal, user agent, or user device, wearable device, vehicle-mounted device, Drones, etc.
  • vehicle wireless communication technology vehicle to X, V2X
  • V2X vehicle to X
  • D2D device-to-device communication
  • M2M/MTC machine-to-machine/ Machine-to-machine/machine-type communications
  • IoT terminal equipment subscriber unit (subscriber unit), subscriber station (subscriber station), mobile station (mobile station), remote station
  • the terminal device may also be a wearable device.
  • Wearable devices can also be called wearable smart devices or smart wearable devices. It is a general term for applying wearable technology to intelligently design daily wear and develop wearable devices, such as glasses, gloves, watches, clothing and shoes. wait.
  • a wearable device is a portable device that is worn directly on the body or integrated into the user's clothing or accessories. Wearable devices are not just hardware devices, but also achieve powerful functions through software support, data interaction, and cloud interaction.
  • wearable smart devices include full-featured, large-sized devices that can achieve complete or partial functions without relying on smartphones, such as smart watches or smart glasses, and those that only focus on a certain type of application function and need to cooperate with other devices such as smartphones. Used, such as various smart bracelets, smart helmets, smart jewelry, etc. for physical sign monitoring.
  • the functions in the embodiments of this application may also be called network elements, network functions or functional entities, devices, etc.
  • the access and mobility management functions may also be called access and mobility management network elements, or access and mobility management network functions, or access and mobility management functional entities, etc.
  • the names of each function are not limited in this application. Those skilled in the art can replace the names of the above functions with other names to perform the same function, which all fall within the scope of protection of this application.
  • FIG. 2A shows a schematic diagram of an application scenario provided by this application.
  • This scenario takes an IOPS network and a macro network as an example. Of course, in actual applications, it can also be a private network and a macro network.
  • This application does not specifically limit it.
  • the terminal device is in Provides communication services to public safety users through LTE access network equipment with IOPS function (IOPS-capable eNB) without backhaul communication.
  • IOPS-capable eNB LTE access network equipment with IOPS function
  • There is no backhaul communication that is, the link between the access network equipment and the LTE macro network core network (macro EPC) is interrupted. In the event of disasters such as earthquakes or failure of backhaul optical fiber, the backhaul communication is interrupted.
  • the LTE access network equipment with IOPS function (IOPS-capable eNodeBs) establishes a backhaul connection with the IOPS network, forming a network that can be used for Provides a locally connected IOPS network (IOPS network).
  • the terminal device receives communication services in IOPS mode (IOPS mode) through the IOPS network to ensure reliable transmission of data.
  • LTE access network equipment (IOPS-Incapable eNodeBs) without IOPS functionality cannot establish a backhaul connection to the IOPS network.
  • FIG. 2B shows a schematic diagram of another application scenario provided by this application.
  • This scenario takes an IOPS network as an example. Of course, it can also be a private network in actual application. This application does not specifically limit it. If there is no IOPS-capable eNB, it is a public security When users provide communication services (that is, No infrastructure), when eNodeB is deployed (eNodeB Deployed), access network equipment (Nomadlc eNodeB) with IOPS function is used (the access network equipment is removable and similar to user Prepare a small access network device) to establish a backhaul connection with the IOPS network, forming a system that can be used to provide local The connected IOPS core network (Local EPC) forms an IOPS network (IOPS network) that can be used to provide local connections.
  • IOPS network IOPS network
  • IOPS scenarios in the existing LTE TS 23.401 and TS 33.401 mainly focuses on the process of UE switching from macro network access to IOPS network access.
  • LTE has the following basic assumptions for IOPS scenarios:
  • the RAN node supports both macro network and IOPS.
  • the RAN node has IOPS.
  • Functional eNB node IOPS-capable eNB
  • IOPS-capable eNB is connected to both macro network EPC and L-EPC.
  • the IOPS mode has an exclusive identifier, such as a public land mobile network identifier (PLMN ID). All L-EPCs of the same public safety agency/operator have the same PLMN ID.
  • PLMN ID public land mobile network identifier
  • the IOPS-capable eNB will broadcast the PLMN ID corresponding to the IOPS to assist UEs that support the IOPS mode to access the IOPS mode.
  • L-EPC The main function of L-EPC is to provide routing functions for communication between IOPS-enabled UEs.
  • IOPS-enabled UE has two UMTS user identity module applications (universal mobile telecommunications system subscriber identity module application, USIM app).
  • the two USIM apps correspond to IOPS mode and normal mode respectively.
  • the USIM app of IOPS has the root key K, PLMN ID and International Mobile Subscriber Identity (IMSI) dedicated to IOPS PLMN.
  • IMSI International Mobile Subscriber Identity
  • Step 1 The UE accesses the macro network EPC and performs communication services.
  • Step 2 The eNB detects that the backhaul link with the macro network is disconnected. This eNB is IOPS-capable. The eNB will not be described in details below.
  • eNB activates the IOPS mode based on the operator's local policy decision.
  • Step 3 After L-EPC is activated, the eNB establishes a backhaul link with L-EPC.
  • Step 4 After eNB establishes the backhaul link with L-EPC, it broadcasts the PLMN ID of the IOPS network.
  • Step 5 The UE detects the IOPS PLMN ID broadcast and activates the IOPS-specific USIM app.
  • Step 6 The UE determines that it needs to access the corresponding L-EPC based on the IOPS PLMN ID, and conducts the access process (including access authentication) and session establishment with the L-EPC.
  • Step 7 The UE and L-EPC execute the access process (attach process) and establish a local protocol data network (packet data network, PDN) link.
  • attach process attach process
  • PDN packet data network
  • Step 8 The UE accesses L-EPC and performs communication services.
  • the UE when the UE performs primary authentication with the macro network and the IOPS network, it needs to use different IMSIs and different root keys when contracting with the macro network. That is, the macro network core network will only store the IMSI and root key used when the UE performs primary authentication with the macro network, and the IOPS core network will only store the IMSI and root key used when the UE performs primary authentication with the IOPS network. UE When performing primary authentication with different networks, enable the corresponding IMSI and root key. This method is complex to operate.
  • UE consists of mobile equipment (mobile equipment, ME) and user identity module (USIM app).
  • USIM app is used to store the root key information required for authentication between the user and the network side.
  • a ME device can only be considered a UE if it accesses the network using the information in the USIM app (IMSI and root key).
  • ME is the hardware device of the terminal, such as a mobile phone.
  • the universal integrated circuit card (UICC) is the hardware carrier of the USIM app. Both UICC and USIM app are provided by UICC card suppliers. The information in the USIM app is provided by the operator and written into the USIM app by the UICC supplier.
  • the UE After detecting the IOPS PLMN ID broadcast, the UE needs to activate the USIM app dedicated to IOPS mode.
  • the USIM app includes the root key K used to perform access authentication.
  • the USIM app of IOPS has the root key K, PLMN ID and IMSI dedicated to the IOPS PLMN.
  • the UE selects the IOPS key on the UE side by switching the USIM app of the macro network to the IOPS USIM app. After the UE side key is switched to the IOPS app, the secret key in the IOPS app is used. key to achieve subsequent access authentication with the IOPS network. This method is complex to operate.
  • FIG. 4 is a schematic diagram of a communication method provided by an embodiment of the present application. This method can be executed by a terminal device and is executed as follows:
  • Step 401 The terminal device determines the second authentication information used for access authentication with the second network based on the first authentication information used for access authentication with the first network; the first network is different from the second network.
  • the terminal device described in step 401 can be a terminal device that does not have a USIM app, that is, there is no USIM app in the terminal device or there is no functional module that carries the USIM app, such as positioning tags, Internet of Things devices, etc. , it can also be a terminal device that is set up with USIM app, that is, there is USIM app in the terminal device or there is no functional module carrying USIM app, such as a mobile phone, etc. This application does not specifically limit the type of terminal device here.
  • the first network and the second network may be mutually isolated networks.
  • the first network may be an IOPS network or a private network, and the second network may be a macro network; or the first network may be a macro network, and the second network may be an IOPS network or the private network.
  • the first network may be an IOPS network
  • the second network is a macro network; the first network is a private network (such as a campus network, a campus network, etc.), and the second network is a macro network; the first network is a macro network, and the second network is an IOPS network; the first network is a macro network. network, the second network is a private network, etc. This application is not specifically limited here.
  • the access authentication between the terminal device and the first network can be understood as the main authentication between the terminal device and the first network.
  • the main authentication between the terminal device and the first network is used to authenticate each other's identities between the terminal device and the first network.
  • the terminal can proceed with the subsequent registration process and session establishment process with the first network.
  • the first network is a macro network
  • this represents the primary authentication between the terminal device and the macro network
  • the first network is an IOPS network
  • the access authentication between the terminal device and the second network can be understood as the main authentication between the terminal device and the second network.
  • the main authentication between the terminal device and the second network is used to authenticate each other's identities between the terminal device and the second network. Only in the main After passing the authentication, the terminal can proceed with the subsequent registration process and session establishment process with the second network. Assuming that the second network is an IOPS network, this represents the primary authentication between the terminal device and the IOPS network; assuming that the second network is a macro network, this represents the primary authentication between the terminal device and the macro network. This application does not describe how to perform the main authentication process here. It can be understood with reference to the existing technology.
  • the terminal device determines the second authentication information used by the terminal device to perform access authentication with the second network based on the first authentication information used by the terminal device to perform access authentication with the first network. It can be understood that the terminal device determines the second authentication information with reference to the first authentication information. Second authentication information, or deducing the second authentication information based on certain parameters in the first authentication information. This application does not limit how to determine the second authentication information.
  • the first network is a macro network and the second network is an IOPS network.
  • the terminal device can determine the second authentication information of the terminal device and the IOPS network based on the first authentication information of the terminal device and the macro network; the first network is the IOPS network, the second network is the macro network, and the terminal device can determine the second authentication information of the terminal device and the IOPS network based on the terminal device and the IOPS network.
  • the first authentication information determines the second authentication information between the terminal device and the macro network, which is not specifically limited in this application.
  • the terminal device uses the first authentication information as an input parameter to generate the second authentication information.
  • the terminal device uses the first authentication information as an input parameter of a key derivation function (KDF), and uses the output of the key derivation function as the second authentication information, where the key derivation function can be an existing standard KDF function in .
  • KDF key derivation function
  • the second authentication information derived in this way can adapt to the needs of two network access authentications, avoiding the use of two different sets of authentication information and different networks for access authentication, which can improve data processing efficiency.
  • the first authentication information includes one or more of the following: CK, IK, SQN, K AUSF , K SEAF , KAMF .
  • the terminal device obtains the second authentication information based on the key derivation generated by the first network primary authentication of the terminal device.
  • the second authentication information may be further deduced based on the CK and IK generated by the first network and the UE in the primary authentication process.
  • the derivation method is as follows :
  • K AUSF K SEAF and KAMF generated by the first network and UE in the main authentication process.
  • the first UDM needs to obtain K AUSF from AUSF, SEAF or AMF first. , K SEAF and K AMF and then further generate the first authentication information.
  • the deduction method is as follows:
  • KDF Key derivation function
  • the deduction method is not limited.
  • One of the above deduction methods can be used for deduction, and other deduction methods can also be used for deduction, such as the terminal device and the first network agreeing on deduction rules for deduction, etc. This application is in This is not specifically limited.
  • the terminal device determines the second authentication information based on the first authentication information, which may be triggered by the following trigger conditions, specifically as follows:
  • Condition 1 When the terminal device receives instruction information from the first network for instructing the terminal device to generate second authentication information, the terminal device determines the second authentication information based on accessing the first authentication information.
  • the indication information may be information independently indicated by the first network, that is, the indication information is only used to instruct the terminal device to generate the second authentication letter, wherein the form of the independent indication information may be using a dedicated message.
  • dedicated indication information can also be used; the indication information can also be carried by the first network through other information, that is, the indication information is carried in other information. In this way, signaling can be saved. Which method is used specifically? This application does not specifically limit the instructions in this way.
  • the second authentication information is determined based on the first authentication information.
  • the terminal device's ability to access the second network can be understood as the terminal device supporting the establishment of a connection with the IOPS network. If the terminal device determines that it supports the establishment of a connection with the IOPS network, it can The second authentication information is determined directly based on the first authentication information. It should be noted that the terminal device supports establishing a connection with the IOPS network. This can be determined by the terminal device based on internal information, such as obtaining an instruction to support the IOPS network from the USIM app, or obtaining the contract information of the IOPS network from the USIM app, or it can be The mobile device is pre-configured with capability information to support the IOPS network.
  • Condition 3 When the terminal device receives the identification information of the second network and determines to establish a connection with the second network, it determines the second authentication information based on the first authentication information.
  • the terminal device may receive a broadcast message from an access network device that supports providing services for the second network.
  • the message includes the identifier of the second network.
  • the broadcast identifier is PLMN1.
  • the terminal device determines that it can communicate with the second network.
  • the second authentication information can be directly determined based on the first authentication information.
  • the terminal device determines that it can establish a connection with the second network corresponding to the identifier of the second network. Specifically, the terminal device determines that it needs to access the second network based on the identifier of the second network.
  • the terminal device may receive the trigger of any of the above trigger conditions, or may receive the trigger of multiple of the above trigger conditions.
  • the terminal device receives the condition 1 and the condition at the same time. 2; the terminal device receives the trigger of condition 1 and condition 3 at the same time; the terminal device receives the trigger of condition 1, condition 2 and condition 3 at the same time.
  • This application is only described as an example and is not specifically limited.
  • the terminal device can trigger and determine the second authentication information based on the instruction information of the first network. It can also determine the second authentication information when it is determined that it has the ability to access the second network. It can also determine the second authentication information after receiving the third network.
  • the identification information of the second network when it is determined to establish a connection with the second network, the second authentication information may also be a combination of the above three situations.
  • This application is not specifically limited here, and can be flexibly determined according to actual needs. Through this In this way, the terminal device can clearly know the timing of determining the second authentication information instead of predetermining the second authentication information, which can ensure the timeliness and reliability of data processing.
  • Step 402 After receiving the authentication request from the second network, the terminal device performs access authentication with the second network based on the second authentication information.
  • all or part of the second authentication information may be used as the root key required for the terminal device to perform primary authentication with the second network, or the terminal device may be used.
  • the root key and second authentication information required for primary authentication with the second network further obtain the authentication information sent to the second network in the primary authentication process, such as XMAC and/or RES information.
  • the first network and the second network are two different networks.
  • the terminal device can determine the authentication information of another network based on the authentication information of one network. In this way, the complexity of access authentication can be reduced, the amount of device data calculation is reduced, and there is no need to store a large amount of authentication in the terminal device. information, it can also reduce the amount of data storage in the terminal device, save the storage space of the device, and further adopt the solution of this application to improve the data processing efficiency.
