WO2023213208A1 - Procédé de communication et appareil de communication - Google Patents

Procédé de communication et appareil de communication Download PDF

Info

Publication number
WO2023213208A1
WO2023213208A1 PCT/CN2023/090404 CN2023090404W WO2023213208A1 WO 2023213208 A1 WO2023213208 A1 WO 2023213208A1 CN 2023090404 W CN2023090404 W CN 2023090404W WO 2023213208 A1 WO2023213208 A1 WO 2023213208A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
information
access
data management
authentication information
Prior art date
Application number
PCT/CN2023/090404
Other languages
English (en)
Chinese (zh)
Inventor
雷骜
吴义壮
杨艳梅
崔洋
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023213208A1 publication Critical patent/WO2023213208A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H04W48/04—Access restriction performed under specific conditions based on user or terminal location or mobility data, e.g. moving direction, speed
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information

Definitions

  • the embodiments of the present application relate to the field of communication technology, and in particular, to a communication method and a communication device.
  • Isolated e-utran operation for public safety (IOPS) technology is introduced into the long term evolution (LTE) system in the 3rd generation mobile communications partnership project (3GPP) R13 version.
  • LTE long term evolution
  • 3GPP 3rd generation mobile communications partnership project
  • the UE When the UE performs primary authentication with the macro network and the IOPS network, it needs to use different international mobile subscriber identity (IMSI) and different root keys when signing with the macro network. That is, the macro network core network will only store the IMSI and root key used when the UE performs primary authentication with the macro network, and the IOPS core network will only store the IMSI and root key used when the UE performs primary authentication with the IOPS network.
  • IMSI international mobile subscriber identity
  • This application provides a communication method and communication device to reduce the complexity of access authentication and improve data processing efficiency.
  • this application provides a communication method, including:
  • the first unified data management unit determines the second authentication information used by the terminal device for access authentication with the second network based on the first authentication information used by the terminal device for access authentication with the first network.
  • the first unified data management unit belongs to the first unified data management unit.
  • the first unified data management unit determines the second authentication information used by the terminal device to perform access authentication with the second network based on the first authentication information used by the terminal device to perform access authentication with the first network, which can be understood as the first unified data management unit.
  • the data management unit determines the second authentication information with reference to the first authentication information, or deduce the second authentication information based on certain parameters in the first authentication information.
  • This application does not limit how to determine the second authentication information.
  • the first network and the second network are two different networks. Usually, if the terminal can access the two networks, it needs to pre-configure two different sets of authentication information to perform access authentication with the corresponding networks respectively.
  • the first unified data management unit can determine the authentication information of another network based on the authentication information of a certain network. In this way, the terminal can pre-configure only one set of authentication information.
  • This method reduces the complexity of access authentication and reduces the number of device data. The calculation amount is reduced, and there is no need to store a large amount of authentication information in the terminal device and the unified data management unit. It can also reduce the data storage in the terminal device and the unified data management unit. reserves, saving the storage space of the equipment, and further adopting the solution of this application can improve the data processing efficiency.
  • the second authentication information is determined based on the first authentication information.
  • the existence of the permission of the terminal device to access the first network can be understood as the terminal device supports receiving communication services under the first network, such as sending data, receiving data, etc. through the first network.
  • the first unified data management unit can be Other network elements, such as access and mobility management network elements, obtain whether the terminal device has the permission to access the first network. If it is determined that there is, the second authentication information is determined based on the first authentication information. If it is determined that there is no access to the first network.
  • the authority can be determined by the second authentication information. Before determining the second authentication information based on the first authentication information, this application determines that the terminal device has the authority to access the first network to avoid calculating the number of users who do not support receiving services under the first network. Second authentication information of the terminal device.
  • the first unified data management unit receives indication information from the access and mobility management network element, and the indication information is used to trigger the first unified data management unit to determine the second authentication information.
  • the first unified data management network element can determine the second authentication information based on the indication information only after receiving the indication information. This method can accurately determine the timing of the second authentication information and ensure Data processing efficiency.
  • the first unified data management unit uses the first authentication information as an input parameter to generate the second authentication information.
  • the second authentication information derived in this way can adapt to the needs of the two networks, avoiding the use of two different sets of authentication information and different networks for access authentication, which can improve data processing efficiency.
  • the first authentication information includes one or more of the following: confidentiality key CK, integrity key IK, sequence number (SQN), AUSF key K AUSF , SEAF Key K SEAF , AMF key K AMF .
  • Including the above parameters in the first authentication information can ensure that the first unified data management unit deduce the second authentication information.
  • the first unified data management unit sends the identification information and the second authentication information of the terminal device to the second unified data management unit, and the identification information of the terminal device is associated with the second authentication information.
  • the second unified data management unit may receive the second authentication information of multiple terminal devices, the first unified data management unit sends the identification information and the second authentication information of the terminal devices to the second unified data management unit, There is a corresponding relationship between the identification information of the terminal device and the second authentication information, which facilitates the second unified data management unit to know the corresponding relationship between the second authentication information and the terminal device.
  • the first unified data management unit receives a second unified data management unit identifier from the access and mobility management network element, and the second unified data management unit identifier is used to identify a specific second unified data management unit. network element.
  • the first unified data management unit since there may be multiple second unified data management units, the first unified data management unit receives the second unified data management unit identifier from the access and mobility management network element, so that the first unified data management unit knows when obtaining After receiving the second authentication information, send the second authentication information to which second unified data management unit.
  • the first unified data management unit sends the second authentication information to the second unified data management unit through the access and mobility management network element and the wireless access network device; or, the first unified data management unit The unit sends the second authentication information to the second unified data management unit through the Network Exposure Function (NEF).
  • NEF Network Exposure Function
  • the second authentication information is securely protected through key protection information.
  • the first unified data management unit receives the second network data from the access and mobility management network element.
  • the first unified data management unit determines the key protection information according to the identification information of the second network.
  • the second network identification information may be associated with the key protection information, and different second networks may correspond to different key protection information. In this way, the communication between the first unified data management unit and different second networks can be ensured. The security of data transmission between.
  • the first network is an IOPS network or a private network
  • the second network is a macro network
  • the first network is a macro network
  • the second network is an IOPS network or a private network
  • this application provides a communication method, including:
  • the access and mobility management network element determines the identification information of the second network; the first unified data management unit belongs to the first network; the first network is different from the second network; the access and mobility management network element sends a message to the first unified data management unit The identification information of the second network.
  • the first unified data management network element determines that the terminal device and the second network are connected based on the first authentication information used for access authentication between the terminal device and the first network. Access the second authentication information used for authentication. This method can accurately determine the timing of the second authentication information and ensure the efficiency of data processing.
  • the access and mobility management network element triggers indication information, and the indication information is used to instruct the first unified data management unit to determine based on the first authentication information used for access authentication between the terminal device and the first network. Second authentication information used for access authentication between the terminal device and the second network; the access and mobility management network element sends instruction information to the first unified data management unit.
  • the first unified data management network element when the first unified data management network element receives the instruction information, it determines the access authentication information used by the terminal device and the second network based on the first authentication information used by the terminal device and the first network. This method can accurately determine the timing of the second authentication information and ensure the efficiency of data processing.
  • the access and mobility management network element determines the identification information of the second network based on the existence of a second network co-deployed with the wireless access network device accessed by the terminal device.
  • the wireless access network device there is a second network co-deployed with the wireless access network device, that is, the second network that the wireless access network device can connect to.
  • the connection may or may not be created.
  • the access and mobility management network element can determine the identification information of the second network based on this. This method can prevent the wireless access network device accessed by the terminal device from not supporting switching to the second network, resulting in a waste of processing resources in determining the second authentication message.
  • the access and mobility management network element obtains the capability information of the terminal device from the terminal device, and the access and mobility management network element determines that the terminal device has access to the second network based on the capability information of the terminal device.
  • the access and mobility management network element determines the identification information of the second network based on the terminal device having the ability to access the second network and the accessed wireless access network device having a co-deployed second network.
  • This method can prevent the wireless access network device accessed by the terminal device from not supporting switching to the second network, and the terminal device not supporting the ability to access the second network, resulting in a waste of processing resources for determining the second authentication message.
  • the access and mobility management network element receives a request message for the identification information of the second network from the first unified data management unit; the access and mobility management network element determines the identification information of the second network based on the request message. Identification information.
  • the access and mobility management network element queries whether the wireless access network device accessed by the terminal device has a co-deployed second network. , if there is a co-deployed second network, the second network identification information can be directly sent to the first unified data management unit. If the wireless access network device accessed by the terminal device does not have a co-deployed second network, then the second network is replied to. A unified data management network element refuses to respond. This method can prevent the access and mobility management network element from not storing network identification information and failing to send the second authentication. Message to accurate second network.
  • the access and mobility management network elements have a co-deployed second network, that is, the second network to which the wireless access network device can be connected.
  • the connection may or may not be created.
  • the access and mobility management network elements can determine the identification information of the second network based on this; the access and mobility management network elements do not have a co-deployed second network, that is, the wireless access network device has no second network to which it can connect.
  • the access and mobility management network element sends instruction information to the terminal device for instructing the terminal device to generate the second authentication information.
  • the terminal device knows that the second authentication information has been generated, and the terminal device can be ready to access the second network at any time.
  • the second authentication information is securely protected through key protection information.
  • the first network is an IOPS network or a private network
  • the second network is a macro network
  • the first network is a macro network
  • the second network is an IOPS network or a private network
  • this application provides a communication method, including:
  • the second unified data management unit receives the second authentication information used by the terminal device from the first unified data management network element to perform access authentication with the second network; the second unified data management unit accesses the terminal device according to the second authentication information. Certification.
  • the second authentication information is determined by the first unified data management unit based on the first authentication information used for access authentication between the terminal device and the first network; the first unified data management unit belongs to the first network ; The second unified data management unit belongs to the second network; the first network is different from the second network.
  • the second authentication information is protected by key protection information.
  • the second unified data management unit uses the key decryption information to perform the second authentication on the protection of the key protection information.
  • the information is decrypted to determine the second authentication information.
  • the key decryption information is associated with the identification information of the second network.
  • the first network is an IOPS network or a private network
  • the second network is a macro network
  • the first network is a macro network
  • the second network is an IOPS network or a private network
  • inventions of the present application provide a communication device.
  • the communication device may be a first unified data management unit or a chip provided inside the first unified data management unit. It may also be an access and mobility management network element or a The chip provided inside the access and mobility management network element may also be a second unified data management unit or a chip provided inside the second unified data management unit.
  • the communication device has the function of implementing any one of the above first to third aspects.
  • the communication device includes a module or unit corresponding to the steps involved in any one of the above first to third aspects, or Means, the functions or units or means can be implemented by software, or by hardware, or by hardware executing corresponding software.
  • the communication device includes a processing unit and a transceiver unit, where the transceiver unit can be used to send and receive signals to achieve communication between the communication device and other devices.
