WO2023216272A1 - Procédé et appareil de gestion de clé, et dispositif et support de stockage - Google Patents

Procédé et appareil de gestion de clé, et dispositif et support de stockage Download PDF

Info

Publication number
WO2023216272A1
WO2023216272A1 PCT/CN2022/092885 CN2022092885W WO2023216272A1 WO 2023216272 A1 WO2023216272 A1 WO 2023216272A1 CN 2022092885 W CN2022092885 W CN 2022092885W WO 2023216272 A1 WO2023216272 A1 WO 2023216272A1
Authority
WO
WIPO (PCT)
Prior art keywords
akma
key
service network
application
network
Prior art date
Application number
PCT/CN2022/092885
Other languages
English (en)
Chinese (zh)
Inventor
梁浩然
陆伟
Original Assignee
北京小米移动软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京小米移动软件有限公司 filed Critical 北京小米移动软件有限公司
Priority to PCT/CN2022/092885 priority Critical patent/WO2023216272A1/fr
Priority to CN202280001756.0A priority patent/CN117413554A/zh
Publication of WO2023216272A1 publication Critical patent/WO2023216272A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security

Definitions

  • the present application relates to the field of communications, and in particular to a key management method, device, equipment and storage medium.
  • AKMA Authentication and Key Management for Applications based on 3GPP credentials
  • ProSe Proximity based Service
  • Message within 5G 5th generation mobile communication technology message service
  • MSGin5G fifth generation mobile communication technology message service
  • AF Application Function
  • Embodiments of the present application provide a key management method, device, equipment and storage medium for performing key requests based on a proxy entity in a service network in a roaming scenario.
  • the technical solutions are as follows:
  • a key management method is provided, which is applied in a roaming scenario.
  • the method is executed by a proxy entity in the service network.
  • the method includes:
  • a key management method is provided, which is applied in a roaming scenario.
  • the method is executed by the AAnF in the home network.
  • the method includes:
  • the AKMA application key of the AF in the serving network is generated based on the AKMA key of the terminal;
  • the application key acquisition response is fed back to the proxy entity in the service network, and the application key acquisition response includes the AKMA application key information of the AF in the service network.
  • a key management method is provided, which is applied in a roaming scenario.
  • the method is executed by an application function in the service network.
  • the method includes:
  • the AKMA application key response includes the AKMA application key information of the AF in the service network.
  • a key management method is provided, which is applied in a roaming scenario.
  • the method is executed by a terminal.
  • the method includes:
  • the service network identifier is used to trigger the AF in the service network to send the service network identifier to the service network when the service network identifier of the terminal is inconsistent with the home network identifier.
  • the proxy entity sends the AKMA application key request.
  • a key management device includes:
  • the receiving module is used to receive the AKMA application key request sent by the AF in the service network;
  • the sending module is also used to feed back an AKMA application key response to the AF in the service network.
  • the AKMA application key response includes the AKMA application key information of the AF in the service network.
  • a key management device includes:
  • the receiving module is used to receive the application key acquisition request sent by the proxy entity in the service network;
  • a generation module configured to generate the AKMA application key of the AF in the service network based on the AKMA key of the terminal when the AKMA key of the terminal is stored in the AAnF in the home network;
  • the sending module is configured to feed back an application key acquisition response to the proxy entity in the service network, where the application key acquisition response includes the AKMA application key information of the AF in the service network.
  • a key management device includes:
  • the receiving module is used to receive the service network identifier and AKMA key identifier sent by the terminal;
  • a sending module configured to send an AKMA application key request to the proxy entity in the serving network when the terminal's serving network identifier is inconsistent with the home network identifier;
  • the receiving module is also configured to receive an AKMA application key response fed back by the proxy entity in the service network.
  • the AKMA application key response includes the AKMA application key information of the AF in the service network.
  • a key management device includes:
  • the sending module is used to send the service network identifier and the AKMA key identifier to the AF in the service network.
  • the service network identifier is used to trigger the AF in the service network when the service network identifier of the terminal is inconsistent with the home network identifier. , sends an AKMA application key request to the proxy entity in the service network.
  • a proxy entity includes a communication component
  • the communication component is used to receive the AKMA application key request sent by the AF in the service network;
  • an AAnF including a communication component and a processor
  • the communication component is used to receive the application key acquisition request sent by the proxy entity in the service network;
  • a processor configured to generate the AKMA application key of the AF in the service network based on the AKMA key of the terminal when the AKMA key of the terminal is stored in the AAnF in the home network;
  • the communication component is also used to feed back an application key acquisition response to the proxy entity in the service network.
  • the application key acquisition response includes the AKMA application key information of the AF in the service network.
  • an AF is provided, the AF including a communication component;
  • Communication component used to receive the service network identifier and AKMA key identifier sent by the terminal;
  • the AKMA application key response includes the AKMA application key information of the AF in the service network.
  • a terminal including a transceiver
  • the transceiver is used to send the service network identifier and the AKMA key identifier to the AF in the service network.
  • the service network identifier is used to trigger the AF in the service network when the service network identifier of the terminal is inconsistent with the home network identifier. , sends an AKMA application key request to the proxy entity in the service network.
  • a computer-readable storage medium is provided, and a computer program is stored in the storage medium, and the computer program is used to be executed by a processor to implement the key management method as described above.
  • a chip is provided.
  • the chip includes programmable logic circuits and/or program instructions, and is used to implement the key management method as described above when the chip is running.
  • a computer program product includes computer instructions.
  • the computer instructions are stored in a computer-readable storage medium.
  • the processor reads and executes the computer instructions from the computer-readable storage medium to implement Key management methods as described above.
  • Figure 1 is a schematic diagram of the network architecture of the AKMA service provided by an exemplary embodiment of the present application
  • Figure 2 is a flow chart for generating AKMA keys provided by an exemplary embodiment of the present application
  • Figure 3 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 4 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 5 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 6 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 7 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 8 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 9 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 10 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 11 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 12 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 13 is a schematic diagram of a key management device provided by an exemplary embodiment of the present application.
  • Figure 14 is a schematic diagram of a key management device provided by an exemplary embodiment of the present application.
  • Figure 15 is a schematic diagram of a key management device provided by an exemplary embodiment of the present application.
  • Figure 16 is a schematic diagram of a key management device provided by an exemplary embodiment of the present application.
  • Figure 17 is a schematic structural diagram of a communication device provided by an exemplary embodiment of the present application.
  • Figure 18 is a schematic structural diagram of a network element device provided by an exemplary embodiment of the present application.
  • first, second, third, etc. may be used in this disclosure to describe various information, the information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other.
  • first information may also be called second information, and similarly, the second information may also be called first information.
  • word “if” as used herein may be interpreted as "when” or “when” or “in response to determining.”
  • the 5G system includes terminals, access networks and core networks.
  • the terminal is a device with wireless transceiver function, which can be deployed on land, water, air, etc.
  • the terminal can be used in self-driving, remote medical, smart grid, transportation safety, smart city, smart home, etc. At least in one scene.
  • the access network is used to implement access-related functions and can provide network access functions for authorized users in a specific area.
  • the access network forwards control signals and user data between terminal equipment and the core network.
  • the access network may include access network equipment, which may be equipment that provides access to terminal equipment, and may include Radio Access Network (RAN) equipment and AN equipment.
  • RAN equipment is mainly wireless network equipment in the 3GPP network, and AN equipment can be non-3GPP-defined access network equipment. In systems using different wireless access technologies, the names of equipment with base station functions may be different.
  • gNB Next Generation Node Basestation
  • gNB Next Generation Node Basestation
  • gNB Next Generation Node Basestation
  • LTE Long Term Evolution
  • eNB evolved NodeB
  • the core network is responsible for maintaining mobile network subscription data and providing terminals with functions such as session management, mobility management, policy management, and security authentication.
  • the core network can include the following network elements: User Plane Function (UPF), Authentication Server Function (AUSF), Access and Mobility Management Function (AMF), and Session Management Function (Session Management Function, SMF), Network Exposure Function (NEF), Network Function Repository Function (NRF), Policy Control Function (Policy Control Function, PCF) and Unified Data Management (Unified Data Management , UDM), optionally, it can also include application function (Application Function, AF) and unified data repository (Unified Data Repository, UDR).
  • UDM and UDR are collectively referred to as data management network elements.
  • AMF is mainly responsible for mobility management in mobile networks, such as user location update, user registration network, user switching, etc.
  • SMF is mainly responsible for session management in mobile networks, such as session establishment, modification, and release.
  • UPF is responsible for forwarding and receiving user data in terminal devices. It can receive user data from the data network and transmit it to the terminal device through the access network device. It can also receive user data from the terminal device through the access network device and forward it to the data network.
  • PCF mainly supports providing a unified policy framework to control network behavior, provides policy rules to the control layer network functions, and is also responsible for obtaining user subscription information related to policy decisions.
  • AUSF is used to perform security authentication of terminals.
  • NEF is mainly used to support the opening of capabilities and events.
  • NRF is used to provide storage and selection functions for network function entity information for other network elements.
  • UDM is used to store user data, such as contract data, authentication/authorization data, etc.
  • AF interacts with the 3GPP core network to provide application layer services, such as providing application layer data routing, providing access network capability opening functions, interacting with the policy framework to provide policy control, and interacting with the IP Multimedia subsystem (IP Multimedia) of the 5G network. Subsystem, IMS) interaction, etc.
  • IP Multimedia IP Multimedia subsystem
  • the Data Network is used to provide business services to users. It can be a private network, such as a local area network; it can also be an external network that is not controlled by the operator, such as the Internet; it can also be a shared network by the operator. Deployed private network, such as IMS network.
  • the terminal device can access the DN through the established Protocol Data Unit (PDU) session.
  • PDU Protocol Data Unit
  • 5G may also be called “5G New Radio (NR)” or “NR”
  • terminal may also be called “terminal equipment” or “user equipment”. (User Equipment, UE)”.
  • NR New Radio
  • UE User Equipment
  • AKMA Authentication and Key Management for Applications based on 3GPP credentials
  • the security protection of the AKMA process can be used to improve the security of data transmission.
  • an AF corresponds to a video application server.
  • a UE that supports the AKMA service transmits data to the AF, compared with the unprotected transmission method of traditional UE and AF, using the AKMA service can improve the security of data transmission.
  • the network architecture shown in Figure 1 includes UE, access network (Radio Access Network, (R)AN), AUSF, AMF, AF, NEF, AKMA anchor function network element (AKMA Anchor Function, AAnF) and UDM.
  • Figure 1 shows a schematic network architecture diagram of the AKMA service provided by an exemplary embodiment of the present application
  • Figure 2 shows a flow chart of generating an AKMA key provided by an exemplary embodiment of the present application.
  • the UE communicates with the AF through (R)AN and AMF
  • the UE communicates with the AF through AMF
  • the Ua* interface is the communication interface between the UE and the AF.
  • the AUSF can generate the key of the AKMA service (ie, the AKMA key) and provide the key of the UE's AKMA service to the AAnF.
  • the key of the AKMA service may be K AKMA , which may also be called the root key of the AKMA service.
  • the UE side will also generate the same key for the AKMA service, that is, generate the same K AKMA .
  • the process of generating a key for the AKMA service can be seen in Figure 2.
  • the UE registers with the 5G core network
  • the UE sends a registration request to the AMF through the RAN.
  • the registration request carries the UE's identity information.
  • the AMF selects the AUSF based on the UE's identity information (such as the hidden identity identifier (Subscriber Concealed Identifier, SUCI)).
  • the hidden identity identifier Subscriber Concealed Identifier, SUCI
  • Primary Authentication in Figure 2 is the process in which the AUSF authenticates the UE and the UE authenticates the AUSF during the registration process. Primary authentication can also be described as two-way authentication. For details, please refer to 3GPP TS33 .501-g106.1 chapter related description.
  • AUSF can use the intermediate key generated during the primary authentication process, such as KAUSF , to generate KAKMA , and generate key identification information for KAKMA .
  • the key identification information can be used to identify KAKMA , for example, it can be a KAKMA identifier ( KAKMA Identifier, A-KID).
  • the UE can use the intermediate key generated during the primary authentication process, such as KAUSF , to generate KAKMA and key identification information for KAKMA . It can be understood that the UE and the AUSF locally generate the same KAUSF , KAKMA and key identification information respectively.
  • AAnF can interact with AUSF, obtain the key of AKMA service from AUSF, and generate the communication key between the AF and UE and the validity of the communication key based on the key of AKMA service and the identification of AF. time.
  • the AAnF can send the communication key and the validity time of the communication key to the AF, so that the AF can use the communication key to perform data transmission with the UE, thereby improving the security of data transmission between the AF and the UE.
  • the communication key between the AF and the UE may be called the AKMA Application Key (K AF ) corresponding to the AF.
  • the K AF between different AFs and the same UE may be different.
  • the K AF between AF1 and UE1 is K AF 1
  • the K AF between AF2 and UE1 is K AF 2.
  • AF can interact with 3GPP core network elements.
  • AF can obtain Quality of Service (QoS) parameters from PCF, or AF can provide QoS parameters to PCF, which can then affect the data transmission of the application.
  • AF can interact with NEF.
  • the AF obtains the communication key between the AF and the UE and the validity time of the communication key from the AAnF.
  • AF can be located inside the 5G core network or outside the 5G core network. If the AF is located inside the 5G core network, the AF can directly interact with the PCF; if the AF is located outside the 5G core network, the AF can interact with the PCF through NEF.
  • the embodiment of the present application provides a key management method for generating a communication key between an AF and a terminal located in a service network.
  • the communication keys between the same terminal and different AFs may be the same or different.
  • the embodiment of this application is only directed to the communication keys between a certain AF located in the service network and the terminal.
  • the key management method provided by the embodiment of the present application there are at least one terminal, at least one AF, at least one AAnF, and at least one proxy entity.
  • the key management method provided by the embodiment of the present application is applied in a roaming scenario, the AAnF is located in the home network of the terminal, and the terminal, AF and proxy entity are located in the service network.
  • the terminal can be represented by UE, and the proxy entity in the service network can be represented by AAnFProxy; the coverage ranges of the home network and the service network are different, the same, or overlap.
  • the AAnFProxy is a separate network function (Nextwork Function, NF) in the service network; or, the AAnFProxy is part of any NF in the service network; or, the AAnFProxy is available within the 3GPP operator domain.
  • Letter application function (Trusted AF).
  • the terminal type includes but is not limited to handheld devices, wearable devices, vehicle-mounted devices, Internet of Things devices, etc.
  • the terminal may be a mobile phone, a tablet computer, an e-book reader, a laptop computer, a desktop computer, At least one of televisions, game consoles, augmented reality (Augmented Reality, AR) terminals, virtual reality (VR) terminals, mixed reality (Mixed Reality, MR) terminals, wearable devices, handles and controllers, etc.
  • augmented reality Augmented Reality, AR
  • VR virtual reality
  • MR mixed reality
  • Figure 3 shows a flow chart of a key management method provided by an exemplary embodiment of the present application for generating a communication key between an AF and a terminal located in a service network.
  • the method includes at least some of the following steps: :
  • Step 101 The UE sends an application session establishment request to the AF in the serving network.
  • the AF in the service network communicates with the UE, it needs to be determined whether the AKMA service can be used between the two.
  • the main authentication process between the UE and the AUSF is passed, so that the UE and the AUSF locally generate the same K AUSF , KAKMA and A-KID respectively.
  • the main authentication process can refer to the above content and will not be described again.
  • the prerequisites for the AF in the serving network to communicate with the UE are implicitly specific to the terminal and the AF, or are explicitly indicated by the AF to the terminal.
  • the application session establishment request is used to trigger the application session establishment request, and the application session establishment request can be represented by Application Session Establishment Request.
  • the application session establishment request carries the AKMA key identifier and/or the service network identifier, and the AKMA key identifier can be represented by A-KID.
  • A-KID is used to indicate the identifier of the AKMA key of the terminal;
  • the service network identifier is used to indicate the service network of the terminal, and is used to trigger AF in the service network when the service network identifier of the terminal is inconsistent with the home network identifier.
  • a key management request is sent to the proxy entity in the service network.
  • TS 33.535 stipulates that A-KID should adopt the Network Access Identifier (NAI) format specified in clause 2.2 of IETF RFC 7542, such as: username@security domain.
  • the username part should include the Routing Indicator (RID) and the AKMA Temporary UE Identifier (A-TID), and the security domain part should include the home network identifier.
  • NAI Network Access Identifier
  • the application session establishment request includes A-KID, and the A-KID carries the service network identifier of the terminal; or, the application session establishment request includes the A-KID and the service network identifier of the terminal; or, The application session establishment request includes the A-KID, and the terminal sends the terminal's service network identifier before or after the application session establishment request.
  • the service network identifier indicates a corresponding application session establishment request or A-KID.