  • Figures 5A and 5B use a mobile equipment (ME) and a user identity module (USIM app) (where ME and USIM app constitute a UE, in Figure 5A the UE includes USIM app, in Figure 5B, the data interaction between the UE's USIM app (optional), the first network and the second network is explained as an example.
  • the first network is a macro network
  • the second network is an IOPS network (that is, the IOPS core network described below)
  • the first UDM belongs to the macro network
  • the second UDM belongs to the IOPS network.
  • the details are as follows:
  • Step 0 The UE accesses the macro network and completes the main authentication process with the macro network.
  • the macro network obtains the root key in IOPS mode based on the key generated after authenticating with the UE master, which is recorded as K IOPS (that is, the second authentication information).
  • the macro network sends K IOPS to the IOPS core network.
  • K IOPS is the key shared between the UE and the macro network.
  • K IOPS can be further deduced based on the CK and IK generated in the main authentication process between the macro network and the UE, or it can also be generated based on the main authentication process between the macro network and the UE.
  • K AUSF , K SEAF or KAMF are further deduced, which are not limited here.
  • the macro network can determine the second authentication information based on the first authentication information based on the triggering of AMF or the data processing of the macro network UDM, which is not specifically limited in this application.
  • Step 1 ME determines to instruct the USIM app to generate K IOPS based on the trigger conditions.
  • the trigger conditions are as follows:
  • Trigger condition a ME determines that it needs to instruct the USIM app to generate K IOPS based on the IOPS indication obtained from the macro network (that is, condition 1 above). Specifically, the ME can obtain the IOPS indication from any message interacting with the macro network, such as the UE Obtain the IOPS indication from the registration success message, or the UE obtains the IOPS indication according to the UE configuration update command (UE configuration update command) message in the UE configuration update process.
  • the UE configuration update command UE configuration update command
  • Trigger condition b ME determines that it needs to instruct the USIM app to generate K IOPS based on its own equipment supporting IOPS access (that is, condition 2 above). Specifically, ME supports IOPS access, that is, ME supports establishing a connection with the IOPS network. ME can determine that ME supports IOPS access based on the instruction obtained from the USIM app that supports the IOPS network. ME can also obtain the instruction of the IOPS network from the USIM app. The subscription information determines that the ME supports IOPS access. The ME can also determine that the ME supports IOPS access based on the capability information of the ME device that is preconfigured to support the IOPS network.
  • Trigger condition c ME obtains the IOPS PLMN ID broadcast by the access network device with IOPS function, determines that it needs to establish a connection with the IOPS network, and further determines that it needs to instruct the USIM app to generate K IOPS (that is, condition 3 above). Specifically, the ME determines to establish a link with the IOPS network when it determines that it needs to access the IOPS network when it cannot search for PLMN information of other accessible networks other than the IOPS network, or the ME determines to establish a link with the IOPS network. According to the operator's configuration, the ME receives the PLMN information of the IOPS network and connects to the IOPS network by default.
  • the access network equipment with IOPS function is a RAN node that can support access to the macro network core network and IOPS core network, and can be IOPS-capable gNB or IOPS-capable NG-RAN (next generation radio access network), That is, it supports gNB nodes that simultaneously access the 5G macro network core network and the 5G IOPS core network, or supports NG-RAN nodes that simultaneously access the 5G macro network core network and the 5G IOPS core network.
  • the IOPS function access network device is still establishing a backhaul link with the IOPS core network after detecting the macro network disconnection.
  • the ME instructs the USIM app to determine the second authentication information; the USIM app determines the second authentication information. In actual application, it can be performed by referring to step 2.
  • the ME may also instruct the USIM app to determine the second authentication information through the indication information of the context information of the IOPS network. This application is not specifically limited here.
  • Step 2 ME sends key storage instructions to USIM app.
  • the above key storage instructs the USIM app to determine K IOPS and store K IOPS .
  • the key storage instruction also instructs the USIM app to store other parameters required for primary authentication.
  • This parameter can be the SQN parameter required for primary authentication.
  • K IOPS is derived from K AUSF , K SEAF or KAMF
  • ME determines that USIM app does not store K AUSF , K SEAF or KAMF
  • ME will also send K AUSF , K SEAF or KAMF to USIM app.
  • ME can also send K AUSF , K SEAF or KAMF directly to USIM app without confirmation.
  • the method for the ME to determine that the USIM app does not store K AUSF , K SEAF or KAMF can be that the ME does not obtain the 5G security parameter storage indication from the USIM app.
  • 5G security parameter storage indication please refer to existing standards.
  • the mobile device can directly instruct the user identity recognition module through the instruction information (the above-mentioned key storage instruction), so that the user identity identification module can determine the second authentication information, and can also provide instructions through the instruction information of the context information of the IOPS network. , but also through other methods, which are not specifically limited in this application.
  • Step 3 USIM app deduce K IOPS according to the key storage instructions, and USIM app stores K IOPS .
  • K IOPS is the root key used for access authentication with the IOPS network.
  • K IOPS can be further deduced based on the CK and IK generated in the main authentication process between the macro network and the UE, or it can be further deduced based on the main authentication process between the macro network and the UE.
  • the K AUSF , K SEAF or KAMF generated during the certification process are further deduced and are not limited here. This can be understood with reference to the manner in which the terminal device deduces the second authentication information in step 401 of FIG. 4 , which will not be described again here.
  • the USIM app stores K IOPS and determines K IOPS as the root key used for access authentication with the IOPS network. It can establish and store the corresponding relationship between the IOPS identifier and K IOPS , or it can store K IOPS . to dedicated In the storage area for storing the IOPS key, K IOPS can also be stored in the USIM app to store the context information required for access authentication with the IOPS network, that is, the USIM app can subsequently obtain it based on the IOPS-related instruction information. to K IOPS .
  • the IOPS identifier is used to indicate that its corresponding information is used for access authentication with the IOPS network.
  • the USIM app can determine the IOPS identifier and use it to index information when it determines that it needs to perform access authentication with the IOPS network.
  • the IOPS identifier can be the context of the IOPS network. Instructions. For example, after the USIM app has deduced the key for accessing IOPS network 1, it is connected to other IOPS networks. When the USIM app connects to IOPS network 1 again, there is no need to perform key derivation and the key to access IOPS network 1 is directly retrieved from the storage area. Just perform access authentication. This method can save the processing resources of the device and improve data processing efficiency.
  • the USIM app also determines and stores other parameters required for UE and IOPS network master authentication. Specifically, the USIM app stores K IOPS and other parameters required for UE and IOPS network master authentication in the USIM app. It is used to store the context information required for access authentication with the IOPS network. It can also determine and store the correspondence between the IOPS identifier, K IOPS , UE and the parameters required for primary authentication of the IOPS network for the USIM app.
  • Step 4 ME triggers the establishment of a connection with the IOPS network to access the IOPS network, and performs primary authentication with the IOPS network.
  • step 1 if step 1 is not triggered by trigger condition c, the access network device that supports the IOPS function before step 4 can also establish a backhaul link with the IOPS network after detecting that the macro network is disconnected, and the ME
  • the IOPS PLMN ID broadcast by the access network device that supports the IOPS function determines the need to establish a connection with the IOPS core network, and then the IOPS network can initiate a main authentication request to the ME.
  • the ME determines the indication information of the context information of the second network, and the ME sends the indication information of the context information of the second network to the USIM app; the USIM app determines the indication information of the context information of the second network.
  • the indication information of the context information obtains the second authentication information in the context of the second network; the USIM app uses the second authentication information to perform access authentication with the second network. For details, please refer to steps 5-7 below.
  • the first authentication information and the second authentication information are stored in the user identity recognition module.
  • the first authentication information and the second authentication information are both stored in the user identity recognition module.
  • the terminal device does not need to set up two UICC cards, nor does it need to deploy two different apps, which can reduce the processing complexity of the terminal device.
  • Step 5 After the ME obtains the primary authentication request of the IOPS network, it determines that the primary authentication request is used for primary authentication with the IOPS network, and the ME determines the indication information of the IOPS network context information.
  • the indication information of the IOPS network context information is used to indicate that the IOPS network context information needs to be used for primary authentication with the IOPS network.
  • the specific implementation method may be that the ME determines the AUTHENTICATION command, where the AUTHENTICATION command includes the indication information of the IOPS network context information determined in step 5. More specifically, the ME includes the indication information of the IOPS network context information in the P2 field in the AUTHENTICATION command message, that is, the value in the P2 field in the AUTHENTICATION command is the indication information of the IOPS network context information.
  • Step 6 ME sends indication information of IOPS network context information to USIM app.
  • This method enables the USIM app to determine the second authentication information in the context of the IOPS network through the indication information of the context information of the IOPS network, and performs access authentication with the IOPS network based on the second authentication information, which can improve data processing efficiency.
  • Step 7 The USIM app determines that it needs to use the IOPS network for access authentication based on the indication information of the IOPS network context information.
  • the USIM app determines that it needs to use K IOPS to perform the main authentication process.
  • the USIM app can also determine the need to use the IOPS network for access authentication based on the indication information of the IOPS network context information.
  • the USIM app can also determine other parameter information required for authentication, such as SQN.
  • the USIM app determines K IOPS and/or other parameter information required for authentication based on the indication information of the IOPS network context information. It may determine that the IOPS network needs to be used for access authentication based on the indication information of the IOPS network context information. After further determining the IOPS identifier, the USIM app uses the IOPS identifier to index to K IOPS and/or other parameter information required for authentication. It can also determine that it needs to use the IOPS network for access authentication based on the indication information of the IOPS network context information. A storage area dedicated to storing IOPS mode K IOPS and/or other parameter information required for authentication.
  • K IOPS and/or other parameter information required for authentication may also be required based on the indication information of the IOPS network context information. After using the IOPS network for access authentication, obtain K IOPS and/or other parameter information required for authentication from the context information dedicated to storing the IOPS mode K IOPS and/or other parameter information required for authentication.
  • Step 8 The USIM app and network side use K IOPS as the root key to perform the main authentication process.
  • the USIM app replies with the generated CK, IK, XMAC and RES values in step 8.
  • the ME further determines the primary authentication reply message based on the USIM app reply message.
  • step 8 and subsequent network side verification of the main authentication reply message please refer to TS. 33.501 Existing technology will not be described again here.
  • the IOPS network After receiving the primary authentication reply message, the IOPS network can determine that the USIM app indeed generated K IOPS according to the above steps by any of the following methods:
  • the IOPS network did not receive an authentication failure or synchronization failure message in the primary authentication reply.
  • the primary authentication reply message passes the network side verification, that is, the UE successfully passes the primary authentication.
  • step 0-1 reference may be made to the description of step 0-1 in FIG. 5A above, which will not be described again here.
  • Step 2 ME deduce K IOPS based on the trigger condition in step 1 and store K IOPS .
  • K IOPS is the root key used for access authentication with the IOPS network.
  • K IOPS can be further deduced based on the CK and IK generated in the main authentication process between the macro network and the UE, or based on the K AUSF , K SEAF or KAMF generated in the main authentication process between the macro network and the UE.
  • K AUSF K AUSF
  • K SEAF K SEAF
  • KAMF KAMF
  • ME stores K IOPS and determines K IOPS as the root key used for access authentication with the IOPS network. It can establish and store the corresponding relationship between the IOPS identifier and K IOPS , or it can store K IOPS in A storage area dedicated to storing the IOPS key, or K IOPS can be stored in the ME to store the context information required for access authentication with the IOPS network, that is, the ME can subsequently obtain it based on the IOPS-related indication information. KIOPS .
  • the IOPS identifier is used to indicate that its corresponding information is used for access authentication with the IOPS network.
  • the ME When the ME determines that it needs to perform access authentication with the IOPS network, it can determine the IOPS identifier and use it to index information.
  • the IOPS identifier can be a context indication of the IOPS network. information. For example, after ME has deduced the key for accessing the IOPS network and then connected to other IOPS networks, when ME accesses IOPS network 1 again, it does not need to perform key derivation and directly retrieves the key from the storage area and accesses IOPS network 1. Certification is enough. This method can save the processing resources of the device and improve data processing efficiency.
  • ME also determines and stores other parameters required for UE and IOPS network master authentication. Specifically, ME stores K IOPS and other parameters required for UE and IOPS network master authentication in ME for In storing the context information required for access authentication with the IOPS network, the ME can also determine and store the correspondence between the IOPS identifier, K IOPS , and the parameters required for the UE and IOPS network master authentication.
  • Step 3 ME triggers the establishment of a connection with the IOPS network to access the IOPS network, and performs primary authentication with the IOPS network.
  • step 1 if step 1 is not triggered by trigger condition c, the access network device that supports the IOPS function before step 3 can also establish a backhaul link with the IOPS network after detecting that the macro network is disconnected, and ME according to The IOPS PLMN ID broadcast by the access network device that supports the IOPS function determines the need to establish a connection with the IOPS core network, and then the IOPS network can initiate a main authentication request to the ME.
  • Step 4 After ME obtains the primary authentication request from the IOPS network, it determines that the primary authentication request is used for primary authentication with the IOPS network. ME determines that the ME uses K IOPS as the root key to perform the primary authentication process with the network side.
  • the ME obtains the main authentication request of the IOPS network, determines that the main authentication request is used for main authentication with the IOPS network, and determines the K IOPS and/or other parameters required for the main authentication of the UE and the IOPS network.
  • ME further determines the main authentication reply message based on CK, IK, XMAC and RES. Step 4 and subsequent network side verification of the main authentication reply message can refer to TS 33.501 existing technology. No further details will be given here.
  • the ME determines K IOPS and/or other parameters required for the UE to authenticate with the IOPS network master, which can be that after the ME receives the authentication request from the IOPS network, the ME needs to use the IOPS network for access authentication from the storage dedicated to the IOPS network.
  • the ME can also receive the K IOPS and/or other parameter information required for authentication from the IOPS network. After the authentication request, the ME needs to further determine the IOPS identifier after performing access authentication with the IOPS network. The ME determines the K IOPS and/or other parameters required for UE and IOPS network master authentication based on the IOPS identifier and the corresponding relationship in step 2. .
  • the terminal device can determine the authentication information of another network based on the authentication information of a certain network. In this way, the complexity of access authentication can be reduced, the amount of device data calculation is reduced, and there is no need to store it in the terminal device. A large amount of authentication information can also reduce the amount of data storage in the terminal device and save the storage space of the device. Further adoption of the solution of this application can improve data processing efficiency.
  • Figure 6 takes the data interaction between the ME, the user identity module (USIM app) (where the ME and the USIM app constitute the UE), the first network and the second network as an example.
  • the first network is a macro network
  • the second network is an IOPS network (that is, the IOPS core network described below)
  • the first UDM belongs to the macro network
  • the second UDM belongs to the IOPS network.
  • the details are as follows:
  • Step 0 is the same as step 0 in the above-mentioned Figures 5A and 5B, and will not be described again here.
  • Step 1 The ME obtains the IOPS PLMN ID broadcast by the access network device with IOPS function, and determines that the IOPS network establishes a connection (that is, condition 3 in step 401 of Figure 4 above). Specifically, the ME obtains the IOPS PLMN ID broadcast by the access network device with IOPS function, determines that it needs to establish a connection with the IOPS network, and further determines that it needs to instruct the USIM app to generate K IOPS . Specifically, the ME determines to establish a link with the IOPS network when it determines that it needs to access the IOPS network when it cannot search for PLMN information of other accessible networks other than the IOPS network, or the ME determines to establish a link with the IOPS network. According to the operator's configuration, the ME receives the PLMN information of the IOPS network and connects to the IOPS network by default.