  • the transceiver unit is used to receive signals from Configuration information of the terminal device; the processing unit can be used to perform some internal operations of the communication device.
  • the transceiver unit may be called an input-output unit, a communication unit, etc., the transceiver unit may be a transceiver, and the processing unit may be a processor.
  • the transceiver unit may be an input-output interface, an input-output circuit, or an input-output pin, etc., and may also be called an interface, a communication interface, or an interface circuit, etc.;
  • the processing unit may be a processor, a processing circuit or a logic circuit, etc.
  • the communication device includes a processor and may also include a transceiver, and the transceiver For sending and receiving signals, the processor executes program instructions to complete the method in any possible design or implementation manner from the first aspect to the third aspect.
  • the communication device may further include one or more memories, the memory being used to couple with the processor, and the memory may store the necessary computer programs to implement the functions involved in any one of the above-mentioned first to third aspects. or instructions.
  • the processor can execute the computer program or instructions stored in the memory. When the computer program or instructions are executed, the communication device implements any of the possible designs or implementations of the first to third aspects. method.
  • the communication device includes a processor, which may be coupled to a memory.
  • the memory may store necessary computer programs or instructions to implement the functions involved in any one of the above-mentioned first to third aspects.
  • the processor can execute the computer program or instructions stored in the memory. When the computer program or instructions are executed, the communication device implements any of the possible designs or implementations of the first to third aspects. method.
  • the communication device includes a processor and an interface circuit, wherein the processor is configured to communicate with other devices through the interface circuit and execute any possible design of the first to third aspects above, or Methods in the implementation.
  • the processor can be implemented by hardware or software.
  • the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be implemented by software.
  • the processor may be a general-purpose processor implemented by reading software code stored in memory.
  • the above processors may be one or more, and the memories may be one or more.
  • the memory can be integrated with the processor, or the memory can be provided separately from the processor. During the specific implementation process, the memory and the processor can be integrated on the same chip, or they can be respectively provided on different chips. The embodiments of this application do not limit the type of memory and the arrangement method of the memory and the processor.
  • embodiments of the present application provide a communication system that includes the first unified data management unit, the access and mobility management network element, and the second unified data management unit in the above first to third aspects.
  • the present application provides a chip system, which includes a processor and may also include a memory, for implementing the method described in any of the possible designs of the first aspect to the third aspect.
  • the chip system can be composed of chips or include chips and other discrete devices.
  • the present application also provides a computer-readable storage medium.
  • Computer-readable instructions are stored in the computer-readable storage medium.
  • the computer-readable instructions When the computer-readable instructions are run on a computer, the computer executes the steps from the first aspect to the third aspect. Any of three possible design approaches.
  • the present application provides a computer program product containing instructions that, when run on a computer, cause the computer to execute the methods of the embodiments of the first to third aspects.
  • Figure 1 shows a schematic diagram of a communication system provided by an embodiment of the present application
  • Figure 2A shows a schematic diagram of an application scenario
  • Figure 2B shows a schematic diagram of another application scenario
  • Figure 3 shows a schematic flow chart of UE switching from macro network to IOPS network
  • Figure 4 shows a schematic flowchart of a communication method provided by an embodiment of the present application
  • Figure 5 shows a schematic flowchart of another communication method provided by an embodiment of the present application.
  • Figure 6 shows a schematic flowchart of another communication method provided by an embodiment of the present application.
  • Figure 7 shows a schematic flowchart of another communication method provided by an embodiment of the present application.
  • Figure 8 shows a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • Figure 9 shows a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • Figure 10 shows a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • Figure 1 exemplarily shows a schematic diagram of a mobile communication network architecture.
  • the network architecture includes terminal equipment, access network equipment, access and mobility management functions, session management functions, user plane functions, policy control functions, and network slice selection. Functions, network slice specific authentication and authorization functions, network warehouse functions, network data analysis functions, unified data management functions, unified data storage functions, authentication service functions, network capability opening functions, terminal wireless capability management functions, binding support functions, application functions, and the data network (DN) connecting the operator's network.
  • the terminal device can access the wireless network through the access node at the current location.
  • the terminal device can send service data to the data network through access network equipment and user plane functions, and receive service data from the data network.
  • Access and mobility management functions are mainly used for the attachment of terminal devices in mobile networks, mobility management, tracking area update processes, etc.
  • the access and mobility management function can be the access and mobility management function (AMF).
  • AMF access and mobility management function
  • future communication systems such as 6G communication systems
  • the access and mobility management function It can still be AMF, or it can also have other names, which is not limited by this application.
  • the session management function is mainly used for session management in mobile networks, such as session establishment, modification, and release. Specific functions include assigning Internet protocol addresses to terminal devices and selecting user plane functions that provide packet forwarding functions.
  • the session management function can be a session management function (SMF).
  • SMF session management function
  • the session management function can still be an SMF, or it can have other names. This application is not limited.
  • the user plane function is mainly used to process user messages, such as forwarding and accounting.
  • the user plane function can be user plane function (UPF).
  • UPF user plane function
  • future communication systems such as 6G communication system
  • the user plane function can still be UPF, or it can have other names. This application is not limited.
  • Policy control function including policy control function, billing policy control function, quality of service (QoS) control, etc.
  • the policy control function can be a policy control function (PCF).
  • PCF policy control function
  • the policy control function can still be a PCF, or it can have other names. This application is not limited.
  • the network slice selection function is mainly used to select appropriate network slices for the services of terminal devices.
  • the network slice selection function can be the network slice selection function (NSSF).
  • the network slice selection function can still be the NSSF, or it can With other names, this application is not limited.
  • NSSAAF network slice-specific authentication and authorization capabilities authorization function
  • the network warehouse function is mainly used to provide registration and discovery of network functions or services provided by network functions.
  • the network repository function can be a network repository function (NRF).
  • NRF network repository function
  • the network repository function can still be an NRF, or it can have other names. This application is not limited.
  • the network data analysis function can collect data from various network functions, such as policy control function, session management function, user plane function, access management function, and application function (through the network capability opening function), and conduct analysis and prediction.
  • the network data analysis function can be network data analysis function (NWDAF).
  • NWDAF network data analysis function
  • the unified data management function is mainly used to manage the contract information of terminal devices.
  • the unified data management function can be a unified data management (UDM) function.
  • the unified data management function can still be a UDM function, or it can With other names, this application is not limited.
  • the unified data storage function is mainly used to store structured data information, including contract information, policy information, and network data or business data defined in standard formats.
  • the unified data storage function can be the unified data storage (unified data repository, UDR) function.
  • UDR unified data repository
  • future communication systems such as 6G communication systems
  • the unified data storage function can still be the UDR function, or it can With other names, this application is not limited.
  • the authentication service function is mainly used for security authentication of terminal equipment.
  • the authentication service function can be the authentication server function (AUSF).
  • the authentication service function can still be the AUSF, or it can have other names. , this application is not limited.
  • the network capability exposure function can controlly expose some network functions to applications.
  • the network capability opening function may be NEF.
  • future communication systems such as 6G communication systems
  • the network capability opening function may still be NEF, or may have other names, which is not limited by this application.
  • the terminal wireless capability management function is used to store and manage the wireless capabilities of terminal devices in the network.
  • the terminal radio capability management function can be the terminal radio capability management function (UE radio capability management function, UCMF).
  • UE radio capability management function UE radio capability management function
  • the terminal radio capability management function can still be the UCMF. , or it may also have other names, which is not limited by this application.
  • the binding support function is used to maintain the correspondence between the Internet Protocol (IP) addresses and service functions of the interconnection between user networks.
  • IP Internet Protocol
  • the binding support function may be the binding support function (BSF).
  • BSF binding support function
  • future communication systems such as 6G communication systems
  • the binding support function may still be the BSF, or it may have Other names are not limited by this application.
  • the application function can provide service data of various applications to the control plane function of the operator's communication network, or obtain network data information and control information from the control plane function of the communication network.
  • the application function may be an application function (AF).
  • AF application function
  • the application function may still be an AF, or may have other names. This application does not limited.
  • Data network is mainly used to provide data transmission services for terminal devices.
  • the data network can be a private network, such as a local area network, or a public data network (PDN), such as the Internet.
  • PDN public data network
  • Operators consolidate and deploy proprietary networks, such as configured IP multimedia core network subsystem (IMS) services.
  • IMS IP multimedia core network subsystem
  • the terminal that is, terminal equipment
  • the terminal is an entity on the user side that is used to receive or transmit signals, and is used to send uplink signals to network equipment or receive downlink signals from network equipment.
  • Including devices that provide voice and/or data connectivity to users which may include, for example, UEs, handheld devices with wireless connectivity capabilities, or processing devices connected to wireless modems.
  • the terminal device can communicate with the core network via the radio access network (RAN) and exchange voice and/or data with the RAN.
  • RAN radio access network
  • the terminal equipment may include UE, vehicle wireless communication technology (vehicle to X, V2X) terminal equipment, wireless terminal equipment, mobile terminal equipment, device-to-device communication (device-to-device, D2D) terminal equipment, machine-to-machine/ Machine-to-machine/machine-type communications (M2M/MTC) terminal equipment, IoT terminal equipment, subscriber unit (subscriber unit), subscriber station (subscriber station), mobile station (mobile station), remote station ( remote station), AP, remote terminal, access terminal, user terminal, user agent, or user device, wearable device, vehicle-mounted device, Drones etc.
  • vehicle wireless communication technology vehicle to X, V2X
  • V2X vehicle to X
  • D2D device-to-device communication
  • M2M/MTC machine-to-machine/ Machine-to-machine/machine-type communications
  • IoT terminal equipment subscriber unit (subscriber unit), subscriber station (subscriber station), mobile station (mobile station), remote station (
  • the terminal device may also be a wearable device.
  • Wearable devices can also be called wearable smart devices or smart wearable devices. It is a general term for applying wearable technology to intelligently design daily wear and develop wearable devices, such as glasses, gloves, watches, clothing and shoes. wait.
  • a wearable device is a portable device that is worn directly on the body or integrated into the user's clothing or accessories. Wearable devices are not just hardware devices, but also achieve powerful functions through software support, data interaction, and cloud interaction.
  • wearable smart devices include full-featured, large-sized devices that can achieve complete or partial functions without relying on smartphones, such as smart watches or smart glasses, and those that only focus on a certain type of application function and need to cooperate with other devices such as smartphones. Used, such as various smart bracelets, smart helmets, smart jewelry, etc. for physical sign monitoring.
  • the functions in the embodiments of this application may also be called network elements, network functions or functional entities, devices, etc.
  • the access and mobility management functions may also be called access and mobility management network elements, or access and mobility management network functions, or access and mobility management functional entities, etc.
  • the names of each function are not limited in this application. Those skilled in the art can replace the names of the above functions with other names to perform the same function, which all fall within the scope of protection of this application.
  • FIG. 2A shows a schematic diagram of an application scenario provided by this application.
  • This scenario takes an IOPS network and a macro network as an example. Of course, in actual applications, it can also be a private network and a macro network.
  • This application does not specifically limit it.
  • the terminal device is in Provides communication services to public safety users through LTE access network equipment with IOPS function (IOPS-capable eNB) without backhaul communication.
  • IOPS-capable eNB LTE access network equipment with IOPS function
  • There is no backhaul communication that is, the link between the access network equipment and the LTE macro network core network (macro EPC) is interrupted. In the event of disasters such as earthquakes or failure of backhaul optical fiber, the backhaul communication is interrupted.
  • the LTE access network equipment with IOPS function (IOPS-capable eNodeBs) establishes a backhaul connection with the IOPS network, forming a network that can be used for Provides a locally connected IOPS network (IOPS network).
  • the terminal device receives communication services in IOPS mode (IOPS mode) through the IOPS network to ensure reliable transmission of data.
  • LTE access network equipment (IOPS-Incapable eNodeBs) without IOPS functionality cannot establish a backhaul connection to the IOPS network.
  • FIG 2B shows a schematic diagram of another application scenario provided by this application.
  • This scenario takes an IOPS network as an example. Of course, it can also be a private network in actual application. This application does not specifically limit it. If there is no IOPS-capable eNB, it is a public security When users provide communication services (that is, No infrastructure), when eNodeB is deployed (eNodeB Deployed), access network equipment (Nomadlc eNodeB) with IOPS function is used (the access network equipment is removable and similar to user Prepare a small access network device) to establish a backhaul connection with the IOPS network, forming an IOPS core network (Local EPC) that can be used to provide local connections, forming an IOPS network that can be used to provide local connections. ).
  • No infrastructure No infrastructure
  • eNodeB Deployed access network equipment with IOPS function is used (the access network equipment is removable and similar to user Prepare a small access network device) to establish a backhaul connection with
  • IOPS scenarios in the existing LTE standard technical specifications (TS) TS 23.401 and TS 33.401 mainly focuses on the process of UE switching from macro network access to IOPS network access.
  • LTE has the following basic assumptions for IOPS scenarios:
  • the RAN node supports both macro network and IOPS.
  • the RAN node has IOPS.
  • Functional eNB node IOPS-capable eNB
  • IOPS-capable eNB is connected to both macro network EPC and L-EPC.
  • the IOPS mode has an exclusive identifier, such as a public land mobile network identifier (PLMN ID). All L-EPCs of the same public safety agency/operator have the same PLMN ID.
  • PLMN ID public land mobile network identifier
  • the IOPS-capable eNB will broadcast the PLMN ID corresponding to the IOPS to assist UEs that support the IOPS mode to access the IOPS mode.
  • L-EPC The main function of L-EPC is to provide routing functions for communication between IOPS-enabled UEs.
  • IOPS-enabled UE has two UMTS user identity module applications (universal mobile telecommunications system subscriber identity module application, USIM app).
  • the two USIM apps correspond to IOPS mode and normal mode respectively.
  • the USIM app of IOPS has the root key K, PLMN ID and International Mobile Subscriber Identity (IMSI) dedicated to IOPS PLMN.
  • IMSI International Mobile Subscriber Identity
  • Step 1 The UE accesses the macro network EPC and performs communication services.
  • Step 2 The eNB detects that the backhaul link with the macro network is disconnected. This eNB is IOPS-capable. The eNB will not be described in details below.
  • eNB activates the IOPS mode based on the operator's local policy decision.
  • Step 3 After L-EPC is activated, the eNB establishes a backhaul link with L-EPC.
  • Step 4 After eNB establishes the backhaul link with L-EPC, it broadcasts the PLMN ID of the IOPS network.
  • Step 5 The UE detects the IOPS PLMN ID broadcast and activates the IOPS-specific USIM app.
  • Step 6 The UE determines that it needs to access the corresponding L-EPC based on the IOPS PLMN ID, and conducts the access process (including access authentication) and session establishment with the L-EPC.
  • Step 7 The UE and L-EPC execute the access process (attach process) and establish a local protocol data network (packet data network, PDN) link.
  • attach process attach process
  • PDN packet data network
  • Step 8 The UE accesses L-EPC and performs communication services.
  • the UE when the UE performs primary authentication with the macro network and the IOPS network, it needs to use different IMSIs and different root keys when contracting with the macro network. That is, the macro network core network will only store the IMSI and root key used when the UE performs primary authentication with the macro network, and the IOPS core network will only store the IMSI and root key used when the UE performs primary authentication with the IOPS network. UE When performing primary authentication with different networks, enable the corresponding IMSI and root key. This method is complex to operate.
  • this application provides a communication method to reduce the complexity of access authentication, and on the basis of reducing the complexity of access authentication, reduce the amount of data storage of the device and save the storage space of the device.
  • FIG 4 is a schematic diagram of a communication method provided by an embodiment of the present application.
  • This method can be implemented through a first unified data management unit and a second unified data management unit.
  • the execution of the interaction of units can also be achieved with the help of other network elements, such as AMF, which is not specifically limited here.
  • the first unified data management network element takes the first UDM as an example
  • the second unified data management network element takes the second UDM is taken as an example to illustrate.
  • the unified data management network element can also be other network elements.
  • Network elements that can be used to store authentication information for accessing the network and can further process the authentication information can be For the same data management network element, perform the following:
  • Step 401 The first UDM determines the second authentication information used by the terminal device for access authentication with the second network based on the first authentication information used by the terminal device for access authentication with the first network.
  • the first UDM belongs to the first network; the first network is different from the second network.
  • the first network and the second network may be mutually isolated networks.
  • the first network may be an IOPS network or a private network, and the second network may be a macro network; or the first network may be a macro network, and the second network may be an IOPS network or the private network.
  • the first network may be an IOPS network
  • the second network is a macro network; the first network is a private network (such as a campus network, a campus network, etc.), and the second network is a macro network; the first network is a macro network, and the second network is an IOPS network; the first network is a macro network. network, the second network is a private network, etc.
  • This application is not specifically limited here.
  • the access authentication between the terminal device and the first network can be understood as the main authentication between the terminal device and the first network.
  • the main authentication between the terminal device and the first network is used to authenticate each other's identities between the terminal device and the first network.
  • the terminal can proceed with the subsequent registration process and session establishment process with the first network.
  • the first network is a macro network
  • this represents the primary authentication between the terminal device and the macro network
  • the first network is an IOPS network
  • the access authentication between the terminal device and the second network can be understood as the main authentication between the terminal device and the second network.
  • the second network is an IOPS network
  • it means the main authentication between the terminal device and the IOPS network
  • Macro network means the main authentication between the terminal device and the macro network.
  • the first UDM determines the second authentication information used by the terminal device to perform access authentication with the second network based on the first authentication information used by the terminal device to perform access authentication with the first network. It can be understood that the first UDM refers to the first authentication information. Determine the second authentication information, or deduce the second authentication information based on certain parameters in the first authentication information. This application does not limit how to determine the second authentication information.
  • the first network is a macro network
  • the second network is In the IOPS network
  • the first UDM can determine the second authentication information of the terminal device and the IOPS network based on the first authentication information of the terminal device and the macro network; the first network is the IOPS network and the second network is the macro network.
  • the first UDM can determine the second authentication information of the terminal device and the IOPS network based on the first authentication information of the terminal device and the macro network.
  • the first authentication information of the device and the IOPS network determines the second authentication information of the terminal device and the macro network, which is not specifically limited in this application.
  • the first UDM uses the first authentication information as an input parameter to generate the second authentication information.
  • the second authentication information derived in this way can adapt to the access authentication requirements of the two networks, avoiding the use of two different sets of authentication information and different networks for access authentication, which can improve data processing efficiency.
  • the first authentication information includes one or more of the following: CK, IK, SQN, K AUSF , K SEAF , KAMF .
  • the first UDM obtains the second authentication information by deducing the key generated by the terminal device using the first network master authentication.
  • the first UDM may obtain the second authentication information by further deducing based on the CK and IK generated by the first UDM and the UE in the main authentication process.
  • the specific method is as follows:
  • K AUSF K SEAF and KAMF generated by the first UDM and UE in the main authentication process.
  • the first UDM needs to obtain K AUSF from AUSF, SEAF or AMF first. , K SEAF and K AMF and then further generate the first authentication information.
  • the deduction method is as follows:
  • KDF Key derivation function
  • the deduction method is not limited.
  • One of the above deduction methods can be used for deduction, and other deduction methods can also be used for deduction, such as the first UDM and the second UDM agreeing on deduction rules for deduction, etc. This application There is no specific limitation here.
  • the first UDM can protect the second authentication information through the key protection information and obtain the second authentication information protected by the key protection information.
  • the key protection information may be preset by the first UDM.
  • the second network may include multiple, and the identification information of different second networks can be indicated by different identifiers, such as: PLMN1, PLMN2, NID (network identifier, network ID) or other identifiers, etc. Different second network identifiers
  • PLMN1 corresponds to key protection information 1
  • PLMN2 corresponds to key protection information 2
  • NID3 corresponds to key protection information 3, etc.
  • the first UDM obtains the identification information of the second network, it can know which key protection information is used to encrypt and protect the second authentication information.
  • the identification information of the second network may come from the access and mobility management network element. However, it may also be broadcast by the access wireless network device connected to the terminal device, which is not specifically limited in this application.
  • the second network identification information may be determined by the access and mobility management network element, and then the first UDM is received from the access and mobility management network element, wherein the access and mobility management network element may determine the second network identification information in the following manner Network identification information:
  • Method 1 The access and mobility management network element determines the identification information of the second network based on the existence of a second network co-deployed with the wireless access network device accessed by the terminal device.
  • the wireless access network device there is a second network co-deployed with the wireless access network device, that is, the second network that the wireless access network device can connect to.
  • the connection may or may not be created.
  • the access and mobility management network element can determine the identification information of the second network based on this.
  • Method 2 The access and mobility management network element determines that the terminal device has the ability to access the second network based on the capability information of the terminal device; the access and mobility management network element determines that the terminal device has the ability to access the second network and the access There is a co-deployed second network for the wireless access network equipment, and the identification information of the second network is determined.
  • Method 3 The access and mobility management network element receives a request message for the identification information of the second network from the first UDM; the access and mobility management network element determines the identification information of the second network based on the request message.
  • the access and mobility management network element queries whether the wireless access network device accessed by the terminal device has a co-deployed second network. If so, The second network identification information can be directly sent to the first UDM. If the wireless access network device accessed by the terminal device does not have a co-deployed second network, a rejection response of the first UDM will be replied. In this way, access and The mobility management network element does not store the network identification information, resulting in the failure to send the second authentication message to the accurate second network. It should be noted that the access and mobility management network elements have a co-deployed second network, that is, the second network to which the wireless access network device can be connected.
  • connection may or may not be created.
  • the access and mobility management network elements can determine the identification information of the second network based on this; the access and mobility management network elements do not have a co-deployed second network, that is, the wireless access network device has no second network to which it can connect.
  • the indication information can be triggered.
  • the indication information is used to trigger the first UDM to determine the second authentication information.
  • the second authentication information is determined based on the instruction information. This method can accurately determine the timing of the second authentication information and ensure the efficiency of data processing.
  • the instruction information can also be used to instruct the first UDM to transfer the second authentication information to the second UDM, or instruct other operations, which is not specifically limited in this application.
  • the first UDM may determine the second authentication information based on the first authentication information.
  • the terminal device has the permission to access the first network can be understood as the terminal device supports receiving communication services under the first network, that is, the terminal device has the permission to access the first network, for example, to send data through the first network,
  • the first unified data management unit can obtain from other network elements such as access and mobility management network elements whether the terminal device has permission to access the first network. If it is determined that it exists, determine the second authentication information based on the first authentication information. Authentication information, if it is determined that there is no authority to access the first network, the second authentication information can be determined. Before determining the second authentication information based on the first authentication information, this application determines that the terminal device has the authority to access the first network, Avoid calculating second authentication information for a terminal device that does not support receiving services under the first network.
  • Step 402 The first UDM sends the second authentication information to the second UDM.
  • the second UDM belongs to the second network.
  • the second UDM receives the second authentication information.
  • the first UDM may send the identification information and the second authentication information of the terminal device to the second UDM, and the identification information of the terminal device is associated with the second authentication information.
  • the first UDM since the second UDM may receive the second authentication information of multiple terminal devices, the first UDM sends the identification information of the terminal device and the second authentication information to the second UDM, where the identification information of the terminal device and There is a corresponding relationship between the second authentication information, which facilitates the second UDM to know the corresponding relationship between the second authentication information and the terminal device.
  • the first UDM obtains the identification information of the second UDM from the access and mobility management network element, and the identification information of the second UDM is used to identify the second UDM.
  • the terminal can be determined based on the identification information of the second UDM obtained from the access and mobility management network element. The identification information of the device and the second authentication information are sent to the second UDM, so that the first UDM knows which second UDM the second authentication information is sent to.
  • the first UDM can send the second authentication information to the second UDM through access and mobility management network elements and wireless access network equipment; or, the first UDM can send the second authentication information to the second UDM through NEF.
  • the first UDM can also send the second authentication information to the second UDM through other methods, which is not specifically limited in this application.
  • the first UDM in order to ensure the security of the second authentication information during transmission, can protect the second authentication information through key protection information, then in this step, the first UDM will use key protection information.
  • the second authentication information protected by the key protection information is sent to the second UDM.
  • Step 403 The second UDM performs access authentication on the terminal device according to the second authentication information.
  • the second UDM decrypts the second authentication information protected by the key protection information through the key decryption information, and determines the second authentication information.
  • the key decryption information may be preset by the second UDM.
  • the key decryption information and key protection information may be symmetric keys or asymmetric keys, which are not specifically limited in this application.
  • the identification information of the second network is related to the decryption protection information, that is, different identification information of the second network can correspond to different decryption protection information.
  • Key protection information such as: PLMN1 corresponds to key decryption information 1, PLMN2 corresponds to key decryption information 2, etc. If the second UDM obtains the identification information of the second network, it can know which key decryption information is specifically used to decrypt the second authentication information.