  • Step 102 The AF in the service network sends an AKMA application key request to the proxy entity in the service network.
  • the AKMA application key request is used to request the AKMA application key information of the AF in the service network from the proxy entity in the service network.
  • the AKMA application key request includes the A-KID and/or AF identifier (AF Identifier, AF_ID).
  • the proxy entity can be represented by AAnFProxy;
  • A-KID is obtained from the terminal by the AF in the service network;
  • AF_ID is used to indicate the identifier of the AF in the service network.
  • AF_ID contains AF's fully qualified domain name (Fully Qualified Domain Name, FQDN) and Ua* security protocol identifier.
  • FQDN Fully Qualified Domain Name
  • Ua* security protocol identifier is used to indicate the security protocol that the AF will use with the UE.
  • the proxy entity in the service network is a separate NF in the service network; or, the proxy entity in the service network is part of any NF in the service network; or, the proxy entity in the service network is a trusted application function (Trusted AF), such as the trusted application function within the 3GPP operator domain.
  • Trusted AF trusted application function
  • the service network corresponding to the terminal is the terminal's home network, and the AF can obtain K AF from AAnf as described in clause 6.3 of TS 33.535.
  • AKMA applies key request to request K AF .
  • the AKMA application key request sent by the AF in the service network to the proxy entity in the service network varies according to the policies in the AF in the service network.
  • the AF in the serving network sends the first AKMA application key request to the proxy entity in the home network.
  • the first AKMA application key request is used to indicate that the AF in the service network requires a terminal identity.
  • the first AKMA Application Key Request can be expressed using AKMA Application Key Request.
  • the AF in the serving network sends a second AKMA application key request to the proxy entity in the home network.
  • the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identity.
  • the second AKMA Application Key request can be expressed using AKMA Application Key AnonUser Request.
  • Step 103 The proxy entity in the serving network sends an application key acquisition request to the AAnF in the home network.
  • the application key acquisition request is used to request the AKMA application key information of the AF in the service network from the AAnF in the home network, and the application key acquisition request includes A-KID and/or AF_ID.
  • A-KID and /AF_ID For relevant descriptions of A-KID and /AF_ID, please refer to the foregoing content and will not be described again.
  • step 102 according to the different policies in the AF in the service network, the AF in the service network sends different AKMA application key requests to the proxy entity in the service network.
  • the proxy entity in the service network sends a request to the home network
  • the application key acquisition request sent by AAnF is also different.
  • the proxy entity in the serving network receives the first AKMA application key request.
  • the first AKMA application key request is used to indicate that the AF in the serving network requires a terminal identity; subsequently, the proxy entity in the serving network sends a request to the home network.
  • the AAnF in sends the first application key acquisition request.
  • the first application key acquisition request can be represented by Naanf_AKMA_ApplicationKey_Get Request.
  • the proxy entity in the service network receives the second AKMA application key request.
  • the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identity; subsequently, the proxy entity in the service network sends a request to the home network.
  • the AAnF in the network sends a second application key acquisition request.
  • the second application key acquisition request can be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Request.
  • the proxy entity in the serving network also needs to determine the AAnF in the home network.
  • the key management method provided by the embodiment of the present application also includes:
  • the proxy entity in the service network discovers the AAnF in the home network through the NRF in the service network and the home network.
  • the NRF in the home network is represented by hNRF
  • the NRF in the service network is represented by vNRF.
  • the process of the agent entity in the service network discovering the AAnF in the home network can be implemented as follows: The agent entity in the service network uses the service The network identifier determines vNRF; vNRF can determine hNRF based on the home network identifier transmitted by the proxy entity in the service network; hNRF determines based on the preset policy that AAnF in the home network has the right to serve AAnFProxy and AF in the service network, and then authorizes The proxy entity in the home network accesses the AAnF in the home network.
  • Step 104 The AAnF in the home network generates the AKMA application key of the AF in the serving network based on the AKMA key of the terminal.
  • the AKMA Application Key (K AF ) is used to indicate the communication key between the UE and the AF in the serving network.
  • the AKMA application key is generated based on the AKMA key of the terminal. Therefore, the following conditions need to be met to perform step 104: the AAnF in the home network stores the AKMA key of the terminal.
  • AKMA application key can be achieved in the following way: AAnF in the home network obtains A-KID and AF_ID according to the application key acquisition request; then, AAnF in the home network can generate the AKMA application key based on the AKMA key and AF_ID. key.
  • the AAnF in the home network can verify whether the UE is authorized to use the AKMA service based on the existence of the AKMA key of the terminal corresponding to the A-KID.
  • the AAnF in the home network before performing step 104, the AAnF in the home network also needs to perform the following steps: determine whether the AAnF in the home network provides services to the AF in the service network and the proxy entity in the service network based on the authorization information or policy.
  • step 104 is performed; the AAnF in the home network cannot provide services to the AF in the service network and the proxy entity in the service network.
  • the AAnF in the home network may refuse to perform step 104 and feed back an error response to the proxy entity in the serving network.
  • authorization information or policy provided by local policy or NRF in the home network.
  • Step 105 The AAnF in the home network sends an application key acquisition response to the proxy entity in the serving network.
  • the application key acquisition response includes the AKMA application key information of the AF in the service network, and the AKMA application key information at least includes the AKMA application key.
  • step 103 the application key acquisition request sent by the proxy entity in the serving network to the AAnF in the home network is different.
  • the application key acquisition response sent by the AAnF in the home network to the proxy entity in the serving network is also different.
  • the AAnF in the home network receives the first application key acquisition request sent by the proxy entity in the serving network; after generating the AKMA application key, the home network The AAnF in the server sends a first application key acquisition response to the proxy entity in the service network.
  • the first application key acquisition response can be represented by Naanf_AKMA_ApplicationKey_Get Response.
  • the AKMA application key information of the AF carried in the first application key acquisition response includes at least one of the following information: AKMA application key, expiration time of the AKMA application key, terminal's subscription permanent identifier (Subscription Permanent Identifier, SUPI); the expiration time of the AKMA application key can be expressed by K AF expTime.
  • the AAnF in the home network receives the second application key acquisition request sent by the proxy entity in the serving network; after generating the AKMA application key, the home network The AAnF in the network sends a second application key acquisition response to the proxy entity in the service network.
  • the second application key acquisition response can be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Response.
  • the AKMA application key information of the AF carried in the second application key acquisition response includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • the proxy entity in the service network can obtain the AKMA application key information of different AFs under different circumstances and feed it back to the AF in the service network.
  • steps 103, 104 and 105 provide an implementation manner in which the AKMA application key information of the AF in the serving network is generated by the AAnF in the home network.
  • the AKMA application key information of the AF in the service network can also be generated by the proxy entity in the service network.
  • the proxy entity in the service network obtains the A-KID and AF_ID according to the application key acquisition request; subsequently, the proxy entity in the service network can generate the AKMA application key based on the AKMA key and AF_ID.
  • this embodiment only shows the implementation manner in which the AKMA application key information of the AF in the serving network is generated by the AAnF in the home network, and does not limit this application.
  • Step 106 The proxy entity in the service network sends an AKMA application key response to the AF in the service network.
  • the AKMA application key response includes the AKMA application key information of the AF in the service network.
  • the AKMA application key request sent by the AF in the service network to the proxy entity in the service network is different.
  • the AKMA application key response sent by the proxy entity in the service network to the AF in the service network is also different.
  • the proxy entity in the service network receives the first AKMA application key request sent by the AF in the service network.
  • the first AKMA application key request is used to indicate that the AF in the service network requires a terminal identification; subsequently, the first AKMA application key request in the service network
  • the proxy entity sends the first AKMA application key response to the AF in the service network.
  • the first AKMA Application Key Response can be expressed using AKMA Application Key Response.
  • the AKMA application key information of the AF carried in the first AKMA application key response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and the SUPI.
  • the proxy entity in the service network receives the second AKMA application key request sent by the AF in the service network.
  • the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identification; subsequently, the service network
  • the proxy entity in the service network sends a second AKMA application key response to the AF in the service network.
  • the second AKMA Application Key response can be represented by AKMA Application Key AnonUser.
  • the AKMA application key information of the AF carried in the second AKMA application key response includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • Step 107 The AF in the serving network sends an application session establishment response to the visiting UE.
  • the application session establishment response corresponds to the application session establishment request and is used to feed back the AKMA application key information of AF in the service network, which can be represented by Application Session Establishment Response.
  • the UE After receiving the application session establishment response, the UE can determine the AKMA application key based on the AF's AKMA application key information carried in the AKMA application key response.
  • the AAnF in the home network does not carry the AKMA key of the terminal.
  • the AAnF in the home network sends an error response to the proxy entity in the serving network; the proxy entity in the serving network sends the error response to the AF in the serving network; the AF in the serving network feeds back application session rejection information to the UE , the rejection information includes the reason for the response failure. Based on this, the AF in the service network refuses to establish the application session by including the response failure reason.
  • the UE can resend the application session establishment request, and the application session establishment request carries the new A-KID and/or service network identification. symbol.
  • the steps on the UE side can independently become an embodiment of the key management method applied in the terminal, and the steps on the AAnF side in the home network can independently become an application.
  • the steps on the AF side in the serving network may separately become an embodiment of the key management method in the AF in the serving network, in the serving network
  • the steps on the proxy entity side may alone become an embodiment of the key management method applied in the proxy entity in the service network.
  • the embodiments of this application provide a key management method, which can realize AKMA application key request and The AKMA application key response enables the terminal to obtain the AKMA application key information of the AF in the service network.
  • Figure 4 shows a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • the method is applied in a roaming scenario.
  • the method is executed by a proxy entity in the service network.
  • the proxy entity can be represented by AAnFProxy.
  • the key management method provided by the embodiment of this application includes the following steps:
  • Step 202 Receive the AKMA application key request sent by the AF in the service network.
  • the AKMA application key request is used to request the AKMA application key information of the AF in the service network from the proxy entity in the service network.
  • the AKMA application key request includes the AKMA key identifier and/or AF identifier.
  • the proxy entity can be represented by AAnFProxy;
  • the AKMA key identifier can be represented by A-KID, which is used to indicate the identifier of the AKMA key of the terminal;
  • the AF identifier can be represented by AF_ID, which is used to indicate the identifier of the AF in the service network.
  • the proxy entity in the service network is a separate NF in the service network; or, the proxy entity in the service network is part of any NF in the service network; or, the proxy entity in the service network is a trusted application function (Trusted AF), such as the trusted application function within the 3GPP operator domain.
  • Trusted AF trusted application function
  • the terminal is in a roaming scenario, the service network corresponding to the terminal is the service network, and the service network is inconsistent with the home network of the terminal.
  • the AF in the service network needs to report to the agent in the service network
  • the entity sends an AKMA application key request to request K AF .
  • the AKMA application key request sent by the AF in the service network to the proxy entity in the service network varies according to the policies in the AF in the service network.
  • the AF in the serving network sends the first AKMA application key request to the proxy entity in the home network.
  • the first AKMA application key request is used to indicate that the AF in the service network requires a terminal identity.
  • the first AKMA Application Key Request can be expressed using AKMA Application Key Request.
  • the AF in the serving network sends a second AKMA application key request to the proxy entity in the home network.
  • the second AKMA application key request is used to indicate that the AF in the service network does not require terminal identification.
  • the second AKMA Application Key request can be expressed using AKMA Application Key AnonUser Request.
  • Step 204 Feed back the AKMA application key response to the AF in the service network.
  • the AKMA application key response includes the AKMA application key information of the AF in the service network, and the AKMA application key response corresponds to the AKMA application key request.
  • the AF in the service network sends different AKMA application key requests to the proxy entity in the service network.
  • the AKMA application key response sent by the proxy entity in the service network to the AF in the service network is also different.
  • the proxy entity in the service network receives the first AKMA application key request sent by the AF in the service network.
  • the first AKMA application key request is used to indicate that the AF in the service network requires a terminal identity; subsequently, the first AKMA application key request in the service network
  • the proxy entity sends the first AKMA application key response to the AF in the service network.
  • the first AKMA Application Key Response can be expressed using AKMA Application Key Response.
  • the AKMA application key information of the AF carried in the first AKMA application key response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and the SUPI.
  • the proxy entity in the service network receives the second AKMA application key request sent by the AF in the service network.
  • the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identification; subsequently, the service network
  • the proxy entity in the service network sends a second AKMA application key response to the AF in the service network.
  • the second AKMA Application Key response can be represented by AKMA Application Key AnonUser.
  • the AKMA application key information of the AF carried in the second AKMA application key response includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • the AKMA application key information of AF in the service network is generated in various ways.
  • the AKMA application key information of the AF in the serving network is generated by the proxy entity in the serving network; or the AKMA application key information of the AF in the serving network is generated by the AAnF in the home network.
  • the key management method provided by the embodiment of this application also includes the following two steps:
  • Step 1 Send an application key acquisition request to the AAnF in the home network.
  • the application key acquisition request is used to request AKMA application key information of the AF in the service network from the AAnF in the home network.
  • the application key acquisition request includes A-KID and/or AF_ID.
  • the application key acquisition request sent by the proxy entity in the service network to the AAnF in the home network also changes according to the different policies in the AF in the service network.
  • the proxy entity in the serving network receives the first AKMA application key request.
  • the first AKMA application key request is used to indicate that the AF in the serving network requires a terminal identity; subsequently, the proxy entity in the serving network sends a request to the home network.
  • the AAnF in sends the first application key acquisition request.
  • the first application key acquisition request can be represented by Naanf_AKMA_ApplicationKey_Get Request.
  • the proxy entity in the service network receives the second AKMA application key request.
  • the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identity; subsequently, the proxy entity in the service network sends a request to the home network.
  • the AAnF in the network sends a second application key acquisition request.
  • the second application key acquisition request can be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Request.
  • Step 2 Receive the application key acquisition response fed back by the AAnF in the home network.
  • the application key acquisition response includes the AKMA application key information of the AF in the service network.
  • the application key acquisition response corresponds to the application key acquisition request, and is used by the AAnF in the home network to feed back the AF's AKMA application key information to the proxy entity in the serving network.
  • step 1 the application key acquisition request sent by the proxy entity in the serving network to the AAnF in the home network is different.
  • the application key acquisition response sent by the AAnF in the home network to the proxy entity in the serving network is also different.
  • the AAnF in the home network receives the first application key acquisition request sent by the proxy entity in the serving network; after generating the AKMA application key, the home network The AAnF in the server sends a first application key acquisition response to the proxy entity in the service network.
  • the first application key acquisition response can be represented by Naanf_AKMA_ApplicationKey_Get Response.
  • the AKMA application key information of the AF carried in the first application key acquisition response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and the SUPI.
  • the AAnF in the home network receives the second application key acquisition request sent by the proxy entity in the serving network; after generating the AKMA application key, the home network The AAnF in the network sends a second application key acquisition response to the proxy entity in the service network.
  • the second application key acquisition response can be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Response.
  • the AKMA application key information of the AF carried in the second application key acquisition response includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • steps 1 and 2 should be between step 202 and step 204.
  • the proxy entity in the serving network After receiving the application key acquisition response fed back by the AAnF in the home network, the proxy entity in the serving network will apply the key The AKMA application key information of the AF in the service network carried in the return response is fed back to the AF in the service network.
  • the embodiments of this application provide a key management method, which can realize AKMA application key request and The AKMA application key responds so that the AF in the service network can obtain the AKMA application key information of the AF.
  • the AKMA application key request sent by the AF in the service network to the proxy entity in the service network is also different, so that the AF in the service network gets the AKMA application key response.
