WO2023216273A1 - 密钥管理方法、装置、设备及存储介质 - Google Patents

密钥管理方法、装置、设备及存储介质 Download PDF

Info

Publication number
WO2023216273A1
WO2023216273A1 PCT/CN2022/092886 CN2022092886W WO2023216273A1 WO 2023216273 A1 WO2023216273 A1 WO 2023216273A1 CN 2022092886 W CN2022092886 W CN 2022092886W WO 2023216273 A1 WO2023216273 A1 WO 2023216273A1
Authority
WO
WIPO (PCT)
Prior art keywords
identifier
akma
key
home network
network
Prior art date
Application number
PCT/CN2022/092886
Other languages
English (en)
French (fr)
Inventor
梁浩然
陆伟
Original Assignee
北京小米移动软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京小米移动软件有限公司 filed Critical 北京小米移动软件有限公司
Priority to PCT/CN2022/092886 priority Critical patent/WO2023216273A1/zh
Priority to CN202280001699.6A priority patent/CN117413553A/zh
Publication of WO2023216273A1 publication Critical patent/WO2023216273A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security

Definitions

  • the present application relates to the field of mobile communications, and in particular to a key management method, device, equipment and storage medium.
  • AKMA Authentication and Key Management for Applications
  • 3GPP 3rd Generation Partnership Project
  • 5th Generation In scenarios such as mobile communication technology message business (Message within 5G, MSGin5G), it is used as a solution to protect the communication between the terminal and the application function (Application Function, AF).
  • Embodiments of the present application provide a key management method, device, equipment and storage medium.
  • the technical solutions are as follows:
  • a key management method is provided.
  • the method is applied in a roaming scenario.
  • the method is executed by a proxy entity in the service network.
  • the method includes:
  • a key management method is provided.
  • the method is applied in a roaming scenario.
  • the method is executed by the AF in the home network.
  • the method includes:
  • a key management method is provided.
  • the method is applied in a roaming scenario.
  • the method is executed by the AAnF in the home network.
  • the method includes:
  • a key management method is provided.
  • the method is applied in a roaming scenario.
  • the method is executed by a terminal.
  • the method includes:
  • the service network identifier is used to trigger the AAnF in the home network to detect when the service network identifier of the terminal is different from the home network identifier.
  • an application key confirmation request is sent to the proxy entity in the service network, and the AKMA key identifier is the identifier of the AKMA key of the terminal.
  • a key management device is provided.
  • the device is used in a roaming scenario.
  • the device includes:
  • the receiving module is used to receive the application key confirmation request sent by the anchor function network element AAnF of the application authentication and key management AKMA in the home network.
  • the application key confirmation request includes at least one of the following:
  • the terminal s contracted permanent identification SUPI
  • the AF identifier is the identifier of the AF in the home network
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the application key confirmation request is sent by the AAnF to the proxy entity when the terminal's serving network identifier is different from the home network identifier.
  • the device also includes:
  • the sending module is used to send the application key confirmation response to AAnF.
  • the device also includes:
  • Storage module used to store application key confirmation requests.
  • the proxy entity is determined by the AAnF in the network element of the serving network when the serving network identifier of the terminal is different from the home network identifier.
  • the proxy entity is discovered by the AAnF in the network element of the serving network through the network storage function NRF in the serving network and the home network.
  • the proxy entity information is configured locally in AAnF.
  • the proxy entity is a separate network function NF in the service network;
  • the proxy entity is part of any NF in the service network.
  • the proxy entity is a trusted application function within the 3GPP operator domain.
  • a key management device is provided.
  • the device is used in a roaming scenario.
  • the device includes:
  • the receiving module is used to receive the service network identifier and AKMA key identifier sent by the terminal;
  • the sending module is used to send an application key acquisition request to the AAnF in the home network.
  • the application key acquisition request carries the service network identifier.
  • the service network identifier is used to trigger the service network identifier and home network identifier of the AAnF in the terminal. Under different circumstances, send an application key confirmation request to the proxy entity in the service network;
  • the receiving module is also used to receive the application key acquisition response fed back by the AAnF.
  • the application key acquisition response includes the AKMA application key information of the AF.
  • the AKMA application key information includes at least one of the following:
  • the transmit module is used to:
  • the AF When the AF needs the terminal identification, it sends a first application key acquisition request to the AAnF.
  • the first application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key
  • the AF identifier is the identifier of the AF in the home network.
  • the first application key acquisition request includes an AKMA key identifier and a service network identifier
  • the AKMA key identifier carries the service network identifier; or the first application key acquisition request carries the service network identifier in a separate field.
  • the transmit module is used to:
  • a second application key acquisition request is sent to the AAnF in the home network.
  • the second application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key
  • the AF identifier is the identifier of the AF in the home network.
  • the second application key acquisition request includes an AKMA key identifier and a service network identifier
  • the AKMA key identifier carries the service network identifier; or the second application key acquisition request carries the service network identifier through a separate field.
  • the receiving module is used for:
  • the error response is sent when the AKMA key of the terminal is not stored in AAnF;
  • Send module used to send error responses to the terminal.
  • the device also includes:
  • Discovery module for discovering AAnF through NRF in the home network.
  • the receiving module is used for:
  • the sending module is used to feed back the application session establishment response to the terminal.
  • the application session establishment request includes the AKMA key identifier of AKMA, and the AKMA key identifier carries the service network identifier; or the application session establishment request includes the AKMA key identifier and the service network identifier;
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the transmit module is used to:
  • rejection information of the application session is fed back to the terminal, and the rejection information includes the reason for the response failure.
  • the AKMA key identifier is in the Network Access Identifier NAI format.
  • a key management device is provided.
  • the device is used in a roaming scenario.
  • the device includes:
  • a receiving module configured to receive an application key acquisition request sent by the AF in the home network, where the application key acquisition request carries the service network identifier;
  • Generating module used to generate AF's AKMA application key based on the terminal's AKMA key
  • the sending module is used to feed back the application key acquisition response to the AF, and the application key acquisition response includes the AKMA application key information of the AF;
  • the sending module is also used to send an application key confirmation request to the proxy entity in the service network.
  • the AKMA application key information includes at least one of the following:
  • the receiving module is used for:
  • the first application key acquisition request is used to indicate that the AF requires a terminal identity.
  • the first application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key
  • the AF identifier is the identifier of the AF.
  • the first application key acquisition request includes an AKMA key identifier and a service network identifier
  • the AKMA key identifier carries the service network identifier; or the first application key acquisition request carries the service network identifier through a separate field.
  • the receiving module is used for:
  • the second application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key
  • the AF identifier is the identifier of the AF.
  • the second application key acquisition request includes an AKMA key identifier and a service network identifier
  • the AKMA key identifier carries the service network identifier; or the second application key acquisition request carries the service network identifier through a separate field.
  • the AKMA application key information fed back by AAnF does not include the terminal's SUPI.
  • the transmit module is used to:
  • the device also includes:
  • the determination module is used to determine that AAnF provides services to AF and proxy entities in the service network based on authorization information or policies.
  • authorization information or policies are provided by local policy or the NRF in the home network.
  • the application key confirmation request includes at least one of the following:
  • the AF identifier is the identifier of the AF
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the transmit module is used to:
  • an application key confirmation request is sent to the proxy entity.
  • the receiving module is used for:
  • the device also includes:
  • the determining module is configured to determine the proxy entity in the network element of the serving network when the serving network identifier of the terminal is different from the home network identifier.
  • the proxy entity is discovered through the NRF in the serving network and the home network.
  • a key management device is provided.
  • the device is used in a roaming scenario.
  • the device includes:
  • the sending module is used to send the service network identifier and the AKMA key identifier to the AF in the home network.
  • the service network identifier is used to trigger the AAnF in the home network when the service network identifier of the terminal is different from the home network identifier.
  • an application key confirmation request is sent to the proxy entity in the service network, and the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the transmit module is used to:
  • the installation also includes:
  • the receiving module is used to receive the application session establishment response of AF feedback.
  • the application session establishment request includes the AKMA key identifier of AKMA, and the AKMA key identifier carries the service network identifier; or the application session establishment request includes the AKMA key identifier and the service network identifier;
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • a proxy entity in a service network where the proxy entity includes a communication component
  • the communication component is used to receive the application key confirmation request sent by the anchor function network element AAnF of the application authentication and key management AKMA in the home network.
  • an application function AF is provided, the AF including a communication component;
  • Communication component used to receive the service network identifier and AKMA key identifier sent by the terminal;
  • an anchor function network element AAnF that applies authentication and key management AKMA is provided, where the AAnF includes a communication component and a processor;
  • a communication component configured to receive an application key acquisition request sent by the AF in the home network, where the application key acquisition request carries a service network identifier
  • a processor configured to generate the AKMA application key of the AF in the home network based on the AKMA key of the terminal;
  • a communication component configured to feed back an application key acquisition response to the AF in the home network, where the application key acquisition response includes the AKMA application key information of the AF in the home network;
  • Communication component used to send application key confirmation requests to proxy entities in the service network.
  • a terminal including a transceiver
  • a transceiver configured to send a service network identifier and an AKMA key identifier to the AF in the home network.
  • the service network identifier is used to trigger the AAnF in the home network to use the service network identifier and the home key identifier of the terminal. If the network identifiers are different, an application key confirmation request is sent to the proxy entity in the service network, and the AKMA key identifier is the identifier of the AKMA key of the terminal.
  • a computer-readable storage medium in which executable instructions are stored, and the executable instructions are loaded and executed by a processor to implement the above aspects. Key management methods.
  • a chip is provided.
  • the chip includes programmable logic circuits and/or program instructions. When the chip is run on a computer device, it is used to implement the key management described in the above aspect. method.
  • a computer program product or computer program includes computer instructions.
  • the computer instructions are stored in a computer-readable storage medium.
  • a processor reads the computer instructions from the computer program.
  • the readable storage medium reads and executes the computer instructions, so that the computer device performs the key management method described in the above aspect.
  • the AAnF in the home network sends an application key confirmation request to the proxy entity in the serving network, so that the relevant network elements in the serving network can learn that the terminal can communicate with the AF in the home network in the roaming scenario.
  • Figure 1 is a network architecture diagram of the AKAM service provided by an exemplary embodiment of the present application
  • Figure 2 is a flow chart for generating AKMA keys provided by an exemplary embodiment of the present application
  • Figure 3 is a schematic diagram of the system architecture of a communication system provided by an exemplary embodiment of the present application.
  • Figure 4 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 5 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 6 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 7 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 8 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 9 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 10 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 11 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 12 is a flow chart of a key management method provided by an exemplary embodiment of the present application.
  • Figure 13 is a structural block diagram of a key management device provided by an exemplary embodiment of the present application.
  • Figure 14 is a structural block diagram of a key management device provided by an exemplary embodiment of the present application.
  • Figure 15 is a structural block diagram of a key management device provided by an exemplary embodiment of the present application.
  • Figure 16 is a structural block diagram of a key management device provided by an exemplary embodiment of the present application.
  • Figure 17 is a schematic structural diagram of a communication device provided by an exemplary embodiment of the present application.
  • Figure 18 is a schematic structural diagram of a network element device provided by an exemplary embodiment of the present application.
  • first, second, third, etc. may be used in this disclosure to describe various information, the information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other.
  • first information may also be called second information, and similarly, the second information may also be called first information.
  • word “if” as used herein may be interpreted as "when” or “when” or “in response to determining.”
  • the 5G system includes terminals, access networks and core networks.
  • the terminal is a device with wireless transceiver function, and the terminal can be deployed on land, water, air, etc.
  • the terminal can be used in self-driving, remote medical, smart grid, transportation safety, smart city, smart home, etc. At least in one scene.
  • the access network is used to implement access-related functions and can provide network access functions for authorized users in a specific area.
  • the access network forwards control signals and user data between terminals and the core network.