  • the first network and the second network are two different networks.
  • the terminal can access the two networks, it needs to deduce two different sets of authentication information to conduct access authentication with the corresponding networks respectively.
  • the third network A unified data management unit can determine the authentication information of another network based on the authentication information of a certain network. In this way, the complexity of access authentication can be reduced, and the amount of device data calculation can be reduced, and between the terminal device and the unified data management unit There is no need to store a large amount of authentication information, it can also reduce the amount of data storage in the terminal device and the unified data management unit, save the storage space of the device, and further adopt the solution of this application to improve data processing efficiency.
  • Figure 5 takes the data interaction between UE, RAN, AMF, AUSF, first UDM and second UDM as an example to illustrate.
  • the AMF will send instruction information to the first UDM so that the first UDM determines the second authentication information.
  • the first network is the macro network and the second network is the IOPS network (that is, the IOPS core network described below. ), the first UDM belongs to the macro network, and the second UDM belongs to the IOPS network as an example.
  • the details are as follows:
  • Step 0a The AMF determines that the RAN connected to the AMF can establish a connection with the IOPS core network.
  • the information in this step can be obtained when the device is powered on and connected when the IOPS network is set up, or it can be configured by the network administrator.
  • the specific method is not limited.
  • the AMF also obtains the network identification information of the IOPS core network (that is, the identification information of the second network) co-deployed with the RAN (that is, the wireless access network equipment) connected to the AMF.
  • the network identification information of the IOPS core network is used It is used to identify the network where the IOPS core network is located, and can further be used to identify the IOPS core network.
  • the IOPS core network deployed by RAN is the IOPS core network that RAN can connect to. However, in actual application, the connection may or may not be created.
  • the IOPS core network where the network equipment is deployed is not specified here.
  • the AMF obtains the network identification information of the IOPS core network deployed with the RAN connected to the AMF, the AMF maintains the corresponding relationship between the identification of the RAN and the network identification of the IOPS core network.
  • the RAN may have multiple co-deployed IOPS core networks, and the preconfiguration information may also include priority information to indicate the priorities of the multiple co-deployed IOPS core networks of the RAN. The AMF may determine based on the priority information. Select which IOPS core network.
  • the RAN node has a co-deployed IOPS core network, it can be understood that the RAN node supports the ability to access the IOPS core network, or can connect to the IOPS network. If the RAN node does not have a co-deployed IOPS core network, It can be understood that the RAN node does not support the ability to access the IOPS core network, or cannot connect to the IOPS network.
  • Step 0b The first UDM pre-configures the key protection key required to protect the second authentication information during transmission (ie, the key protection information described above).
  • protecting the second authentication information during transmission is to use a key protection key to protect the second authentication information before sending the second authentication information, and obtain the protected second authentication information, wherein the key protection key is used
  • protecting the second authentication information may include confidentiality protection and/or integrity protection of the second authentication information, thereby ensuring the security of the second authentication information during the transmission of the second authentication information.
  • the first UDM also configures a corresponding relationship between the key protection key and the network identification information of the IOPS core network.
  • Step 0c The second UDM is pre-configured to obtain the key required to obtain the second authentication information (that is, as described above key to decrypt the information).
  • the key is used to obtain the second authentication information.
  • key acquisition please refer to the description of the key decryption information in step 403 above.
  • Using the key to obtain the second authentication information specifically using the key to obtain the key and the protected second authentication information to obtain the second authentication information. Further, using the key to obtain the key and the protected second authentication information to obtain the second authentication information may be to use the key to obtain the key to decrypt the protected second authentication information to obtain the second authentication information, and/or use the key to obtain the second authentication information. Obtaining a key verifies the integrity of the protected secondary authentication information.
  • the key acquisition key corresponds to the key protection key in step 0b, that is, it can be a symmetric key with the preconfigured key in the first UDM, or it can be an asymmetric key with each other.
  • the key decryption key can be used to decrypt information encrypted by the preconfigured key protection key in the first UDM, and can also be used to verify the integrity of the information protected by the configured key protection key in the first UDM.
  • Step 1 The UE requests access to the macro network and sends a registration request message to the AMF.
  • the UE carries IOPS capability information in the registration request message, and this message is used to indicate that the UE supports the IOPS function.
  • the registration request message is a NAS (non-access stratum, non-access stratum) message.
  • the UE needs to carry the NAS message in an AS (access stratum, access stratum) message and send it to the RAN node.
  • the RAN node Send NAS messages to AMF over the backhaul network.
  • the UE supports the IOPS function. Specifically, the UE may have the ability to access the IOPS network, or the UE may have the ability to communicate with the IOPS network.
  • the UE does not carry IOPS capability information in the registration request.
  • the UE does not need to indicate the support for the IOPS function to the AMF, which reduces the UE's processing burden on the registration request.
  • Step 2 The AMF determines that it is necessary to instruct the first UDM to initiate key transfer based on the IOPS capability information obtained from the UE and the ability of the RAN node accessed by the UE to support connection to the IOPS core network.
  • Instructing the first UDM to initiate key transfer in step 2 above can be understood as instructing the first UDM to determine the second authentication information based on the first authentication information and send the second authentication information to the second UDM.
  • AMF can determine the corresponding RAN based on the backhaul network that accepts the NAS message, and then determine the RAN node's ability to support access to the IOPS network based on the preconfigured information in 0a.
  • the AMF also determines the network identification information of the IOPS core network corresponding to the RAN accessed by the UE based on the preconfiguration information in step 0a.
  • the AMF may determine the identification information of the corresponding RAN based on the backhaul network that accepts the NAS message, and further determine the corresponding IOPS core network based on the identification information of the RAN and the corresponding relationship between the identification information of the RAN and the second network identification information in step 0a. network identification information.
  • the AMF can determine the network identification information of the corresponding IOPS core network based on the priority information obtained by the AMF in step 0a.
  • the RAN accessed by the UE may be connected to multiple IOPS core networks.
  • the AMF can determine the network identifiers and information of multiple local IOPS core networks and send them to the first UDM.
  • the AMF determines the need to instruct the first UDM to initiate key transfer only based on the ability of the RAN node accessed by the UE to support connection to the IOPS core network.
  • the AMF may determine the need to instruct the first UDM to initiate key transfer based only on the IOPS capability information obtained from the UE. This method may simplify the processing logic of the AMF.
  • Step 3 The AMF sends an IOPS instruction to the first UDM to instruct the first UDM to obtain the root key K IOPS (that is, the second authentication information) required for the authentication of the UE and the IOPS core network owner in the IOPS mode, and send the second authentication information to the first UDM.
  • the second authentication information is sent to the second UDM.
  • the IOPS indication is also used to instruct the first UDM to simultaneously obtain other parameters required for primary authentication between the UE and the IOPS core network in IOPS mode.
  • the other parameters may include one or more of the five-tuple information used for primary authentication. for example SQN parameters (that is, an example of the above-mentioned first authentication information), and determine the second authentication information based on the determined parameters.
  • SQN parameters that is, an example of the above-mentioned first authentication information
  • the second authentication information also includes the SQN parameters.
  • the AMF also sends the network identification information of the IOPS core network corresponding to the RAN accessed by the UE to the first UDM.
  • the IOPS indication in step 3 can be passed through the UE and macro network master authentication process.
  • AMF interacts with the first UDM to trigger the master authentication message.
  • AMF sends the UE authentication request (Nausf_UEAuthentication_Authenticate Request) of AUSF to
  • the AUSF is further sent to the first UDM by the AUSF through the UDM's UE authentication acquisition request (Nudm_UEAuthentication_Get Request) (this message is exemplarily described in Figure 5). It can also be used to obtain the UE subscription information after the registration process.
  • the Nudm_SDM_Get message obtained by the contract information management is sent to the first UDM, or the message of other AMF interacting with the first UDM can carry the IOPS indication, which is not limited here.
  • the AMF can use a new service message to instruct the first UDM to obtain the root key K IOPS (that is, the second authentication information) required for authentication between the UE and the IOPS core network owner in the IOPS mode.
  • the AMF The IOPS indication is not sent to the first UDM but is implicitly indicated by the new service message.
  • Step 4 After the first UDM determines that the UE has the authority to access the IOPS network based on the UE contract information, it deduces and obtains the authentication key between the UE and the IOPS core network owner in IOPS mode based on the key generated by the UE and the macro network owner authentication (first authentication information).
  • the required root key K IOPS secondary authentication information.
  • the UE has the authority to access the IOPS network, which can be understood to mean that the UE has the authority to access the IOPS network. It can also be understood that the UE supports receiving communication services under the IOPS network.
  • the first terminal device in step 401 please refer to the first terminal device in step 401. There is a description of the rights to access the first network.
  • K IOPS is deduced from one or more of CK, IK, K AUSF , K SEAF and KAMF generated in the main authentication process
  • the first authentication information at this time is the deduced K IOPS One or more of CK, IK, K AUSF , K SEAF and KAMF used.
  • the first UDM obtains the protected second authentication information using the key protection K IOPS in step 0b.
  • Protecting K IOPS using a key protection key may be confidentiality protection and/or integrity protection of K IOPS .
  • the AMF sends the IOPS indication in step 3 to the first UDM in the main authentication process
  • the first UDM needs to obtain the main authentication success indication through the UDM's UE authentication result confirmation request Nudm_UEAuthentication_ResultConfirmation Request message. , and then trigger step 4.
  • the IOPS indication is also used to instruct the first UDM to simultaneously acquire other parameters required for authentication between the UE and the IOPS core network owner in IOPS mode, as described in step 3, use the key protection key to protect the K IOPS acquisition.
  • a key protection key is also used to protect other parameters required for the main authentication, where the other parameters may include one or more of the five-tuple information used for the main authentication, For example, SQN parameters.
  • the first authentication information in addition to the key generated by the authentication between the UE and the macro network master, the first authentication information also includes other parameters required for the master authentication, such as SQN parameters.
  • the first UDM also obtains the network identification information of the IOPS core network corresponding to the RAN accessed by the UE from the AMF in step 3, the first UDM protects the key and the IOPS core network according to the key configured in 0b.
  • the corresponding relationship between the network identification information and the network identification information of the IOPS core network obtained from the AMF is used to determine the key protection key, and further use the key protection key protection to obtain the protected second authentication information.
  • Step 4a If K IOPS is further deduced from one or more of K AUSF , K SEAF or KAMF generated in the main authentication process, the UE stores K AUSF , K SEAF or KAMF in the USIM app accordingly.
  • This step is optional.
  • Step 5 The first UDM sends a key transfer request message to the AMF.
  • the key transfer request message includes the identification information of the UE and the protected second authentication information, so that the first AMF determines the IOPS core network information corresponding to the RAN accessed by the UE based on the identification information of the UE, where the IOPS core network information includes the IOPS
  • the network identification information of the core network determines which IOPS core network where the second UDM is located to which the identification information of the UE and the protected second authentication information are sent.
  • the AMF determines the network identification information of the IOPS core network corresponding to the RAN accessed by the UE.
  • the AMF can determine the corresponding backhaul network based on the identification information of the UE, and further determine the identification information of the RAN corresponding to the backhaul network, so as to determine the network identification information of the IOPS core network corresponding to the RAN.
  • the corresponding relationship between the identification and the identification of the RAN and the second network identification information in step 0a is determined to determine the network identification information of the corresponding IOPS core network.
  • the key transfer request message includes the identification information of the UE and the protected second authentication information, so that the second UDM can determine which UE the second authentication information to be obtained belongs to, and perform primary authentication in the subsequent IOPS network where the UE and the second UDM are located.
  • the corresponding second authentication information may be determined according to the identification information of the UE.
  • the first UDM determines the identification information of the UE in the primary authentication.
  • the identification information of the UE may be the SUPI information of the UE.
  • the key transfer indication information is used to instruct the AMF network element that this message is used to transfer the second authentication information to the IOPS network
  • the network identification information of the IOPS core network is used to assist the AMF in determining which IOPS network the key transfer request message needs to be sent to.
  • the first UDM can forward the key transfer request to the second UDM through AMF, RAN, forward it through NEF, or send it to the second UDM through other methods, such as between the first UDM and the second UDM.
  • Direct link forwarding If the first UDM does not forward the key transfer request to the second UDM through the AMF or RAN, then step 6 and step 7 are skipped after this step, and step 8 is performed directly.
  • Step 6 The AMF determines to forward the UE's identification information and the protected second authentication information to the second UDM.
  • step 4 if step 4 is triggered after obtaining the primary authentication success indication based on the UE authentication result confirmation request Nudm_UEAuthentication_ResultConfirmation Request message of the UDM, the AMF can determine the second UDM based on the network identification information of the IOPS core network in step 5, and Forward the identification information of the UE and the protected second authentication information to the second UDM; if step 4 is triggered based on the message that the AMF interacts with the first UDM, the AMF performs the following steps according to the key transfer request message included in the key transfer request message from the first UDM: The UE identification information and the IOPS core network information corresponding to the RAN accessed by the UE determine the second UDM, where the IOPS core network information includes the network identification information of the IOPS core network, and forwards the UE identification information and the protected second UDM to the second UDM. Certification Information.