  • the AKMA application key information carried inside is also different.
  • the AKMA application key information carried in the AKMA application key response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and SUPI; for another example, when the AF in the service network does not require terminal identification, the AKMA application key information carried in the AKMA application key response includes at least one of the following information: AKMA application key, AKMA application key expiration time.
  • the AKMA application key information of the AF in the serving network can be generated by the proxy entity in the serving network or the AAnF in the home network.
  • the key management method provided by the embodiment of this application also provides a specific method for the AAnF in the home network to generate AKMA application key information.
  • Figure 5 shows a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • the method is applied in a roaming scenario.
  • the method is executed by the AAnF in the home network.
  • the method includes the following steps:
  • Step 302 Receive the application key acquisition request sent by the proxy entity in the service network.
  • the application key acquisition request is used to request AKMA application key information of the AF in the service network from the AAnF in the home network.
  • the application key acquisition request includes A-KID and/or AF_ID.
  • the application key acquisition request sent by the proxy entity in the service network to the AAnF in the home network changes according to the different policies in the AF in the service network.
  • the proxy entity in the serving network receives the first AKMA application key request.
  • the first AKMA application key request is used to indicate that the AF in the serving network requires a terminal identity; subsequently, the proxy entity in the serving network sends a request to the home network.
  • the AAnF in sends the first application key acquisition request.
  • the first application key acquisition request can be represented by Naanf_AKMA_ApplicationKey_Get Request.
  • the proxy entity in the service network receives the second AKMA application key request.
  • the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identity; subsequently, the proxy entity in the service network sends a request to the home network.
  • the AAnF in the network sends a second application key acquisition request.
  • the second application key acquisition request can be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Request.
  • Step 304 If the AKMA key of the terminal is stored in the AAnF in the home network, generate the AKMA application key of the AF in the service network (Derive AF key from K AKMA ) based on the AKMA key of the terminal.
  • the AKMA application key is used to indicate the communication key between the UE and the AF in the serving network, and can be represented by K AF .
  • the AKMA application key can be generated in the following manner: AAnF in the home network obtains A-KID and AF_ID based on the application key acquisition request; subsequently, AAnF in the home network can generate AKMA based on the AKMA key and AF_ID. Application key.
  • the AAnF in the home network can verify whether the UE is authorized to use the AKMA service based on the existence of the AKMA key of the terminal corresponding to the A-KID.
  • the AAnF in the home network Before performing step 304, the AAnF in the home network also needs to determine whether it can provide services to the AF in the serving network.
  • the key management method provided by the embodiment of this application also includes:
  • the authorization information or policy it is determined whether the AAnF in the home network provides services to the AF in the service network and the proxy entity in the service network.
  • step 304 is performed; the AAnF in the home network cannot provide services to the AF in the service network and the proxy entity in the service network.
  • the AAnF in the home network may refuse to perform step 304 and feed back an error response to the proxy entity in the serving network.
  • authorization information or policy provided by local policy or NRF in the home network.
  • Step 306 Feed back the application key acquisition response to the proxy entity in the service network.
  • the application key acquisition response includes the AKMA application key information of the AF in the service network.
  • the application key acquisition response corresponds to the application key acquisition request, and is used by the AAnF in the home network to feed back the AKMA application key information of the AF to the proxy entity in the serving network; for the relevant description of the AKMA application key information of the AF, please refer to The foregoing content will not be repeated again.
  • step 304 the application key acquisition request sent by the proxy entity in the serving network to the AAnF in the home network is different.
  • the application key acquisition response sent by the AAnF in the home network to the proxy entity in the serving network is also different.
  • the AAnF in the home network receives the first AKMA application key request sent by the proxy entity in the serving network; after generating the AKMA application key, the home network The AAnF in the server sends a first application key acquisition response to the proxy entity in the service network.
  • the first application key acquisition response can be represented by Naanf_AKMA_ApplicationKey_Get Response.
  • the AKMA application key information of the AF carried in the first application key acquisition response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and the SUPI.
  • the AAnF in the home network receives the second AKMA application key request sent by the proxy entity in the serving network; after generating the AKMA application key, the home network The AAnF in the network sends a second application key acquisition response to the proxy entity in the service network.
  • the second application key acquisition response can be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Response.
  • the AKMA application key information of the AF carried in the second application key acquisition response includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • the embodiments of this application provide a key management method, which can realize AKMA application key request and The AKMA application key response enables the proxy entity in the service network to obtain the AKMA application key information of the AF in the service network.
  • the AKMA application key information of the AF carried in the application key acquisition response fed back by the AAnF in the home network to the proxy entity in the serving network is also different.
  • Figure 6 shows a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • the method is applied in a roaming scenario.
  • the method is executed by the AAnF in the service network.
  • the method includes the following steps:
  • Step 402 Receive the service network identifier and AKMA key identifier sent by the terminal.
  • the service network identifier is used to indicate the service network of the terminal, and is used to trigger the AF in the service network to send the key to the proxy entity in the service network when the service network identifier of the terminal is inconsistent with the home network identifier.
  • the service network identifier may carry the A-KID field or a separate field in the application session establishment request.
  • the terminal moves from the coverage area of the home network to the coverage area of the serving network.
  • the terminal sends a service network identifier to the AF in the service network, and the service network identifier corresponds to the service network. From this, it can be determined that the terminal is in a roaming scenario.
  • the service network identifier may be sent separately by the terminal to the AF in the service network, or may be carried in the application session establishment request sent by the terminal to the AF in the service network.
  • step 402 may be implemented as: receiving an application session establishment request sent by the terminal, where the application session establishment request carries the service network identifier and the AKMA key identifier.
  • the service network identifier may be carried by the AKMA key identifier in the application session establishment request, or may be carried by a dedicated field.
  • the application session establishment request includes the AKMA key identifier, and the AKMA key identifier carries the service network identifier; for another example, the application session establishment request includes the AKMA key identifier and the service network identifier.
  • the application session establishment request is used to trigger the application session establishment request, and the application session establishment request can be represented by Application Session Establishment Request.
  • Step 404 When the service network identifier of the terminal is inconsistent with the home network identifier, send an AKMA application key request to the proxy entity in the service network.
  • the AKMA application key request is used to request the AKMA application key information of the AF in the service network from the proxy entity in the service network.
  • the AKMA application key request includes the AKMA key identifier and/or AF identifier.
  • the terminal is in a roaming scenario, the service network corresponding to the terminal is the service network, and the service network is inconsistent with the home network of the terminal.
  • the AF in the service network needs to report to the agent in the service network
  • the entity sends an AKMA application key request to request K AF .
  • the AKMA application key request sent by the AF in the service network to the proxy entity in the service network varies according to the policies in the AF in the service network.
  • the AF in the serving network sends the first AKMA application key request to the proxy entity in the home network.
  • the first AKMA application key request is used to indicate that the AF in the service network requires a terminal identity.
  • the first AKMA Application Key Request can be expressed using AKMA Application Key Request.
  • the AF in the serving network sends a second AKMA application key request to the proxy entity in the home network.
  • the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identity.
  • the second AKMA Application Key request can be expressed using AKMA Application Key AnonUser Request.
  • Step 406 Receive the AKMA application key response fed back by the proxy entity in the service network.
  • the AKMA application key response includes the AKMA application key information of the AF in the service network.
  • the AKMA application key response corresponds to the AKMA application key request; for the relevant description of the AF's AKMA application key information, please refer to the foregoing content and will not be described again.
  • step 404 the AKMA application key request sent by the AF in the service network to the proxy entity in the service network is different.
  • the AKMA application key response sent by the proxy entity in the service network to the AF in the service network is also different.
  • the proxy entity in the service network receives the first AKMA application key request sent by the AF in the service network.
  • the first AKMA application key request is used to indicate that the AF in the service network requires a terminal identity; subsequently, the first AKMA application key request in the service network
  • the proxy entity sends the first AKMA application key response to the AF in the service network.
  • the first AKMA Application Key Response can be expressed using AKMA Application Key Response.
  • the AKMA application key information of the AF carried in the first AKMA application key response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and the SUPI.
  • the proxy entity in the service network receives the second AKMA application key request sent by the AF in the service network.
  • the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identification; subsequently, the service network
  • the proxy entity in the service network sends a second AKMA application key response to the AF in the service network.
  • the second AKMA Application Key response can be represented by AKMA Application Key AnonUser.
  • the AKMA application key information of the AF carried in the second AKMA application key response includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • the AKMA application key information of the AF in the serving network can be generated by the proxy entity in the serving network or the AAnF in the home network.
  • the generation process of the AKMA application key information of the AF in the service network please refer to the foregoing content and will not be described again.
  • the embodiments of this application provide a key management method, which can realize AKMA application key request and The AKMA application key responds so that the AF in the service network can obtain the AKMA application key information of the AF.
  • the AKMA application key request sent by the AF in the service network to the proxy entity in the service network is also different, so that the AF in the service network gets the AKMA application key response.
  • the AKMA application key information carried inside is also different.
  • Figure 7 shows a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • the method is applied in a roaming scenario.
  • the method is executed by a terminal.
  • the method includes the following steps:
  • Step 502 Send the service network identifier and the AKMA key identifier to the AF in the service network.
  • the serving network identifier is used to trigger the AF in the serving network to send an AKMA application key request to the proxy entity in the serving network when the serving network identifier of the terminal is inconsistent with the home network identifier.
  • the service network identifier may be carried in the A-KID field or a separate field in the application session establishment request.
  • the terminal moves from the coverage area of the home network to the coverage area of the serving network.
  • the terminal sends a service network identifier to the AF in the service network, and the service network identifier corresponds to the service network. From this, it can be determined that the terminal is in a roaming scenario.
  • the service network identifier may be sent separately by the terminal to the AF in the service network, or may be carried in the application session establishment request sent by the terminal to the AF in the service network.
  • step 502 may be implemented as follows: sending an application session establishment request to the AF in the service network, where the application session establishment request carries the service network identifier and the AKMA key identifier.
  • the service network identifier may be carried by the AKMA key identifier in the application session establishment request, or may be carried by a dedicated field.
  • the application session establishment request includes the AKMA key identifier, and the AKMA key identifier carries the service network identifier; for another example, the application session establishment request includes the AKMA key identifier and the service network identifier.
  • the application session establishment request is used to trigger the application session establishment request, and the application session establishment request can be represented by Application Session Establishment Request.
  • the embodiments of the present application provide a key management method, in which the terminal sends the service network identifier to the AF in the service network, so that the AF in the service network can determine whether the terminal is in a roaming scenario; and in When the service network identifier is inconsistent with the home network identifier, the AF in the service network is triggered to send an AKMA application key request to the proxy entity in the service network, so that the AF in the service network can obtain the AF's AKMA application key information. .
  • the service network identifier may be carried in the application session establishment request sent by the terminal to the AF in the service network.
  • the AKMA application key information of the AF in the serving network can be generated by the proxy entity in the serving network or the AAnF in the home network.
  • Figure 8 is an embodiment in which the proxy entity in the service network generates the AKMA application key information of the AF in the service network.
  • Figure 9 is an example in which the AAnF in the home network generates the AKMA application key information of the AF in the service network. .
  • Figure 8 shows a flow chart of a key management method provided by an exemplary embodiment of the present application. When applied in a roaming scenario, the method includes the following steps:
  • Step 601 The UE sends the serving network identifier and the AKMA key identifier to the AF in the serving network.
  • the service network identifier is used to indicate the service network of the terminal.
  • the service network identifier may carry the A-KID field or a separate field in the application session establishment request.
  • the terminal moves from the coverage area of the home network to the coverage area of the serving network.
  • the terminal sends a service network identifier to the AF in the service network, and the service network identifier corresponds to the service network. From this, it can be determined that the terminal is in a roaming scenario.
  • the service network identifier may be sent separately by the terminal to the AF in the service network, or may be carried in the application session establishment request sent by the terminal to the AF in the service network.
  • Step 602 When the serving network identifier of the UE is inconsistent with the home network identifier, the AF in the serving network sends an AKMA application key request to AAnFProxy in the serving network.
  • the AKMA application key request is used to request the AKMA application key information of the AF in the service network from AAnFProxy in the service network.
  • the AKMA application key request includes the AKMA key identifier and/or AF identifier.
  • the terminal is in a roaming scenario, the service network corresponding to the terminal is the service network, and the service network is inconsistent with the home network of the terminal.
  • the AF in the service network needs to report to AAnFProxy in the service network.
  • the AKMA application key request sent by AF in the service network to AAnFProxy in the service network differs according to the policies in the AF in the service network.
  • the AF in the serving network sends the first AKMA application key request to AAnFProxy in the home network.
  • the first AKMA application key request is used to indicate that the AF in the service network requires a terminal identity.
  • the first AKMA Application Key Request can be expressed using AKMA Application Key Request.
  • the AF in the serving network sends a second AKMA application key request to AAnFProxy in the home network.
  • the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identity.
  • the second AKMA Application Key request can be expressed using AKMA Application Key AnonUser Request.
  • Step 603 AAnFProxy in the service network generates the AKMA application key of AF in the service network.
  • the AKMA application key is used to indicate the communication key between the UE and the AF in the serving network, and can be represented by K AF .
  • the AKMA application key can be generated in the following way: AAnFProxy in the service network obtains A-KID and AF_ID based on the application key acquisition request; subsequently, AAnFProxy in the service network can generate AKMA based on the AKMA key and AF_ID. Application key.
  • Step 604 AAnFProxy in the service network sends an AKMA application key response to AF in the service network.
  • the AKMA application key response includes the AKMA application key information of the AF in the service network.
  • the AKMA application key response corresponds to the AKMA application key request; for the relevant description of the AF's AKMA application key information, please refer to the foregoing content and will not be described again.
  • step 602 the AKMA application key request sent by AF in the service network to AAnFProxy in the service network is different.
  • the AKMA application key response sent by AAnFProxy in the service network to AF in the service network is also different.
  • AAnFProxy in the service network receives the first AKMA application key request sent by the AF in the service network.
  • the first AKMA application key request is used to indicate that the AF in the service network requires a terminal identification; subsequently, the AF in the service network AAnFProxy sends the first AKMA application key response to the AF in the service network.
  • the first AKMA Application Key Response can be expressed using AKMA Application Key Response.
  • the AKMA application key information of the AF carried in the first AKMA application key response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and the SUPI.
  • AAnFProxy in the service network receives the second AKMA application key request sent by the AF in the service network.
  • the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identification; subsequently, the service network
  • the AAnFProxy sends a second AKMA application key response to the AF in the serving network.
  • the second AKMA Application Key response can be represented by AKMA Application Key AnonUser.
  • the AKMA application key information of the AF carried in the second AKMA application key response includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • the steps on the UE side can independently become an embodiment of the key management method applied in the terminal, and the steps on the AF side in the service network can independently become an application.
  • the steps on the AAnFProxy side in the service network can individually become an embodiment of the key management method in AAnFProxy in the service network.
  • the embodiments of this application provide a key management method and provide an implementation method in which the AKMA application key information of AF in the service network is generated by AAnFProxy in the service network.
  • AKMA application key request and AKMA application key response can be implemented, so that AF in the service network can obtain the AKMA application key of AF information.