  • Step 2 ME triggers the establishment of a connection with the IOPS network to access the IOPS network, and performs primary authentication with the IOPS network.
  • Step 3 After the ME obtains the primary authentication request of the IOPS network, it determines to establish a connection with the IOPS core network and perform access authentication based on the IOPS PLMN ID obtained by the ME in Step 1.
  • the ME determines the indication information of the IOPS network context information.
  • the indication information of the IOPS network context information is used to indicate the need to use the IOPS network context information and IOPS network performs primary authentication.
  • the specific implementation method may be that the ME determines the AUTHENTICATION command, where the AUTHENTICATION command includes the indication information of the IOPS network context information determined in step 3. More specifically, the ME includes the indication information of the IOPS network context information in the P2 field in the AUTHENTICATION command message, that is, the value in the P2 field in the AUTHENTICATION command is the indication information of the IOPS network context information.
  • Step 4 ME sends indication information of IOPS network context information to USIM app.
  • K IOPS is derived from K AUSF , K SEAF or KAMF
  • the ME determines that the USIM app does not store K AUSF , K SEAF or KAMF
  • the ME simultaneously sends K AUSF , K SEAF or KAMF in step 4. to USIM app.
  • ME can also send K AUSF , K SEAF or KAMF directly to USIM app without confirmation.
  • the method for the ME to determine that the USIM app does not store K AUSF , K SEAF or KAMF can be that the ME does not obtain the 5G security parameter storage indication from the USIM app.
  • 5G security parameter storage indication please refer to existing standards.
  • Step 5 The USIM app determines that it needs to use the IOPS network for access authentication based on the indication information of the IOPS network context information.
  • the USIM app determines to deduce K IOPS and uses the K IOPS as the root key to perform the main authentication process with the IOPS network.
  • K IOPS can be further deduced based on the CK and IK generated in the main authentication process between the macro network and the UE, or based on the K AUSF , K SEAF or KAMF generated in the main authentication process between the macro network and the UE.
  • K AUSF K AUSF
  • K SEAF K SEAF
  • KAMF KAMF
  • the USIM app also determines other parameter information required for authentication, such as SQN, based on the indication information of the IOPS network context information.
  • Step 6 The USIM app and network side use K IOPS as the root key to perform the main authentication process.
  • K IOPS K IOPS
  • the USIM app eliminates the process of calling the stored K IOPS according to the IOPS indication information, eliminating the storage process and reducing the storage burden.
  • Figure 7 takes the data interaction between the ME, the user identity module (USIM app) (where the ME and the USIM app constitute the UE), the first network and the second network as an example.
  • the first network is a macro network
  • the second network is an IOPS network (that is, the IOPS core network described below)
  • the first UDM belongs to the macro network
  • the second UDM belongs to the IOPS network.
  • the details are as follows:
  • Steps 0-4 are the same as steps 0-4 in Figure 6 above and will not be described again.
  • the ME does not send the parameters required to deduce K IOPS to the USIM app.
  • the USIM app actively requests the parameters required to deduce K IOPS from the ME. Specifically, the USIM app obtains the indication information of the IOPS network context information sent by the ME. Then, the mobile device is requested for the first authentication information; the USIM app determines the second authentication information based on the first authentication information, and uses the second authentication information to perform access authentication with the second network. Please refer to steps 5-6 for details.
  • Step 5 USIM app requests ME to obtain one or more of K AUSF , K SEAF or KAMF .
  • Step 6 ME sends one or more of K AUSF , K SEAF or KAMF to USIM app.
  • Step 7 The USIM app deduces K IOPS and uses this K IOPS as the root key to perform the main authentication process with the IOPS network.
  • K IOPS can be further deduced based on the CK and IK generated in the main authentication process between the macro network and the UE, and It can be further deduced based on K AUSF , K SEAF or KAMF generated in the main authentication process between the macro network and the UE, which is not limited here. This can be understood with reference to the manner in which the terminal device deduces the second authentication information in step 401 of FIG. 4 , which will not be described again here.
  • Step 8 This is the same as step 8 in Figure 5A and will not be repeated here.
  • Figures 8A and 8B adopt the ME and user identity module (USIM app) (where the ME and USIM app constitute the UE, in Figure 8A the UE includes the USIM app, and in Figure 8B the UE The USIM app is optional), the data interaction between the first network and the second network is taken as an example to illustrate.
  • the first network is a macro network
  • the second network is an IOPS network (that is, the IOPS core network described below)
  • the first UDM belongs to the macro network
  • the second UDM belongs to the IOPS network.
  • the details are as follows:
  • Step 0-1 is the same as step 0-1 in Figure 6 above.
  • the authentication request obtained by the terminal device from the second network includes: indication information of the second network, and the terminal device performs access authentication with the second network based on the indication information of the second network and the second authentication information.
  • indication information of the second network the terminal device performs access authentication with the second network based on the indication information of the second network and the second authentication information.
  • Step 2 The IOPS network initiates a main authentication request to the ME.
  • the IOPS network indicates to the UE that this main authentication request belongs to the main authentication with the IOPS network through the main authentication request.
  • the IOPS network carries the IOPS indication information in the main authentication request, or the IOPS network carries the IOPS indication information in the authentication management field (AMF) in the authentication vector, for example, in the 8-th section of the authentication management field.
  • the 15 bits carry IOPS indication information.
  • Step 3 After the ME obtains the primary authentication request of the IOPS network, it determines to establish a connection with the IOPS core network and performs access authentication.
  • the ME determines the indication information of the IOPS network context information.
  • the indication information of the IOPS network context information is used to indicate that the IOPS network context information needs to be used for primary authentication with the IOPS network.
  • the ME can also determine the indication information of the IOPS network context information to indicate that the USIM app needs to use the IOPS network context information to perform primary authentication with the IOPS network, and instead use the USIM After the app obtains the authentication management field, it determines to obtain K IOPS based on the IOPS instruction information therein, and then performs the main authentication process with the IOPS core network.
  • the specific implementation method may be that the ME determines the AUTHENTICATION command, where the AUTHENTICATION command includes the indication information of the IOPS network context information determined in step 3. More specifically, the ME includes the indication information of the IOPS network context information in the P2 field in the AUTHENTICATION command message, that is, the value in the P2 field in the AUTHENTICATION command is the indication information of the IOPS network context information.
  • Step 4 ME sends indication information of IOPS network context information to USIM app.
  • K IOPS is derived from K AUSF , K SEAF or KAMF
  • the ME determines that the USIM app does not store K AUSF , K SEAF or KAMF
  • the ME simultaneously sends K AUSF , K SEAF or KAMF in step 4. to USIM app.
  • ME can also send K AUSF , K SEAF or KAMF directly to USIM app without confirmation.
  • the method for the ME to determine that the USIM app does not store K AUSF , K SEAF or KAMF can be that the ME does not obtain the 5G security parameter storage indication from the USIM app.
  • 5G security parameter storage indication please refer to existing standards.
  • the ME may not determine the indication information of the IOPS network context information to indicate that the USIM app needs to use the IOPS network context information to perform primary authentication with the IOPS network, but instead the USIM app After obtaining the AMF, determine to obtain K IOPS based on the IOPS indication information. Then perform the main authentication process with the IOPS core network.
  • Step 5 The USIM app determines that it needs to use the IOPS network for access authentication based on the indication information of the IOPS network context information. The USIM app determines that it needs to use K IOPS to perform the main authentication process.
  • Step 6 is the same as step 8 in Figure 5A and will not be described again here.
  • step 0-2 reference may be made to the description of step 0-2 in FIG. 8A above, which will not be described again here.
  • Step 3 After ME obtains the main authentication request from the IOPS network, it determines to establish a connection with the IOPS core network and performs access authentication. ME determines K IOPS and uses K IOPS as the root key with the network side to perform the main authentication process. Among them, K IOPS can be further deduced based on the CK and IK generated in the main authentication process between the macro network and the UE, or based on the K AUSF , K SEAF or KAMF generated in the main authentication process between the macro network and the UE. There are no limitations here. This can be understood with reference to the manner in which the terminal device deduces the second authentication information in step 401 of FIG. 4 , which will not be described again here.
  • each device may include a corresponding hardware structure and/or software module to perform each function.
  • each device may include a corresponding hardware structure and/or software module to perform each function.
  • the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is performed by hardware or computer software driving the hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each specific application, but such implementations should not be considered beyond the scope of this application.
  • Embodiments of the present application can divide the device into functional units according to the above method examples.
  • each functional unit can be divided corresponding to each function, or two or more functions can be integrated into one unit.
  • the above integrated units can be implemented in the form of hardware or software functional units.
  • FIG. 9 shows a possible exemplary block diagram of the communication device involved in the embodiment of the present application.
  • the communication device 900 may include: a processing unit 901 and a transceiver unit 902.
  • the processing unit 901 is used to control and manage the operations of the communication device 900 .
  • the transceiver unit 902 is used to support communication between the communication device 900 and other devices.
  • the transceiver unit 902 may include a receiving unit and/or a sending unit, respectively configured to perform receiving and sending operations.
  • the communication device 900 may also include a storage unit for storing program codes and/or data of the communication device 900 .
  • the transceiver unit may be called an input-output unit, a communication unit, etc.
  • the transceiver unit may be a transceiver
  • the processing unit may be a processor.
  • the communication device is a module (such as a chip) in a communication device
  • the transceiver unit may be an input-output interface, an input-output circuit, or an input-output pin, etc., and may also be called an interface, a communication interface, or an interface circuit, etc.
  • the processing unit may be a processor, a processing circuit or a logic circuit, etc.
  • the device may be the above-mentioned UE or the like.
  • the processing unit 901 of the communication device 900 is configured to determine the second authentication information used for access authentication with the second network based on the first authentication information used for access authentication with the first network; the first network Different from the second network, the transceiver unit 902 is configured to perform access authentication with the second network based on the second authentication information after receiving the authentication request from the second network.
  • the processing unit 901 determines the second authentication information according to accessing the first authentication information; and/or , when the communication device has the ability to access the second network, the processing unit 902 determines the second authentication information based on the first authentication information. information; and/or, when the transceiver unit 902 receives the identification information of the second network and determines to establish a connection with the second network, the processing unit 901 determines the second authentication information based on the first authentication information.
  • the communication device 900 includes: a mobile device and a user identity recognition module.
  • the mobile device instructs the user identity recognition module to determine the second authentication information based on the first authentication information; and the user identity recognition module determines the second authentication information based on the first authentication information.
  • the mobile device instructs the user identity recognition module to obtain the second authentication information through the indication information of the context information of the second network.
  • the mobile device after receiving the authentication request from the second network, sends the indication information of the context information of the second network to the user identity recognition module; the user identity recognition module obtains the third authentication information based on the indication information of the context information of the second network. Second authentication information in the context of the second network; using the second authentication information to perform access authentication with the second network.
  • the first authentication information and the second authentication information are stored in the user identity recognition module.
  • the user identity recognition module requests the first authentication information from the mobile device; the user identity recognition module determines the second authentication information based on the first authentication information, and uses the second authentication information to perform access authentication with the second network.
  • the authentication request includes: indication information of the second network, and the terminal device performs access authentication with the second network based on the indication information of the second network and the second authentication information.
  • the processing unit 901 is configured to use the first authentication information as an input parameter to generate second authentication information.
  • the first authentication information includes one or more of the following: CK, IK, SQN parameters, K AUSF , K SEAF , and KAMF .
  • the first network is an IOPS network or a private network
  • the second network is a macro network
  • the first network is a macro network
  • the second network is an IOPS network or a private network
  • the communication device 1000 may be a chip or a system on a chip.
  • the communication device may be located in the device involved in any of the above method embodiments, such as a UE, etc., to perform actions corresponding to the device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • Communication device 1000 includes processor 1010.
  • the processor 1010 is used to execute the computer program stored in the memory 1020 to implement the actions of each device in any of the above method embodiments.
  • Communication device 1000 may also include memory 1020 for storing computer programs.
  • the memory 1020 and the processor 1010 are coupled. Coupling is an indirect coupling or communication connection between devices, units or modules, which can be in electrical, mechanical or other forms, and is used for information interaction between devices, units or modules.
  • the memory 1020 is integrated with the processor 1010.
  • processors 1010 and memories 1020 there can be one or more processors 1010 and memories 1020 without limitation.
  • the communication device 1000 may or may not include the transceiver 1030, which is illustrated by a dotted box in the figure.
  • the communication device 1000 may interact with other devices through the transceiver 1030.
  • the transceiver 1030 can be a circuit, a bus, a transceiver, or any other device that can be used for information exchange.
  • the communication device 1000 may be a UE in implementing each of the above methods.
  • connection medium between the above-mentioned transceiver 1030, processor 1010 and memory 1020 is not limited in the embodiment of the present application.
  • the memory 1020, the processor 1010 and the transceiver 1030 are connected through a bus in Figure 10.
  • the bus is represented by a thick line in Figure 10.
  • the connection methods between other components are only schematically explained. It is not limited.
  • the bus can be divided into address bus, data bus, control bus, etc.
  • Figure 10 is represented by only one thick line, but it does not mean that there is only one bus or one type of bus.
  • the processor may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or Execute each method, step and logical block diagram disclosed in the embodiment of this application.
  • a general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in conjunction with the embodiments of the present application can be directly implemented by a hardware processor, or executed by a combination of hardware and software modules in the processor.
  • the memory may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), etc., or it may be a volatile memory (volatile memory), such as Random-access memory (RAM).
  • Memory may also be, but is not limited to, any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer.
  • the memory in the embodiment of the present application can also be a circuit or any other device capable of performing a storage function, used to store computer programs, program instructions and/or data.
  • the embodiment of the present application also provides another communication device 1100, including: an interface circuit 1110 and a logic circuit 1120; the interface circuit 1110 can be understood as an input and output interface, and can be used to perform any of the above methods.
  • the logic circuit 1120 can be used to run codes or instructions to perform the method performed by each device in any of the above embodiments, which will not be described again.
  • embodiments of the present application also provide a computer-readable storage medium that stores instructions.
  • each device in any of the above method embodiments is executed. is implemented, for example, so that the method executed by the terminal device in the embodiment shown in FIG. 4 is implemented.
  • the computer-readable storage medium may include: U disk, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk and other various media that can store program codes.
  • embodiments of the present application provide a communication system, which includes the terminal device mentioned in any of the above method embodiments and can be used to perform the method performed by each device in any of the above method embodiments.
  • embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction apparatus, the instructions
  • the device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.
  • These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby causing the computer or other programmable data processing device to perform a series of operations on the computer or other programmable data processing device.
  • the instructions executed on a programmable device provide steps for implementing the functions specified in the flow diagram process or processes and/or the block diagram block or blocks.