  • the key transfer request message sent by the first UDM to the AMF in step 5 may not include the identification information of the UE.
  • the AMF and the first UDM The information exchanged by UDM includes request messages and reply messages.
  • the AMF sends a request message to the first UDM.
  • the request message carries the identification information of the UE.
  • the first UDM sends a reply message to the AMF according to the request message.
  • the AMF can determine the identification information of the UE based on the association between the request message and the reply message.
  • the AMF can determine the second UDM based on the identity information of the UE and the IOPS core network information corresponding to the RAN accessed by the UE, and send it to the UE.
  • the second UDM forwards the identification information of the UE and the protected second authentication information.
  • the AMF determines to forward the identification information of the UE and the protected second authentication information to the second UDM, and also includes: Based on the identity information of the UE, the RAN to which the UE accesses is determined, and the AMF sends a key transfer message to the RAN.
  • the key transfer message carries the identification information of the UE and the protected second authentication information.
  • the key transfer indication information may also be carried, and the indication information is used to instruct the RAN to forward the key transfer message.
  • the AMF obtains the network identification information of the IOPS core network from the second UDM, when the AMF sends the key transfer message to the RAN, it also sends the network identification information of the IOPS core network to the RAN.
  • the AMF further determines which IOPS network the key transfer request message needs to be sent to based on the network identification information of the IOPS core network.
  • the key transfer indication information is used to instruct the AMF network element that this message is used to transfer the second authentication information to the IOPS network
  • the network identification information of the IOPS core network is used to assist the AMF in determining which IOPS network the key transfer request message needs to be sent to.
  • step 6 can also be triggered according to the key transfer request message (step 5), implicitly triggered according to the protected second authentication information, or triggered according to the key transfer instruction information carried in step 5.
  • Step 6a The AMF triggers sending an IOPS key indication to the UE.
  • the IOPS key indication is used to instruct the UE to obtain and store the root key K IOPS required for the UE and IOPS core network master authentication in IOPS mode based on the key deduction generated by the master authentication.
  • the K IOPS The K IOPS .
  • This step is an optional step, that is, the access and mobility management network element sends instruction information to the terminal device for instructing the terminal device to generate the second authentication information. In this way, the terminal device knows that the second authentication information has been generated, and the terminal device can be ready to access the second network at any time.
  • Step 7 The RAN sends a key transfer message to the IOPS network.
  • the RAN sends a key transfer message to the IOPS network. Specifically, the RAN sends the key transfer message to the IOPS network so that the second UDM in the IOPS network obtains the key transfer message. The RAN needs to send the key transfer message to the second UDM through the second AMF. The second UDM sends a key transfer message, where the second AMF and the second UDM belong to the same IOPS network.
  • the RAN obtains the key transfer message from the AMF, and the key transfer message includes the protected second authentication information and the identification information of the UE.
  • the RAN when it sends a key transfer message to the IOPS network, it may also carry key transfer indication information.
  • the key transfer indication information is used to instruct the IOPS network.
  • the message carries the key transfer message.
  • the RAN sends the key transfer message to the IOPS network.
  • the second AMF sends a message, which carries the key transfer message and the key transfer indication information.
  • the key transfer indication information is used to indicate to the second AMF that the message carries the key transfer message.
  • the RAN determines the second UDM based on the network identification information of the IOPS core network.
  • Step 8 The second UDM determines that it needs to obtain the second authentication information (K IOPS ) according to the key transfer message.
  • the second UDM forms and stores the corresponding relationship between the second authentication information and the identification information of the UE, that is, the corresponding relationship between K IOPS and SUPI. .
  • the second UDM obtains the identification information of the UE and the protected second authentication information in the key transfer message.
  • the second UDM uses the key preconfigured in step 0c.
  • the key is used to obtain the second authentication information, specifically using the key to obtain the key and the protected second authentication information to obtain the second authentication information.
  • using the key to obtain the key and the protected second authentication information to obtain the second authentication information may be to use the key to obtain the key to decrypt the protected second authentication information to obtain the second authentication information, and/or use the key to obtain the second authentication information.
  • Obtaining a key verifies the integrity of the protected secondary authentication information.
  • the second UDM determines the corresponding relationship between the second authentication information and the identification information of the UE, that is, the corresponding relationship between K IOPS and SUPI.
  • the second UDM The K IOPS information is determined using the corresponding relationship between the SUPI of the UE and the second authentication information and the identification information of the UE, and is used as the root key for primary authentication to perform the main authentication process with the UE.
  • Step 9 The UE uses K IOPS as the root key for primary authentication to perform the primary authentication process with the second UDM.
  • the AMF instructs the first UDM to determine the second authentication information based on the network deployment (whether the RAN can connect to the IOPS) and/or the UE capabilities.
  • the second authentication information is based on the information required for primary authentication between the UE and the network where the first UDM is located.
  • Information acquisition, specifically the root key for primary authentication between the UE and the IOPS network is further deduced and determined based on the key obtained for primary authentication between the UE and the macro network (that is, the derived key of the macro network root key), and further determined by the first UDM Send the second authentication information to the second UDM.
  • the UE and the IOPS core network can use the derived key of the macro network root key for the main authentication process, eliminating the need to pre-configure the UE root key for the local IOPS core network, which can reduce the complexity of data processing and improve data processing. efficiency.
  • Figure 6 takes the data interaction between UE, RAN, AMF, AUSF, first UDM and second UDM as an example for explanation.
  • the first UDM determines the second authentication information after determining the UE's permission to access the IOPS network based on the UE's subscription information.
  • the AMF will not provide the third authentication information to the IOPS network.
  • a UDM sends indication information.
  • the first network is the macro network
  • the second network is the IOPS network (that is, the IOPS core network described below)
  • the first UDM belongs to the macro network
  • the second UDM belongs to the IOPS network.
  • Steps 0a/0b/0c are the same as steps 0a/0b/0c in Figure 5 above. The difference is that in this implementation: in step 0a, the AMF does not need to obtain the network identification information of the IOPS core network connected to the RAN connected to the AMF; 0b There is no need to configure the corresponding relationship between the key protection key and the network identification information of the IOPS core network.
  • Step 1 The UE requests access to the macro network and sends a registration request message to the AMF.
  • Step 2 After receiving the registration request, AMF exchanges messages with the first UDM.
  • the interaction message between AMF and UDM can be an indirect interaction with UDM, that is, during the main authentication process between UE and macro network, AMF interacts with the first UDM to trigger the main authentication message after receiving the registration request.
  • AMF sends AUSF
  • the UE authentication request Nausf_UEAuthentication_Authenticate Request is sent to AUSF, which is further sent to the first UDM by AUSF through UDM's UE authentication acquisition request Nudm_UEAuthentication_Get Request.
  • the AMF and UDM interaction message can also be the UDM that AMF will use to obtain UE subscription information after the registration process.
  • the Nudm_SDM_Get message obtained by the contract information management is sent to the first UDM, or it can also be a message for other AMFs to interact with the UDM, which is not limited here.
  • Step 3 After the first UDM determines that the UE has the authority to access the IOPS network based on the UE contract information, it deduces based on the key generated by the UE and the macro network owner authentication (first authentication information) to obtain the authentication key between the UE and the IOPS core network owner in the IOPS mode.
  • the required root key K IOPS (secondary authentication information).
  • Step 3a If K IOPS is further derived from one or more of K AUSF , K SEAF or KAMF generated in the main authentication process, the UE shall store K AUSF , K SEAF or KAMF in the USIM app accordingly.
  • This step is optional.
  • Step 4 The first UDM sends a key transfer request message to the AMF.
  • the key transfer request message includes the identification information of the UE and the protected second authentication information, so that the second The AMF determines the IOPS core network information corresponding to the RAN that the UE accesses based on the identification information of the UE, where the IOPS core network information includes the network identification information of the IOPS core network, that is, it determines to send the identification information of the UE and the protected second authentication information to Which IOPS core network the second UDM is located on.
  • the key transfer request message includes the identification information of the UE and the protected second authentication information, so that the second UDM can determine which UE the second authentication information to be obtained belongs to, and perform primary authentication in the subsequent IOPS network where the UE and the second UDM are located.
  • the corresponding second authentication information may be determined according to the identification information of the UE.
  • the first UDM determines the identification information of the UE in the primary authentication.
  • the identification information of the UE may be the SUPI information of the UE.
  • the key transfer indication information is used to instruct the AMF network element that this message is used to transfer the second authentication information to the IOPS network
  • the network identification information of the IOPS core network is used to assist the AMF in determining which IOPS network the key transfer request message needs to be sent to.
  • the first UDM can forward the key transfer request to the second UDM through AMF, RAN, forward it through NEF, or send it to the second UDM through other methods, such as between the first UDM and the second UDM.
  • Direct link forwarding If the first UDM does not forward the key transfer request to the second UDM through the AMF or RAN, step 5 and step 6 will be skipped after this step, and step 7 will be performed directly.
  • Step 5 Based on the key transfer request message and the IOPS core network corresponding to the RAN accessed by the UE, the AMF determines to forward the protected second authentication information to the second UDM.
  • the AMF forwards the protected second authentication information to the IOPS core network corresponding to the RAN accessed by the UE, so that the second UDM in the IOPS core network can obtain the second authentication information.
  • this step can be triggered in any one or more of the following ways: triggered according to the key transfer request message (that is, step 4), triggered according to the protected third
  • the second authentication information triggers implicitly or according to the key transfer instruction carried in step 4.
  • the AMF can send a key transfer failure message to the UDM along with the corresponding cause value information.
  • Step 5a The AMF triggers sending an IOPS key indication to the UE.
  • the IOPS key indication is used to instruct the UE to obtain and store the root key K IOPS required for the UE and IOPS core network master authentication in IOPS mode based on the key deduction generated by the master authentication.
  • the K IOPS The K IOPS .
  • This step is an optional step, that is, the access and mobility management network element sends instruction information to the terminal device for instructing the terminal device to generate the second authentication information. In this way, the terminal device knows that the second authentication information has been generated, and the terminal device can be ready to access the second network at any time.
  • Step 6 The RAN sends a key transfer message to the IOPS network.
  • the RAN sends a key transfer message to the IOPS network. Specifically, the RAN sends the key transfer message to the IOPS network so that the second UDM in the IOPS network obtains the key transfer message. The RAN needs to send the key transfer message to the second UDM through the second AMF. The second UDM sends a key transfer message, where the second AMF and the second UDM belong to the same IOPS network.
  • the RAN obtains the key transfer message from the AMF, and the key transfer message includes the protected second authentication information and the UE's identification information (SUPI).
  • the key transfer message includes the protected second authentication information and the UE's identification information (SUPI).
  • the RAN when it sends a key transfer message to the IOPS network, it may also carry key transfer indication information.
  • the key transfer indication information is used to instruct the IOPS network.
  • the message carries the key transfer message.
  • the RAN sends the key transfer message to the IOPS network.
  • the second AMF sends a message, which carries the key transfer message and the key transfer indication information.
  • the key transfer indication information is used to indicate to the second AMF that the message carries the key transfer message.
  • Step 7 The second UDM determines that it needs to obtain the second authentication information (K IOPS ) according to the key transfer message.
  • the second UDM forms and stores the corresponding relationship between the second authentication information and the identification information of the UE, that is, the corresponding relationship between K IOPS and SUPI. .
  • the second UDM obtains the identification information of the UE and the protected second authentication information in the key transfer message.
  • the second UDM uses the key preconfigured in step 0c.
  • the key is used to obtain the second authentication information, specifically using the key to obtain the key and the protected second authentication information to obtain the second authentication information.
  • using the key to obtain the key and the protected second authentication information to obtain the second authentication information may be to use the key to obtain the key to decrypt the protected second authentication information to obtain the second authentication information, and/or use the key to obtain the second authentication information.
  • Obtaining a key verifies the integrity of the protected secondary authentication information.
  • the second UDM determines the corresponding relationship between the second authentication information and the identification information of the UE, that is, the corresponding relationship between K IOPS and SUPI.
  • the second UDM uses the UE's SUPII and the corresponding relationship between the second authentication information and the UE's identification information to determine the K IOPS information, and uses it as the root key for primary authentication to perform the main authentication process with the UE. .
  • Step 8 The UE uses K IOPS as the root key for primary authentication to perform the primary authentication process with the second UDM.
  • the first UDM determines the UE's permission to access the IOPS network based on the UE's subscription information, it determines the second authentication information.
  • the second authentication information is obtained based on the information required for primary authentication between the UE and the network where the first UDM is located.
  • the root key for primary authentication between the UE and the IOPS network is further deduced and determined based on the key obtained for primary authentication between the UE and the macro network (i.e., the derived key of the macro network root key), and is further deduced and determined by the first UDM for the second authentication.
  • the information is sent to the second UDM.
  • the UE and the IOPS core network can use the derived key of the macro network root key for the main authentication process, eliminating the need to pre-configure the UE root key for the local IOPS core network, which can reduce the complexity of data processing and improve data processing. efficiency.
  • Figure 7 takes the data interaction between UE, RAN, AMF, AUSF, first UDM and second UDM as an example for explanation.
  • the first UDM determines the second authentication information after determining the UE's permission to access the IOPS network based on the UE's subscription information.