  • Figure 9 shows a flow chart of a key management method provided by an exemplary embodiment of the present application. When applied in a roaming scenario, the method includes the following steps:
  • Step 701 The UE sends the serving network identifier and the AKMA key identifier to the AF in the serving network.
  • the service network identifier is used to indicate the service network of the terminal.
  • the service network identifier may carry the A-KID field or a separate field in the application session establishment request.
  • the terminal moves from the coverage area of the home network to the coverage area of the serving network.
  • the terminal sends a service network identifier to the AF in the service network, and the service network identifier corresponds to the service network. From this, it can be determined that the terminal is in a roaming scenario.
  • the service network identifier may be sent separately by the terminal to the AF in the service network, or may be carried in the application session establishment request sent by the terminal to the AF in the service network.
  • Step 702 When the serving network identifier of the UE is inconsistent with the home network identifier, the AF in the serving network sends an AKMA application key request to AAnFProxy in the serving network.
  • the AKMA application key request is used to request the AKMA application key information of the AF in the service network from AAnFProxy in the service network.
  • the AKMA application key request includes the AKMA key identifier and/or AF identifier.
  • the terminal is in a roaming scenario, the service network corresponding to the terminal is the service network, and the service network is inconsistent with the home network of the terminal.
  • the AF in the service network needs to report to AAnFProxy in the service network.
  • the AKMA application key request sent by AF in the service network to AAnFProxy in the service network differs according to the policies in the AF in the service network.
  • the AF in the serving network sends the first AKMA application key request to AAnFProxy in the home network.
  • the first AKMA application key request is used to indicate that the AF in the service network requires a terminal identity.
  • the first AKMA Application Key Request can be expressed using AKMA Application Key Request.
  • the AF in the serving network sends a second AKMA application key request to AAnFProxy in the home network.
  • the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identity.
  • the second AKMA Application Key request can be expressed using AKMA Application Key AnonUser Request.
  • Step 703 AAnFProxy in the service network sends an application key acquisition request to AAnF in the home network.
  • the application key acquisition request is used to request AKMA application key information of the AF in the service network from the AAnF in the home network.
  • the application key acquisition request includes A-KID and/or AF_ID.
  • the application key acquisition request sent by AAnFProxy in the service network to AAnF in the home network changes according to the different policies in the AF in the service network.
  • AAnFProxy in the service network receives the first AKMA application key request.
  • the first AKMA application key request is used to indicate that the AF in the service network requires a terminal identification; subsequently, AAnFProxy in the service network sends a request to the AF in the home network.
  • AAnF sends a first application key acquisition request.
  • the first application key acquisition request can be represented by Naanf_AKMA_ApplicationKey_Get Request.
  • AAnFProxy in the service network receives the second AKMA application key request.
  • the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identification; subsequently, AAnFProxy in the service network sends a request to the home network.
  • the AAnF sends a second application key acquisition request.
  • the second application key acquisition request can be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Request.
  • the proxy entity in the serving network also needs to determine the AAnF in the home network.
  • the key management method provided by the embodiment of the present application also includes:
  • the proxy entity in the service network discovers the AAnF in the home network through the NRF in the service network and the home network.
  • the process of the agent entity in the service network discovering the AAnF in the home network can be implemented as follows:
  • the proxy entity in the service network determines the vNRF through the service network identifier; the vNRF can determine the hNRF based on the home network identifier transmitted by the proxy entity in the service network; the hNRF determines based on the preset policy that the AAnF in the home network has the right to be the service network AAnFProxy and AF services, and then authorize the proxy entity in the home network to access the AAnF in the home network.
  • the service network identifier may be provided by the terminal to the AF in the service network, and transmitted by the AF in the service network to the proxy entity in the service network.
  • Step 704 If the AKMA key of the terminal is stored in the AAnF in the home network, the AAnF in the home network generates the AKMA application key of the AF in the serving network based on the AKMA key of the terminal.
  • the AKMA application key is used to indicate the communication key between the UE and the AF in the serving network, and can be represented by K AF .
  • the AKMA application key can be generated in the following manner: AAnF in the home network obtains A-KID and AF_ID based on the application key acquisition request; subsequently, AAnF in the home network can generate AKMA based on the AKMA key and AF_ID. Application key.
  • the AAnF in the home network can verify whether the UE is authorized to use the AKMA service based on the existence of the AKMA key of the terminal corresponding to the A-KID.
  • Step 705 AAnF in the home network sends an application key acquisition response to AAnFProxy in the service network.
  • the application key acquisition response includes the AKMA application key information of the AF in the service network.
  • the application key acquisition response corresponds to the application key acquisition request, and is used by AAnF in the home network to feed back AF's AKMA application key information to AAnFProxy in the serving network; the relevant description of AF's AKMA application key information can refer to the above The content will not be described again.
  • step 703 the application key acquisition request sent by AAnFProxy in the service network to AAnF in the home network is different.
  • the application key acquisition response sent by AAnF in the home network to AAnFProxy in the service network is also different.
  • the AAnF in the home network receives the first application key acquisition request sent by AAnFProxy in the service network; after generating the AKMA application key, the AAnF in the home network The AAnF sends the first application key acquisition response to AAnFProxy in the service network.
  • the first application key acquisition response can be represented by Naanf_AKMA_ApplicationKey_Get Response.
  • the AKMA application key information of the AF carried in the first application key acquisition response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and the SUPI.
  • the AAnF in the home network receives the second application key acquisition request sent by AAnFProxy in the service network; after generating the AKMA application key, the home network AAnF in the service network sends a second application key acquisition response to AAnFProxy in the service network.
  • the second application key acquisition response can be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Response.
  • the AKMA application key information of the AF carried in the second application key acquisition response includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • Step 706 AAnFProxy in the service network sends an AKMA application key response to AF in the service network.
  • the AKMA application key response includes the AKMA application key information of the AF in the service network.
  • the AKMA application key response corresponds to the AKMA application key request; for the relevant description of the AF's AKMA application key information, please refer to the foregoing content and will not be described again.
  • step 702 the AKMA application key request sent by the AF in the service network to AAnFProxy in the service network is different.
  • the AKMA application key response sent by AAnFProxy in the service network to AF in the service network is also different.
  • AAnFProxy in the service network receives the first AKMA application key request sent by the AF in the service network.
  • the first AKMA application key request is used to indicate that the AF in the service network requires a terminal identification; subsequently, the AF in the service network AAnFProxy sends the first AKMA application key response to the AF in the service network.
  • the first AKMA Application Key Response can be expressed using AKMA Application Key Response.
  • the AKMA application key information of the AF carried in the first AKMA application key response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and the SUPI.
  • AAnFProxy in the service network receives the second AKMA application key request sent by the AF in the service network.
  • the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identification; subsequently, the service network
  • the AAnFProxy sends a second AKMA application key response to the AF in the serving network.
  • the second AKMA Application Key response can be represented by AKMA Application Key AnonUser.
  • the AKMA application key information of the AF carried in the second AKMA application key response includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • the steps on the UE side can independently become an embodiment of the key management method applied in the terminal, and the steps on the AAnF side in the home network can independently become an application.
  • the steps on the AF side in the serving network may separately become an embodiment of the key management method in the AF in the serving network, in the serving network
  • the steps on the AAnFProxy side may alone become an embodiment of the key management method in AAnFProxy applied to the service network.
  • the steps of the key management method please refer to the above content and will not be described again.
  • the embodiments of this application provide a key management method and provide an implementation method in which the AKMA application key information of the AF in the serving network is generated by the AAnF in the home network.
  • AKMA application key request and AKMA application key response can be realized, so that AF in the service network can obtain AF's AKMA application key information.
  • the AKMA application key information includes at least one of the following: the AKMA application key of the AF in the service network; the expiration time of the AKMA application key; and the SUPI of the terminal. This situation is realized when the AF in the service network requires the terminal identification.
  • the AKMA application key information includes at least one of the following: the AKMA application key of the AF in the service network; and the expiration time of the AKMA application key. This situation is realized when the AF in the service network does not require terminal identification.
  • the AF in the service network requires terminal identification.
  • FIG. 10 shows a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • steps 701, 702, 703, 705, and 706 can be implemented as steps 7011, 7021, 7031, 7051, and 7061 respectively.
  • the method also includes step 707 and step 708. The above steps are as follows:
  • Step 7011 The UE sends an application session establishment request to the AF in the serving network.
  • the application session establishment request is used to trigger the establishment request of the application session.
  • the application session establishment request can be represented by Application Session Establishment Request; the application session establishment request carries the service network identifier.
  • the service network identifier may be carried by the AKMA key identifier in the application session establishment request, or may be carried by a dedicated field.
  • the application session establishment request includes the AKMA key identifier, and the AKMA key identifier carries the service network identifier; or, the application session establishment request includes the AKMA key identifier and the service network identifier.
  • the AKMA key identifier is an identifier used to indicate the AKMA key of the terminal.
  • Step 7021 When the serving network identifier of the UE is inconsistent with the home network identifier, the AF in the serving network sends the first AKMA application key request to AAnFProxy in the serving network.
  • the first AKMA application key request is used to indicate that the AF in the serving network requires a terminal identity.
  • the AKMA application key request is used to request the AKMA application key information of the AF in the service network from AAnFProxy in the service network.
  • the first AKMA Application Key Request can be expressed using AKMA Application Key Request.
  • the first AKMA application key request includes an AKMA key identifier and/or an AF identifier.
  • the AKMA key identifier is an identifier used to indicate the AKMA key of the terminal, which can be represented by A-KID;
  • the AF identifier is an identifier used to indicate the AF in the service network, which can be represented by AF_ID.
  • AAnFProxy in the service network is a separate NF in the service network; or, AAnFProxy in the service network is part of any NF in the service network; or, AAnFProxy in the service network is a Trusted Application Function (Trusted AF) ), such as trusted application functions within the 3GPP operator domain.
  • Trusted AF Trusted Application Function
  • Step 7031 AAnFProxy in the serving network sends a first application key acquisition request to AAnF in the home network.
  • the first application key acquisition request is used to request the AKMA application key information of the AF in the serving network from the AAnF in the home network when the AF in the serving network requires a terminal identification.
  • the AKMA application key information of the AF includes at least one of the following: the AKMA application key of the AF in the service network; the expiration time of the AKMA application key; and the SUPI of the terminal.
  • AAnFProxy in the service network can determine that the AF in the service network requires a terminal identification; subsequently, AAnFProxy in the service network sends a first application key acquisition request to AAnF in the home network.
  • the first application key acquisition request can be represented by Naanf_AKMA_ApplicationKey_Get Request.
  • the first application key acquisition request includes A-KID and/or AF_ID.
  • Step 707 According to the authorization information or policy, the AAnF in the home network determines whether the AAnF provides services to the AF in the service network and the proxy entity in the service network.
  • the authorization information or policy is associated with an AF identifier, which is an identifier used to indicate the AF in the service network.
  • step 707 Before generating the AKMA application key of the AF in the serving network, step 707 needs to be performed to determine whether the AAnF in the home network can provide services to the AF in the serving network and the proxy entity in the serving network.
  • step 704 is performed; the AAnF in the home network cannot provide services to the AF in the service network and the proxy in the service network. If the entity provides services, AAnF in the home network may refuse to perform step 704 and feed back an error response to AAnFProxy in the serving network.
  • authorization information or policy provided by local policy or NRF in the home network.
  • Step 7051 AAnF in the home network sends a first application key acquisition response to AAnFProxy in the service network.
  • the first application key acquisition response corresponds to the first application key acquisition request, and is used for the AAnF in the home network to feed back the AF's AKMA application to the AAnFProxy in the service network when the AF in the service network requires the terminal identification.
  • Key information For the relevant description of AF's AKMA application key information, please refer to the above content and will not be described again.
  • the AAnF in the home network receives the first application key acquisition request sent by AAnFProxy in the serving network; according to steps 707 and 704, after generating the AKMA application After obtaining the key, AAnF in the home network sends a first application key acquisition response to AAnFProxy in the service network.
  • the first application key acquisition response can be represented by Naanf_AKMA_ApplicationKey_Get Response.
  • the AKMA application key information of the AF carried in the first application key acquisition response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and the SUPI.
  • Step 7061 AAnFProxy in the service network sends the first AKMA application key response to the AF in the service network.
  • the first AKMA application key response corresponds to the first AKMA application key request; for the relevant description of the AKMA application key information of the AF, please refer to the foregoing content and will not be described again.
  • AAnFProxy in the service network receives the first AKMA application key request sent by the AF in the service network.
  • the first AKMA application key request is used to indicate that the AF in the service network requires a terminal identification; subsequently, the AF in the service network AAnFProxy sends the first AKMA application key response to the AF in the service network.
  • the first AKMA Application Key Response can be expressed using AKMA Application Key Response.
  • the AKMA application key information of the AF carried in the first AKMA application key response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and the SUPI.
  • Step 708 The AF in the serving network sends an application session establishment response to the UE.
  • the application session establishment response corresponds to the application session establishment request, and is used to feed back the AKMA application key information of AF in the service network, which can be represented by Application Session Establishment Response.
  • the UE can use the AKMA application key information of the AF carried in the AKMA application key response.
  • the AKMA application key information of the AF carried in the first AKMA application key response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and the SUPI.
  • the AAnF in the home network does not carry the terminal's AKMA key.
  • AAnF in the home network sends an error response to AAnFProxy in the serving network; AAnFProxy in the serving network sends the error response to AF in the serving network; AF in the serving network feeds back application session rejection information to the UE.
  • the rejection message includes the reason for the response failure. Based on this, the AF in the service network refuses to establish the application session by including the response failure reason.
  • the UE can resend the application session establishment request, and the application session establishment request carries the new A-KID and/or service network identification. symbol.
  • the steps on the UE side can independently become an embodiment of the key management method applied in the terminal, and the steps on the AAnF side in the home network can independently become an application.
  • the steps on the AF side in the serving network may separately become an embodiment of the key management method in the AF in the serving network, in the serving network
  • the steps on the AAnFProxy side may alone become an embodiment of the key management method in AAnFProxy applied to the service network.
  • the steps of the key management method please refer to the above content and will not be described again.
  • the embodiments of this application provide a key management method.
  • the AF in the service network requires a terminal identification, it is based on the AAnFProxy in the service network, the AF in the service network and the AAnF in the home network.
  • the terminal can obtain the corresponding AKMA application key information.
  • the AKMA application key information includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and SUPI.
  • the AF in the service network does not require terminal identification.
  • FIG 11 shows a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • steps 701, 702, 703, 705, and 706 can be implemented as steps 7011, 7022, 7032, 7052, and 7062 respectively.
  • the method also includes step 707 and step 708.
  • step 7011, step 707 and step 708, please refer to the foregoing content and will not be repeated.
  • the remaining steps are as follows:
  • Step 7022 When the serving network identifier of the UE is inconsistent with the home network identifier, the AF in the serving network sends a second AKMA application key request to AAnFProxy in the serving network.
  • the second AKMA application key request is used to indicate that the AF in the serving network does not require a terminal identification.
  • the AKMA application key request is used to request the AKMA application key information of the AF in the service network from AAnFProxy in the service network.
  • the second AKMA Application Key request can be expressed using AKMA Application Key AnonUser Request.
  • the second AKMA application key request includes A-KID and/or AF_ID.
  • AAnFProxy in the service network is a separate NF in the service network; or, AAnFProxy in the service network is part of any NF in the service network; or, AAnFProxy in the service network is a trusted NF within the 3GPP operator domain.
  • Step 7032 AAnFProxy in the service network sends a second application key acquisition request to AAnF in the home network.
  • the second application key acquisition request is used to request the AKMA application key information of the AF in the serving network from the AAnF in the home network when the AF in the serving network does not need a terminal identification.