  • the access network may include access network equipment, which may be equipment that provides access for terminals, and may include wireless access network (Radio Access Network, RAN) equipment and access network (Access Network, AN) equipment.
  • RAN equipment is mainly wireless network equipment in the 3GPP network, and AN equipment can be non-3GPP-defined access network equipment.
  • the names of devices with base station functions may be different. For example, in the 5G system, it is called RAN or Next Generation Node Basestation (gNB); in the Long Term Evolution (LTE) system, it is called evolved NodeB (eNB or eNodeB) .
  • gNB Next Generation Node Basestation
  • LTE Long Term Evolution
  • eNB evolved NodeB
  • the core network is responsible for maintaining mobile network subscription data and providing terminals with functions such as session management, mobility management, policy management, and security authentication.
  • the core network can include the following network elements: User Plane Function (UPF), Authentication Server Function (AUSF), Access and Mobility Management Function (AMF), and Session Management Function (Session Management Function, SMF), Network Exposure Function (NEF), Network Function Repository Function (NRF), Policy Control Function (Policy Control Function, PCF) and Unified Data Management (Unified Data Management , UDM).
  • UPF User Plane Function
  • AUSF Authentication Server Function
  • AMF Access and Mobility Management Function
  • Session Management Function Session Management Function
  • SMF Session Management Function
  • NEF Network Exposure Function
  • NRF Network Function Repository Function
  • Policy Control Function Policy Control Function
  • PCF Policy Control Function
  • UDM Unified Data Management
  • application functions Application Function, AF
  • UDR Unified Data Repository
  • AMF is mainly responsible for mobility management in mobile networks, such as user location update, user registration network, user switching, etc.
  • SMF is mainly responsible for session management in mobile networks, such as session establishment, modification, and release.
  • UPF is responsible for forwarding and receiving user data in the terminal. It can receive user data from the data network and transmit it to the terminal through the access network device. It can also receive user data from the terminal through the access network device and forward it to the data network.
  • PCF mainly supports providing a unified policy framework to control network behavior, provides policy rules to the control layer network functions, and is also responsible for obtaining user subscription information related to policy decisions.
  • AUSF is used to perform security authentication of terminals.
  • NEF is mainly used to support the opening of capabilities and events.
  • NRF is used to provide storage and selection functions for network function entity information for other network elements.
  • UDM is used to store user data, such as contract data, authentication/authorization data, etc.
  • AF interacts with the 3GPP core network to provide application layer services, such as providing application layer data routing, providing access network capability opening functions, interacting with the policy framework to provide policy control, and interacting with the IP Multimedia subsystem (IP Multimedia) of the 5G network. Subsystem, IMS) interaction, etc.
  • IP Multimedia IP Multimedia subsystem
  • DN Network Data Network
  • the terminal can access the DN through the established Protocol Data Unit (PDU) session.
  • PDU Protocol Data Unit
  • 5G may also be called “5G New Radio (NR)” or “NR”
  • terminal may also be called “terminal equipment” or “user equipment”. (User Equipment, UE)”.
  • NR New Radio
  • UE User Equipment
  • the security protection of the AKMA process can be used to improve the security of data transmission.
  • an AF corresponds to a video application server.
  • a UE that supports the AKMA service transmits data to the AF, compared with the unprotected transmission method of traditional UE and AF, using the AKMA service can improve the security of data transmission.
  • Figure 1 is a network architecture diagram of the AKAM service provided by an exemplary embodiment of the present application.
  • the network architecture includes UE, access network (Radio Access Network, (R)AN), AUSF, AMF, AF, NEF, AKMA anchor function network element (AKMA Anchor Function, AAnF) and UDM .
  • R Radio Access Network
  • AUSF Access Management Function
  • AMF Access Management Function
  • AF AF
  • NEF AKMA anchor function network element
  • AKMA Anchor Function AAnF
  • UDM AKMA Anchor Function
  • there are three ways for the UE to communicate with the AF The first is for the UE to communicate with the AF through (R)AN and AMF.
  • the second is for the UE to communicate with the AF through AMF.
  • the third is for the UE to communicate with the AF. Communicates directly with AF via Ua* interface.
  • the Ua* interface is the communication interface between the UE and the AF.
  • the AUSF can generate the key of the AKMA service (ie, the AKMA key) and provide the key of the UE's AKMA service to the AAnF.
  • the key of the AKMA service may be K AKMA , which may also be called the root key of the AKMA service.
  • the UE side will also generate the same key for the AKMA service, that is, generate the same K AKMA .
  • FIG. 2 is a flow chart for generating AKMA keys provided by an exemplary embodiment of the present application.
  • the UE when the UE registers with the 5G core network, the UE sends a registration request to the AMF through the RAN.
  • the registration request carries the UE's identity information (such as a hidden identity identifier (Subscriber Concealed Identifier, SUCI)).
  • the AMF selects the AUSF based on the UE's identity information, and sends a message to the selected AUSF to trigger the main authentication process.
  • the AUSF authenticates the UE and sends authentication parameters to the AMF. Then the AMF sends the authentication parameters to the UE through the RAN.
  • the UE authenticates the AUSF based on the authentication parameters and sends a response to the AMF through the RAN.
  • the AMF compares the response and conforms to The authentication is successful.
  • Primary Authentication in Figure 2 is the process in which the AUSF authenticates the UE and the UE authenticates the AUSF during the registration process. Primary authentication can also be called two-way authentication.
  • AUSF can use the intermediate key generated during the main authentication process, such as K AUSF , to generate K AKMA and generate key identification information for K AKMA .
  • the key identification information can be used to identify K AKMA . For example, it can It is the K AKMA identifier (K AKMA Identifier, A-KID).
  • the UE can use the intermediate key generated during the primary authentication process, such as K AUSF , to generate KAKMA and generate key identification information for KAKMA . It should be noted that the UE and AUSF locally generate the same KAUSF , KAKMA and key identification information respectively.
  • AAnF can interact with AUSF, obtain the key of the AKMA service from AUSF, and generate the communication key between the AF and the UE based on the key of the AKMA service and the identity of the AF.
  • the validity time of the communication key The AAnF can send the communication key and the validity time of the communication key to the AF, so that the AF can use the communication key to perform data transmission with the UE, thereby improving the security of data transmission between the AF and the UE.
  • the communication key between the AF and the UE may be K AF , for example.
  • the K AF between different AFs and the same UE may be different.
  • the K AF between AF1 and UE1 is K AF 1
  • the K AF between AF2 and UE1 is K AF 2.
  • AF can interact with 3GPP core network elements.
  • AF can obtain Quality of Service (QoS) parameters from PCF, or AF can provide QoS parameters to PCF, which can then affect the data transmission of the application.
  • AF can interact with NEF.
  • the AF obtains the communication key between the AF and the UE and the validity time of the communication key from the AAnF.
  • AF can be located inside the 5G core network or outside the 5G core network. If the AF is located inside the 5G core network, the AF can directly interact with the PCF; if the AF is located outside the 5G core network, the AF can interact with the PCF through NEF.
  • AKMA service solution applies to non-roaming scenarios, that is, the current service network of the terminal is the same as the terminal's home network, and AAnF and AF belong to the terminal's home network.
  • a roaming scenario that is, when the terminal's current service network is different from the terminal's home network, or the terminal's service network is a visited network (also called a visited network)
  • the home network of the terminal is different from the access network.
  • the terminal in a roaming scenario, sends a service network identifier to the AF in the home network, and the AF in the home network sends an application secret carrying the service network identifier to the AAnF in the home network.
  • key acquisition request so that when the AAnF in the home network determines that the terminal is in a roaming scenario based on the service network identifier, it can determine the proxy entity in the service network in the network element of the service network and send it an application key confirmation request.
  • relevant network elements in the serving network can learn that the terminal and the AF in the home network can establish AKMA-based communication, thereby providing AKMA services in roaming scenarios.
  • FIG. 3 shows a schematic diagram of the system architecture of a communication system provided by an embodiment of the present application.
  • the system architecture may include: terminal 10, access network equipment 20 and core network equipment 30.
  • the terminal 10 may refer to a UE (User Equipment), an access terminal, a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a wireless communication device, a user agent or a user device.
  • UE User Equipment
  • the terminal can also be a cellular phone, a cordless phone, a SIP (Session Initiation Protocol) phone, a WLL (Wireless Local Loop) station, a PDA (Personal Digital Assistant), or a Handheld devices with wireless communication functions, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, terminals in 5GS (5th Generation System, fifth-generation mobile communication system) or future evolved PLMN (Public Land Mobile Network (public land mobile communication network) terminals, etc., the embodiments of the present application are not limited to this.
  • 5GS Fifth Generation System, fifth-generation mobile communication system
  • PLMN Public Land Mobile Network (public land mobile communication network) terminals, etc.
  • the devices mentioned above are collectively called terminals.
  • the number of terminals 10 is usually multiple, and one or more terminals 10 may be distributed in the cell managed by each access network device 20 .
  • the access network device 20 is a device deployed in the access network to provide wireless communication functions for the terminal 10 .
  • the access network device 20 may include various forms of macro base stations, micro base stations, relay stations, access points, etc.
  • the names of devices with access network device functions may be different. For example, in 5G NR systems, they are called gNodeB or gNB.
  • the name "access network equipment" may change.
  • the above-mentioned devices that provide wireless communication functions for the terminal 10 are collectively referred to as access network equipment.
  • a communication relationship can be established between the terminal 10 and the core network device 30.
  • the access network device 20 may be EUTRAN (Evolved Universal Terrestrial Radio Access Network) or one or more eNodeBs in EUTRAN; in the 5G NR system, the access network device 20 The network device 20 may be a RAN or one or more gNBs in the RAN.
  • EUTRAN Evolved Universal Terrestrial Radio Access Network
  • eNodeBs Evolved Universal Terrestrial Radio Access Network
  • the network device 20 may be a RAN or one or more gNBs in the RAN.
  • the functions of the core network equipment 30 are mainly to provide user connections, manage users, and carry services, and serve as a bearer network to provide an interface to an external network.
  • the core network equipment in the 5G NR system can include AMF (Access and Mobility Management Function, access and mobility management function) entities, UPF (User Plane Function, user plane function) entities, SMF (Session Management Function, session management Function) entity, AKMA Anchor Function (AAnF) entity and Application Function (Application Function, AF) entity and other devices.
  • AMF Access and Mobility Management Function, access and mobility management function
  • UPF User Plane Function, user plane function
  • SMF Session Management Function, session management Function
  • AKMA Anchor Function Application Function, AF
  • Application Function Application Function
  • the access network device 20 and the core network device 30 communicate with each other through some over-the-air technology, such as the NG interface in the 5G NR system.
  • the access network device 20 and the terminal 10 communicate with each other through some air technology, such as the Uu interface.
  • the embodiment of the present application provides a key management method for generating a communication key between an AF and a terminal located in the home network in a roaming scenario.
  • the communication keys between the same terminal and different AFs may be the same or different.
  • This embodiment of the present application only describes the communication keys between a certain AF located in the home network and the terminal.
  • the key management method provided by the embodiment of the present application there are at least one terminal, at least one AF, at least one AAnF, and at least one proxy entity.
  • the key management method provided by the embodiment of the present application is applied in a roaming scenario, where the AF and AAnF are located in the terminal's home network, and the terminal and the proxy entity are located in the service network.
  • the terminal can be represented by UE, and the proxy entity in the service network can be represented by AAnFProxy; the coverage ranges of the home network and the service network are different, the same, or overlap.
  • the AAnFProxy is a separate network function (Nextwork Function, NF) in the service network; or the AAnFProxy is part of any NF in the service network; or the AAnFProxy is a trusted application within the 3GPP operator domain Function(Trusted AF).
  • NF Nextwork Function
  • the terminal type includes but is not limited to handheld devices, wearable devices, vehicle-mounted devices, Internet of Things devices, etc.