  • the AMF will not provide the third authentication information to the IOPS network.
  • a UDM sends indication information.
  • the first network is the macro network
  • the second network is the IOPS network (that is, the IOPS core network described below)
  • the first UDM belongs to the macro network
  • the second UDM belongs to the IOPS network.
  • Steps 0a/0b/0c are the same as steps 0a/0b/0c in the above-mentioned Figure 6, and steps 1-2 are the same as steps 1-2 in the above-mentioned Figure 6, and will not be described again here.
  • Step 3 After the first UDM determines that the UE has the authority to access the IOPS network based on the UE subscription information, it triggers a network identification request acquisition message to be sent to the AMF to request the network identification information of the IOPS core network corresponding to the RAN that the UE accesses.
  • the AMF interacts with the UDM indirectly in step 2, that is, during the main authentication process between the UE and the macro network, the AMF interacts with the first UDM to trigger the main authentication message after receiving the registration request (specifically, the AMF will AUSF
  • the UE authentication request Nausf_UEAuthentication_Authenticate Request is sent to the AUSF, which is further sent to the first UDM by the AUSF through the UDM's UE authentication acquisition request Nudm_UEAuthentication_Get Request).
  • the UDM needs to obtain the primary authentication success indication through the UDM's UE authentication result confirmation request Nudm_UEAuthentication_ResultConfirmation Request message. and then perform this step again.
  • Step 4 The first UDM requests the AMF to obtain the network identification information of the IOPS core network corresponding to the RAN accessed by the UE.
  • UDM sends a network identification information acquisition request to the AMF, which carries the UE's SUPI information.
  • it also carries the network identifier to obtain instruction information.
  • the AMF determines that it is necessary to obtain network identification information.
  • the AMF determines whether the RAN corresponding to the UE accessed by the SUPI has a corresponding local IOPS core network. If it exists, it determines the network identification information of the local IOPS core network (taking into account the actual deployment situation, the UE access
  • the RAN may be connected to multiple IOPS core networks. In this case, the AMF can determine the network identification information of multiple local IOPS core networks and send it to the first UDM); if it does not exist, send reply information to the first UDM and carry Corresponding cause value information.
  • the AMF determines the network identification information of the IOPS core network corresponding to the RAN accessed by the UE.
  • the AMF can determine the corresponding backhaul network based on the identification information of the UE, and further determine the identification information of the RAN corresponding to the backhaul network, so as to determine the network identification information of the IOPS core network corresponding to the RAN.
  • the corresponding relationship between the identification and the identification of the RAN and the second network identification information in step 0a is determined to determine the network identification information of the corresponding IOPS core network.
  • AMF may determine the need to obtain IOPS network identification information based on the network identification information acquisition request message, or may determine the need to obtain IOPS network identification information based on the network identification information acquisition instruction information in the message, which is not specifically limited in this application.
  • Step 5 AMF replies to the request information of the first UDM.
  • Step 6 The first UDM deduces and obtains the root key K IOPS (second authentication information) required for authentication between the UE and the IOPS core network owner in IOPS mode based on the key (first authentication information) generated by the authentication between the UE and the macro network owner.
  • K IOPS second authentication information
  • first authentication information generated by the authentication between the UE and the macro network owner.
  • step 3 in the embodiment of FIG. 6 and step 4 in FIG. 5 , and will not be described again here.
  • Step 6a For details, please refer to step 3a in the embodiment of Figure 6 mentioned above.
  • Step 7 is the same as step 5 in the above embodiment of Figure 5.
  • Steps 8-11 Steps 6-9 in the above embodiment of Figure 5.
  • the first UDM generates an IOPS key based on the UE's subscription information, and further sends it to the second UDM by the first UDM.
  • the UE and the IOPS core network can use the derived key of the macro network root key for the main authentication process, eliminating the need to pre-configure the UE root key for the local IOPS core network.
  • different UDMs can be sent to multiple second UDMs. The key allows the UE to access any IOPS core network when multiple IOPS core networks are deployed, which can reduce the complexity of data processing and improve data processing efficiency.
  • each device may include a corresponding hardware structure and/or software module to perform each function.
  • each device may include a corresponding hardware structure and/or software module to perform each function.
  • the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is performed by hardware or computer software driving the hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each specific application, but such implementations should not be considered beyond the scope of this application.
  • Embodiments of the present application can divide the device into functional units according to the above method examples.
  • each functional unit can be divided corresponding to each function, or two or more functions can be integrated into one unit.
  • the above integrated units can be implemented in the form of hardware or software functional units.
  • FIG. 8 shows a possible exemplary block diagram of the communication device involved in the embodiment of the present application.
  • the communication device 800 may include: a processing unit 801 and a transceiver unit 802 .
  • the processing unit 801 is used to control and manage the operations of the communication device 800 .
  • the transceiver unit 802 is used to support the communication device 800 Communication with other devices.
  • the transceiver unit 802 may include a receiving unit and/or a sending unit, respectively configured to perform receiving and sending operations.
  • the communication device 800 may also include a storage unit for storing program codes and/or data of the communication device 800 .
  • the transceiver unit may be called an input-output unit, a communication unit, etc.
  • the transceiver unit may be a transceiver
  • the processing unit may be a processor.
  • the communication device is a module (such as a chip) in a communication device
  • the transceiver unit may be an input-output interface, an input-output circuit, or an input-output pin, etc., and may also be called an interface, a communication interface, or an interface circuit, etc.
  • the processing unit may be a processor, a processing circuit or a logic circuit, etc.
  • the device may be the above-mentioned first UDM, AMF, second UDM, etc.
  • the processing unit 801 of the communication device 800 is configured to determine the second authentication used by the terminal device to perform access authentication with the second network based on the first authentication information used by the terminal device for access authentication with the first network.
  • Information the communication device belongs to the first network; the first network is different from the second network; the transceiver unit 802 is used to send the second authentication information to the second unified data management unit, and the second unified data management unit belongs to the second network.
  • the processing unit 801 is configured to determine the second authentication information according to the first authentication information when it is determined that the terminal device has the authority to access the first network.
  • the transceiver unit 802 is configured to receive indication information from the access and mobility management network element, where the indication information is used to trigger the communication device to determine the second authentication information.
  • the processing unit 801 is configured to use the first authentication information as an input parameter to generate second authentication information.
  • the first authentication information includes one or more of the following: CK, IK, SQN, KAUSF, KSEAF, and KAMF.
  • the transceiver unit 802 is configured to send the identification information of the terminal device and the second authentication information to the second unified data management unit, and the identification information of the terminal device is associated with the second authentication information.
  • the transceiver unit 802 is configured to send the second authentication information to the second unified data management unit through the access and mobility management network element and the wireless access network device; or, the transceiver unit 802 is configured to use The second authentication information is sent to the second unified data management unit through NEF.
  • the second authentication information is securely protected through key protection information.
  • the transceiver unit 802 is configured to receive the identification information of the second network from the access and mobility management network element; the processing unit 801 is configured to determine the key protection information according to the identification information of the second network .
  • the first network is an IOPS network or a private network
  • the second network is a macro network
  • the first network is a macro network
  • the second network is an IOPS network or a private network
  • the processing unit 801 of the communication device 800 is used to determine the identification information of the second network; the first unified data management unit belongs to the first network; the first network is different from the second network; the transceiver unit 802 is used to Send the identification information of the second network to the first unified data management unit.
  • the processing unit 801 triggers indication information.
  • the indication information is used to instruct the first unified data management unit to determine whether the terminal device is connected to the first network based on the first authentication information used for access authentication between the terminal device and the first network.
  • the second authentication information transceiver unit 802 used by the second network for access authentication is used to send instruction information to the first unified data management unit.
  • the processing unit 801 is configured to determine the identification information of the second network based on the existence of a second network co-deployed with the radio access network device accessed by the terminal device.
  • the processing unit 801 is configured to determine, based on the capability information of the terminal device, that the terminal device has the ability to access the second network; based on the terminal device having the ability to access the second network and the accessed wireless Access Network The device has a co-deployed second network, and the identification information of the second network is determined.
  • the transceiver unit 802 is configured to receive a request message for the identification information of the second network from the first unified data management unit; the processing unit 801 is configured to query the identification information of the second network based on the request message. .
  • the transceiver unit 802 is configured to send instruction information to the terminal device for instructing the terminal device to generate the second authentication information.
  • the second authentication information is securely protected through key protection information.
  • the first network is an IOPS network or a private network
  • the second network is a macro network
  • the first network is a macro network
  • the second network is an IOPS network or a private network
  • the transceiver unit 802 of the communication device 800 is used to receive the second authentication information from the first unified data management network element used for access authentication between the terminal equipment and the second network; the processing unit 801 is used to perform the access authentication according to the The second authentication information performs access authentication on the terminal device.
  • the second authentication information is determined by the first unified data management unit based on the first authentication information used for access authentication between the terminal device and the first network; the first unified data management unit belongs to the first network ; The second unified data management unit belongs to the second network; the first network is different from the second network.
  • the second authentication information is protected by key protection information.
  • the processing unit 801 is configured to decrypt the second authentication information protected by the key protection information through the key decryption protection information before performing access authentication on the terminal device according to the second authentication information, and determine Second authentication information.
  • the key decryption protection information is associated with the identification information of the second network.
  • the first network is an IOPS network or a private network
  • the second network is a macro network
  • the first network is a macro network
  • the second network is an IOPS network or a private network
  • the communication device 900 may be a chip or a system on a chip.
  • the communication device may be located in the device involved in any of the above method embodiments, such as the first UDM, AMF, and the second UDM, etc., to perform actions corresponding to the device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • Communication device 900 includes processor 910.
  • the processor 910 is configured to execute the computer program stored in the memory 920 to implement the actions of each device in any of the above method embodiments.
  • Communication device 900 may also include memory 920 for storing computer programs.
  • memory 920 and processor 910 are coupled. Coupling is an indirect coupling or communication connection between devices, units or modules, which can be in electrical, mechanical or other forms, and is used for information interaction between devices, units or modules.
  • the memory 920 is integrated with the processor 910 .
  • processors 910 and memories 920 There can be one or more processors 910 and memories 920 without limitation.
  • the communication device 900 may or may not include the transceiver 930 , as shown by a dotted box in the figure, and the communication device 900 may interact with other devices through the transceiver 930 .
  • the transceiver 930 may be a circuit, a bus, a transceiver, or any other device that may be used for information exchange.
  • the communication device 900 may be the first UDM, AMF and second UDM in the implementation of the above methods.
  • connection medium between the above-mentioned transceiver 930, processor 910 and memory 920 is not limited in the embodiment of the present application.
  • the memory 920, the processor 910 and the transceiver 930 are connected through a bus.
  • the bus is represented by a thick line in Figure 9.
  • the connection methods between other components are only schematically illustrated and are not limiting.
  • the bus can be divided into address bus, data bus, control bus, etc. For ease of presentation, only one thick line is used in Figure 9, but it does not mean that there is only one bus or one type of bus.
  • the processor may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or Execute each method, step and logical block diagram disclosed in the embodiment of this application.
  • a general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in conjunction with the embodiments of the present application can be directly implemented by a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.
  • the memory may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), etc., or it may be a volatile memory (volatile memory), such as Random-access memory (RAM).
  • Memory may also be, but is not limited to, any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer.
  • the memory in the embodiment of the present application can also be a circuit or any other device capable of performing a storage function, used to store computer programs, program instructions and/or data.
  • the embodiment of the present application also provides another communication device 1000, including: an interface circuit 1010 and a logic circuit 1020; the interface circuit 1010 can be understood as an input and output interface, and can be used to perform any of the above methods.
  • the logic circuit 1020 can be used to run codes or instructions to perform the method performed by each device in any of the above embodiments, which will not be described again.
  • embodiments of the present application also provide a computer-readable storage medium that stores instructions.
  • each device in any of the above method embodiments is executed. is implemented, for example, so that the method executed by the first UDM or the second UDM in the embodiment shown in FIG. 4 is implemented.
  • the computer-readable storage medium may include: U disk, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk and other various media that can store program codes.
  • inventions of the present application provide a communication system.
  • the communication system includes the first UDM, AMF and second UDM mentioned in any of the above method embodiments, and can be used to execute each of the above method embodiments.
  • embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction apparatus, the instructions
  • the device implements one process or multiple processes in the flow chart and/or one or more blocks in the block diagram Functions specified in the box.
  • These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device.
  • Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