Abstract

本申请实施例提供一种通信方法及通信装置，涉及通信技术领域。终端设备根据与第一网络进行接入认证所用的第一认证信息确定与第二网络进行接入认证所用的第二认证信息；第一网络与第二网络不同；终端设备接收来自第二网络的认证请求后，根据第二认证信息与第二网络进行接入认证。本申请中，接入第二网络的第二认证信息是基于接入第一网络的第一认证信息确定的，该方式可降低接入认证的复杂度，提高数据处理效率。

Description

一种通信方法及通信装置
相关申请的交叉引用
本申请要求在2022年05月06日提交中国专利局、申请号为202210488537.1、申请名称为“一种通信方法及通信装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术领域，尤其涉及一种通信方法及通信装置。
背景技术
公共安全隔离运营(isolated e-utran operation for public safety，IOPS)技术在第三代移动通信伙伴项目(3rd generation partnership project，3GPP)R13版本中引入长期演进技术(long term evolution，LTE)系统。LTE标准技术规范(technical specification，TS)23.401和TS33.401中对于IOPS场景的定义主要集中于用户设备(user equipment，UE)从宏网接入切换到IOPS网络。
UE在与宏网和IOPS网络进行主认证时，需要使用不同与宏网签约时的国际移动用户识别码(international mobile subscriber identity，IMSI)和不同的根密钥。即宏网核心网中只会存储UE与宏网进行主认证时使用的IMSI和根密钥，而IOPS核心网中只会存储UE与IOPS网络进行主认证时使用的IMSI和根密钥，UE在与不同网络进行主认证时，启用对应的IMSI和根密钥。
在执行IOPS的接入认证的时候，UE是通过将宏网的USIM app切换为IOPS USIM app方式选择到UE侧的IOPS密钥，UE侧密钥切换到IOPS app后使用IOPS app中的密钥，实现后续与IOPS网络进行接入认证。如果需要在UE上实现USIM app的切换，有两种可选的实现方式：
方式1.使用单一的UICC卡实现双USIM app功能，即在同一个UICC上安装两个USIM app，一个服务于宏网接入，一个专用于IOPS网络接入。UE在需要切换成USIM app时，指示UICC激活对应的USIM app。
方式2.使用不同的UICC卡实现双USIM app功能，即一张UICC卡上面安装用于宏网接入的USIM app，另一张UICC卡上面安装用于IOPS网络接入的USIM app。
发明内容
本申请提供一种通信方法及通信装置，以降低终端设备接入不同的网络的复杂度，提高数据处理效率。
第一方面，本申请提供一种通信方法，包括：
终端设备根据与第一网络进行接入认证所用的第一认证信息确定与第二网络进行接入认证所用的第二认证信息；第一网络与第二网络不同；终端设备接收来自第二网络的认证请求后，根据第二认证信息与第二网络进行接入认证。
本申请中，终端设备根据终端设备与第一网络进行接入认证所用的第一认证信息确定终端设备与第二网络进行接入认证所用的第二认证信息可以理解为终端设备参考第一认证信息确定第二认证信息，或者基于第一认证信息中的某些参数推演获取第二认证信息，本申请在此不对如何确定第二认证信息进行限定。其中，第一网络和第二网络为两个不同的网络，通常是终端若可以接入两个网络需要由两个网络的运营商预配置两套不同的认证信息分别与对应的网络进行接入认证，但是本申请中，终端设备可基于某个网络的认证信息确定另一网络的认证信息，通过该方式可以减少接入认证的复杂度，且减少了设备数据计算量，且在终端设备中也无需存储大量的认证信息，还可以减少终端设备中的数据存储量，节约设备的存储空间，进一步地采用本申请的方案可以提高数据处理效率。
在一种可选的方式中，终端设备接收到来自第一网络的用于指示终端设备生成第二认证信息的指示信息的情况下，根据接入第一认证信息确定第二认证信息；和/或，终端设备具有接入第二网络的能力的情况下，根据第一认证信息确定第二认证信息；和/或，终端设备接收到第二网络的标识信息，确定与第二网络建立连接的情况下，根据第一认证信息确定第二认证信息。
本申请中，终端设备可根据第一网络的指示信息触发确定第二认证信息，还可在确定自身具有接入第二网络的能力的情况下，确定第二认证信息，还可在接收到第二网络的标识信息，确定与第二网络建立连接的情况下，确定第二认证信息，还可能是上述3种方式的结合，本申请在此不具体限定，可根据实际需求灵活确定，通过该方式，终端设备可以明确知晓确定第二认证信息的时机，而不是预先确定第二认证信息，可以保证数据处理的时效性和可靠性。需要说明的是，终端设备具有接入第二网络的能力可以理解为终端设备支持与第二网络建立连接，或终端设备可以与第二网络建立链接。终端设备支持与第二网络建立连接，可以是终端设备根据内部信息确定，例如从用户身份识别模块获取了支持第二网络的指示，或从用户身份识别模块取了第二网络的签约信息，也可以是终端设备中预配置了支持第二网络的能力信息。
在一种可选的方式中，终端设备包括：移动设备和用户身份识别模块，移动设备指示所述用户身份识别模块根据第一认证信息确定第二认证信息；用户身份识别模块根据第一认证信息确定第二认证信息。
本申请中，在终端设备包括用户身份识别模块时，通过移动设备与用户身份识别模块的相互配合确定第二认证信息，更加适配实际生产生活中终端设备如，手机的需求。在实际应用时，移动设备可通过指示信息直接指示用户身份识别模块，以便用户身份识别模块确定第二认证信息，还可通过第二网络的上下文信息的指示信息进行指示，还可通过其他方式，本申请在此不具体限定。
在一种可选的方式中，移动设备通过第二网络的上下文信息的指示信息指示用户身份识别模块获取第二认证信息。
通过该方式移动设备可以在使用第二网络的上下文信息的指示信息来指示用户身份识别模块使用第二网络的上下文信息进行接入认证，同时使用第二网络的上下文信息来指示用户身份识别模块确定第二认证信息，可以节约信令。
在一种可选的方式中，移动设备接收来自第二网络的认证请求后，移动设备将第二网络的上下文信息的指示信息发送至用户身份识别模块；用户身份识别模块根据第二网络的上下文信息的指示信息，确定第二网络的上下文中的第二认证信息；用户身份识别模块采 用第二认证信息与第二网络进行接入认证。
通过第二网络的上下文信息的指示信息确定第二网络的上下文中的第二认证信息，基于第二认证信息与第二网络进行接入认证，可以提高数据处理效率。
在一种可选的方式中，第一认证信息和第二认证信息存储于用户身份识别模块。
本申请中，第一认证信息和第二认证信息均存储在用户身份识别模块中，终端设备无需设置两张UICC卡，也无需部署两个不同的app，可以降低终端设备的处理复杂度。
在一种可选的方式中，用户身份识别模块向移动设备请求第一认证信息；用户身份识别模块根据第一认证信息确定第二认证信息，并采用第二认证信息与第二网络进行接入认证。
本申请中，移动设备在接收到用户身份识别模块后请求第一认证信息后，确定第二认证信息，可以保证数据处理效率。
在一种可选的方式中，第二网络的认证请求中包括：第二网络的指示信息，终端设备根据第二网络的指示信息、第二认证信息与第二网络进行接入认证。
本申请中，终端设备基于第二网络的认证请求中的第二网络的指示信息以及第二认证信息与第二网络进行接入认证可以提高数据处理效率。
在一种可选的方式中，终端设备将第一认证信息作为密钥推演函数的输入参数，生成第二认证信息，密钥推演函数可以是现有标准中的key derivation function(KDF)函数。具体可以为，终端设备将第一认证信息作为密钥推演函数的输入参数，将密钥推演函数的输出作为第二认证信息。
通过该方式推演的第二认证信息可以适配两个网络的需求，避免采用两套不同的认证信息与不同的网络进行接入认证，可以提高数据处理效率。
在一种可选的方式中，第一认证信息包括以下中的一种或多种：机密性密钥CK、完整性密钥IK、序号(sequence number，SQN)、AUSF密钥KAUSF、SEAF密钥KSEAF、AMF密钥KAMF。
第一认证信息中包括上述参数可保证终端设备推演出第二认证信息。
在一种可选的方式中，第一网络为IOPS网络或私网，第二网络为宏网络；或，第一网络为宏网络，第二网络为IOPS网络或私网。
第二方面，本申请实施例提供一种通信装置，所述通信装置可以为终端设备或者设置在终端设备内部的芯片。所述通信装置具备实现上述第一方面中任一方面的功能，比如，所述通信装置包括执行上述第一方面中任一方面涉及步骤所对应的模块或单元或手段(means)，所述功能或单元或手段可以通过软件实现，或者通过硬件实现，也可以通过硬件执行相应的软件实现。
在一种可能的设计中，所述通信装置包括处理单元、收发单元，其中，收发单元可以用于收发信号，以实现该通信装置和其它装置之间的通信，比如，收发单元用于接收来自终端设备的配置信息；处理单元可以用于执行该通信装置的一些内部操作。所述收发单元可以称为输入输出单元、通信单元等，所述收发单元可以是收发器；所述处理单元可以是处理器。当通信装置是通信设备中的模块(如，芯片)时，所述收发单元可以是输入输出接口、输入输出电路或输入输出管脚等，也可以称为接口、通信接口或接口电路等；所述处理单元可以是处理器、处理电路或逻辑电路等。
在又一种可能的设计中，所述通信装置包括处理器，还可以包括收发器，所述收发器 用于收发信号，所述处理器执行程序指令，以完成上述第一方面中任意可能的设计或实现方式中的方法。其中，所述通信装置还可以包括一个或多个存储器，所述存储器用于与处理器耦合，所述存储器可以保存实现上述第一方面中任一方面涉及的功能的必要计算机程序或指令。所述处理器可执行所述存储器存储的计算机程序或指令，当所述计算机程序或指令被执行时，使得所述通信装置实现上述第一方面任意可能的设计或实现方式中的方法。
在又一种可能的设计中，所述通信装置包括处理器，处理器可以用于与存储器耦合。所述存储器可以保存实现上述第一方面中任一方面涉及的功能的必要计算机程序或指令。所述处理器可执行所述存储器存储的计算机程序或指令，当所述计算机程序或指令被执行时，使得所述通信装置实现上述第一方面至第三方面任意可能的设计或实现方式中的方法。
在又一种可能的设计中，所述通信装置包括处理器和接口电路，其中，处理器用于通过所述接口电路与其它装置通信，并执行上述第一方面任意可能的设计或实现方式中的方法。
可以理解地，上述第二方面中，处理器可以通过硬件来实现也可以通过软件来实现，当通过硬件实现时，该处理器可以是逻辑电路、集成电路等；当通过软件来实现时，该处理器可以是一个通用处理器，通过读取存储器中存储的软件代码来实现。此外，以上处理器可以为一个或多个，存储器可以为一个或多个。存储器可以与处理器集成在一起，或者存储器与处理器分离设置。在具体实现过程中，存储器可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请实施例对存储器的类型以及存储器与处理器的设置方式不做限定。
第三方面，本申请实施例提供一种通信系统，该通信系统包括上述第一方面中的终端设备。
第四方面，本申请提供了一种芯片系统，该芯片系统包括处理器，还可以包括存储器，用于实现上述第一方面中任一种可能的设计中所述的方法。该芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
第五方面，本申请还提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机可读指令，当计算机可读指令在计算机上运行时，以使得计算机执行如第一方面中任一种可能的设计中的方法。
第六方面，本申请提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面的各实施例的方法。
上述第二方面至第六方面可以达到的技术效果，请参照上述第一方面中相应可能设计方案可以达到的技术效果说明，本申请这里不再重复赘述。
附图说明
图1示出了本申请实施例提供的一种通信系统的示意图；
图2A示出了一种应用场景的示意图；
图2B示出了另一种应用场景的示意图；
图3示出了UE从宏网切换到IOPS网络的流程示意图；
图4示出了本申请实施例提供的一种通信方法的流程示意图；
图5A示出了本申请实施例提供的另一种通信方法的流程示意图；
图5B示出了本申请实施例提供的另一种通信方法的流程示意图；
图6示出了本申请实施例提供的另一种通信方法的流程示意图；
图7示出了本申请实施例提供的另一种通信方法的流程示意图；
图8A示出了本申请实施例提供的另一种通信方法的流程示意图；
图8B示出了本申请实施例提供的另一种通信方法的流程示意图；
图9示出了本申请实施例提供的通信装置的结构示意图；
图10示出了本申请实施例提供的通信装置的结构示意图；
图11示出了本申请实施例提供的通信装置的结构示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地详细描述。方法实施例中的具体操作方法也可以应用于装置实施例或系统实施例中。其中，在本申请的描述中，除非另有说明，“多个”的含义是两个或两个以上。因此装置与方法的实施可以相互参见，重复之处不再赘述。
图1示例性示出一种移动通信网络架构的示意图，该网络架构中包括终端设备、接入网设备、接入和移动管理功能、会话管理功能、用户面功能、策略控制功能、网络切片选择功能、网络切片特定身份验证和授权功能、网络仓库功能、网络数据分析功能、统一数据管理功能、统一数据存储功能、认证服务功能、网络能力开放功能、终端无线能力管理功能、绑定支撑功能、应用功能，以及连接运营商网络的数据网络(data network，DN)。终端设备可通过当前位置的接入节点来接入无线网络。终端设备可通过接入网设备、用户面功能向数据网络发送业务数据，以及从数据网络接收业务数据。
接入和移动管理功能，主要用于移动网络中的终端设备的附着、移动性管理、跟踪区更新流程等。在5G通信系统中，接入和移动管理功能可以是接入与移动性管理功能(access and mobility management function，AMF)，在未来的通信系统(如6G通信系统)中，接入和移动管理功能可以仍是AMF，或者也可以具有其它名称，本申请并不限定。
会话管理功能，主要用于移动网络中的会话管理，如会话建立、修改、释放。具体功能如为终端设备分配互联网协议地址、选择提供报文转发功能的用户面功能等。在5G通信系统中，会话管理功能可以是会话管理功能(session management function，SMF)，在未来的通信系统(如6G通信系统)中，会话管理功能可以仍是SMF，或者也可以具有其它名称，本申请并不限定。
用户面功能，主要用于对用户报文进行处理，如转发和计费等。在5G通信系统中，用户面功能可以是用户面功能(user plane function，UPF)，在未来的通信系统(如6G通信系统)中，用户面功能可以仍是UPF，或者也可以具有其它名称，本申请并不限定。
策略控制功能，包含策略控制功能、计费策略控制功能、服务质量(quality of service，QoS)控制等。在5G通信系统中，策略控制功能可以是策略控制功能(policy control function，PCF)，在未来的通信系统(如6G通信系统)中，策略控制功能可以仍是PCF，或者也可以具有其它名称，本申请并不限定。
网络切片选择功能，主要用于为终端设备的业务选择合适的网络切片。在5G通信系统中，网络切片选择功能可以是网络切片选择功能(network slice selection function，NSSF)，在未来的通信系统(如6G通信系统)中，网络切片选择功能可以仍是NSSF，或者也可以具有其它名称，本申请并不限定。
网络切片特定身份验证和授权功能(network slice-specific authentication and authorization function，NSSAAF)主要用于针对终端设备接入特定网络切片的验证和授权。
网络仓库功能，主要用于提供网络功能或网络功能所提供服务的注册和发现。在5G通信系统中，网络仓库功能可以是网络仓库功能(network repository function，NRF)，在未来的通信系统(如6G通信系统)中，网络仓库功能可以仍是NRF，或者也可以具有其它名称，本申请并不限定。
网络数据分析功能，可以从各个网络功能，例如策略控制功能、会话管理功能、用户面功能、接入管理功能、应用功能(通过网络能力开放功能)收集数据，并进行分析和预测。在5G通信系统中，网络数据分析功能可以是网络数据分析功能(network data analytics function，NWDAF)，在未来的通信系统(如6G通信系统)中，网络数据分析功能可以仍是NWDAF，或者也可以具有其它名称，本申请并不限定。