  • the terminal may be a mobile phone, a tablet computer, an e-book reader, a laptop computer, a desktop computer, At least one of a television, a game console, an augmented reality (AR) terminal, a virtual reality (VR) terminal, a mixed reality (MR) terminal, a wearable device, a handle and a controller, etc.
  • AR augmented reality
  • VR virtual reality
  • MR mixed reality
  • Figure 4 shows a flow chart of a key management method provided by an embodiment of the present application. This method is applied in roaming scenarios, and this method can be applied to the system shown in Figure 3.
  • the method includes:
  • Step 402 The terminal sends an application session establishment request to the AF in the home network.
  • the main authentication process between the terminal and the AUSF is passed, so that the terminal and the AUSF locally generate the same KAUSF , KAKMA and A-KID respectively.
  • the main authentication process can refer to the above content and will not be described again.
  • the prerequisites for the AF in the home network to communicate with the terminal are implicitly specific to the terminal and the AF, or are explicitly indicated by the AF to the terminal.
  • the application session establishment request is used to trigger the application session establishment request, and the application session establishment request can be represented by Application Session Establishment Request.
  • the application session establishment request carries the AKMA key identifier and the service network identifier, and the AKMA key identifier can be represented by A-KID.
  • A-KID is the identifier of the AKMA key of the terminal.
  • the service network identifier is used to indicate the service network of the terminal and is used to trigger AAnF in the home network when the service network identifier of the terminal is different from the home network identifier.
  • TS 33.535 stipulates that A-KID should use the home network identifier (Network Access Identifier) specified in clause 2.2 of the Internet Engineering Task Force (IETF) Request For Comments (RFC) 7542 , NAI) format, such as: username@security domain.
  • the username part should include the Routing Indicator (RID) and the AKMA Temporary UE Identifier (A-TID), and the security domain part should include the home network identifier.
  • the application session establishment request carrying the service network identifier of the terminal may include at least the following two situations:
  • the application session establishment request includes the AKMA key identifier of AKMA, and the AKMA key identifier carries the service network identifier;
  • the application session establishment request includes the AKMA key identifier and the service network identifier.
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the application session establishment request includes A-KID.
  • the terminal can also send the service network identifier of the terminal separately before or after the application session establishment request.
  • the service network identifier indicates that a corresponding application session is established. Request or A-KID.
  • Step 404 The AF in the home network sends an application key acquisition request to the AAnF in the home network.
  • the application key acquisition request carries the service network identifier of the terminal. After receiving the application session establishment request sent by the terminal, the AF in the home network will send an application key acquisition request to the AAnF in the home network.
  • the application key acquisition request is used to request the AKMA application key information of the AF in the home network from the AAnF in the home network.
  • step 404 according to different policies in the AF in the home network, the application key acquisition request sent by the AF in the home network to the AAnF in the home network is also different.
  • the AF in the home network sends a first application key acquisition request to the AAnF in the home network.
  • the first application key acquisition request may be represented by Naanf_AKMA_ApplicationKey_Get Request.
  • the first application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key, and the AF identifier is the identifier of the AF in the home network.
  • the AKMA key identifier can be represented by A-KID
  • the AF identifier can be represented by AF_ID.
  • the A-KID is obtained from the terminal by the AF in the home network.
  • AF_ID contains AF's fully qualified domain name (Fully Qualified Domain Name, FQDN) and Ua* security protocol identifier.
  • the Ua* security protocol identifier is used to indicate the security protocol that the AF will use with the UE.
  • the first application key acquisition request includes an AKMA key identifier and a service network identifier (which may also include an AF identifier).
  • the AKMA key identifier carries the service network identifier; or the first application key acquisition request carries the service network identifier through a separate field. That is, the first application key acquisition request can carry the service network identifier through the above two methods.
  • the AF in the home network When the AF in the home network does not need the terminal identification, the AF in the home network sends a second application key acquisition request to the AAnF in the home network.
  • the second application key acquisition request may be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Request.
  • the second application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key
  • the AF identifier is the identifier of the AF in the home network.
  • the second application key acquisition request includes an AKMA key identifier and a service network identifier (which may also include an AF identifier).
  • the AKMA key identifier carries the service network identifier; or the second application key acquisition request carries the service network identifier through a separate field. That is, the second application key acquisition request can carry the service network identifier through the above two methods.
  • whether the AF in the home network requires terminal identification is indicated by the policy in the AF in the home network.
  • the AKMA key identifier is in the Network Access Identifier NAI format.
  • NAI Network Access Identifier
  • TS 33.535 stipulates that A-KID should adopt the Network Access Identifier (NAI) format specified in clause 2.2 of IETF RFC 7542, such as: username@security domain.
  • the username part should include the Routing Indicator (RID) and the AKMA Temporary UE Identifier (A-TID), and the security domain part should include the home network identifier.
  • the AF in the home network before performing step 103, the AF in the home network also needs to determine the AAnF in the home network. For example, the AF in the home network discovers the AAnF in the home network through the NRF in the home network.
  • Step 406 The AAnF in the home network generates the AKMA application key of the AF in the home network based on the AKMA key of the terminal.
  • the AKMA Application Key (K AF ) is used to indicate the communication key between the terminal and the AF in the home network.
  • the AKMA application key is generated based on the AKMA key of the terminal. Therefore, the following conditions need to be met to perform step 406: the AAnF in the home network stores the AKMA key of the terminal.
  • the AKMA application key can be obtained in the following manner: the AAnF in the home network obtains the A-KID and AF_ID according to the application key acquisition request. Afterwards, the AAnF in the home network can generate the AKMA application key based on the AKMA key and AF_ID.
  • the AAnF in the home network can verify whether the terminal is authorized to use the AKMA service based on the existence of the AKMA key of the terminal corresponding to the A-KID.
  • the AAnF in the home network before performing step 406, the AAnF in the home network also needs to perform the following steps: determine, based on the authorization information or policy, that the AAnF in the home network provides services to the AF in the home network and the proxy entity in the serving network.
  • authorization information or policies are provided by local policies or NRF in the home network.
  • the AAnF in the home network determines whether the AAnF in the home network can provide services to the AF in the home network and the proxy entity in the serving network based on the authorization information or policy associated with the AF_ID.
  • the AAnF in the home network executes step 406; the AAnF in the home network cannot provide services to the AF in the home network.
  • the AAnF in the home network may refuse to perform step 406 and feed back an error response to the AF in the home network.
  • Step 408 The AAnF in the home network feeds back the application key acquisition response to the AF in the home network.
  • the application key acquisition response includes the AKMA application key information of the AF in the home network.
  • the AKMA application key information includes at least one of the following:
  • the AAnF in the home network will feed back an error response to the AF in the home network.
  • the application key acquisition request sent by the AF in the home network to the AAnF in the home network may be different.
  • the application key acquisition response sent by the AAnF in the home network to the AF in the visiting home network is also different.
  • the AAnF in the home network will receive the first application key acquisition request. After generating the AKMA application key, the AAnF in the home network sends a first application key acquisition response to the AF in the home network.
  • the first application key acquisition response may be expressed using Naanf_AKMA_ApplicationKey_Get Response.
  • the AKMA application key information of the AF carried in the first application key acquisition response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and the SUPI of the terminal.
  • the expiration time of the AKMA application key can be expressed using K AF expTime.
  • the AAnF in the home network will receive the second application key acquisition request. After generating the AKMA application key, the AAnF in the home network sends a second application key acquisition response to the AF in the home network.
  • the second application key acquisition response may be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Response.
  • the AKMA application key information fed back by the AAnF in the home network does not include the SUPI of the terminal, that is, the second application key acquisition response Does not include SUPI for terminals.
  • the AKMA application key information of the AF carried in the second application key acquisition response includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • Step 410 The AAnF in the home network sends an application key confirmation request to the proxy entity in the serving network.
  • the application key confirmation request can be represented by AKMA Application Key Comfirmation Request.
  • the AAnF in the home network will send an application key confirmation request to the proxy entity in the serving network. If the serving network identifier of the terminal is the same as the home network identifier, step 410 will not be executed, but step 414 will be executed directly after step 408.
  • the AAnF in the home network sends an application key confirmation request to the proxy entity in the serving network before, after or at the same time as the AAnF in the home network feeds back the application key acquisition response to the AF in the home network.
  • the application key confirmation request includes at least one of the following:
  • the AF identifier is the identifier of the AF in the home network
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the AKMA key identifier stores the home network identifier of the terminal.
  • the AAnF in the home network needs to first determine the proxy entity in the service network in the network element of the service network, and then it can request the service network to the service network.
  • the proxy entity in sends an application key confirmation request.
  • the AAnF in the home network discovers the proxy entity in the serving network through the NRF in the serving network and the home network in the network element of the serving network. .
  • the NRF in the home network is represented by hNRF
  • the NRF in the service network is represented by vNRF.
  • the process of AAnF in the home network discovering the proxy entity in the service network can be implemented as follows: AAnF in the home network passes through the service network The identifier determines the hNRF; the hNRF can determine the vNRF based on the service network identifier transmitted by the AAnF in the home network; the vNRF determines that the AAnF in the home network has the right to serve the AF in the home network based on the preset policy, and then authorizes the AF in the home network AAnF accesses the proxy entity in the service network.
  • the information of the proxy entity in the serving network is configured locally on the AAnF in the home network. At this time, the AAnF in the home network does not need to discover the proxy entity in the service network through NRF.
  • the proxy entity in the service network is a separate NF in the service network; or the proxy entity in the service network is part of any NF in the service network; or the proxy entity in the service network is an available NF within the 3GPP operator domain.
  • Letter application function is a separate NF in the service network; or the proxy entity in the service network is part of any NF in the service network; or the proxy entity in the service network is an available NF within the 3GPP operator domain.
  • Step 412 The proxy entity in the serving network sends an application key confirmation response to the AAnF in the home network.
  • the application key confirmation response can be represented by AKMA Application Key Confirmation Response.
  • the application key confirmation response is used by the proxy entity in the serving network to notify the AAnF in the home network that it has learned that the terminal and the AF in the home network can establish AKMA-based communication, as well as related AKMA application key information.
  • the proxy entity in the service network will store the application key confirmation request, and then send the application key confirmation response to the AAnF in the home network. .
  • Step 414 The AF in the home network feeds back the application session establishment response to the terminal.
  • the application session establishment response corresponds to the application session establishment request and is used to feed back the AKMA application key information of the AF in the home network, which can be represented by Application Session Establishment Response.
  • the terminal After receiving the application session establishment response, the terminal can determine the AKMA application key based on the AKMA application key information of the AF carried in the application session establishment response.
  • the AAnF in the home network does not carry the AKMA key of the terminal.
  • the AAnF in the home network sends an error response to the AF in the home network.
  • the AF in the home network will feed back application session rejection information to the terminal, and the rejection information includes the reason for the response failure. Based on this, the AF in the home network refuses to establish the application session by including the response failure reason.
  • the terminal can resend the application session establishment request, and the application session establishment request carries the new A-KID and/or serving network identification. symbol.
  • the steps on the UE side can independently become an embodiment of the key management method applied in the terminal, and the steps on the AAnF side in the home network can independently become an application.
  • the steps on the AF side in the home network may alone become an embodiment of the key management method in the AF in the home network, in the serving network
  • the steps on the proxy entity side may alone become an embodiment of the key management method applied in the proxy entity in the service network.
  • the terminal in the roaming scenario, sends the service network identifier to the AF in the home network, and the AF in the home network sends the service network identifier carrying the service network identifier to the AAnF in the home network.
  • the AAnF in the home network determines that the terminal is in a roaming scenario based on the service network identifier, and can determine the proxy entity in the service network in the network element of the service network and send the application to it.
  • the key confirmation request enables relevant network elements in the serving network to know that the terminal and the AF in the home network can establish AKMA-based communication, thereby providing AKMA services in roaming scenarios.