La présente demande concerne, dans les modes de réalisation, un procédé de communication et un appareil de communication, se rapportant au domaine technique des communications. Selon de premières informations d'authentification utilisées pour une authentification d'accès effectuée entre un dispositif terminal et un premier réseau, une première unité de gestion de données unifiée détermine des secondes informations d'authentification utilisées pour une authentification d'accès effectuée entre le dispositif terminal et un second réseau, la première unité de gestion de données unifiée appartenant au premier réseau et le premier réseau étant différent du second réseau; et la première unité de gestion de données unifiée envoie les secondes informations d'authentification à une seconde unité de gestion de données unifiée, la seconde unité de gestion de données unifiée appartenant au second réseau. Dans la présente demande, les secondes informations d'authentification pour un accès au second réseau sont déterminées sur la base des premières informations d'authentification pour un accès au premier réseau, ce qui permet de réduire la complexité d'authentification d'accès et d'améliorer l'efficacité de traitement de données.
PCT/CN2023/090404 2022-05-06 2023-04-24 Procédé de communication et appareil de communication WO2023213208A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210489861.5 2022-05-06
CN202210489861.5A CN117062070A (zh) 2022-05-06 2022-05-06 一种通信方法及通信装置

Publications (1)

Publication Number Publication Date
WO2023213208A1 true WO2023213208A1 (fr) 2023-11-09