  • the second application key acquisition request can be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Request.
  • the AKMA application key information of the AF includes at least one of the following: the AKMA application key of the AF in the service network; and the expiration time of the AKMA application key.
  • AAnFProxy in the service network can determine that the AF in the service network does not require a terminal identification; AAnFProxy in the service network sends a second application key acquisition request to AAnF in the home network.
  • the second application key acquisition request includes A-KID and/or AF_ID.
  • Step 7052 AAnF in the home network sends a second application key acquisition response to AAnFProxy in the service network.
  • the second application key acquisition response corresponds to the second application key acquisition request, and is used for the AAnF in the home network to feed back the AKMA of the AF to the AAnFProxy in the service network when the AF in the service network does not need a terminal identification.
  • Application key information for the description of AF's AKMA application key information, please refer to the foregoing content and will not be described again.
  • the AAnF in the home network receives the second application key acquisition request sent by AAnFProxy in the serving network; according to steps 707 and 704, after generating the AKMA After applying the key, AAnF in the home network sends a second application key acquisition response to AAnFProxy in the service network.
  • the second application key acquisition response can be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Response.
  • the AKMA application key information of the AF carried in the second application key acquisition response includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • Step 7062 AAnFProxy in the service network sends a second AKMA application key response to AF in the service network.
  • the second AKMA application key response corresponds to the second AKMA application key request; the relevant description of the AKMA application key information of the AF may refer to the foregoing content and will not be described again.
  • AAnFProxy in the service network receives the second AKMA application key request sent by the AF in the service network.
  • the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identification; subsequently, the AF in the service network
  • the AAnFProxy sends a second AKMA application key response to the AF in the serving network.
  • the second AKMA Application Key response can be represented by AKMA Application Key AnonUser Response.
  • the AKMA application key information of the AF carried in the second AKMA application key response includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • the steps on the UE side can independently become an embodiment of the key management method applied in the terminal, and the steps on the AAnF side in the home network can independently become an application.
  • the steps on the AF side in the serving network may separately become an embodiment of the key management method in the AF in the serving network, in the serving network
  • the steps on the AAnFProxy side may alone become an embodiment of the key management method in AAnFProxy applied to the service network.
  • the steps of the key management method please refer to the above content and will not be described again.
  • the embodiments of this application provide a key management method based on AAnFProxy in the service network, AF in the service network and AAnF in the home network when the AF in the service network does not require a terminal identification.
  • the terminal can obtain the corresponding AKMA application key information.
  • the AKMA application key information includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • Figures 10 and 11 are two different implementations based on the key management method shown in Figure 9. For the key management method shown in Figure 8, there are also similar implementations. Again.
  • step 601 can also be implemented as step 7011, and the key management method shown in Figure 8 can also include step 708, so that the UE carries the service network identifier through the application session establishment request.
  • step 602 can also be implemented as step 7021 or 7022, and step 604 can also be implemented as step 7061 or 7062, so that AF in the service network and AAnFProxy in the service network can implement different AKMA application key requests based on different situations. and AKMA application key responses.
  • Figure 12 shows a flow chart of a key management method provided by an exemplary embodiment of the present application. When applied in a roaming scenario, the method includes the following steps:
  • the AF in the service network communicates with the UE, it needs to be determined whether the AKMA service can be used between the two.
  • the main authentication process between the UE and the AUSF is passed, so that the UE and the AUSF locally generate the same K AUSF , KAKMA and A-KID respectively.
  • the main authentication process can refer to the above content and will not be described again.
  • the prerequisites for the AF in the serving network to communicate with the UE are implicitly specific to the terminal and the AF, or are explicitly indicated by the AF to the terminal.
  • Step 801 The UE sends an application session establishment request to the AF in the serving network.
  • the application session establishment request is used to trigger the application session establishment request, and the application session establishment request can be represented by Application Session Establishment Request.
  • the application session establishment request carries A-KID and/or service network identifier.
  • A-KID is used to indicate the identifier of the terminal's AKMA key;
  • the service network identifier is used to indicate the service network of the terminal and is used to trigger When the service network identifier of the terminal is inconsistent with the home network identifier, the AF in the service network sends a key management request to AAnFProxy in the service network.
  • the application session establishment request includes A-KID, and the A-KID carries the service network identifier of the terminal; or, the application session establishment request includes the A-KID and the service network identifier of the terminal; or, The application session establishment request includes the A-KID, and the terminal sends the terminal's service network identifier before or after the application session establishment request.
  • the service network identifier indicates a corresponding application session establishment request or A-KID.
  • TS 33.535 stipulates that A-KID should adopt the NAI format specified in clause 2.2 of IETF RFC 7542, such as: username@security domain.
  • Step 8021 The AF in the service network sends the first AKMA application key request to AAnFProxy in the service network.
  • the first AKMA application key request is used to indicate that the AF in the service network requires a terminal identification
  • the first AKMA application key request includes A-KID and/or AF_ID.
  • the AF does not have an active context associated with the A-KID,then the AF selects the AAnFProxy in the serving network and sends request to AAnFProxy with the A-KID to request the K AF .
  • the AF also includes its identity( AF_ID) in the request.
  • the AF sends AKMA Application Key Request if the policy in AF indicates it needs the UE identity.
  • the AKMA application key request is used to request the AKMA application key information of the AF in the service network from AAnFProxy in the service network.
  • the first AKMA Application Key Request can be expressed using AKMA Application Key Request.
  • AAnFProxy in the service network is a separate NF in the service network; or, AAnFProxy in the service network is part of any NF in the service network; or, AAnFProxy in the service network is a trusted NF within the 3GPP operator domain.
  • Step 8022 The AF in the service network sends a second AKMA application key request to AAnFProxy in the service network.
  • the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identification, and the second AKMA application key request includes A-KID and/or AF_ID. (The AF sends the request via the AKMA Application Key AnonUser Request if the policy in AF indicates the AF does not need the UE identity.)
  • the AKMA application key request is used to request the AKMA application key information of the AF in the service network from AAnFProxy in the service network.
  • the second AKMA Application Key request can be expressed using AKMA Application Key AnonUser Request.
  • step 8021 and step 8022 are executed alternatively and cannot be executed at the same time.
  • Step 8031 AAnFProxy in the service network sends a first application key acquisition request to AAnF in the home network.
  • the first application key acquisition request is used to request the AKMA application key information of the AF in the serving network from the AAnF in the home network when the AF in the serving network requires a terminal identification.
  • the first application key acquisition request can be represented by Naanf_AKMA_ApplicationKey_Get Request. (The AAnFProxy sends the request via the Naanf_AKMA_ApplicationKey_Get service operation if it receives AKMA Application Key Request from the AF.)
  • AAnFProxy in the service network can determine that the AF in the service network requires a terminal identification; AAnFProxy in the service network sends a first application key acquisition request to AAnF in the home network, and the first application key acquisition request includes A- KID and/or AF_ID.
  • Step 8032 AAnFProxy in the service network sends a second application key acquisition request to AAnF in the home network.
  • the second application key acquisition request is used to request the AKMA application key information of the AF in the serving network from the AAnF in the home network when the AF in the serving network does not need a terminal identification.
  • the second application key The key acquisition request can be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Request. (The AAnFProxy sends the request via the Naanf_AKMA_ApplicationKey_AnonUser_Get service operation if it receives AKMA Application Key AnonUser Request from the AF.)
  • AAnFProxy in the service network can determine that the AF in the service network does not need a terminal identification; AAnFProxy in the service network sends a second application key acquisition request to AAnF in the home network, and the second application key acquisition request includes A -KID and/or AF_ID.
  • step 8031 and step 8032 can be executed alternatively and cannot be executed at the same time.
  • the AAnFProxy in the serving network also needs to determine the AAnF in the home network.
  • the key management method provided by the embodiment of the present application also includes:
  • AAnFProxy in the service network discovers AAnF in the home network through the NRF in the service network and home network.
  • the process of AAnFProxy in the service network discovering the AAnF in the home network can be implemented as follows: AAnFProxy in the service network identifies the service network through determine the vNRF; vNRF can determine hNRF based on the home network identifier transmitted by AAnFProxy in the service network; hNRF determines that the AAnF in the home network has the right to serve AAnFProxy and AF in the service network based on the preset policy, and then authorizes the home network The AAnFProxy accesses the AAnF in the home network.
  • Step 804 In the case where the AAnF in the home network stores the AKMA key of the terminal, the AAnF in the home network generates the AKMA application key of the AF in the serving network based on the AKMA key of the terminal.
  • the AKMA application key is used to indicate the communication key between the UE and the AF in the serving network, which can be represented by K AF .
  • the AKMA application key can be generated in the following manner: AAnF in the home network obtains A-KID and AF_ID based on the application key acquisition request; subsequently, AAnF in the home network can generate AKMA based on the AKMA key and AF_ID. Application key.
  • the AAnF in the home network can verify whether the UE is authorized to use the AKMA service based on the existence of the AKMA key of the terminal corresponding to the A-KID. (The AAnF shall verify whether the subscriber is authorized to use AKMA based on the presence of the UE specific K AKMA key identified by the A-KID.)
  • the AAnF in the home network before performing step 804, the AAnF in the home network also needs to perform the following steps: determine whether the AAnF in the home network can provide services to the AF in the service network and the proxy entity in the service network based on the authorization information or policy. .
  • step 804 is performed; the AAnF in the home network cannot provide services to the AF in the service network and the proxy entity in the service network.
  • the AAnF in the home network may refuse to perform step 804 and feed back an error response to the AAnFProxy in the serving network.
  • the AAnF in the home network shall check whether the AAnF can provide the service to the AF and AAnFProxy based on the configured local policy or based on the authorization information or policy provided by the NRF using the AF_ID of AF. If it succeeds, the The following procedures are executed. Otherwise, the AAnF shall reject the procedure.
  • authorization information or policy provided by local policy or NRF in the home network.
  • the AAnF in the home network may or may not store the AKMA key of the terminal.
  • the AAnF in the home network When the AAnF in the home network stores the AKMA key of the terminal, the AAnF in the home network generates the AKMA application key of the AF in the service network based on the AKMA key of the terminal (If K AKMA is present in AAnF, the AAnF shall derive K AF for the AF.);
  • the AAnF in the home network does not store the AKMA key of the terminal, the AAnF in the home network feeds back an error response (If K AKMA is not present in the AAnF, the AAnF shall continue with step 4 with an error response.).
  • Step 8051 AAnF in the home network sends a first application key acquisition response to AAnFProxy in the service network.
  • the first application key acquisition response corresponds to the first application key acquisition request, and is used for the AAnF in the home network to feed back the AF's AKMA application to the AAnFProxy in the service network when the AF in the service network requires the terminal identification. Key information.
  • the AAnF sends Naanf_AKMA_ApplicationKey_Get response to the AAnFProxy with SUPI,K AF ,the K AF expiration time,and the SUPI of UE.
  • the first application key acquisition response may be represented by Naanf_AKMA_ApplicationKey_Get Response.
  • the AKMA application key information of AF includes at least one of the following information: AKMA application key (K AF ), expiration time of the AKMA application key (K AF expTime), and SUPI.
  • step 8031 when the AF in the service network requires the terminal identification, the AAnF in the home network receives the first application key acquisition request sent by AAnFProxy in the service network; after generating the AKMA application key, the AAnF in the home network The AAnF sends the first application key acquisition response to AAnFProxy in the service network.
  • Step 8052 AAnF in the home network sends a second application key acquisition response to AAnFProxy in the service network.
  • the second application key acquisition response corresponds to the first application key acquisition request, and is used for AAnF in the home network to feed back AF to AAnFProxy in the service network when the AF in the service network does not require a terminal identification.
  • AKMA application key information The AAnF sends Naanf_AKMA_ApplicationKey_AnonUser_Get response to the AAnFProxy with K AF and the K AF expiration time.
  • the first application key acquisition response may be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Response.
  • the AKMA application key information of the AF includes at least one of the following information: the AKMA application key (K AF ) and the expiration time of the AKMA application key (K AF expTime).
  • the AAnF in the home network receives the first application key acquisition request sent by AAnFProxy in the service network; after generating the AKMA application key, the AAnF in the home network The AAnF sends the first application key acquisition response to AAnFProxy in the service network.
  • step 8051 and step 8052 can be executed alternatively and cannot be executed at the same time.
  • steps 8031/8032, 804 and 8051/8052 provide an implementation manner in which the AKMA application key information of the AF in the serving network is generated by the AAnF in the home network.
  • the AKMA application key information of AF in the service network can also be generated by AAnFProxy in the service network.
  • AAnFProxy in the service network obtains A-KID and AF_ID based on the application key acquisition request; subsequently, AAnFProxy in the service network can generate an AKMA application key based on the AKMA key and AF_ID.
  • this embodiment only shows the implementation manner in which the AKMA application key information of the AF in the serving network is generated by the AAnF in the home network, and does not limit this application.
  • Step 8061 AAnFProxy in the service network sends the first AKMA application key response to AF in the service network.
  • the first AKMA application key response corresponds to the first AKMA application key request.
  • the first AKMA Application Key Response can be represented by an AKMA Application Key Response;
  • the AKMA Application Key information of the AF includes at least one of the following information: the AKMA Application Key, the expiration time of the AKMA Application Key, and SUPI.
  • the AAnFProxy sends AKMA Application Key Response to AF in the serving network with SUPI,K AF ,the K AF expiration time,and the SUPI of UE.
  • AAnFProxy in the service network receives the first AKMA application key request sent by the AF in the service network.
  • the first AKMA application key request is used to indicate that the AF in the service network requires a terminal identification; subsequently, the AF in the service network AAnFProxy sends the first AKMA application key response to the AF in the service network.
  • Step 8062 AAnFProxy in the service network sends a second AKMA application key response to AF in the service network.
  • the second AKMA application key response corresponds to the second AKMA application key request.
  • the second AKMA Application Key response may be represented by an AKMA Application Key AnonUser Response;
  • the AKMA Application Key information of the AF includes at least one of the following information: the AKMA Application Key and the expiration time of the AKMA Application Key.
  • the AAnFProxy sends AKMA Application Key AnonUser Response to the AF with K AF and K AF expiration time.
  • AAnFProxy in the service network receives the second AKMA application key request sent by the AF in the service network.
  • the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identification; subsequently, the AF in the service network
  • the AAnFProxy sends a second AKMA application key response to the AF in the serving network.
  • step 8061 and step 8062 can be executed alternatively and cannot be executed at the same time.
  • Step 807 The AF in the serving network sends an application session establishment response to the visiting UE.
  • the application session establishment response corresponds to the application session establishment request and is used to feed back the AKMA application key information of AF in the service network, which can be represented by Application Session Establishment Response.
  • the UE can obtain the AKMA application key information of the AF based on the AKMA application key information of the AF carried in the AKMA application key response and based on the different AKMA application key responses received. Also different.
  • the AKMA application key information of AF carried in the first AKMA application key response includes at least one of the following information: AKMA application key, expiration time of the AKMA application key and SUPI; the second AKMA application key response
  • the AKMA application key information of the AF carried in includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • the AAnF in the home network does not carry the terminal's AKMA key.
  • AAnF in the home network sends an error response to AAnFProxy in the serving network; AAnFProxy in the serving network sends the error response to AF in the serving network; AF in the serving network feeds back application session rejection information to the UE.
  • the rejection message includes the reason for the response failure. Based on this, the AF in the service network refuses to establish the application session by including the response failure reason.
  • the UE can resend the application session establishment request, and the application session establishment request carries the new A-KID and/or service network identification. symbol.
  • the AF shall reject the Application Session Establishment by including a failure cause.
  • UE may trigger a new Application Session Establishment request with the latest A-KID to the A KMA AF.
  • the steps on the UE side can independently become an embodiment of the key management method applied in the terminal, and the steps on the AAnF side in the home network can independently become an application.
  • the steps on the AF side in the serving network may separately become an embodiment of the key management method in the AF in the serving network, in the serving network
  • the steps on the AAnFProxy side may alone become an embodiment of the key management method in AAnFProxy applied to the service network.
  • the steps of the key management method please refer to the above content and will not be described again.
  • the terminal can send the serving network identifier to the AF in the serving network (The UE should be able to send serving network identifier to the AF).
  • AAnF in the home network can receive A-KID, AF_ID from AAnFProxy in the service network (AAnF should be able to receive A-KID, AF_ID from the AAnFProxy).
  • AAnF in the home network can send K AF ,K AF expiration time, and SUPI of the UE to the AAnFProxy in the serving network (AAnF should be able to send K AF ,K AF expiration time, and SUPI of the UE to the AAnFProxy) .