  • Figure 5 shows a flow chart of a key management method provided by an embodiment of the present application. This method is applied in roaming scenarios, and this method can be applied to proxy entities in the service network. The method includes:
  • Step 502 Receive the application key confirmation request sent by the AAnF in the home network.
  • the application key confirmation request can be represented by AKMA Application Key Comfirmation Request.
  • the application key confirmation request is that the AAnF in the home network determines the AKMA application key of the AF in the home network based on the application key acquisition request sent by the AF in the home network, and feeds back the application key to the AF in the home network. In the case of key acquisition response, it is sent by the AAnF in the home network to the proxy entity in the serving network.
  • the application key confirmation request is used by the AAnF in the home network to notify the proxy entity in the serving network that in a roaming scenario, the terminal and the AF in the home network can establish AKMA-based communication, as well as related AKMA application key information.
  • the application key confirmation request is sent by the AAnF in the home network to the proxy entity in the service network when the service network identifier of the terminal is different from the home network identifier, that is, when the terminal is roaming.
  • the terminal will send the service network identifier to the AF in the home network.
  • the application key acquisition request sent by the AF in the home network to the AAnF in the home network carries the service network identifier.
  • the AAnF in the home network will use the service network identifier The identifier can determine whether the terminal is roaming.
  • the AKMA key identifier stores the service network identifier of the terminal.
  • the terminal sends the AKMA key identifier to the AF in the home network, thereby sending the service network identifier to the AF in the home network.
  • the service network identifier of the terminal can also be sent directly by the terminal to the AF in the home network.
  • the terminal sends an application session establishment request to the AF in the home network.
  • the application session establishment request includes the AKMA key identifier and the serving network identifier.
  • the terminal sends the service network identifier separately before or after sending the application session establishment request to the AF in the home network.
  • the serving network identifier is used to trigger the AAnF in the home network to send an application key confirmation request to the proxy entity in the serving network when the serving network identifier of the terminal is different from the home network identifier.
  • the application key confirmation request includes at least one of the following:
  • the AF identifier is the identifier of the AF in the home network
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the AKMA key identifier stores the home network identifier of the terminal.
  • the proxy entity in the service network after receiving the application key confirmation request sent by the AAnF in the home network, the proxy entity in the service network also sends an application key confirmation response to the AAnF in the home network.
  • the proxy entity in the service network will first store the application key confirmation request, and then send the application key confirmation response to the AAnF in the home network.
  • the application key confirmation response can be represented by AKMA Application Key Confirmation Response.
  • the proxy entity in the serving network is determined by the AAnF in the home network in the network element of the serving network when the serving network identifier of the terminal is different from the home network identifier.
  • the proxy entity in the service network is stored in the network element of the service network by the AAnF in the home network through the network storage in the service network and the home network.
  • the information of the proxy entity in the serving network is configured locally on the AAnF in the home network. At this time, the AAnF in the home network does not need to discover the proxy entity in the service network through NRF.
  • the proxy entity in the service network is a separate NF in the service network; or the proxy entity in the service network is part of any NF in the service network; or the proxy entity in the service network is an available NF within the 3GPP operator domain.
  • Letter application function is a separate NF in the service network; or the proxy entity in the service network is part of any NF in the service network; or the proxy entity in the service network is an available NF within the 3GPP operator domain.
  • the method provided by this embodiment enables the AAnF in the home network to send an application key confirmation request to the proxy entity in the service network in the roaming scenario, so that the relevant network elements in the service network can learn about the location of the terminal.
  • AKMA-based communication can be established with the AF in the home network, thereby providing AKMA services in the roaming scenario.
  • Figure 6 shows a flow chart of a key management method provided by an embodiment of the present application. This method is applied in roaming scenarios, and this method can be applied to AF in the home network. The method includes:
  • Step 602 Receive the service network identifier and AKMA key identifier sent by the terminal.
  • the service network identifier is used to indicate the service network of the terminal.
  • the service network identifier is used to trigger the AAnF in the home network to send the service network identifier to the service network when the service network identifier of the terminal is different from the home network identifier.
  • the proxy entity sends an application key confirmation request.
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the terminal moves from the coverage area of the home network to the coverage area of the serving network.
  • the terminal sends a service network identifier to the AF in the home network.
  • the service network identifier corresponds to the service network. From this, it can be determined that the terminal is in a roaming scenario.
  • the serving network identifier may be sent separately by the terminal to the AF in the home network, or may be carried in the application session establishment request sent by the terminal to the AF in the home network.
  • the AF in the home network receives an application session establishment request sent by the terminal, and the application session establishment request carries the service network identifier.
  • the service network identifier may be carried by the AKMA key identifier in the application session establishment request, or may be carried by a dedicated field.
  • the application session establishment request includes the AKMA key identifier of AKMA, and the AKMA key identifier carries the service network identifier; or the application session establishment request includes the AKMA key identifier and the service network identifier.
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the application session establishment request is used to trigger the application session establishment request.
  • the application session establishment request can be represented by Application Session Establishment Request.
  • Step 604 Send an application key acquisition request to the AAnF in the home network.
  • the application key acquisition request carries the service network identifier of the terminal. After receiving the service network identifier (application session establishment request) sent by the terminal, the AF in the home network will send an application key acquisition request to the AAnF in the home network.
  • the application key acquisition request is used to request the AKMA application key information of the AF in the home network from the AAnF in the home network.
  • the application key acquisition request sent by the AF in the home network to the AAnF in the home network is also different.
  • the AF in the home network sends a first application key acquisition request to the AAnF in the home network.
  • the first application key acquisition request may be represented by Naanf_AKMA_ApplicationKey_Get Request.
  • the first application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key, and the AF identifier is the identifier of the AF in the home network.
  • the first application key acquisition request includes an AKMA key identifier and a service network identifier (which may also include an AF identifier).
  • the AKMA key identifier carries the service network identifier; or the first application key acquisition request carries the service network identifier through a separate field. That is, the first application key acquisition request can carry the service network identifier through the above two methods.
  • the AF in the home network When the AF in the home network does not need the terminal identification, the AF in the home network sends a second application key acquisition request to the AAnF in the home network.
  • the second application key acquisition request may be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Request.
  • the second application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key, and the AF identifier is the identifier of the AF in the home network.
  • the second application key acquisition request includes an AKMA key identifier and a service network identifier (which may also include an AF identifier).
  • the AKMA key identifier carries the service network identifier; or the second application key acquisition request carries the service network identifier through a separate field. That is, the second application key acquisition request can carry the service network identifier through the above two methods.
  • whether the AF in the home network requires terminal identification is indicated by the policy in the AF in the home network.
  • the AKMA key identifier is in the Network Access Identifier NAI format.
  • the AF in the home network also needs to determine the AAnF in the home network. For example, the AF in the home network discovers the AAnF in the home network through the NRF in the home network.
  • Step 606 Receive the application key acquisition response fed back by the AAnF in the home network.
  • the application key acquisition response includes the AKMA application key information of the AF in the home network.
  • the AAnF in the home network stores the AKMA key of the terminal
  • the AAnF in the home network will generate the AKMA application key of the AF in the home network based on the AKMA key of the terminal.
  • the AKMA application key is used to indicate the communication key between the terminal and the AF in the home network.
  • the above-mentioned AKMA application key information includes at least one of the following:
  • step 604 the application key acquisition request sent by the AF in the home network to the AAnF in the home network may be different.
  • the application key acquisition response sent by the AAnF in the home network to the AF in the visiting home network is also different.
  • the AAnF in the home network will receive the first application key acquisition request. After generating the AKMA application key, the AAnF in the home network sends a first application key acquisition response to the AF in the home network.
  • the first application key acquisition response may be expressed using Naanf_AKMA_ApplicationKey_Get Response.
  • the AKMA application key information of the AF carried in the first application key acquisition response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and the SUPI of the terminal.
  • the expiration time of the AKMA application key can be expressed using K AF expTime.
  • the AAnF in the home network will receive the second application key acquisition request. After generating the AKMA application key, the AAnF in the home network sends a second application key acquisition response to the AF in the home network.
  • the second application key acquisition response may be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Response.
  • the AKMA application key information fed back by the AAnF in the home network does not include the SUPI of the terminal, that is, the second application key acquisition response Does not include SUPI for terminals.
  • the AKMA application key information of the AF carried in the second application key acquisition response includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • the AF in the home network When the AF in the home network receives the application session establishment request sent by the terminal, it will obtain a response based on the above application key and feed back the application session establishment response to the terminal.
  • the AF in the home network will receive an error response fed back by the AAnF in the home network, and the error response is the AAnF in the home network. Sent when the AKMA key of the terminal is not stored in . In this case, the AF in the home network will send an error response to the terminal. For example, when receiving an error response fed back by the AAnF in the home network, the AF in the home network will feed back application session rejection information to the terminal, and the rejection information includes the reason for the response failure.
  • the terminal in the roaming scenario, sends the service network identifier to the AF in the home network, and the AF in the home network sends the service network identifier carrying the service network identifier to the AAnF in the home network.
  • application key acquisition request of the symbol so that when the AAnF in the home network determines that the terminal is in a roaming scenario based on the service network identifier, it can send an application key confirmation request to the proxy entity in the service network, so that the relevant AAnF in the service network
  • the network element learns that the terminal and the AF in the home network can establish AKMA-based communication, thereby providing AKMA services in roaming scenarios.
  • Figure 7 shows a flow chart of a key management method provided by an embodiment of the present application. This method is applied in roaming scenarios, and this method can be applied to AAnF in the home network. The method includes:
  • Step 702 Receive an application key acquisition request sent by the AF in the home network.
  • the application key acquisition request carries the service network identifier.
  • the application key acquisition request carries the service network identifier of the terminal.
  • the serving network identifier is used to trigger the AAnF in the home network to send an application key confirmation request to the proxy entity in the serving network when the serving network identifier of the terminal is different from the home network identifier.
  • the AF in the home network After receiving the application session establishment request sent by the terminal, the AF in the home network will send an application key acquisition request to the AAnF in the home network.
  • the application key acquisition request is used to request the AKMA application key information of the AF in the home network from the AAnF in the home network.
  • the application key acquisition request sent by the AF in the home network to the AAnF in the home network is also different.
  • the AF in the home network sends a first application key acquisition request to the AAnF in the home network.
  • the first application key acquisition request may be represented by Naanf_AKMA_ApplicationKey_Get Request.
  • the first application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key, and the AF identifier is the identifier of the AF in the home network.
  • the AKMA key identifier can be represented by A-KID, and the AF identifier can be represented by AF_ID.
  • the first application key acquisition request includes an AKMA key identifier and a service network identifier (which may also include an AF identifier).
  • the AKMA key identifier carries the service network identifier; or the first application key acquisition request carries the service network identifier through a separate field. That is, the first application key acquisition request can carry the service network identifier through the above two methods.
  • the AF in the home network When the AF in the home network does not need the terminal identification, the AF in the home network sends a second application key acquisition request to the AAnF in the home network.
  • the second application key acquisition request may be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Request.
  • the second application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key, and the AF identifier is the identifier of the AF in the home network.
  • the second application key acquisition request includes an AKMA key identifier and a service network identifier (which may also include an AF identifier).
  • the AKMA key identifier carries the service network identifier; or the second application key acquisition request carries the service network identifier through a separate field. That is, the second application key acquisition request can carry the service network identifier through the above two methods.
  • whether the AF in the home network requires terminal identification is indicated by the policy in the AF in the home network.
  • the AKMA key identifier is in the Network Access Identifier NAI format.
  • the AF in the home network before performing step 702, the AF in the home network also needs to determine the AAnF in the home network. For example, the AF in the home network discovers the AAnF in the home network through the NRF in the home network.
  • Step 704 Generate the AKMA application key of the AF in the home network based on the AKMA key of the terminal.
  • the AKMA application key is used to indicate the communication key between the terminal and the AF in the home network.