Family

ID=88646245

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/090404 WO2023213208A1 (fr) 2022-05-06 2023-04-24 Procédé de communication et appareil de communication

Country Status (2)

Country Link
CN (1) CN117062070A (fr)
WO (1) WO2023213208A1 (fr)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101056172A (zh) * 2006-04-10 2007-10-17 富士通株式会社 认证网络系统
US20120054840A1 (en) * 2010-08-31 2012-03-01 Vivek Gupta Roaming between networks employing different authentication protocols
US20170223531A1 (en) * 2014-07-28 2017-08-03 Telefonaktiebolaget Lm Ericsson (Publ) Authentication in a wireless communications network
CN111669276A (zh) * 2019-03-07 2020-09-15 华为技术有限公司 一种网络验证方法、装置及系统
CN112449339A (zh) * 2019-08-15 2021-03-05 中国移动通信有限公司研究院 一种网络漫游方法、装置、终端及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101056172A (zh) * 2006-04-10 2007-10-17 富士通株式会社 认证网络系统
US20120054840A1 (en) * 2010-08-31 2012-03-01 Vivek Gupta Roaming between networks employing different authentication protocols
US20170223531A1 (en) * 2014-07-28 2017-08-03 Telefonaktiebolaget Lm Ericsson (Publ) Authentication in a wireless communications network
CN111669276A (zh) * 2019-03-07 2020-09-15 华为技术有限公司 一种网络验证方法、装置及系统
CN112449339A (zh) * 2019-08-15 2021-03-05 中国移动通信有限公司研究院 一种网络漫游方法、装置、终端及存储介质

Also Published As

Publication number Publication date
CN117062070A (zh) 2023-11-14

Similar Documents

Publication Publication Date Title
KR102601585B1 (ko) Nas 메시지의 보안 보호를 위한 시스템 및 방법
JP6574238B2 (ja) デバイスを別のデバイスのネットワークサブスクリプションと関係付けること
US10687213B2 (en) Secure establishment method, system and device of wireless local area network
TWI717383B (zh) 用於網路切分的金鑰層級
KR101868713B1 (ko) 사용자 디바이스들 간의 제어된 크레덴셜 제공
CN111788839A (zh) 用户身份隐私保护和网络密钥管理
US20230319556A1 (en) Key obtaining method and communication apparatus
US20230099786A1 (en) Methods and Apparatus for Provisioning Private Network Devices During Onboarding
US20220272607A1 (en) Network Access Method and Communication Apparatus
US20230014494A1 (en) Communication method, apparatus, and system
JP2020511095A (ja) 通信ネットワーク内での使用のためのネットワークノード、通信デバイス、およびそれらを動作させる方法
US20220174497A1 (en) Communication Method And Apparatus
WO2018170703A1 (fr) Procédé et dispositif d'établissement de connexion
WO2018076553A1 (fr) Procédé et dispositif d'accès à un réseau
EP3962131A1 (fr) Sélection de relais dans des réseaux cellulaires en tranches
WO2021212497A1 (fr) Procédé et appareil d'authentification de sécurité, et dispositif et support de stockage
CA3204536A1 (fr) Procede de generation d?identifiant de cle et appareil associe
US20220272533A1 (en) Identity authentication method and communications apparatus
WO2023213208A1 (fr) Procédé de communication et appareil de communication
WO2020220862A1 (fr) Procédé et dispositif de communication
WO2023213184A1 (fr) Procédé de communication et appareil de communication
KR101780401B1 (ko) 무선 통신 시스템에서의 인증 및 보안 설정을 위한 방법 및 이를 위한 장치
US20230354028A1 (en) Method, system, and apparatus for generating key for inter-device communication
US20230396433A1 (en) Key update method and apparatus
WO2024094108A1 (fr) Procédé de communication et appareil de communication

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23799195

Country of ref document: EP

Kind code of ref document: A1