  • the AAnF in the home network can send an error response to the AAnFProxy in the service network (AAnF should be able to send error response to the AAnFProxy).
  • the AF in the service network can receive A-KID from the UE (AF should be able to receive A-KID from the UE).
  • the AF in the service network can request K AF from AAnF in the home network of the UE by sending A -KID and AF_ID to AAnFProxy in the service network (AF should be able to request K AF from AAnF in the home network of UE by sending A-KID and AF_ID to AAnFProxy in the serving network).
  • the AF in the service network can obtain the K AF of the UE, the expiration time of K AF and SUPI from the AAnFProxy in the service network (AF should be able to obtain K AF ,K AF expiration, and SUPI of the UE from the AAnFProxy).
  • AF in the service network can obtain error response from the AAnFProxy in the service network (AF should be able to obtain error response from the AAnFProxy).
  • the AF When the AF in the service network needs the identity information of the UE, the AF should be able to send the AKMA ApplicationKey Request to AAnFProxy when the AF needs the identity information of the UE).
  • the AF When the AF in the service network does not need the identity information of the UE, the AF should be able to send AKMA ApplicationKey AnonUser Request to AAnFProxy when the AF does not need the identity information of the UE).
  • the AAnFProxy functionality in the service network may be implemented as a separate network function in the service network, or as part of any NF in the service network, or as a trusted application function within the 3GPP operator domain (AAnfProxy functionality may be implemented as a separate network function in the serving network, or be part of any NF in the serving network, or as a trusted AF).
  • AAnFProxy in the service network can receive A-KID and AF_ID from the AF in the service network (AAnFProxy should be able to receive A-KID and AF_ID from the AF).
  • AAnFProxy in the serving network can discover AAnF in the UE's home network through NRFs in the serving network and home network (AAnFProxy should be able to discover AAnF in the home network of UE via NRFs in the serving network and home network).
  • AAnFProxy in the serving network can request K AF and K AF expiration time for AF by sending A-KID and AF_ID to AAnF in the UE home network (AAnFProxy should be able to request K AF and K AF expiration time for AF by send A-KID and AF_ID to the AAnF in the home network of UE).
  • AAnFProxy in the service network can obtain K AF , K AF expiration time, and SUPI from AAnF in the home network of UE (AAnFProxy should be able to obtain K AF ,K AF expiration time, and SUPI from AAnF in the home network of UE).
  • AAnFProxy in the service network can obtain error response from AAnF in the UE's home network (AAnFProxy should be able to obtain error response from AAnF in the home network of UE).
  • AAnFProxy in the service network can request the Naanf_AKMA_ApplicationKey_AnonUser_Get service from AAnF in the home network of the UE (AAnFProxy should be able to request Naanf_AKMA_ApplicationKey_AnonUser_Get service from AAnF in the home network of UE).
  • AAnFProxy in the service network can request the Naanf_AKMA_ApplicationKey_Get service from AAnF in the home network of the UE (AAnFProxy should be able to request Naanf_AKMA_ApplicationKey_Get service from AAnF in the home network of UE).
  • AAnFProxy in the service network can send K AF , K AF expiration, and SUPI of the UE to the AF (AAnFProxy should be able to send K AF ,K AF expiration, and SUPI of the UE to the AF).
  • AAnFProxy in the service network can send error responses to the AF in the service network (AAnFProxy should be able to send error response to the AF).
  • the embodiments of this application provide a key management method that can realize AKMA application key request and AKMA based on the interaction between AAnFProxy in the service network, AF in the service network and AAnF in the home network.
  • the application key response enables the terminal to obtain the AKMA application key information of the AF in the service network.
  • Figure 13 shows a schematic diagram of a key management device provided by an exemplary embodiment of the present application.
  • the device includes:
  • the receiving module 1310 is used to receive the AKMA application key request sent by the AF in the service network;
  • the sending module 1320 is configured to feed back an AKMA application key response to the AF in the service network, where the AKMA application key response includes the AKMA application key information of the AF in the service network.
  • the AKMA application key information of the AF in the serving network is generated by the proxy entity in the serving network; or the AKMA application key information of the AF in the serving network is generated by the AAnF in the home network.
  • the AKMA application key information of the AF in the serving network is generated by the AAnF in the home network.
  • the sending module 1320 is also used to send an application key acquisition request to the AAnF in the home network; the receiving module 1310 is also used to Receive an application key acquisition response fed back by the AAnF in the home network.
  • the application key acquisition response includes the AKMA application key information of the AF in the serving network.
  • the AKMA application key information includes at least one of the following: the AKMA application key of the AF in the service network; the expiration time of the AKMA application key; SUPI.
  • the sending module 1320 is configured to send a first application key acquisition request to the AAnF in the home network when the AF in the serving network requires a terminal identity.
  • the first application key acquisition request includes at least one of the following: AKMA key identifier, which is an identifier used to indicate the AKMA key of the terminal; AF identifier, which is an AF identifier. is an identifier used to indicate the AF in the service network.
  • AKMA key identifier which is an identifier used to indicate the AKMA key of the terminal
  • AF identifier which is an AF identifier. is an identifier used to indicate the AF in the service network.
  • the receiving module 1310 is configured to receive a first AKMA application key request sent by the AF in the service network, where the first AKMA application key request is used to indicate that the AF in the service network requires a terminal identity.
  • the AKMA application key information includes at least one of the following: the AKMA application key of the AF in the service network; and the expiration time of the AKMA application key.
  • the sending module 1320 is configured to send a second application key acquisition request to the AAnF in the home network when the AF in the serving network does not require a terminal identification.
  • the second application key acquisition request includes at least one of the following: AKMA key identifier, which is an identifier used to indicate the AKMA key of the terminal; AF identifier, AF identifier is an identifier used to indicate the AF in the service network.
  • the receiving module 1310 is configured to receive a second AKMA application key request sent by the AF in the service network, where the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identification.
  • the AKMA key identifier is obtained from the terminal by the AF in the service network.
  • the receiving module 1310 is also used to receive an error response fed back by the AAnF in the home network.
  • the error response is sent when the AKMA key of the terminal is not stored in the AAnF in the home network; the sending module 1320, Also used to send error responses to AF in the service network.
  • the device also includes a discovery module 1330, configured to discover the AAnF in the home network through the NRF in the serving network and the home network.
  • a discovery module 1330 configured to discover the AAnF in the home network through the NRF in the serving network and the home network.
  • the proxy entity in the service network is a separate NF in the service network; or the proxy entity in the service network is part of any NF in the service network; or the proxy entity in the service network is a trusted application function.
  • Figure 14 shows a schematic diagram of a key management device provided by an exemplary embodiment of the present application.
  • the device includes:
  • the receiving module 1410 is used to receive the application key acquisition request sent by the proxy entity in the service network;
  • the generation module 1420 is configured to generate the AKMA application key of the AF in the service network based on the AKMA key of the terminal when the AKMA key of the terminal is stored in the AAnF in the home network;
  • the sending module 1430 is configured to feed back an application key acquisition response to the proxy entity in the service network, where the application key acquisition response includes the AKMA application key information of the AF in the service network.
  • the AKMA application key information includes at least one of the following: AKMA application key; expiration time of the AKMA application key; SUPI.
  • the receiving module 1410 is configured to receive a first application key acquisition request sent by the proxy entity in the service network, where the first application key acquisition request is used to indicate that the AF in the service network requires a terminal identity.
  • the first application key acquisition request includes at least one of the following: AKMA key identifier, which is an identifier used to indicate the AKMA key of the terminal; AF identifier, which is an AF identifier. is an identifier used to indicate the AF in the service network.
  • AKMA key identifier which is an identifier used to indicate the AKMA key of the terminal
  • AF identifier which is an AF identifier. is an identifier used to indicate the AF in the service network.
  • the AKMA application key information includes at least one of the following: AKMA application key; expiration time of the AKMA application key.
  • the receiving module 1410 is configured to receive a second application key acquisition request sent by the proxy entity in the service network.
  • the second application key acquisition request is used to indicate that the AF in the service network does not require a terminal identification.
  • the second application key acquisition request includes at least one of the following: AKMA key identifier, which is an identifier used to indicate the AKMA key of the terminal; AF identifier, AF identifier is an identifier used to indicate the AF in the service network.
  • the sending module 1430 is also configured to feed back an error response to the proxy entity in the serving network when the AKMA key of the terminal is not stored in the AAnF in the home network.
  • the generation module 1420 is also used to determine whether the AAnF in the home network provides services to the AF in the service network and the proxy entity in the service network according to the authorization information or policy; the AAnF in the home network stores terminals AKMA key and the AAnF in the home network provides services to the AF in the service network and the proxy entity in the service network, the AKMA application key of the AF in the service network is generated based on the AKMA key of the terminal.
  • authorization information or policy provided by local policy or NRF in the home network.
  • Figure 15 shows a schematic diagram of a key management device provided by an exemplary embodiment of the present application.
  • the device includes:
  • the receiving module 1510 is used to receive the service network identifier and the AKMA key identifier sent by the terminal;
  • the sending module 1520 is configured to send an AKMA application key request to the proxy entity in the serving network when the terminal's serving network identifier is inconsistent with the home network identifier;
  • the receiving module 1510 is also configured to receive an AKMA application key response fed back by the proxy entity in the service network.
  • the AKMA application key response includes the AKMA application key information of the AF in the service network.
  • the AKMA application key information of the AF in the serving network is generated by the proxy entity in the serving network; or the AKMA application key information of the AF in the serving network is generated by the AAnF in the home network.
  • the AKMA application key information includes at least one of the following: the AKMA application key of the AF in the service network; the expiration time of the AKMA application key; SUPI.
  • the sending module 1520 is configured to send a first AKMA application key request to the proxy entity in the service network, where the first AKMA application key request is used to indicate that the AF in the service network requires a terminal identity.
  • the first AKMA application key request includes at least one of the following: AKMA key identifier, the AKMA key identifier is an identifier used to indicate the AKMA key of the terminal; AF identifier, AF identifier is an identifier used to indicate the AF in the service network.
  • the AKMA application key information includes at least one of the following: the AKMA application key of the AF in the service network; and the expiration time of the AKMA application key.
  • the sending module 1520 is configured to send a second AKMA application key request to the proxy entity in the service network, where the second AKMA application key request is used to indicate that the AF in the service network does not require a terminal identity.
  • the second AKMA application key request includes at least one of the following: AKMA key identifier, which is an identifier used to indicate the AKMA key of the terminal; AF identifier, AF identifier is an identifier used to indicate the AF in the service network.
  • the receiving module 1510 is also used to receive an error response fed back by the proxy entity in the service network.
  • the error response is sent by the AAnF in the home network to the proxy in the service network without storing the AKMA key of the terminal. Entity.
  • the receiving module 1510 is configured to receive an application session establishment request sent by the terminal.
  • the application session establishment request carries the service network identifier and the AKMA key identifier;
  • the sending module 1520 is also configured to feed back the application session establishment response to the terminal. .
  • the application session establishment request includes the AKMA key identifier, and the AKMA key identifier carries the service network identifier; or, the application session establishment request includes the AKMA key identifier and the service network identifier; where, the AKMA key
  • the identifier is an identifier used to indicate the AKMA key of the terminal.
  • the sending module 1520 is also configured to feed back rejection information of the application session to the terminal when receiving an error response fed back by the proxy entity in the service network.
  • the rejection information includes the reason for the response failure.
  • the AKMA key identifier is in NAI format.
  • Figure 16 shows a schematic diagram of a key management device provided by an exemplary embodiment of the present application.
  • the device includes:
  • the sending module 1610 is used to send the service network identifier and the AKMA key identifier to the application function AF in the service network.
  • the service network identifier is used to trigger the service network identifier of the AF in the service network to be inconsistent with the home network identifier of the terminal. In this case, send an AKMA application key request to the proxy entity in the service network.
  • the sending module 1610 is used to send an application session establishment request to the AF in the service network.
  • the application session establishment request carries the service network identifier and the AKMA key identifier;
  • the device also includes a receiving module 1620, used to receive Application session establishment response fed back by AF in the service network.
  • the application session establishment request includes the AKMA key identifier, and the AKMA key identifier carries the service network identifier; or, the application session establishment request includes the AKMA key identifier and the service network identifier; where, the AKMA key
  • the identifier is an identifier used to indicate the AKMA key of the terminal.
  • Figure 17 shows a schematic structural diagram of a communication device (terminal or network device) provided by an exemplary embodiment of the present application.
  • the communication device includes: a processor 1701, a receiver 1702, a transmitter 1703, a memory 1704 and a bus 1705.
  • the processor 1701 includes one or more processing cores.
  • the processor 1701 executes various functional applications and information processing by running software programs and modules.
  • the receiver 1702 and the transmitter 1703 can be implemented as a communication component, and the communication component can be a communication chip.
  • Memory 1704 is connected to processor 1701 through bus 1705.
  • the memory 1704 may be used to store at least one instruction, and the processor 1701 is used to execute the at least one instruction to implement each step of the key management method executed by the terminal in the above method embodiment.
  • memory 1704 may be implemented by any type of volatile or non-volatile storage device, or combination thereof, including but not limited to: magnetic or optical disks, electrically erasable programmable Read-only memory (Electrically-Erasable Programmable Read Only Memory, EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, EPROM), static random access memory (Static Random Access Memory, SRAM), read-only memory (Read-Only Memory, ROM), magnetic memory, flash memory, programmable read-only memory (Programmable Read-Only Memory, PROM).
  • magnetic or optical disks electrically erasable programmable Read-only memory (Electrically-Erasable Programmable Read Only Memory, EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, EPROM), static random access memory (Static Random Access Memory, SRAM), read-only memory (Read-Only Memory, ROM), magnetic memory, flash memory, programmable read-only memory
  • Figure 18 shows a schematic structural diagram of a network element device provided by an exemplary embodiment of the present application.
  • the network element device includes: a processor 1801, a memory 1802, and a communication component 1803.
  • the processor 1801 is connected to the memory 1802, and the memory 1802 is connected to the communication component 1803.
  • the memory 1802 can be used to store at least one instruction and computer program, and the processor 1801 is used to execute the at least one instruction and computer program to implement the processing steps of the key management method performed by the core network element in the above method embodiment.
  • the processing steps refer to other steps except the receiving step and the sending step.
  • the communication component 1803 is used to implement the receiving steps and sending steps of the key management method executed by the core network element in the above method embodiment.
  • the embodiment of the present application also provides a proxy entity.
  • the proxy entity includes a communication component; the communication component is used to receive the AKMA application key request sent by the AF in the service network; and feed back the AKMA application key response to the AF in the service network.
  • the AKMA application key response includes the AKMA application key information of the AF in the serving network.
  • the embodiment of the present application also provides an AAnF.
  • the AAnF includes a communication component and a processor; the communication component is used to receive an application key acquisition request sent by the proxy entity in the service network; and the processor is used for the AAnF in the home network.
  • the AKMA key of the terminal is stored in the terminal, the AKMA application key of the AF in the service network is generated based on the AKMA key of the terminal; the communication component is also used to feed back the application key acquisition response to the proxy entity in the service network.
  • the application key acquisition response includes the AKMA application key information of the AF in the service network.
  • the embodiment of the present application also provides an AF.
  • the AF includes a communication component; a communication component for receiving the service network identifier and the AKMA key identifier sent by the terminal; in the case where the service network identifier of the terminal is inconsistent with the home network identifier Next, send an AKMA application key request to the proxy entity in the service network; receive an AKMA application key response fed back by the proxy entity in the service network, where the AKMA application key response includes the AKMA application key information of the AF in the service network.
  • the embodiment of the present application also provides a terminal.
  • the terminal includes a transceiver; the transceiver is configured to: send a service network identifier and an AKMA key identifier to the AF in the service network, and the service network identifier is used to trigger the When the terminal's serving network identifier is inconsistent with the home network identifier, the AF sends an AKMA application key request to the proxy entity in the serving network.
  • Embodiments of the present application also provide a computer-readable storage medium.
  • a computer program is stored in the storage medium, and the computer program is used to be executed by a processor to implement the key management method as described above.
  • An embodiment of the present application also provides a chip.
  • the chip includes programmable logic circuits and/or program instructions, and is used to implement the key management method as described above when the chip is running.
  • Embodiments of the present application also provide a computer program product or computer program.
  • the computer program product or computer program includes computer instructions.
  • the computer instructions are stored in a computer-readable storage medium.
  • the processor reads and executes the computer program from the computer-readable storage medium. Instructions to implement the key management method as described above.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