  • the AKMA application key is generated based on the AKMA key of the terminal. Therefore, when the AAnF in the home network stores the AKMA key of the terminal, the AAnF in the home network generates the AKMA application key of the AF in the home network based on the AKMA key of the terminal.
  • the AKMA application key can be obtained in the following manner: the AAnF in the home network obtains the A-KID and AF_ID according to the application key acquisition request. Afterwards, the AAnF in the home network can generate the AKMA application key based on the AKMA key and AF_ID.
  • the AAnF in the home network can verify whether the terminal is authorized to use the AKMA service based on the existence of the AKMA key of the terminal corresponding to the A-KID.
  • the AAnF in the home network before performing step 704, the AAnF in the home network also needs to perform the following steps: determine, based on the authorization information or policy, that the AAnF in the home network provides services to the AF in the home network and the proxy entity in the serving network.
  • authorization information or policies are provided by local policies or NRF in the home network.
  • the AAnF in the home network determines whether the AAnF in the home network can provide services to the AF in the home network and the proxy entity in the serving network based on the authorization information or policy associated with the AF_ID.
  • the AAnF in the home network executes step 704; the AAnF in the home network cannot provide services to the AF in the home network.
  • the AAnF in the home network may refuse to perform step 704 and feed back an error response to the AF in the home network.
  • Step 706 Feed back the application key acquisition response to the AF in the home network.
  • the application key acquisition response includes the AKMA application key information of the AF in the home network.
  • the AKMA application key information includes at least one of the following:
  • the AAnF in the home network will feed back an error response to the AF in the home network.
  • the application key acquisition request sent by the AF in the home network to the AAnF in the home network may be different.
  • the application key acquisition response sent by the AAnF in the home network to the AF in the visiting home network is also different.
  • the AAnF in the home network will receive the first application key acquisition request. After generating the AKMA application key, the AAnF in the home network sends a first application key acquisition response to the AF in the home network.
  • the first application key acquisition response may be expressed using Naanf_AKMA_ApplicationKey_Get Response.
  • the AKMA application key information of the AF carried in the first application key acquisition response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and the SUPI of the terminal.
  • the expiration time of the AKMA application key can be expressed using K AF expTime.
  • the AAnF in the home network will receive the second application key acquisition request. After generating the AKMA application key, the AAnF in the home network sends a second application key acquisition response to the AF in the home network.
  • the second application key acquisition response may be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Response.
  • the AKMA application key information fed back by the AAnF in the home network does not include the SUPI of the terminal, that is, the second application key acquisition response Does not include SUPI for terminals.
  • the AKMA application key information of the AF carried in the second application key acquisition response includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • Step 708 Send an application key confirmation request to the proxy entity in the service network.
  • the application key confirmation request can be represented by AKMA Application Key Comfirmation Request.
  • the AAnF in the home network will send an application key confirmation request to the proxy entity in the serving network.
  • the application key confirmation request includes at least one of the following:
  • the AF identifier is the identifier of the AF in the home network
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the AKMA key identifier stores the home network identifier of the terminal.
  • the AAnF in the home network needs to first determine the proxy entity in the service network in the network element of the service network, and then it can request the service network to the service network.
  • the proxy entity in sends an application key confirmation request.
  • the AAnF in the home network discovers the proxy entity in the serving network through the NRF in the serving network and the home network in the network element of the serving network. .
  • the proxy entity in the service network is a separate NF in the service network; or the proxy entity in the service network is part of any NF in the service network; or the proxy entity in the service network is an available NF within the 3GPP operator domain.
  • Letter application function is a separate NF in the service network; or the proxy entity in the service network is part of any NF in the service network; or the proxy entity in the service network is an available NF within the 3GPP operator domain.
  • the AAnF in the home network after the AAnF in the home network sends an application key confirmation request to the proxy entity in the service network, it will also receive an application key confirmation response sent by the proxy entity in the service network.
  • the application key confirmation response can be represented by AKMA Application Key Confirmation Response.
  • the proxy entity in the service network after receiving the application key confirmation request sent by the AAnF in the home network, the proxy entity in the service network will store the application key confirmation request, and then send the application key confirmation response to the AAnF in the home network. .
  • the method provided by this embodiment receives the application key acquisition request carrying the service network identifier sent by the AF in the home network, so that the AAnF in the home network can obtain the application key according to the service network identifier.
  • the agent entity in the service network can be determined in the network element of the service network and an application key confirmation request is sent to it, so that the relevant network elements in the service network can know the identity of the terminal and the home network.
  • AF can establish AKMA-based communication to provide AKMA services in roaming scenarios.
  • Figure 8 shows a flow chart of a key management method provided by an embodiment of the present application. This method is applied in roaming scenarios, and this method can be applied to terminals. The method includes:
  • Step 802 Send the serving network identifier and the AKMA key identifier to the AF in the home network.
  • the service network identifier is used to indicate the service network of the terminal.
  • the service network identifier is used to trigger the AAnF in the home network to send a message to the proxy entity in the service network when the service network identifier of the terminal is different from the home network identifier.
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the terminal moves from the coverage area of the home network to the coverage area of the serving network.
  • the terminal sends a service network identifier to the AF in the home network.
  • the service network identifier corresponds to the service network. From this, it can be determined that the terminal is in a roaming scenario.
  • the serving network identifier may be sent separately by the terminal to the AF in the home network, or may be carried in the application session establishment request sent by the terminal to the AF in the home network.
  • the AF in the home network receives an application session establishment request sent by the terminal, and the application session establishment request carries the service network identifier.
  • the service network identifier may be carried by the AKMA key identifier in the application session establishment request, or may be carried by a dedicated field.
  • the application session establishment request includes the AKMA key identifier of AKMA, and the AKMA key identifier carries the service network identifier; or the application session establishment request includes the AKMA key identifier and the service network identifier.
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the application session establishment request is used to trigger the application session establishment request.
  • the application session establishment request can be represented by Application Session Establishment Request.
  • the AF in the home network After the terminal sends an application session establishment request to the AF in the home network, the AF in the home network sends an application key acquisition request to the AAnF in the home network.
  • the application key acquisition request carries the service network identifier of the terminal.
  • the AAnF in the home network generates the AKMA application key of the AF in the home network based on the terminal's AKMA key, and feeds back the application key to the AF in the home network to obtain a response, so that the AF in the home network feeds back the application to the terminal. Session establishment response.
  • the AAnF in the home network will send an application key confirmation request to the proxy entity in the serving network.
  • the application key confirmation request is used by the AAnF in the home network to notify the proxy entity in the serving network that in a roaming scenario, the terminal and the AF in the home network can establish AKMA-based communication, as well as related AKMA application key information.
  • the method provided by this embodiment uses the terminal to send the service network identifier to the AF in the home network in the roaming scenario, so that the AAnF in the home network determines that the terminal is in the roaming scenario based on the service network identifier. , can send an application key confirmation request to the proxy entity in the service network, so that the relevant network elements in the service network know that the terminal and the AF in the home network can establish AKMA-based communication, thereby providing AKMA services in roaming scenarios.
  • Figure 9 shows a flow chart of a key management method provided by an exemplary embodiment of the present application, which is applied in a roaming scenario.
  • the method includes:
  • Step 902 The terminal sends the serving network identifier and the AKMA key identifier to the AF in the home network.
  • the service network identifier is used to indicate the service network of the terminal.
  • the service network identifier is used to trigger the AAnF in the home network to send a message to the proxy entity in the service network when the service network identifier of the terminal is different from the home network identifier.
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the terminal moves from the coverage area of the home network to the coverage area of the serving network.
  • the terminal sends a service network identifier to the AF in the home network.
  • the service network identifier corresponds to the service network. From this, it can be determined that the terminal is in a roaming scenario.
  • the serving network identifier may be sent separately by the terminal to the AF in the home network, or may be carried in the application session establishment request sent by the terminal to the AF in the home network.
  • the AF in the home network receives an application session establishment request sent by the terminal, and the application session establishment request carries the service network identifier.
  • the service network identifier may be carried by the AKMA key identifier in the application session establishment request, or may be carried by a dedicated field.
  • the application session establishment request includes the AKMA key identifier of AKMA, and the AKMA key identifier carries the service network identifier; or the application session establishment request includes the AKMA key identifier and the service network identifier.
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the application session establishment request is used to trigger the application session establishment request.
  • the application session establishment request can be represented by Application Session Establishment Request.
  • Step 904 The AF in the home network sends an application key acquisition request to the AAnF in the home network.
  • the application key acquisition request carries the service network identifier of the terminal. After receiving the application session establishment request sent by the terminal, the AF in the home network will send an application key acquisition request to the AAnF in the home network.
  • the application key acquisition request is used to request the AKMA application key information of the AF in the home network from the AAnF in the home network.
  • step 904 according to different policies in the AF in the home network, the application key acquisition request sent by the AF in the home network to the AAnF in the home network is also different.
  • the AF in the home network sends a first application key acquisition request to the AAnF in the home network.
  • the first application key acquisition request may be represented by Naanf_AKMA_ApplicationKey_Get Request.
  • the first application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key, and the AF identifier is the identifier of the AF in the home network.
  • the first application key acquisition request includes an AKMA key identifier and a service network identifier (which may also include an AF identifier).
  • the AKMA key identifier carries the service network identifier; or the first application key acquisition request carries the service network identifier through a separate field. That is, the first application key acquisition request can carry the service network identifier through the above two methods.
  • the AF in the home network When the AF in the home network does not need the terminal identification, the AF in the home network sends a second application key acquisition request to the AAnF in the home network.
  • the second application key acquisition request may be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Request.
  • the second application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key, and the AF identifier is the identifier of the AF in the home network.
  • the second application key acquisition request includes an AKMA key identifier and a service network identifier (which may also include an AF identifier).
  • the AKMA key identifier carries the service network identifier; or the second application key acquisition request carries the service network identifier through a separate field. That is, the second application key acquisition request can carry the service network identifier through the above two methods.
  • whether the AF in the home network requires terminal identification is indicated by the policy in the AF in the home network.
  • the AKMA key identifier is in the Network Access Identifier NAI format.
  • the AF in the home network before performing step 904, the AF in the home network also needs to determine the AAnF in the home network. For example, the AF in the home network discovers the AAnF in the home network through the NRF in the home network.
  • Step 906 The AAnF in the home network generates the AKMA application key of the AF in the home network based on the AKMA key of the terminal.
  • the AKMA application key is used to indicate the communication key between the terminal and the AF in the home network.
  • the AKMA application key is generated based on the AKMA key of the terminal. Therefore, the following conditions need to be met to perform step 906: the AAnF in the home network stores the AKMA key of the terminal.
  • the AKMA application key can be obtained in the following manner: the AAnF in the home network obtains the A-KID and AF_ID according to the application key acquisition request. Afterwards, the AAnF in the home network can generate the AKMA application key based on the AKMA key and AF_ID.
  • the AAnF in the home network can verify whether the terminal is authorized to use the AKMA service based on the existence of the AKMA key of the terminal corresponding to the A-KID.
  • the AAnF in the home network before performing step 906, the AAnF in the home network also needs to perform the following steps: determine, based on the authorization information or policy, that the AAnF in the home network provides services to the AF in the home network and the proxy entity in the serving network.
  • authorization information or policies are provided by local policies or NRF in the home network.
  • the AAnF in the home network determines whether the AAnF in the home network can provide services to the AF in the home network and the proxy entity in the serving network based on the authorization information or policy associated with the AF_ID.
  • the AAnF in the home network when the AAnF in the home network can provide services to the AF in the home network and the proxy entity in the serving network, the AAnF in the home network performs step 906; the AAnF in the home network cannot provide services to the AF in the home network.
  • the AAnF in the home network may refuse to perform step 906 and feed back an error response to the AF in the home network.
  • Step 908 The AAnF in the home network feeds back the application key acquisition response to the AF in the home network.
  • the application key acquisition response includes the AKMA application key information of the AF in the home network.