统一数据管理功能，主要用于管理终端设备的签约信息。在5G通信系统中，统一数据管理功能可以是统一数据管理(unified data management，UDM)功能，在未来的通信系统(如6G通信系统)中，统一数据管理功能可以仍是UDM功能，或者也可以具有其它名称，本申请并不限定。
统一数据存储功能，主要用于存储结构化的数据信息，其中包括签约信息、策略信息，以及有标准格式定义的网络数据或业务数据。在5G通信系统中，统一数据存储功能可以是统一数据存储(unified data repository，UDR)功能，在未来的通信系统(如6G通信系统)中，统一数据存储功能可以仍是UDR功能，或者也可以具有其它名称，本申请并不限定。
认证服务功能，主要用于对终端设备进行安全认证。在5G通信系统中，认证服务功能可以是认证服务端功能(authentication server function，AUSF)，在未来的通信系统(如6G通信系统)中，认证服务功能可以仍是AUSF，或者也可以具有其它名称，本申请并不限定。
网络能力开放功能，可以将网络的部分功能有控制地暴露给应用。在5G通信系统中，网络能力开放功能可以是NEF，在未来的通信系统(如6G通信系统)中，网络能力开放功能可以仍是NEF，或者也可以具有其它名称，本申请并不限定。
终端无线能力管理功能，用于存储和管理网络内终端设备的无线能力。在5G通信系统中，终端无线能力管理功能可以是终端无线能力管理功能(UE radio capability management function，UCMF)，在未来的通信系统(如6G通信系统)中，终端无线能力管理功能可以仍是UCMF，或者也可以具有其它名称，本申请并不限定。
绑定支撑功能，用于维护用户网络之间互连的协议(Internet Protocol，IP)地址和服务功能的对应关系。在5G通信系统中，绑定支撑功能可以是绑定支撑功能(binding support function，BSF)，在未来的通信系统(如6G通信系统)中，绑定支撑功能可以仍是BSF，或者也可以具有其它名称，本申请并不限定。
应用功能，可以向运营商的通信网络的控制面功能提供各类应用的服务数据，或者从通信网络的控制面功能获得网络的数据信息和控制信息。在5G通信系统中，应用功能可以是应用功能(application function，AF)，在未来的通信系统(如6G通信系统)中，应用功能可以仍是AF，或者也可以具有其它名称，本申请并不限定。
数据网络，主要用于为终端设备提供数据传输服务。数据网络可以是私有网络，如局 域网，也可以是公用数据网(public data network，PDN)，如因特网(Internet)，还可以是运营商合并部署的专有网络，如配置的IP多媒体网络子系统(IP multimedia core network subsystem，IMS)服务。
本申请实施例中所涉及的终端(也即终端设备)，是用户侧的一种用于接收或发射信号的实体，用于向网络设备发送上行信号，或从网络设备接收下行信号。包括向用户提供语音和/或数据连通性的设备，例如可以包括UE、具有无线连接功能的手持式设备、或连接到无线调制解调器的处理设备。该终端设备可以经无线接入网(radio access network，RAN)与核心网进行通信，与RAN交换语音和/或数据。该终端设备可以包括UE、车用无线通信技术(vehicle to X，V2X)终端设备、无线终端设备、移动终端设备、设备到设备通信(device-to-device，D2D)终端设备、机器到机器/机器类通信(machine-to-machine/machine-type communications，M2M/MTC)终端设备、IoT终端设备、订户单元(subscriber unit)、订户站(subscriber station)，移动站(mobile station)、远程站(remote station)、AP、远程终端(remote terminal)、接入终端(access terminal)、用户终端(user terminal)、用户代理(user agent)、或用户装备(user device)、可穿戴设备、车载设备、无人机等。
作为示例而非限定，在本申请实施例中，该终端设备还可以是可穿戴设备。可穿戴设备也可以称为穿戴式智能设备或智能穿戴式设备等，是应用穿戴式技术对日常穿戴进行智能化设计、开发出可以穿戴的设备的总称，如眼镜、手套、手表、服饰及鞋等。可穿戴设备即直接穿在身上，或是整合到用户的衣服或配件的一种便携式设备。可穿戴设备不仅仅是一种硬件设备，更是通过软件支持以及数据交互、云端交互来实现强大的功能。广义穿戴式智能设备包括功能全、尺寸大、可不依赖智能手机实现完整或者部分的功能，例如：智能手表或智能眼镜等，以及只专注于某一类应用功能，需要和其它设备如智能手机配合使用，如各类进行体征监测的智能手环、智能头盔、智能首饰等。
需要说明的是，本申请实施例中功能还可以称为网元、网络功能或功能实体、设备等，例如，接入和移动管理功能还可以称为接入和移动管理网元、或接入和移动管理网络功能、或接入和移动管理功能实体等。各个功能的名称在本申请中不做限定，本领域技术人员可以将上述功能的名称更换为其它名称而执行相同的功能，均属于本申请保护的范围。
图2A示出了本申请提供的一种应用场景示意图，该场景以IOPS网络与宏网为例，当然在实际应用时也可以是私网和宏网，本申请并不具体限定，通常终端设备在无回传通信条件下通过具有IOPS功能的LTE接入网设备(IOPS-capable eNB)为公共安全用户提供通信服务。其中无回传通信即接入网设备与LTE宏网核心网(macro EPC)之间链接中断的情况。在地震等灾难，或回传光纤故障等情况下，回传通信中断，此时具有IOPS功能的LTE接入网设备(IOPS-capable eNodeBs)建立与IOPS网络的回传连接，形成可为用于提供本地连接的IOPS网络(IOPS network)，终端设备通过IOPS网络在IOPS模式(IOPS mode)下接收通信服务，以确保数据的可靠传输。此外不具有IOPS功能的LTE接入网设备(IOPS-Incapable eNodeBs)不能建立与IOPS网络的回传连接。
图2B示出了本申请提供的另一应用场景示意图，该场景以IOPS网络为例，当然在实际应用时也可以是私网，本申请并不具体限定，在没有IOPS-capable eNB为公共安全用户提供通信服务的情况下(也即No infrastracture)，在eNodeB部署(eNodeB Deployed)时，使用具有IOPS功能的接入网设备(Nomadlc eNodeB)(该接入网设备是可移动的，类似于用户备着一个小接入网设备)实现与IOPS网络的回传连接建立，形成可为用于提供本地 连接的IOPS核心网(Local EPC)，形成可为用于提供本地连接的IOPS网络(IOPS network)。
现有LTE TS 23.401和TS 33.401中对于IOPS场景的定义主要集中于UE从宏网接入切换到IOPS网络接入的流程。其中LTE对于IOPS场景有如下基本假设：
1、宏网EPC与支持IOPS模式的核心网(即本地IOPS模式的EPC，也称Local EPC，或L-EPC)之间存在隔离，RAN节点同时支持宏网和IOPS，该RAN节点为具有IOPS功能的eNB节点(IOPS-capable eNB)。IOPS-capable eNB与宏网EPC和L-EPC均有连接。
2、IOPS模式具有专属的标识，如公共陆地移动网络标识(public land mobile network identifier，PLMN ID)，同一个公共安全机构/运营商的所有L-EPC有同样的PLMN ID。IOPS模式开启时，IOPS-capable eNB会广播IOPS对应的PLMN ID以辅助支持IOPS模式的UE接入IOPS模式。
3、只有授权的具有IOPS功能的UE(IOPS-enabled UE)可以接入IOPS网络。
4、L-EPC主要功能是为IOPS-enabled UE之间通信提供路由功能。
5、IOPS-enabled UE具有两个UMTS用户身份识别模块应用(universal mobile telecommunications system subscriber identity module application，USIM app)，两个USIM app分别对应IOPS模式和正常模式。IOPS的USIM app有专用于IOPS PLMN的根密钥K、PLMN ID和国际移动用户识别码(international mobile subscriber Identity，IMSI)。
现有TS 23.401中UE从宏网切换到IOPS网络的流程如图3所示，如下：
步骤1.UE接入到宏网EPC，并进行通信业务。
步骤2.eNB检测到与宏网的回传链路断线，此eNB为IOPS-capable eNB以下不再赘述。
eNB根据运营商本地策略决策激活IOPS模式。
步骤3.L-EPC激活后，eNB与L-EPC建立回传链路。
步骤4.eNB与L-EPC建立回传链路后，广播IOPS网络的PLMN ID。
步骤5.UE检测到IOPS PLMN ID广播，激活IOPS专用的USIM app。
步骤6.UE根据IOPS PLMN ID确定需要接入对应的L-EPC，并与L-EPC进行接入流程(包括接入认证)和会话建立。
步骤7.UE与L-EPC执行接入流程(附着流程)并建立本地协议数据网络(packet data network，PDN)链接。
步骤8.UE接入L-EPC并进行通信服务。
现有技术中UE在与宏网和IOPS网络进行主认证时，需要使用不同与宏网签约时的IMSI和不同的根密钥。即宏网核心网中只会存储UE与宏网进行主认证时使用的IMSI和根密钥，而IOPS核心网中只会存储UE与IOPS网络进行主认证时使用的IMSI和根密钥，UE在与不同网络进行主认证时，启用对应的IMSI和根密钥，该方式操作复杂。
UE由移动设备(mobile equipment，ME)和用户身份识别模块(USIM app)组成。USIM app用于存储用户与网络侧进行认证所需的根密钥信息。一个ME设备只有使用USIM app中的信息(IMSI和根密钥)接入网络才可被视为UE。其中ME为终端的硬件设备，例如手机。集成电路卡(universal integrated circuit card，UICC)为USIM app的硬件载体，UICC和USIM app均由UICC卡供应商提供。USIM app内信息由运营商提供，并由UICC的供应商写入USIM app中。
UE在检测到IOPS PLMN ID广播后，需要激活IOPS专用于IOPS模式的USIM app， 其中USIM app中包括执行接入认证所用的根密钥K。IOPS的USIM app有专用于IOPS PLMN的根密钥K、PLMN ID和IMSI。
因此在执行IOPS的接入认证的时候，UE是通过将宏网的USIM app切换为IOPS USIM app方式选择到UE侧的IOPS密钥，UE侧密钥切换到IOPS app后使用IOPS app中的密钥，实现后续与IOPS网络进行接入认证，该方式操作复杂。
基于此，本申请提供一种通信方法，以降低接入认证的复杂度。参阅图4为本申请实施例提供的一种通信方法的示意图，该方法可通过终端设备来执行，执行如下：
步骤401，终端设备根据与第一网络进行接入认证所用的第一认证信息确定与第二网络进行接入认证所用的第二认证信息；第一网络与第二网络不同。
需要说明的是，步骤401中所述的终端设备可以为不设置USIM app的终端设备，即终端设备中不存在USIM app或不存在承载USIM app的功能模块，如，定位标签、物联网设备等，还可以为设置USIM app的终端设备，即终端设备中存在USIM app或不存在承载USIM app的功能模块，如，手机等，本申请在此不具体限定终端设备的类型。
其中，第一网络与第二网络可以为相互隔离的网络。其中，第一网络可为IOPS网络或私网，第二网络为宏网络；或，第一网络为宏网络，第二网络为IOPS网络或所述私网，如，第一网络为IOPS网络，第二网络为宏网络；第一网络为私网(如，校园网、园区网等)，第二网络为宏网；第一网络为宏网，第二网络为IOPS网络；第一网络为宏网，第二网络为私网等，本申请在此不具体限定。
其中，终端设备与第一网络进行接入认证可以理解为终端设备与第一网络的主认证，终端设备与第一网络的主认证用于终端设备与第一网络之间互相认证身份，仅在主认证通过后，终端才可与第一网络进行后续注册流程和会话建立流程。假定该第一网络为宏网，则表示终端设备与宏网的主认证；假定该第一网络为IOPS网络，则表示终端设备与IOPS网络的主认证。终端设备与第二网络进行接入认证，可以理解为终端设备与第二网络的主认证，终端设备与第二网络的主认证用于终端设备与第二网络之间互相认证身份，仅在主认证通过后，终端才可与第二网络进行后续注册流程和会话建立流程。假定该第二网络为IOPS网络，则表示终端设备与IOPS网络的主认证；假定该第二网络为宏网，则表示终端设备与宏网的主认证。本申请在此不展开如何进行主认证流程，可参照现有技术来理解。
此外，终端设备根据终端设备与第一网络进行接入认证所用的第一认证信息确定终端设备与第二网络进行接入认证所用的第二认证信息可以理解为终端设备参考第一认证信息确定第二认证信息，或者基于第一认证信息中的某些参数推演第二认证信息，本申请在此不对如何确定第二认证信息进行限定，如，第一网络为宏网，第二网络为IOPS网络，终端设备可根据终端设备与宏网的第一认证信息确定终端设备与IOPS网络的第二认证信息；第一网络为IOPS网络，第二网络为宏网，终端设备可根据终端设备与IOPS网络的第一认证信息确定终端设备与宏网的第二认证信息，本申请在此不具体限定。
可选的，终端设备将第一认证信息作为输入参数，生成第二认证信息。具体可以为，终端设备将第一认证信息作为密钥推演函数(key derivation function，KDF)的输入参数，将密钥推演函数的输出作为第二认证信息，其中密钥推演函数可以是现有标准中的KDF函数。通过该方式推演的第二认证信息可以适配两个网络接入认证的需求，避免采用两套不同的认证信息与不同的网络进行接入认证，可以提高数据处理效率。
可选的，第一认证信息包括以下中的一种或多种：CK、IK、SQN、KAUSF、KSEAF、KAMF。 终端设备根据终端设备第一网络主认证产生的密钥推演获取第二认证信息，可以是根据第一网络与UE在主认证流程中生成的CK和IK进一步推演第二认证信息，推演方式具体如下：
使用CK和IK作为密钥推演函数(key derivation function，KDF)的输入，获取密钥推演函数的输出信息作为第二认证信息，或者使用CK和IK作为密钥推演函数的输入，获取密钥推演函数的输出信息和SQN参数一起作为第二认证信息。
也可以是根据第一网络与UE在主认证流程中生成的KAUSF、KSEAF和KAMF中的一个或多个进一步推演，则此时第一UDM需要先向AUSF、SEAF或AMF获取KAUSF、KSEAF和KAMF中的一个或多个后再进一步生成第一认证信息，推演方式具体如下：
使用KAUSF、KSEAF和KAMF中的一个或多个作为密钥推演函数(key derivation function，KDF)的输入，获取密钥推演函数的输出信息作为第二认证信息，或者使用KAUSF、KSEAF和KAMF中的一个或多个作为密钥推演函数的输入，获取密钥推演函数的输出信息和SQN参数一起作为第二认证信息。
本申请在实际应用时，不对推演方式进行限定，可采用上述推演方式中一种进行推演，还可以采用其他推演方式进行推演，如终端设备与第一网络约定推演规则进行推演等，本申请在此不具体限定。
可选的，终端设备根据第一认证信息，确定第二认证信息，可能是受到如下触发条件的触发，具体如下：
条件1、终端设备接收到来自第一网络的用于指示终端设备生成第二认证信息的指示信息的情况下，根据接入第一认证信息确定第二认证信息。
需要说明的是，该指示信息可以为第一网络单独指示的信息，也即该指示信息仅用于指示终端设备生成第二认证信，其中，单独的指示信息的形式可以是使用专用的消息用于隐式指示，也可是使用专用的指示信息指示；该指示信息还可以为第一网络通过其他信息携带，也即该指示信息携带在其他信息中，通过该方式可以节约信令，具体采用哪种方式进行指示本申请在此不具体限定。
条件2、终端设备具有接入第二网络的能力的情况下，根据第一认证信息确定第二认证信息。
需要说明的是，假定第二网络为IOPS网络，终端设备具有接入第二网络的能力可以理解为终端设备支持与IOPS网络建立连接，终端设备在确定支持与IOPS网络建立连接的情况下，可直接根据第一认证信息确定第二认证信息。需要说明的是，终端设备支持与IOPS网络建立连接，可以是终端设备根据内部信息确定，例如从USIM app获取了支持IOPS网络的指示，或从USIM app获取了IOPS网络的签约信息，也可以是移动设备预配置了支持IOPS网络的能力信息。