La présente demande se rapporte au domaine des communications, et divulgue un procédé et un appareil de gestion de clé, ainsi qu'un dispositif et un support de stockage. Le procédé est appliqué à un scénario d'itinérance, et le procédé de gestion de clé mis en oeuvre par une entité mandataire dans un réseau de desserte consiste à : recevoir une demande d'obtention de clé d'application envoyée par une AF du réseau de desserte ; et renvoyer une réponse de clé d'application AKMA à l'AF du réseau de desserte, la réponse de clé d'application AKMA comprenant des informations de clé d'application AKMA de l'AF du réseau de desserte.
PCT/CN2022/092885 2022-05-13 2022-05-13 Procédé et appareil de gestion de clé, et dispositif et support de stockage WO2023216272A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2022/092885 WO2023216272A1 (fr) 2022-05-13 2022-05-13 Procédé et appareil de gestion de clé, et dispositif et support de stockage
CN202280001756.0A CN117413554A (zh) 2022-05-13 2022-05-13 密钥管理方法、装置、设备及存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/092885 WO2023216272A1 (fr) 2022-05-13 2022-05-13 Procédé et appareil de gestion de clé, et dispositif et support de stockage

Publications (1)

Publication Number Publication Date
WO2023216272A1 true WO2023216272A1 (fr) 2023-11-16