  • the AKMA application key information includes at least one of the following:
  • the AAnF in the home network will feed back an error response to the AF in the home network.
  • the application key acquisition request sent by the AF in the home network to the AAnF in the home network may be different.
  • the application key acquisition response sent by the AAnF in the home network to the AF in the visiting home network is also different.
  • the AAnF in the home network will receive the first application key acquisition request. After generating the AKMA application key, the AAnF in the home network sends a first application key acquisition response to the AF in the home network.
  • the first application key acquisition response may be expressed using Naanf_AKMA_ApplicationKey_Get Response.
  • the AKMA application key information of the AF carried in the first application key acquisition response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and the SUPI of the terminal.
  • the expiration time of the AKMA application key can be expressed using K AF expTime.
  • the AAnF in the home network will receive the second application key acquisition request. After generating the AKMA application key, the AAnF in the home network sends a second application key acquisition response to the AF in the home network.
  • the second application key acquisition response may be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Response.
  • the AKMA application key information fed back by the AAnF in the home network does not include the SUPI of the terminal, that is, the second application key acquisition response Does not include SUPI for terminals.
  • the AKMA application key information of the AF carried in the second application key acquisition response includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • Step 910 The AAnF in the home network sends an application key confirmation request to the proxy entity in the serving network.
  • the application key confirmation request can be represented by AKMA Application Key Comfirmation Request.
  • the AAnF in the home network will send an application key confirmation request to the proxy entity in the serving network.
  • the application key confirmation request includes at least one of the following:
  • the AF identifier is the identifier of the AF in the home network
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the AKMA key identifier stores the home network identifier of the terminal.
  • the AAnF in the home network needs to first determine the proxy entity in the service network in the network element of the service network, and then it can request the service network to the service network.
  • the proxy entity in sends an application key confirmation request.
  • the AAnF in the home network discovers the proxy entity in the serving network through the NRF in the serving network and the home network in the network element of the serving network. .
  • the NRF in the home network is represented by hNRF
  • the NRF in the service network is represented by vNRF.
  • the process of AAnF in the home network discovering the proxy entity in the service network can be implemented as follows: AAnF in the home network passes through the service network The identifier determines the hNRF; the hNRF can determine the vNRF based on the service network identifier transmitted by the AAnF in the home network; the vNRF determines that the AAnF in the home network has the right to serve the AF in the home network based on the preset policy, and then authorizes the AF in the home network AAnF accesses the proxy entity in the service network.
  • the information of the proxy entity in the serving network is configured locally on the AAnF in the home network. At this time, the AAnF in the home network does not need to discover the proxy entity in the service network through NRF.
  • the proxy entity in the service network is a separate NF in the service network; or the proxy entity in the service network is part of any NF in the service network; or the proxy entity in the service network is an available NF within the 3GPP operator domain.
  • Letter application function is a separate NF in the service network; or the proxy entity in the service network is part of any NF in the service network; or the proxy entity in the service network is an available NF within the 3GPP operator domain.
  • the proxy entity in the service network after receiving the application key confirmation request sent by the AAnF in the home network, the proxy entity in the service network also sends an application key confirmation response to the AAnF in the home network.
  • the application key confirmation response can be represented by AKMA Application Key Confirmation Response.
  • the application key confirmation response is used by the proxy entity in the serving network to notify the AAnF in the home network that it has learned that the terminal and the AF in the home network can establish AKMA-based communication, as well as related AKMA application key information.
  • the proxy entity in the service network after receiving the application key confirmation request sent by the AAnF in the home network, the proxy entity in the service network will store the application key confirmation request, and then send the application key confirmation response to the AAnF in the home network. .
  • the AF in the home network after receiving the application key acquisition response fed back by the AAnF in the home network, the AF in the home network also feeds back an application session establishment response to the terminal.
  • the application session establishment response corresponds to the application session establishment request and is used to feed back the AKMA application key information of the AF in the home network, which can be represented by Application Session Establishment Response.
  • the terminal After receiving the application session establishment response, the terminal can determine the AKMA application key based on the AKMA application key information of the AF carried in the application session establishment response.
  • the AAnF in the home network does not carry the AKMA key of the terminal.
  • the AAnF in the home network sends an error response to the AF in the home network.
  • the AF in the home network will feed back application session rejection information to the terminal, and the rejection information includes the reason for the response failure. Based on this, the AF in the home network refuses to establish the application session by including the response failure reason.
  • the terminal can resend the application session establishment request, and the application session establishment request carries the new A-KID and/or serving network identification. symbol.
  • the steps on the UE side can independently become an embodiment of the key management method applied in the terminal, and the steps on the AAnF side in the home network can independently become an application.
  • the steps on the AF side in the home network may alone become an embodiment of the key management method in the AF in the home network, in the serving network
  • the steps on the proxy entity side may alone become an embodiment of the key management method applied in the proxy entity in the service network.
  • the terminal in the roaming scenario, sends the service network identifier to the AF in the home network, and the AF in the home network sends the service network identifier carrying the service network identifier to the AAnF in the home network.
  • the AAnF in the home network determines that the terminal is in a roaming scenario based on the service network identifier, and can determine the proxy entity in the service network in the network element of the service network and send the application to it.
  • the key confirmation request enables relevant network elements in the serving network to know that the terminal and the AF in the home network can establish AKMA-based communication, thereby providing AKMA services in roaming scenarios.
  • the AKMA application key information includes at least one of the following: the AKMA application key of the AF in the home network; the expiration time of the AKMA application key; and the SUPI of the terminal. This situation is realized when the AF in the home network requires terminal identification.
  • the AKMA application key information includes at least one of the following: the AKMA application key of the AF in the service network; and the expiration time of the AKMA application key. This situation is realized when the AF in the home network does not require terminal identification.
  • Figure 10 shows a flow chart of a key management method provided by an exemplary embodiment of the present application, applied in a roaming scenario.
  • the method includes:
  • Step 1002 The terminal sends an application session establishment request to the AF in the home network.
  • the application session establishment request is used to trigger the application session establishment request.
  • the application session establishment request can be represented by Application Session Establishment Request.
  • the application session establishment request carries the AKMA key identifier and the service network identifier, and the AKMA key identifier can be represented by A-KID.
  • the A-KID is used to indicate the identifier of the AKMA key of the terminal, and the service network identifier is used to indicate the service network of the terminal.
  • the application session establishment request carrying the service network identifier of the terminal may include at least the following two situations:
  • the application session establishment request includes the AKMA key identifier of AKMA, and the AKMA key identifier carries the service network identifier;
  • the application session establishment request includes the AKMA key identifier and the service network identifier.
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the application session establishment request includes A-KID
  • the terminal can also send the terminal's service network identifier before or after the application session establishment request.
  • the service network identifier indicates that there is a corresponding application session establishment request. Or A-KID.
  • Step 1004 The AF in the home network sends a first application key acquisition request to the AAnF in the home network.
  • the first application key acquisition request carries the service network identifier of the terminal.
  • the first application key acquisition request is used to request AKMA application key information of the AF in the home network from the AAnF in the home network.
  • the AF in the home network sends a first application key acquisition request to the AAnF in the home network.
  • the first application key acquisition request may be represented by Naanf_AKMA_ApplicationKey_Get Request.
  • the first application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key, and the AF identifier is the identifier of the AF in the home network.
  • the AKMA key identifier can be represented by A-KID, and the AF identifier can be represented by AF_ID.
  • the first application key acquisition request includes an AKMA key identifier and a service network identifier (which may also include an AF identifier).
  • the AKMA key identifier carries the service network identifier; or the first application key acquisition request carries the service network identifier through a separate field. That is, the first application key acquisition request can carry the service network identifier through the above two methods.
  • the AF in the home network requires a terminal identification, which is indicated by the policy in the AF in the home network.
  • the AKMA key identifier is in the Network Access Identifier NAI format.
  • the AF in the home network before performing step 1004, the AF in the home network also needs to determine the AAnF in the home network. That is, the method provided in this embodiment also includes step 1003: the AF in the home network determines the AAnF in the home network. For example, the AF in the home network discovers the AAnF in the home network through the NRF in the home network.
  • Step 1006 The AAnF in the home network generates the AKMA application key of the AF in the home network based on the AKMA key of the terminal.
  • the AKMA Application Key (K AF ) is used to indicate the communication key between the terminal and the AF in the home network.
  • the AKMA application key is generated based on the AKMA key of the terminal. Therefore, the following conditions need to be met to perform step 1006: the AAnF in the home network stores the AKMA key of the terminal.
  • the AKMA application key can be obtained in the following manner: the AAnF in the home network obtains the A-KID and AF_ID according to the application key acquisition request. Afterwards, the AAnF in the home network can generate the AKMA application key based on the AKMA key and AF_ID.
  • the AAnF in the home network can verify whether the terminal is authorized to use the AKMA service based on the existence of the AKMA key of the terminal corresponding to the A-KID.
  • the AAnF in the home network before performing step 1006, the AAnF in the home network also needs to perform the following steps: determine, based on the authorization information or policy, that the AAnF in the home network provides services to the AF in the home network and the proxy entity in the serving network. That is, the method provided by this embodiment also includes step 1005: the AAnF in the home network determines, based on the authorization information or policy, that the AAnF in the home network provides services to the AF in the home network and the proxy entity in the serving network.
  • authorization information or policies are provided by local policies or NRF in the home network. For example, the AAnF in the home network determines whether the AAnF in the home network can provide services to the AF in the home network and the proxy entity in the serving network based on the authorization information or policy associated with the AF_ID.
  • the AAnF in the home network executes step 1006; the AAnF in the home network cannot provide services to the AF in the home network.
  • the AAnF in the home network may refuse to perform step 1006 and feed back an error response to the AF in the home network.
  • Step 1008 The AAnF in the home network feeds back the first application key acquisition response to the AF in the home network.
  • the AAnF in the home network will receive the first application key acquisition request. After generating the AKMA application key, the AAnF in the home network sends a first application key acquisition response to the AF in the home network.
  • the first application key acquisition response may be expressed using Naanf_AKMA_ApplicationKey_Get Response.
  • the AKMA application key information of the AF carried in the first application key acquisition response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and the SUPI of the terminal.
  • the expiration time of the AKMA application key can be expressed using K AF expTime.
  • the AAnF in the home network will feed back an error response to the AF in the home network.
  • Step 1010 The AAnF in the home network sends an application key confirmation request to the proxy entity in the serving network.
  • the application key confirmation request can be represented by AKMA Application Key Comfirmation Request.
  • the AAnF in the home network will send an application key confirmation request to the proxy entity in the serving network.
  • the application key confirmation request includes at least one of the following:
  • the AF identifier is the identifier of the AF in the home network
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the AKMA key identifier stores the home network identifier of the terminal.
  • the AAnF in the home network needs to first determine the proxy entity in the service network in the network element of the service network, and then it can request the service network to the service network.
  • the proxy entity in sends an application key confirmation request. That is, the method provided by this embodiment also includes step 1009: the AAnF in the home network determines the proxy entity in the service network in the network element of the service network.
  • the AAnF in the home network discovers the proxy entity in the serving network through the NRF in the serving network and the home network in the network element of the serving network. .
  • the information of the proxy entity in the serving network is configured locally on the AAnF in the home network. At this time, the AAnF in the home network does not need to discover the proxy entity in the service network through NRF.
  • the proxy entity in the service network is a separate NF in the service network; or the proxy entity in the service network is part of any NF in the service network; or the proxy entity in the service network is an available NF within the 3GPP operator domain.
  • Letter application function is a separate NF in the service network; or the proxy entity in the service network is part of any NF in the service network; or the proxy entity in the service network is an available NF within the 3GPP operator domain.
  • Step 1012 The proxy entity in the serving network sends an application key confirmation response to the AAnF in the home network.
  • the application key confirmation response can be represented by AKMA Application Key Confirmation Response.