条件3、终端设备接收到第二网络的标识信息，确定与第二网络建立连接的情况下，根据第一认证信息确定第二认证信息。
需要说明的是，终端设备可能接收到来自支持为第二网络提供服务的接入网设备的广播消息，该消息中包括第二网络的标识，如广播的标识为PLMN1，终端设备在确定可以与标识为PLMN1的第二网络建立连接的情况下，可直接根据第一认证信息确定第二认证信息。终端设备在确定可以与第二网络的标识对应的第二网络建立连接，具体为终端设备根据第二网络的标识，确定需要接入第二网络。
此外，还要说明的是，在实际应用时，终端设备可能接收到上述任一触发条件的触发，还可能是接收到上述多个触发条件的触发，如，终端设备同时接收到条件1以及条件2的触发；终端设备同时接收到条件1以及条件3的触发；终端设备同时接收到条件1、条件2以及条件3的触发，本申请在此仅示例性描述，并不具体限定。
本申请中，终端设备可根据第一网络的指示信息触发确定第二认证信息，还可在确定自身具有接入第二网络的能力的情况下，确定第二认证信息，还可在接收到第二网络的标识信息，确定与第二网络建立连接的情况下，确定第二认证信息，还可能是上述3种情况的结合，本申请在此不具体限定，可根据实际需求灵活确定，通过该方式，终端设备可以明确知晓确定第二认证信息的时机，而不是预先确定第二认证信息，可以保证数据处理的时效性和可靠性。
步骤402，终端设备接收来自第二网络的认证请求后，根据第二认证信息与第二网络进行接入认证。
具体的，根据第二认证信息与第二网络进行接入认证，可以是使用第二认证信息全部或部分作为终端设备与第二网络进行主认证所需的根密钥，也可以是使用终端设备与第二网络进行主认证所需的根密钥和第二认证信息进一步获取主认证流程中发送给第二网络的认证信息，例如XMAC和/或RES等信息。
本申请中，第一网络和第二网络为两个不同的网络，通常是终端若可以接入两个网络需要推演两套不同的认证信息分别与对应的网络进行接入认证，但是本申请中，终端设备可基于某个网络的认证信息确定另一网络的认证信息，通过该方式可以减少接入认证的复杂度，且减少了设备数据计算量，且在终端设备中也无需存储大量的认证信息，还可以减少终端设备中的数据存储量，节约设备的存储空间，进一步地采用本申请的方案可以提高数据处理效率。
为了更好地说明本申请的方案，附图5A和5B采用移动设备(ME)、用户身份识别模块(USIM app)(其中，ME与USIM app构成UE，在图5A中UE包括USIM app，在图5B中UE的USIM app为可选的)、第一网络以及第二网络之间的数据交互为例来说明。在该实施例中，以第一网络为宏网，第二网络为IOPS网络(也即下文所述的IOPS核心网)，第一UDM属于宏网，第二UDM属于IOPS网络为例来说明，在图5A中，具体如下：
步骤0：UE接入宏网，与宏网完成主认证流程。
宏网根据与UE主认证后生成的密钥获取IOPS模式下的根密钥，记为KIOPS(也即第二认证信息)。宏网将KIOPS发送给IOPS核心网。其中，KIOPS为UE与宏网共享的密钥，KIOPS可以根据宏网和UE之间主认证流程中生成的CK和IK进一步推演，也可以根据宏网和UE之间主认证流程中生成的KAUSF、KSEAF或KAMF进一步推演，此处不作限定。可参照上述终端设备推演第二认证信息的方式来理解，在此不赘述。在实际应用时，宏网可根据AMF的触发，或者宏网UDM的数据处理，根据第一认证信息确定第二认证信息，本申请在此不具体限定。
步骤1：ME根据触发条件确定指示USIM app生成KIOPS，触发条件如下：
触发条件a：ME根据从宏网获取的IOPS指示确定需要指示USIM app生成KIOPS(也即上述的条件1)。具体的，ME可以与任意与宏网交互的消息中获取IOPS指示，例如UE 从注册成功消息中获取IOPS指示，或UE根据UE配置更新流程中的UE配置更新命令(UE configuration update command)消息获取IOPS指示。
触发条件b：ME根据自身设备支持IOPS接入，确定需要指示USIM app生成KIOPS(也即上述的条件2)。具体的，ME支持IOPS接入，即ME支持与IOPS网络建立连接，ME可以根据从USIM app获取了支持IOPS网络的指示确定ME支持IOPS接入，ME还可以根据从USIM app获取了IOPS网络的签约信息确定ME支持IOPS接入，ME也可以根据ME设备中预配置了支持IOPS网络的能力信息确定ME支持IOPS接入。
触发条件c：ME获取到具有IOPS功能的接入网设备广播的IOPS PLMN ID，确定需要与IOPS网络建立连接，进一步的确定需要指示USIM app生成KIOPS(也即上述的条件3)。具体的，ME确定与IOPS网络建立链接可以是在ME搜索不到除IOPS网络以外的其他可接入网络的PLMN信息时，确定需要接入IOPS网络，或者，ME确定与IOPS网络建立链接可以是根据运营商配置ME接收到IOPS网络的PLMN信息后默认接入IOPS网络。
本申请中，具有IOPS功能的接入网设备为可支持接入宏网核心网和IOPS核心网的RAN节点，可以是IOPS-capable gNB或IOPS-capable NG-RAN(next generation radio access network)，即同时支持接入5G宏网核心网和5G IOPS核心网的gNB节点或同时支持接入5G宏网核心网和5G IOPS核心网的NG-RAN节点。在触发条件c之前，IOPS功能接入网设备还在检测到宏网断链后，与IOPS核心网建立回传链接。
可选的，ME指示USIM app确定第二认证信息；USIM app确定第二认证信息，在实际应用时，可参照步骤2来执行。ME还可通过IOPS网络的上下文信息的指示信息指示USIM app确定第二认证信息。本申请在此不具体限定。
步骤2:ME向USIM app发送密钥存储指示。
上述的密钥存储指示USIM app确定KIOPS，并存储KIOPS。
可选的，该密钥存储指示同时指示USIM app存储其他用于主认证所需的参数，该参数可以是主认证所需的SQN参数。
可选的，如果KIOPS由KAUSF、KSEAF或KAMF推演，且ME确定USIM app不存储KAUSF、KSEAF或KAMF，ME同时将KAUSF、KSEAF或KAMF发送给USIM app。ME也可不进行确认直接发送KAUSF、KSEAF或KAMF至USIM app。ME确定USIM app不存储KAUSF、KSEAF或KAMF的方法可以为，ME没有从USIM app获取5G安全参数存储指示，具体可参考现有标准。
在实际应用时，移动设备可通过指示信息(上述的密钥存储指示)直接指示用户身份识别模块，以便用户身份识别模块确定第二认证信息，还可通过IOPS网络的上下文信息的指示信息进行指示，还可通过其他方式，本申请在此不具体限定。
步骤3：USIM app根据密钥存储指示推演KIOPS，USIM app存储KIOPS。KIOPS为用于与IOPS网络进行接入认证的根密钥其中，KIOPS可以根据宏网和UE之间主认证流程中生成的CK和IK进一步推演，也可以根据宏网和UE之间主认证流程中生成的KAUSF、KSEAF或KAMF进一步推演，此处不作限定。可参照上述图4步骤401中终端设备推演第二认证信息的方式来理解，在此不赘述。
需要说明的是，USIM app存储KIOPS并确定KIOPS为用于与IOPS网络进行接入认证的根密钥，可以是建立并存储IOPS标识和KIOPS的对应关系，也可以是将KIOPS存储到专用 于存储IOPS的密钥的存储区域，也可以是将KIOPS存储到USIM app中用于存储与IOPS网络进行接入认证所需的上下文信息中，即USIM app可以后续根据IOPS相关的指示信息获取到KIOPS。其中IOPS标识用于指示其对应的信息用于IOPS网络进行接入认证，USIM app可在确定需要与IOPS网络进行接入认证时，确定IOPS标识并用于索引信息，IOPS标识可以是IOPS网络的上下文指示信息。例如，USIM app推演了接入IOPS网络1的密钥后，接入到其他IOPS网络中，当USIM app再次接入IOPS网络1则无需进行密钥推演，直接从存储区域调取与IOPS网络1进行接入认证即可，该方式可节约设备的处理资源，提高数据处理效率。
可选的，USIM app同时确定并存储其他用于UE与IOPS网络主认证所需的参数，具体为，USIM app将KIOPS和其他用于UE与IOPS网络主认证所需的参数存储到USIM app中用于存储与IOPS网络进行接入认证所需的上下文信息中，也可为USIM app确定并存储IOPS标识、KIOPS、UE与IOPS网络主认证所需参数的对应关系。
步骤4：ME触发与IOPS网络建立连接以接入IOPS网络，与IOPS网络进行主认证。
可选的，如果步骤1并非由触发条件c触发，则在此步骤4之前支持IOPS功能的接入网设备还可在检测到宏网断链后，与IOPS网络建立回传链接，且ME根据支持IOPS功能的接入网设备广播的IOPS PLMN ID，确定需要与IOPS核心网建立连接，之后IOPS网络可向ME发起主认证请求。
可选的，ME接收来自第二网络的认证请求后，ME确定第二网络的上下文信息的指示信息，ME将第二网络的上下文信息的指示信息发送至USIM app；USIM app根据第二网络的上下文信息的指示信息，获取第二网络的上下文中的第二认证信息；USIM app采用第二认证信息与第二网络进行接入认证。具体可参照下述步骤5-7来理解。
其中，第一认证信息与第二认证信息存储于用户身份识别模块。
本申请中，第一认证信息与第二认证信息均存储在用户身份识别模块中，终端设备无需设置两张UICC卡，也无需部署两个不同的app，可以降低终端设备的处理复杂度。
步骤5：ME获取到IOPS网络的主认证请求后，确定该主认证请求用于与IOPS网络进行主认证，ME确定IOPS网络上下文信息的指示信息。其中IOPS网络上下文信息的指示信息用于指示需要使用IOPS网络上下文信息与IOPS网络进行主认证。
具体的实现方式可以是ME确定AUTHENTICATION command命令，其中，AUTHENTICATION command中包括步骤5确定的IOPS网络上下文信息的指示信息。更具体的，ME将IOPS网络上下文信息的指示信息包括在AUTHENTICATION command消息中的P2域中，即AUTHENTICATION command中P2域内的值为IOPS网络上下文信息的指示信息。
步骤6：ME向USIM app发送IOPS网络上下文信息的指示信息。
本方法使得USIM app可以通过IOPS网络的上下文信息的指示信息确定IOPS网络的上下文中的第二认证信息，基于第二认证信息与IOPS网络进行接入认证，可以提高数据处理效率。
步骤7：USIM app根据IOPS网络上下文信息的指示信息确定需要使用与IOPS网络进行接入认证，USIM app确定需要使用KIOPS执行主认证流程。
可选的，USIM app还可根据IOPS网络上下文信息的指示信息确定需要使用与IOPS网络进行接入认证，USIM app还确定认证所需的其他参数信息，例如SQN。
需要说明的是，USIM app根据与IOPS网络上下文信息的指示信息确定KIOPS和/或认证所需的其他参数信息，可以是根据IOPS网络上下文信息的指示信息确定需要使用与IOPS网络进行接入认证后进一步确定IOPS标识，USIM app使用IOPS标识索引到KIOPS和/或认证所需的其他参数信息，也可以是根据IOPS网络上下文信息的指示信息确定需要使用与IOPS网络进行接入认证后，从专用于存储IOPS模式KIOPS和/或认证所需的其他参数信息的存储区域获取KIOPS和/或认证所需的其他参数信息，还可以是也可以是根据IOPS网络上下文信息的指示信息确定需要使用与IOPS网络进行接入认证后，从专用于存储IOPS模式KIOPS和/或认证所需的其他参数信息的上下文信息中获取KIOPS和/或认证所需的其他参数信息。
步骤8：USIM app与网络侧使用KIOPS作为根密钥执行主认证流程。
具体体现于，USIM app在步骤8回复生成的CK、IK、XMAC和RES值，ME根据USIM app的回复消息进一步确定主认证的回复消息，步骤8以及后续网络侧验证主认证回复消息可参考TS 33.501现有技术，此处不再赘述。
在接收到主认证回复消息后，IOPS网络可以通过如下方法中的任意一种确定USIM app确实根据上述步骤生成了KIOPS：
a.IOPS网络没有在主认证回复中接收到认证失败(authentication failure)或同步失败(synchronisation failure)消息。
b.主认证回复消息通过了网络侧验证，即UE成功通过主认证。
在图5B中，具体如下：
步骤0-1可参照上述图5A中步骤0-1的描述，在此不赘述。
步骤2:ME根据步骤1中的触发条件推演KIOPS，存储KIOPS。KIOPS为用于与IOPS网络进行接入认证的根密钥。
其中，KIOPS可以根据宏网和UE之间主认证流程中生成的CK和IK进一步推演，也可以根据宏网和UE之间主认证流程中生成的KAUSF、KSEAF或KAMF进一步推演，此处不作限定。可参照上述图4步骤401中终端设备推演第二认证信息的方式来理解，在此不赘述。
需要说明的是，ME存储KIOPS并确定KIOPS为用于与IOPS网络进行接入认证的根密钥，可以是建立并存储IOPS标识和KIOPS的对应关系，也可以是将KIOPS存储到专用于存储IOPS的密钥的存储区域，也可以是将KIOPS存储到ME中用于存储与IOPS网络进行接入认证所需的上下文信息中，即ME可以后续根据IOPS相关的指示信息获取到KIOPS。其中IOPS标识用于指示其对应的信息用于IOPS网络进行接入认证，ME可在确定需要与IOPS网络进行接入认证时，确定IOPS标识并用于索引信息，IOPS标识可以是IOPS网络的上下文指示信息。例如，ME推演了接入IOPS网络的密钥后，接入到其他IOPS网络中，当ME再次接入IOPS网络1则无需进行密钥推演，直接从存储区域调取与IOPS网络1进行接入认证即可，该方式可节约设备的处理资源，提高数据处理效率。
可选的，ME同时确定并存储其他用于UE与IOPS网络主认证所需的参数，具体为，ME将KIOPS和其他用于UE与IOPS网络主认证所需的参数存储到ME中用于存储与IOPS网络进行接入认证所需的上下文信息中，也可为ME确定并存储IOPS标识、KIOPS、UE与IOPS网络主认证所需参数的对应关系。
步骤3：ME触发与IOPS网络建立连接以接入IOPS网络，与IOPS网络进行主认证。
可选的，如果步骤1并非由触发条件c触发，则在此步骤3之前支持IOPS功能的接入网设备还可在检测到宏网断链后，与IOPS网络建立回传链接，且ME根据支持IOPS功能的接入网设备广播的IOPS PLMN ID，确定需要与IOPS核心网建立连接，之后IOPS网络可向ME发起主认证请求。
步骤4：ME获取到IOPS网络的主认证请求后，确定该主认证请求用于与IOPS网络进行主认证，ME确定与网络侧使用KIOPS作为根密钥执行主认证流程。
具体体现在，ME获取到IOPS网络的主认证请求，确定该主认证请求用于与IOPS网络进行主认证，ME确定KIOPS和/或其他用于UE与IOPS网络主认证所需的参数后确定主认证流程中的CK、IK、XMAC和RES值，ME进一步根据CK、IK、XMAC和RES确定主认证的回复消息，步骤4以及后续网络侧验证主认证回复消息可参考TS 33.501现有技术，此处不再赘述。其中，ME确定KIOPS和/或其他用于UE与IOPS网络主认证所需的参数，可以是ME接收来自IOPS网络的认证请求后，ME需要使用与IOPS网络进行接入认证后从专用于存储IOPS模式KIOPS和/或认证所需的其他参数信息的存储区域获取KIOPS和/或认证所需的其他参数信息，还可以是ME接收来自IOPS网络的认证请求后，ME需要使用与IOPS网络进行接入认证后从专用于存储IOPS模式KIOPS和/或认证所需的其他参数信息的上下文信息中获取KIOPS和/或认证所需的其他参数信息，还可以是ME接收来自IOPS网络的认证请求后，ME需要使用与IOPS网络进行接入认证后进一步确定IOPS标识，ME根据IOPS标识和步骤2中的对应关系确定KIOPS和/或其他用于UE与IOPS网络主认证所需的参数。
本申请中，终端设备可基于某个网络的认证信息确定另一网络的认证信息，通过该方式可以减少接入认证的复杂度，且减少了设备数据计算量，且在终端设备中也无需存储大量的认证信息，还可以减少终端设备中的数据存储量，节约设备的存储空间，进一步地采用本申请的方案可以提高数据处理效率。
为了更好地说明本申请的方案，附图6采用ME、用户身份识别模块(USIM app)(其中，ME与USIM app构成UE)、第一网络以及第二网络之间的数据交互为例来说明。在该实施例中，以第一网络为宏网，第二网络为IOPS网络(也即下文所述的IOPS核心网)，第一UDM属于宏网，第二UDM属于IOPS网络为例来说明，在图6中，具体如下：