Family

ID=88729498

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/092885 WO2023216272A1 (fr) 2022-05-13 2022-05-13 Procédé et appareil de gestion de clé, et dispositif et support de stockage

Country Status (2)

Country Link
CN (1) CN117413554A (fr)
WO (1) WO2023216272A1 (fr)

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111147231A (zh) * 2018-11-05 2020-05-12 华为技术有限公司 一种密钥协商的方法、相关装置及系统

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111147231A (zh) * 2018-11-05 2020-05-12 华为技术有限公司 一种密钥协商的方法、相关装置及系统

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
LENOVO, MOTOROLA MOBILITY: "AKMA roaming", 3GPP DRAFT; S3-214091, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. e-meeting; 20211108 - 20211119, 1 November 2021 (2021-11-01), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP052073503 *
S3: "AKMA service support for roaming UE", 3GPP DRAFT; S3-214236, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. e-meeting; 20211108 - 20211119, 1 November 2021 (2021-11-01), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP052073645 *

Also Published As

Publication number Publication date
CN117413554A (zh) 2024-01-16

Similar Documents

Publication Publication Date Title
US11716621B2 (en) Apparatus and method for providing mobile edge computing services in wireless communication system
CN111543073B (zh) 用于用户认证的装置和方法
EP3616426B1 (fr) Configuration de la politique réseau
US20220095111A1 (en) Flexible authorization in 5g service based core network
CN112753234A (zh) 3gpp专用lan
CN113541925B (zh) 通信系统、方法及装置
US20230239686A1 (en) Secure communication method, apparatus, and system
WO2021197489A1 (fr) Système, procédé et appareil de communication
US20200187000A1 (en) Systems and methods for using gba for services used by multiple functions on the same device
US20230232228A1 (en) Method and apparatus for establishing secure communication
CN116546491A (zh) 在通信网络中用于与服务应用的加密通信的锚密钥生成和管理的方法、设备和系统
CN109891921A (zh) 下一代系统的认证
US20230396602A1 (en) Service authorization method and system, and communication apparatus
WO2023213301A1 (fr) Procédé d'authentification, appareil de communication, et support de stockage lisible par ordinateur
WO2020208294A1 (fr) Établissement de voies de communication sécurisées vers un serveur de connexion à voies multiples (mpc) à connexion initiale sur un réseau public
WO2023216272A1 (fr) Procédé et appareil de gestion de clé, et dispositif et support de stockage
JP2024517897A (ja) Ｎｓｗｏサービスの認証のための方法、デバイス、および記憶媒体
WO2023216274A1 (fr) Procédé et appareil de gestion de clé, dispositif et support de stockage
WO2023216273A1 (fr) Procédé et appareil de gestion de clé, dispositif et support d'informations
KR20200044592A (ko) 다중 경로 전송 시스템, 그리고 이의 다중 경로 전송 방법
WO2023142102A1 (fr) Mise à jour de configuration de sécurité dans des réseaux de communication
WO2024092624A1 (fr) Procédé et dispositif de transfert de clé de chiffrement pour des utilisateurs itinérants dans des réseaux de communication
WO2024032226A1 (fr) Procédé de communication et appareil de communication
WO2022237838A1 (fr) Procédé de communication et dispositif de communication
WO2023144681A1 (fr) Gestion d'informations de consentement de propriétaire de ressource

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 202280001756.0

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22941222

Country of ref document: EP

Kind code of ref document: A1