  • the application key confirmation response is used by the proxy entity in the serving network to notify the AAnF in the home network that it has learned that the terminal and the AF in the home network can establish AKMA-based communication, as well as related AKMA application key information.
  • the proxy entity in the service network will store the application key confirmation request, and then send the application key confirmation response to the AAnF in the home network. .
  • Step 1014 The AF in the home network feeds back the application session establishment response to the terminal.
  • the application session establishment response corresponds to the application session establishment request and is used to feed back the AKMA application key information of the AF in the home network, which can be represented by Application Session Establishment Response.
  • the terminal After receiving the application session establishment response, the terminal can determine the AKMA application key based on the AKMA application key information of the AF carried in the application session establishment response.
  • the AAnF in the home network does not carry the AKMA key of the terminal.
  • the AAnF in the home network sends an error response to the AF in the home network.
  • the AF in the home network will feed back application session rejection information to the terminal, and the rejection information includes the reason for the response failure. Based on this, the AF in the home network refuses to establish the application session by including the response failure reason.
  • the terminal can resend the application session establishment request, and the application session establishment request carries the new A-KID and/or serving network identification. symbol.
  • the steps on the UE side can independently become an embodiment of the key management method applied in the terminal, and the steps on the AAnF side in the home network can independently become an application.
  • the steps on the AF side in the home network may alone become an embodiment of the key management method in the AF in the home network, in the serving network
  • the steps on the proxy entity side may alone become an embodiment of the key management method applied in the proxy entity in the service network.
  • the terminal in the roaming scenario, sends the service network identifier to the AF in the home network, and the AF in the home network sends the service network identifier carrying the service network identifier to the AAnF in the home network.
  • the AAnF in the home network determines that the terminal is in a roaming scenario based on the service network identifier, and can determine the proxy entity in the service network in the network element of the service network and send the application to it.
  • the key confirmation request enables relevant network elements in the serving network to know that the terminal and the AF in the home network can establish AKMA-based communication, thereby providing AKMA services in roaming scenarios.
  • Figure 11 shows a flow chart of a key management method provided by an exemplary embodiment of the present application, applied in a roaming scenario.
  • the method includes:
  • Step 1102 The terminal sends an application session establishment request to the AF in the home network.
  • the application session establishment request is used to trigger the application session establishment request.
  • the application session establishment request can be represented by Application Session Establishment Request.
  • the application session establishment request carries the AKMA key identifier and the service network identifier, and the AKMA key identifier can be represented by A-KID.
  • the A-KID is used to indicate the identifier of the AKMA key of the terminal, and the service network identifier is used to indicate the service network of the terminal.
  • the application session establishment request carrying the service network identifier of the terminal may include at least the following two situations:
  • the application session establishment request includes the AKMA key identifier of AKMA, and the AKMA key identifier carries the service network identifier;
  • the application session establishment request includes the AKMA key identifier and the service network identifier.
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the application session establishment request includes A-KID
  • the terminal can also send the terminal's service network identifier before or after the application session establishment request.
  • the service network identifier indicates that there is a corresponding application session establishment request. Or A-KID.
  • Step 1104 The AF in the home network sends a second application key acquisition request to the AAnF in the home network.
  • the second application key acquisition request carries the service network identifier of the terminal.
  • the second application key acquisition request is used to request the AKMA application key information of the AF in the home network from the AAnF in the home network.
  • the AF in the home network When the AF in the home network does not need the terminal identification, the AF in the home network sends a second application key acquisition request to the AAnF in the home network.
  • the second application key acquisition request may be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Request.
  • the second application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key, and the AF identifier is the identifier of the AF in the home network.
  • the second application key acquisition request includes an AKMA key identifier and a service network identifier (which may also include an AF identifier).
  • the AKMA key identifier carries the service network identifier; or the second application key acquisition request carries the service network identifier through a separate field. That is, the second application key acquisition request can carry the service network identifier through the above two methods.
  • the AF in the home network does not require terminal identification, which is indicated by the policy in the AF in the home network.
  • the AKMA key identifier is in the Network Access Identifier NAI format.
  • the AF in the home network before performing step 1104, the AF in the home network also needs to determine the AAnF in the home network. That is, the method provided in this embodiment also includes step 1103: the AF in the home network determines the AAnF in the home network. For example, the AF in the home network discovers the AAnF in the home network through the NRF in the home network.
  • Step 1106 The AAnF in the home network generates the AKMA application key of the AF in the home network based on the AKMA key of the terminal.
  • the AKMA Application Key (K AF ) is used to indicate the communication key between the terminal and the AF in the home network.
  • the AKMA application key is generated based on the AKMA key of the terminal. Therefore, the following conditions need to be met to perform step 1106: the AAnF in the home network stores the AKMA key of the terminal.
  • the AKMA application key can be obtained in the following manner: the AAnF in the home network obtains the A-KID and AF_ID according to the application key acquisition request. Afterwards, the AAnF in the home network can generate the AKMA application key based on the AKMA key and AF_ID.
  • the AAnF in the home network can verify whether the terminal is authorized to use the AKMA service based on the existence of the AKMA key of the terminal corresponding to the A-KID.
  • the AAnF in the home network before performing step 1106, the AAnF in the home network also needs to perform the following steps: based on the authorization information or policy, determine that the AAnF in the home network provides services to the AF in the home network and the proxy entity in the serving network. That is, the method provided in this embodiment also includes step 1105: the AAnF in the home network determines, based on the authorization information or policy, that the AAnF in the home network provides services to the AF in the home network and the proxy entity in the serving network.
  • authorization information or policies are provided by local policies or NRF in the home network. For example, the AAnF in the home network determines whether the AAnF in the home network can provide services to the AF in the home network and the proxy entity in the serving network based on the authorization information or policy associated with the AF_ID.
  • the AAnF in the home network executes step 1106; the AAnF in the home network cannot provide services to the AF in the home network.
  • the AAnF in the home network may refuse to perform step 1106 and feed back an error response to the AF in the home network.
  • Step 1108 The AAnF in the home network feeds back the second application key acquisition response to the AF in the home network.
  • the AAnF in the home network will receive the second application key acquisition request. After generating the AKMA application key, the AAnF in the home network sends a second application key acquisition response to the AF in the home network.
  • the second application key acquisition response may be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Response.
  • the AKMA application key information fed back by the AAnF in the home network does not include the SUPI of the terminal, that is, the second application key acquisition response Does not include SUPI for terminals.
  • the AKMA application key information of the AF carried in the second application key acquisition response includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • the expiration time of the AKMA application key can be expressed using K AF expTime.
  • the AAnF in the home network will feed back an error response to the AF in the home network.
  • Step 1110 The AAnF in the home network sends an application key confirmation request to the proxy entity in the serving network.
  • the application key confirmation request can be represented by AKMA Application Key Comfirmation Request.
  • the AAnF in the home network will send an application key confirmation request to the proxy entity in the serving network.
  • the application key confirmation request includes at least one of the following:
  • the AF identifier is the identifier of the AF in the home network
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the AKMA key identifier stores the home network identifier of the terminal.
  • the AAnF in the home network needs to first determine the proxy entity in the service network in the network element of the service network, and then it can request the service network to the service network.
  • the proxy entity in sends an application key confirmation request. That is, the method provided by this embodiment also includes step 1109: the AAnF in the home network determines the proxy entity in the serving network in the network element of the serving network.
  • the AAnF in the home network discovers the proxy entity in the serving network through the NRF in the serving network and the home network in the network element of the serving network. .
  • the information of the proxy entity in the serving network is configured locally on the AAnF in the home network. At this time, the AAnF in the home network does not need to discover the proxy entity in the service network through NRF.
  • the proxy entity in the service network is a separate NF in the service network; or the proxy entity in the service network is part of any NF in the service network; or the proxy entity in the service network is an available NF within the 3GPP operator domain.
  • Letter application function is a separate NF in the service network; or the proxy entity in the service network is part of any NF in the service network; or the proxy entity in the service network is an available NF within the 3GPP operator domain.
  • Step 1112 The proxy entity in the serving network sends an application key confirmation response to the AAnF in the home network.
  • the application key confirmation response can be represented by AKMA Application Key Confirmation Response.
  • the application key confirmation response is used by the proxy entity in the serving network to notify the AAnF in the home network that it has learned that the terminal and the AF in the home network can establish AKMA-based communication, as well as related AKMA application key information.
  • the proxy entity in the service network will store the application key confirmation request, and then send the application key confirmation response to the AAnF in the home network. .
  • Step 1114 The AF in the home network feeds back the application session establishment response to the terminal.
  • the application session establishment response corresponds to the application session establishment request and is used to feed back the AKMA application key information of the AF in the home network, which can be represented by Application Session Establishment Response.
  • the terminal After receiving the application session establishment response, the terminal can determine the AKMA application key based on the AKMA application key information of the AF carried in the application session establishment response.
  • the AAnF in the home network does not carry the AKMA key of the terminal.
  • the AAnF in the home network sends an error response to the AF in the home network.
  • the AF in the home network will feed back application session rejection information to the terminal, and the rejection information includes the reason for the response failure. Based on this, the AF in the home network refuses to establish the application session by including the response failure reason.
  • the terminal can resend the application session establishment request, and the application session establishment request carries the new A-KID and/or serving network identification. symbol.
  • the steps on the UE side can independently become an embodiment of the key management method applied in the terminal, and the steps on the AAnF side in the home network can independently become an application.
  • the steps on the AF side in the home network may alone become an embodiment of the key management method in the AF in the home network, in the serving network
  • the steps on the proxy entity side may alone become an embodiment of the key management method applied in the proxy entity in the service network.
  • the terminal in the roaming scenario, sends the service network identifier to the AF in the home network, and the AF in the home network sends the service network identifier carrying the service network identifier to the AAnF in the home network.
  • the AAnF in the home network determines that the terminal is in a roaming scenario based on the service network identifier, and can determine the proxy entity in the service network in the network element of the service network and send the application to it.
  • the key confirmation request enables relevant network elements in the serving network to know that the terminal and the AF in the home network can establish AKMA-based communication, thereby providing AKMA services in roaming scenarios.
  • Figure 12 shows a flow chart of a key management method provided by an exemplary embodiment of the present application, applied in a roaming scenario.
  • the method includes:
  • the AF in the home network communicates with the UE, it needs to be determined whether the AKMA service can be used between the two.
  • the main authentication process between the UE and the AUSF is passed, so that the UE and the AUSF locally generate the same KAUSF , KAKMA and A-KID respectively.
  • the main authentication process can refer to the above content and will not be described again.
  • the prerequisites for the AF in the home network to communicate with the UE are implicitly specific to the UE and the AF, or are explicitly indicated by the AF to the UE.
  • Step 1202 The UE sends an application session establishment request to the AF in the home network.
  • the application session establishment request is used to trigger the application session establishment request.
  • the application session establishment request can be represented by Application Session Establishment Request.
  • the application session establishment request carries the A-KID and the service network identifier.
  • the A-KID is used to indicate the identifier of the AKMA key of the UE
  • the serving network identifier is used to indicate the serving network of the UE.
  • the serving network identifier is used to trigger the AAnF in the home network to send an application key confirmation request to AAnFProxy in the serving network when the serving network identifier of the UE is different from the home network identifier.
  • the application session establishment request includes A-KID, and the A-KID carries the service network identifier of the UE; or the application session establishment request includes the A-KID and the service network identifier of the UE; or the application session The establishment request includes the A-KID, and the UE sends the UE's serving network identifier before or after the application session establishment request.
  • the serving network identifier indicates a corresponding application session establishment request or A-KID.
  • TS 33.535 stipulates that A-KID should adopt the NAI format specified in clause 2.2 of IETF RFC 7542, such as: username@security domain.
  • Step 12041 The AF in the home network sends a first application key acquisition request to the AAnF in the home network.
  • the first application key acquisition request carries the serving network identifier of the UE.
  • the first application key acquisition request is used to request AKMA application key information of the AF in the home network from the AAnF in the home network.