步骤0同上述图5A和图5B中的步骤0，在此不赘述。
步骤1：ME获取到具有IOPS功能的接入网设备广播的IOPS PLMN ID，确定IOPS网络建立连接(也即上述图4步骤401中的条件3)。具体为，ME获取到具有IOPS功能的接入网设备广播的IOPS PLMN ID，确定需要与IOPS网络建立连接，进一步的确定需要指示USIM app生成KIOPS。具体的，ME确定与IOPS网络建立链接可以是在ME搜索不到除IOPS网络以外的其他可接入网络的PLMN信息时，确定需要接入IOPS网络，或者，ME确定与IOPS网络建立链接可以是根据运营商配置ME接收到IOPS网络的PLMN信息后默认接入IOPS网络。
步骤2：ME触发与IOPS网络建立连接以接入IOPS网络，与IOPS网络进行主认证。
步骤3：ME获取到IOPS网络的主认证请求后，根据步骤1中ME获取到的IOPS PLMN ID，确定与IOPS核心网建立连接并执行接入认证，ME确定IOPS网络上下文信息的指示信息。其中IOPS网络上下文信息的指示信息用于指示需要使用IOPS网络上下文信息与 IOPS网络进行主认证。
具体的实现方式可以是ME确定AUTHENTICATION command命令，其中，AUTHENTICATION command中包括步骤3确定的IOPS网络上下文信息的指示信息。更具体的，ME将IOPS网络上下文信息的指示信息包括在AUTHENTICATION command消息中的P2域中，即AUTHENTICATION command中P2域内的值为IOPS网络上下文信息的指示信息。
步骤4：ME向USIM app发送IOPS网络上下文信息的指示信息。
可选的，如果KIOPS由KAUSF、KSEAF或KAMF推演，且ME确定USIM app不存储KAUSF、KSEAF或KAMF，ME在步骤4中同时将KAUSF、KSEAF或KAMF发送给USIM app。ME也可不进行确认直接发送KAUSF、KSEAF或KAMF至USIM app。ME确定USIM app不存储KAUSF、KSEAF或KAMF的方法可以为，ME没有从USIM app获取5G安全参数存储指示，具体可参考现有标准。
步骤5：USIM app根据IOPS网络上下文信息的指示信息确定需要使用与IOPS网络进行接入认证，USIM app确定推演KIOPS，并使用该KIOPS作为根密钥执行与IOPS网络的主认证流程。
其中，KIOPS可以根据宏网和UE之间主认证流程中生成的CK和IK进一步推演，也可以根据宏网和UE之间主认证流程中生成的KAUSF、KSEAF或KAMF进一步推演，此处不作限定。可参照上述图4步骤401中终端设备推演第二认证信息的方式来理解，在此不赘述。
可选的，USIM app还同时根据IOPS网络上下文信息的指示信息确定认证所需的其他参数信息，例如SQN。
步骤6：USIM app与网络侧使用KIOPS作为根密钥执行主认证流程。具体可参照上述附图5A中步骤8的描述。
与上述附图5A实施例的不同在于，USIM app省去了根据IOPS指示信息调用存储过的KIOPS的过程，省去了存储过程减少了存储负担。
为了更好地说明本申请的方案，附图7采用ME、用户身份识别模块(USIM app)(其中，ME与USIM app构成UE)、第一网络以及第二网络之间的数据交互为例来说明。在该实施例中，以第一网络为宏网，第二网络为IOPS网络(也即下文所述的IOPS核心网)，第一UDM属于宏网，第二UDM属于IOPS网络为例来说明，在图7中，具体如下：
步骤0-4同上述图6中的步骤0-4，在此不赘述。
可选的，ME不向USIM app发送推演KIOPS所需的参数，USIM app主动向ME请求推演KIOPS所需的参数，具体地，USIM app在获取到ME发送的IOPS网络上下文信息的指示信息后，向移动设备请求第一认证信息；USIM app根据第一认证信息确定第二认证信息，并采用第二认证信息与第二网络进行接入认证。具体可参照步骤5-6来理解。
步骤5：USIM app向ME请求获取KAUSF、KSEAF或KAMF中的一项或多项。
步骤6：ME将KAUSF、KSEAF或KAMF中的一项或多项发送至USIM app。
步骤7：USIM app推演KIOPS，并使用该KIOPS作为根密钥执行与IOPS网络的主认证流程。
其中，KIOPS可以根据宏网和UE之间主认证流程中生成的CK和IK进一步推演，也 可以根据宏网和UE之间主认证流程中生成的KAUSF、KSEAF或KAMF进一步推演，此处不作限定。可参照上述图4步骤401中终端设备推演第二认证信息的方式来理解，在此不赘述。
步骤8：同上述图5A中的步骤8在此不赘述。
为了更好地说明本申请的方案，附图8A和8B采用ME、用户身份识别模块(USIM app)(其中，ME与USIM app构成UE，在图8A中UE包括USIM app，在图8B中UE的USIM app为可选的)、第一网络以及第二网络之间的数据交互为例来说明。在该实施例中，以第一网络为宏网，第二网络为IOPS网络(也即下文所述的IOPS核心网)，第一UDM属于宏网，第二UDM属于IOPS网络为例来说明，在图8A中，具体如下：
步骤0-1同上述图6中步骤0-1。
可选的，终端设备从第二网络获取的认证请求中包括：第二网络的指示信息，终端设备根据第二网络的指示信息、第二认证信息与第二网络进行接入认证。具体可参照下述步骤2来理解。
步骤2：IOPS网络向ME发起主认证请求，IOPS网络通过主认证请求指示UE本次主认证请求属于与IOPS网络进行主认证。
具体的，IOPS网络在主认证请求中携带IOPS指示信息，也可以是IOPS网络在认证向量中的认证管理字段(authentication management field，AMF)中携带IOPS指示信息，例如在认证管理字段的第8-15位中携带IOPS指示信息。
步骤3：ME获取到IOPS网络的主认证请求后，确定与IOPS核心网建立连接并执行接入认证，ME确定IOPS网络上下文信息的指示信息。其中IOPS网络上下文信息的指示信息用于指示需要使用IOPS网络上下文信息与IOPS网络进行主认证。
可选的，如果IOPS网络使用认证管理字段携带IOPS指示信息，则ME也可不确定IOPS网络上下文信息的指示信息来指示USIM app需要使用IOPS网络上下文信息与IOPS网络进行主认证，而改为由USIM app获取到认证管理字段后根据其中的IOPS指示信息确定获取KIOPS后与IOPS核心网执行主认证流程。
具体的实现方式可以是ME确定AUTHENTICATION command命令，其中，AUTHENTICATION command中包括步骤3确定的IOPS网络上下文信息的指示信息。更具体的，ME将IOPS网络上下文信息的指示信息包括在AUTHENTICATION command消息中的P2域中，即AUTHENTICATION command中P2域内的值为IOPS网络上下文信息的指示信息。
步骤4：ME向USIM app发送IOPS网络上下文信息的指示信息。
可选的，如果KIOPS由KAUSF、KSEAF或KAMF推演，且ME确定USIM app不存储KAUSF、KSEAF或KAMF，ME在步骤4中同时将KAUSF、KSEAF或KAMF发送给USIM app。ME也可不进行确认直接发送KAUSF、KSEAF或KAMF至USIM app。ME确定USIM app不存储KAUSF、KSEAF或KAMF的方法可以为，ME没有从USIM app获取5G安全参数存储指示，具体可参考现有标准。
可选的，如果IOPS网络使用AMF携带IOPS指示信息，则也可不由ME确定IOPS网络上下文信息的指示信息来指示USIM app需要使用IOPS网络上下文信息与IOPS网络进行主认证，而改为由USIM app获取到AMF后根据其中的IOPS指示信息确定获取KIOPS 后与IOPS核心网执行主认证流程。
步骤5：USIM app根据IOPS网络上下文信息的指示信息确定需要使用与IOPS网络进行接入认证，USIM app确定需要使用KIOPS执行主认证流程。
步骤6同上述图5A中的步骤8在此不赘述。
在图8B中，具体如下：
步骤0-2可参照上述图8A中步骤0-2的描述，在此不赘述。
步骤3：ME获取到IOPS网络的主认证请求后，确定与IOPS核心网建立连接并执行接入认证，ME确定KIOPS并与网络侧使用KIOPS作为根密钥执行主认证流程。其中，KIOPS可以根据宏网和UE之间主认证流程中生成的CK和IK进一步推演，也可以根据宏网和UE之间主认证流程中生成的KAUSF、KSEAF或KAMF进一步推演，此处不作限定。可参照上述图4步骤401中终端设备推演第二认证信息的方式来理解，在此不赘述。
上述主要从设备交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，为了实现上述功能，各个设备可以包括执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请的实施例能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对设备进行功能单元的划分，例如，可以对应各个功能划分各个功能单元，也可以将两个或两个以上的功能集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
在采用集成的单元的情况下，图9示出了本申请实施例中所涉及的通信装置的可能的示例性框图。如图9所示，通信装置900可以包括：处理单元901和收发单元902。处理单元901用于对通信装置900的动作进行控制管理。收发单元902用于支持通信装置900与其他设备的通信。可选地，收发单元902可以包括接收单元和/或发送单元，分别用于执行接收和发送操作。可选的，通信装置900还可以包括存储单元，用于存储通信装置900的程序代码和/或数据。所述收发单元可以称为输入输出单元、通信单元等，所述收发单元可以是收发器；所述处理单元可以是处理器。当通信装置是通信设备中的模块(如，芯片)时，所述收发单元可以是输入输出接口、输入输出电路或输入输出管脚等，也可以称为接口、通信接口或接口电路等；所述处理单元可以是处理器、处理电路或逻辑电路等。具体地，该装置可以为上述的UE等。
在一个实施例中，通信装置900的处理单元901，用于根据与第一网络进行接入认证所用的第一认证信息确定与第二网络进行接入认证所用的第二认证信息；第一网络与第二网络不同；收发单元902，用于接收来自第二网络的认证请求后，根据第二认证信息与第二网络进行接入认证。
可选的，收发单元902接收到来自第一网络的用于指示终端设备生成第二认证信息的指示信息的情况下，处理单元901根据接入第一认证信息确定第二认证信息；和/或，通信装置具有接入第二网络的能力的情况下，处理单元902根据第一认证信息确定第二认证信 息；和/或，收发单元902接收到第二网络的标识信息，确定与第二网络建立连接的情况下，处理单元901根据第一认证信息确定第二认证信息。
可选的，通信装置900包括：移动设备和用户身份识别模块，移动设备指示用户身份识别模块根据第一认证信息确定第二认证信息；用户身份识别模块根据第一认证信息确定第二认证信息。
可选的，移动设备通过第二网络的上下文信息的指示信息指示用户身份识别模块获取第二认证信息。
可选的，移动设备接收来自第二网络的认证请求后，将第二网络的上下文信息的指示信息发送至用户身份识别模块；用户身份识别模块根据第二网络的上下文信息的指示信息，获取第二网络的上下文中的第二认证信息；采用第二认证信息与第二网络进行接入认证。
可选的，第一认证信息与第二认证信息存储于用户身份识别模块。
可选的，用户身份识别模块向移动设备请求第一认证信息；用户身份识别模块根据第一认证信息确定第二认证信息，并采用第二认证信息与第二网络进行接入认证。
可选的，认证请求中包括：第二网络的指示信息，终端设备根据第二网络的指示信息、第二认证信息与第二网络进行接入认证。
可选的，处理单元901用于将第一认证信息作为输入参数，生成第二认证信息。
可选的，第一认证信息包括以下中的一种或多种：CK、IK、SQN参数、KAUSF、KSEAF、KAMF。
可选的，第一网络为IOPS网络或私网，第二网络为宏网络；或，第一网络为宏网络，第二网络为IOPS网络或私网。
如图10所示，为本申请还提供的一种通信装置1000。通信装置1000可以是芯片或芯片系统。该通信装置可以位于上述任一方法实施例所涉及的设备中，例如UE等，以执行该设备所对应的动作。
可选的，芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
通信装置1000包括处理器1010。
处理器1010，用于执行存储器1020中存储的计算机程序，以实现上述任一方法实施例中各个设备的动作。
通信装置1000还可以包括存储器1020，用于存储计算机程序。
可选地，存储器1020和处理器1010之间耦合。耦合是装置、单元或模块之间的间接耦合或通信连接，可以是电性，机械或其它的形式，用于装置、单元或模块之间的信息交互。可选的，存储器1020与处理器1010集成在一起。
其中，处理器1010和存储器1020均可以为一个或多个，不予限制。
可选的，在实际应用中，通信装置1000中可以包括收发器1030，也可不包括收发器1030，图中以虚线框来示意，通信装置1000可以通过收发器1030和其它设备进行信息交互。收发器1030可以是电路、总线、收发器或者其它任意可以用于进行信息交互的装置。
在一种可能的实施方式中，该通信装置1000可以为上述各方法实施中的UE。
本申请实施例中不限定上述收发器1030、处理器1010以及存储器1020之间的具体连接介质。本申请实施例在图10中以存储器1020、处理器1010以及收发器1030之间通过总线连接，总线在图10中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图10 中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。在本申请实施例中，处理器可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，可以实施或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
在本申请实施例中，存储器可以是非易失性存储器，比如硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)等，还可以是易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)。存储器还可以是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。本申请实施例中的存储器还可以是电路或者其它任意能够实施存储功能的装置，用于存储计算机程序、程序指令和/或数据。
基于以上实施例，参见图11，本申请实施例还提供另一种通信装置1100，包括：接口电路1110和逻辑电路1120；接口电路1110，可以理解为输入输出接口，可用于执行上述任一方法实施例中各个设备的收发步骤，逻辑电路1120可用于运行代码或指令以执行上述任一实施例中各个设备执行的方法，不再赘述。
基于以上实施例，本申请实施例还提供一种计算机可读存储介质，该计算机可读存储介质存储有指令，当所述指令被执行时，使上述任一方法实施例中各个设备执行的方法被实施，例如，使得图4所示实施例中终端设备执行的方法被实施。该计算机可读存储介质可以包括：U盘、移动硬盘、只读存储器、随机存取存储器、磁碟或者光盘等各种可以存储程序代码的介质。
基于以上实施例，本申请实施例提供一种通信系统，该通信系统包括上述任一方法实施例中提及的终端设备，可用于执行上述任一方法实施例中各个设备执行的方法。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、装置(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理装置的处理器以产生一个机器，使得通过计算机或其他可编程数据处理装置的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理装置以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理装置上，使得在计算机或其他可编程装置上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他 可编程装置上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。

Claims (28)

  1. 一种通信方法，其特征在于，包括：
    终端设备根据与第一网络进行接入认证所用的第一认证信息确定与第二网络进行接入认证所用的第二认证信息；所述第一网络与所述第二网络不同；
    所述终端设备接收来自所述第二网络的认证请求后，根据所述第二认证信息与所述第二网络进行接入认证。
  2. 根据权利要求1所述的方法，其特征在于，所述终端设备根据与第一网络进行接入认证所用的第一认证信息确定与第二网络进行接入认证所用的第二认证信息，包括：
    所述终端设备接收到来自所述第一网络的用于指示所述终端设备生成第二认证信息的指示信息的情况下，根据接入所述第一认证信息确定所述第二认证信息；和/或，
    所述终端设备具有接入所述第二网络的能力的情况下，根据所述第一认证信息确定所述第二认证信息；和/或，
    所述终端设备接收到所述第二网络的标识信息，确定与所述第二网络建立连接的情况下，根据所述第一认证信息确定所述第二认证信息。
  3. 根据权利要求1或2所述的方法，其特征在于，所述终端设备包括：移动设备和用户身份识别模块，所述终端设备根据与第一网络进行接入认证所用的第一认证信息确定与第二网络进行接入认证所用的第二认证信息包括：
    所述移动设备指示所述用户身份识别模块根据所述第一认证信息确定所述第二认证信息；
    所述用户身份识别模块根据所述第一认证信息确定所述第二认证信息。
  4. 根据权利要求3所述的方法，其特征在于，所述移动设备指示所述用户身份识别模块根据所述第一认证信息确定所述第二认证信息，包括：
    所述移动设备通过所述第二网络的上下文信息的指示信息指示所述用户身份识别模块获取所述第二认证信息。
  5. 根据权利要求3或4所述的方法，其特征在于，所述终端设备接收来自所述第二网络的认证请求后，根据所述第二认证信息与所述第二网络进行接入认证，包括：
    所述移动设备接收来自所述第二网络的认证请求后，所述移动设备将所述第二网络的上下文信息的指示信息发送至所述用户身份识别模块；
    所述用户身份识别模块根据所述第二网络的上下文信息的指示信息，获取所述第二认证信息；
    所述用户身份识别模块采用所述第二认证信息与所述第二网络进行接入认证。
  6. 根据权利要求4或5所述的方法，其特征在于，所述第一认证信息和所述第二认证信息存储于所述用户身份识别模块。
  7. 根据权利要求5所述的方法，其特征在于，所述用户身份识别模块采用所述第二认证信息与所述第二网络进行接入认证，包括：
    所述用户身份识别模块向所述移动设备请求所述第一认证信息；
    所述用户身份识别模块根据所述第一认证信息确定所述第二认证信息，并采用所述第二认证信息与所述第二网络进行接入认证。
  8. 根据权利要求1-7中任一所述的方法，其特征在于，所述认证请求中包括：所述第 二网络的指示信息，根据所述第二认证信息与所述第二网络进行接入认证，包括：
    所述终端设备根据所述第二网络的指示信息确定使用所述第二认证信息与所述第二网络进行接入认证。
  9. 根据权利要求1-8中任一所述的方法，其特征在于，所述终端设备根据与第一网络进行接入认证所用的第一认证信息确定与第二网络进行接入认证所用的第二认证信息，包括：
    所述终端设备将所述第一认证信息作为输入参数，获取所述第二认证信息。
  10. 根据权利要求1-9中任一所述的方法，其特征在于，所述第一认证信息包括以下中的一种或多种：机密性密钥CK、完整性密钥IK、序号SQN、AUSF密钥KAUSF、SEAF密钥KSEAF、AMF密钥KAMF。
  11. 根据权利要求1-10中任一所述的方法，其特征在于，所述第一网络为公共安全隔离运营IOPS网络或私网，所述第二网络为宏网络；或，所述第一网络为所述宏网络，所述第二网络为所述IOPS网络或所述私网。
  12. 一种通信装置，其特征在于，包括：
    处理单元，用于根据与第一网络进行接入认证所用的第一认证信息确定与第二网络进行接入认证所用的第二认证信息；所述第一网络与所述第二网络不同；
    收发单元，用于接收来自所述第二网络的认证请求后，根据所述第二认证信息与所述第二网络进行接入认证。
  13. 根据权利要求12所述的装置，其特征在于，所述收发单元用于：
    接收到来自所述第一网络的用于指示所述通信装置生成第二认证信息的指示信息的情况下，根据接入所述第一认证信息确定所述第二认证信息；和/或，
    所述通信装置具有接入所述第二网络的能力的情况下，根据所述第一认证信息确定所述第二认证信息；和/或，
    接收到所述第二网络的标识信息，确定与所述第二网络建立连接的情况下，根据所述第一认证信息确定所述第二认证信息。
  14. 根据权利要求12或13所述的装置，其特征在于，所述通信装置包括：移动设备和用户身份识别模块，所述处理单元用于：
    通过所述移动设备指示所述用户身份识别模块根据所述第一认证信息确定所述第二认证信息；
    通过所述用户身份识别模块根据所述第一认证信息确定所述第二认证信息。
  15. 根据权利要求14所述的装置，其特征在于，所述处理单元用于：
    通过所述第二网络的上下文信息的指示信息指示所述用户身份识别模块获取所述第二认证信息。
  16. 根据权利要求14或15所述的装置，其特征在于，所述收发单元用于：
    通过所述移动设备接收来自所述第二网络的认证请求后，所述移动设备将所述第二网络的上下文信息的指示信息发送至所述用户身份识别模块；
    通过所述用户身份识别模块根据所述第二网络的上下文信息的指示信息，获取所述第二认证信息；所述用户身份识别模块采用所述第二认证信息与所述第二网络进行接入认证。
  17. 根据权利要求15或16所述的装置，其特征在于，所述第一认证信息和所述第二认证信息存储于所述用户身份识别模块。
  18. 根据权利要求16所述的装置，其特征在于，所述处理单元用于：
    向所述移动设备请求所述第一认证信息；
    根据所述第一认证信息确定所述第二认证信息，并采用所述第二认证信息与所述第二网络进行接入认证。
  19. 根据权利要求12-18中任一所述的装置，其特征在于，所述认证请求中包括：所述第二网络的指示信息，所述处理单元，用于：
    根据所述第二网络的指示信息确定使用所述第二认证信息与所述第二网络进行接入认证。
  20. 根据权利要求12-19中任一所述的装置，其特征在于，所述处理单元用于：
    将所述第一认证信息作为输入参数，获取所述第二认证信息。
  21. 根据权利要求12-20中任一所述的装置，其特征在于，所述第一认证信息包括以下中的一种或多种：机密性密钥CK、完整性密钥IK、序号SQN、AUSF密钥KAUSF、SEAF密钥KSEAF、AMF密钥KAMF。
  22. 根据权利要求12-21中任一所述的装置，其特征在于，所述第一网络为公共安全隔离运营IOPS网络或私网，所述第二网络为宏网络；或，所述第一网络为所述宏网络，所述第二网络为所述IOPS网络或所述私网。
  23. 一种通信装置，其特征在于，包括：至少一个处理器和存储器；
    所述存储器，用于存储计算机程序或指令；
    所述至少一个处理器，用于执行所述计算机程序或指令，以使得如权利要求1-11中任一项所述的方法被执行。
  24. 一种芯片系统，其特征在于，所述芯片系统包括：处理电路；所述处理电路与存储介质耦合；
    所述处理电路，用于执行所述存储介质中的部分或者全部计算机程序或指令，当所述部分或者全部计算机程序或指令被执行时，用于实现如权利要求1-11中任一项所述的方法。
  25. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有指令，当所述指令被计算机执行时，使得如权利要求1-11中任一项所述的方法被执行。
  26. 一种包含计算机程序或指令的计算机程序产品，其特征在于，当其在计算机上运行时，使得上述权利要求1-11中任一项所述的方法被执行。
  27. 一种通信方法，其特征在于，包括：
    终端设备根据与第一网络进行接入认证所用的第一认证信息确定与第二网络进行接入认证所用的第二认证信息；所述第一网络与所述第二网络不同；
    所述第二网络向所述终端设备发送认证请求；
    所述终端设备接收来自所述第二网络的认证请求后，根据所述第二认证信息与所述第二网络进行接入认证。
  28. 一种通信系统，其特征在于，包括终端设备和通信设备，其中：
    所述终端设备用于：
    根据与第一网络进行接入认证所用的第一认证信息确定与第二网络进行接入认证所用的第二认证信息；所述第一网络与所述第二网络不同；
    接收来自所述第二网络的认证请求后，根据所述第二认证信息与所述第二网络进行接入认证；
    所述通信设备为所述第二网络的设备，且用于向所述终端设备发送所述认证请求。
PCT/CN2023/088762 2022-05-06 2023-04-17 一种通信方法及通信装置 WO2023213184A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210488537.1A CN117062161A (zh) 2022-05-06 2022-05-06 一种通信方法及通信装置
CN202210488537.1 2022-05-06

Publications (1)

Publication Number Publication Date
WO2023213184A1 true WO2023213184A1 (zh) 2023-11-09

Family

ID=88646250

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/088762 WO2023213184A1 (zh) 2022-05-06 2023-04-17 一种通信方法及通信装置

Country Status (2)

Country Link
CN (1) CN117062161A (zh)
WO (1) WO2023213184A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103209107A (zh) * 2013-04-08 2013-07-17 汉柏科技有限公司 一种实现用户访问控制的方法
WO2020173863A1 (en) * 2019-02-27 2020-09-03 Telefonaktiebolaget Lm Ericsson (Publ) Non-public network authentication in 5g
CN112219415A (zh) * 2018-04-05 2021-01-12 诺基亚技术有限公司 在第一网络中使用用于第二旧网络的订户标识模块的用户认证
WO2021134719A1 (zh) * 2019-12-31 2021-07-08 华为技术有限公司 一种通信方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103209107A (zh) * 2013-04-08 2013-07-17 汉柏科技有限公司 一种实现用户访问控制的方法
CN112219415A (zh) * 2018-04-05 2021-01-12 诺基亚技术有限公司 在第一网络中使用用于第二旧网络的订户标识模块的用户认证
WO2020173863A1 (en) * 2019-02-27 2020-09-03 Telefonaktiebolaget Lm Ericsson (Publ) Non-public network authentication in 5g
WO2021134719A1 (zh) * 2019-12-31 2021-07-08 华为技术有限公司 一种通信方法及装置

Also Published As

Publication number Publication date
CN117062161A (zh) 2023-11-14

Similar Documents

Publication Publication Date Title
US11895157B2 (en) Network security management method, and apparatus
WO2022257549A1 (zh) 网络切片方法、设备及存储介质
JP2022502908A (ja) Ｎａｓメッセージのセキュリティ保護のためのシステム及び方法
WO2021136211A1 (zh) 授权结果的确定方法及装置
US20220272607A1 (en) Network Access Method and Communication Apparatus
KR20140028100A (ko) 중계 노드에 대한 네트워크 부착 방법 및 관련 장치
EP3522668B1 (en) Method and device for trust relationship establishment
WO2018170703A1 (zh) 一种连接建立方法及装置
EP3955613A1 (en) Secondary authentication method and apparatus
US20230079012A1 (en) Communication method and communication apparatus
WO2023024931A1 (zh) 用于设备间通信的方法和装置
WO2023213184A1 (zh) 一种通信方法及通信装置
WO2021212497A1 (zh) 安全认证方法、装置、设备及存储介质
WO2020220862A1 (zh) 一种通信方法及装置
WO2023213208A1 (zh) 一种通信方法及通信装置
WO2021201729A1 (en) Faster release or resume for ue in inactive state
KR101780401B1 (ko) 무선 통신 시스템에서의 인증 및 보안 설정을 위한 방법 및 이를 위한 장치
US11881961B2 (en) Communication method and related apparatus
WO2021057456A1 (zh) 用于注册的方法和装置
US20230354028A1 (en) Method, system, and apparatus for generating key for inter-device communication
WO2024027320A1 (zh) 无线通信的方法、装置和系统
US20220174488A1 (en) Communication method and related device
EP4274310A1 (en) Network intercommunication method and apparatus
WO2021088060A1 (zh) 通信方法及装置
WO2021087696A1 (zh) 身份认证方法及通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23799171

Country of ref document: EP

Kind code of ref document: A1