  • the AF in the home network sends a first application key acquisition request to the AAnF in the home network.
  • the first application key acquisition request may be represented by Naanf_AKMA_ApplicationKey_Get Request.
  • the AF sends the request to AAnF via the Naanf_AKMA_ApplicationKey_Get service operation if the policy in AF indicates it needs the UE identity.
  • the first application key acquisition request includes at least one of the following:
  • the first application key acquisition request includes the A-KID and the service network identifier (which may also include AF_ID).
  • A-KID carries the service network identifier; or the first application key acquisition request carries the service network identifier through a separate field. That is, the first application key acquisition request can carry the serving network identifier of the UE through the above two methods.
  • the AF in the home network requires a UE identity, which is indicated by the policy in the AF in the home network.
  • the AF in the home network before performing step 12041 (12042), the AF in the home network also needs to determine the AAnF in the home network. For example, the AF in the home network discovers the AAnF in the home network through the NRF in the home network.
  • the NRF entrusts a Service Communication Proxy (SCP) to discover and select at least one AAnfProxy in the home network.
  • SCP Service Communication Proxy
  • the AAnfProxy NF in the home network sends all available factors to the SCP.
  • Step 12042 The AF in the home network sends a second application key acquisition request to the AAnF in the home network.
  • the second application key acquisition request carries the serving network identifier of the UE.
  • the second application key acquisition request is used to request the AKMA application key information of the AF in the home network from the AAnF in the home network.
  • the AF in the home network When the AF in the home network does not need the UE identity, the AF in the home network sends a second application key acquisition request to the AAnF in the home network.
  • the second application key acquisition request may be represented by Naanf_AKMA_ApplicationKey_AnonUser_Get Request.
  • the AF sends the request via the Naanf_AKMA_ApplicationKey_AnonUser_Get service operation if the policy in AF indicates it does not need the UE identity.
  • the second application key acquisition request includes at least one of the following:
  • the second application key acquisition request includes the A-KID and the service network identifier (which may also include AF_ID).
  • the A-KID carries the service network identifier; or the second application key acquisition request carries the service network identifier through a separate field. That is, the second application key acquisition request can carry the serving network identifier of the UE through the above two methods.
  • the AF in the home network does not require the UE identification, which is indicated by the policy in the AF in the home network.
  • step 12041 and step 12042 can be executed alternatively and cannot be executed at the same time.
  • Step 1206 The AAnF in the home network generates the AKMA application key of the AF in the home network based on the AKMA key of the UE.
  • the AKMA application key (K AF ) is used to indicate the communication key between the UE and the AF in the home network.
  • the AKMA application key is generated based on the AKMA key of the UE. Therefore, the following conditions need to be met to perform step 1206: the AAnF in the home network stores the AKMA key of the UE.
  • the AKMA application key can be obtained in the following manner: the AAnF in the home network obtains the A-KID and AF_ID according to the first application key acquisition request or the second application key acquisition request. Afterwards, the AAnF in the home network can generate the AKMA application key based on the AKMA key and AF_ID.
  • the AAnF in the home network can verify whether the UE is authorized to use the AKMA service based on the existence of the UE's AKMA key corresponding to the A-KID. (The AAnF shall verify whether the AF is authorized to use AKMA based on the presence of the UE specific K AKMA key identified by the A-KID.)
  • the AAnF in the home network before performing step 1206, the AAnF in the home network also needs to perform the following steps: according to the authorization information or policy associated with the AF_ID, determine whether the AAnF in the home network can provide information to the AF in the home network and the agent in the serving network. Entity provides services.
  • authorization information or policies are provided by local policies or NRF in the home network.
  • the AAnF in the home network executes step 1206; the AAnF in the home network cannot provide services to the AF in the home network.
  • the AAnF in the home network may refuse to perform step 1206 and feed back an error response to the AF in the home network.
  • the AAnF shall check whether the AAnF can provide the service to the AF based on the configured local policy or based on the authorization information or policy provided by the NRF in the home network using the AF_ID. If it succeeds, the following procedures are executed .Otherwise, the AAnF shall reject the procedure.
  • the AAnF in the home network may or may not store the UE's AKMA key.
  • the AAnF in the home network stores the AKMA key of the UE
  • the AAnF in the home network generates the AKMA application key of the AF in the serving network based on the AKMA key of the UE (If K AKMA is present in AAnF, the AAnF shall derive K AF for the AF.);
  • the AAnF in the home network does not store the UE's AKMA key
  • the AAnF in the home network feeds back an error response (If K AKMA is not present in the AAnF, the AAnF shall continue with step 12081 or 12082 with an error response.).
  • Step 12081 The AAnF in the home network feeds back the first application key acquisition response to the AF in the home network.
  • the AAnF in the home network will receive the first application key acquisition request. After generating the AKMA application key, the AAnF in the home network sends a first application key acquisition response to the AF in the home network.
  • the first application key get response may be expressed using Naanf_AKMA_ApplicationKey_Get Response. (The AAnF sends Naanf_AKMA_ApplicationKey_Get response to the AF with SUPI,K AF and the K AF expiration time.)
  • the AKMA application key information of the AF carried in the first application key acquisition response includes at least one of the following information: the AKMA application key, the expiration time of the AKMA application key, and the UE's SUPI.
  • the AAnF in the home network will feed back an error response to the AF in the home network.
  • Step 12082 The AAnF in the home network feeds back the second application key acquisition response to the AF in the home network.
  • the AAnF in the home network will receive the second application key acquisition request. After generating the AKMA application key, the AAnF in the home network sends a second application key acquisition response to the AF in the home network.
  • the second application key get response may be expressed using Naanf_AKMA_ApplicationKey_AnonUser_Get Response. (The AAnF sends Naanf_AKMA_ApplicationKey_AnonUser_Get response to the AF with K AF and the K AF expiration time.)
  • the second application key acquisition response does not include the SUPI of the UE.
  • the AKMA application key information of the AF carried in the second application key acquisition response includes at least one of the following information: the AKMA application key and the expiration time of the AKMA application key.
  • the AAnF in the home network will feed back an error response to the AF in the home network.
  • step 12081 and step 12082 can be executed alternatively and cannot be executed at the same time.
  • Step 1212 AAnF in the home network sends an application key confirmation request to AAnFProxy in the service network.
  • the application key confirmation request can be expressed by AKMA Application Key Comfirmation Request.
  • AAnF in the home network will send an application key confirmation request to AAnFProxy in the serving network.
  • the serving network identifier of UE is different from the home network identifier of UE, the AAnF sends AKMA Application Key Confirmation request to the AAnFProxy in the visited network with K AF ,K AF expiration time,AF_ID,A-KID,and SUPI of the UE.
  • the application key confirmation request includes at least one of the following:
  • the AKMA key identifier stores the home network identifier of the UE.
  • Home network identifier is stored in the A-KID of the UE.
  • the AAnF in the home network needs to first determine the AAnFProxy in the serving network in the network element of the serving network, and then it can send the request to the serving network.
  • AAnFProxy sends an application key confirmation request. ; Proxy Instance in the Visited Network that handles the akma request.otherwise, The Aanf Does Not Note tod to discovery AAnFProxy in the serving network of UE.)
  • the AAnF in the home network discovers the AAnFProxy in the serving network in the network element of the serving network through the NRF in the serving network and the home network.
  • the information of AAnFProxy in the service network is configured locally on the AAnF in the home network.
  • AAnF in the home network does not need to use NRF to discover AAnFProxy in the service network.
  • the AAnF in the home network shall utilize the NRF in the home network and NRF in the visited network to discover the AAnFProxy instance(s)unless AAnFProxy information is available by other means,e.g.locally configured on the AAnF.)
  • AAnFProxy in the above service network is a separate NF in the service network; or AAnFProxy in the service network is part of any NF in the service network; or AAnFProxy in the service network is a trusted application function within the 3GPP operator domain .
  • Step 1212 AAnFProxy in the serving network sends an application key confirmation response to AAnF in the home network.
  • the application key confirmation response can be represented by AKMA Application Key Confirmation Response.
  • the application key confirmation response is used by AAnFProxy in the serving network to notify AAnF in the home network that it has learned that the UE and the AF in the home network can establish AKMA-based communication, as well as related AKMA application key information.
  • the AAnFProxy in the service network will store the application key confirmation request, and then send the application key confirmation response to the AAnF in the home network.
  • the AAnFProxy in the visited network firstly stores K AF ,K AF expiration time,AF_ID,A-KID, and SUPI of the UE. Then it sends the AKMA Application Key Confirmation response to the AAnF in the home network of UE.
  • Step 1214 The AF in the home network feeds back the application session establishment response to the UE.
  • the application session establishment response corresponds to the application session establishment request and is used to feed back the AKMA application key information of the AF in the home network, which can be represented by Application Session Establishment Response.
  • the UE can determine the AKMA application key based on the AKMA application key information of the AF carried in the application session establishment response.
  • the AAnF in the home network does not carry the UE's AKMA key.
  • the AAnF in the home network sends an error response to the AF in the home network.
  • the AF in the home network will feed back application session rejection information to the UE, and the rejection information includes the reason for the response failure. Based on this, the AF in the home network refuses to establish the application session by including the response failure reason.
  • the UE can resend the application session establishment request, and the application session establishment request carries the new A-KID and/or serving network identification. symbol. (The AF sends the Application Session Establishment Response to the UE.
  • the AF shall reject the Application Session Establishment by including a failure cause. Afterwards, the UE may trigger a new Application Session Establishment request with the latest A-KID to the AKMA AF.
  • the steps on the UE side can independently become an embodiment of the key management method applied in the UE, and the steps on the AAnF side in the home network can independently become an application.
  • the steps on the AF side in the home network may alone become an embodiment of the key management method in the AF in the home network, in the serving network
  • the steps on the AAnFProxy side may alone become an embodiment of the key management method in AAnFProxy applied to the service network.
  • the steps of the key management method please refer to the above content and will not be described again.
  • the UE can send the serving network identifier to the AF through the application session establishment request message. (The UE should be able to send serving network identifier to the AF via Application Session Establishment Request message.).
  • the AAnFProxy functionality in the service network may be implemented as a separate network function in the service network, or as part of any NF in the service network, or as a trusted application function within the 3GPP operator domain (AAnfProxy functionality may be implemented as a separate network function in the visited network, or be part of any NF in the visited network, or as a trusted AF.).
  • AAnFProxy in the service network can obtain K AF , K AF expiration time, AF_ID, A-KID and SUPI from AAnF in the UE home network (AAnFProxy should be able to obtain K AF ,K AF expiration time, AF_ID, A-KID, and SUPI of the UE from AAnF in the home network of UE.).
  • the AAnF in the home network can receive the UE's serving network identifier from the AF in the home network (AAnF should be able to receive Serving Network Identifier information of UE from the AF.).
  • the AAnF in the home network can understand the serving network identifier stored in the A-KID (AAnF should be able to understand Serving Network Identifier which is stored in the A-KID.).
  • the AAnf in the home network can use the NRFs in the home network and the serving network to select the AAnFProxy in the serving network (With serving network identifier of UE, AAnf should be able to leverage NRFs in the home network and visited network to select AAnFProxy in the visited network.).
  • AAnF in the home network can send the UE's K AF , K AF expiration time, AF_ID, A-KID and SUPI to AAnFProxy in the serving network (AAnF should be able to send K AF ,K AF expiration time,AF_ID,A- KID, and SUPI of the UE to AAnFProxy in the visited network of UE.).
  • the AAnF in the home network can perform AAnFProxy selection to allocate an AAnFProxy instance in the serving network to handle the AKMA request (If the serving network identifier of UE is different from the home network identifier of UE, the AAnF in the home network should be able to perform AAnFProxy selection to allocate an AAnFProxy Instance in the visited network that handles the AKMA request.).
  • the AF in the home network can receive A-KID and serving network identifier from the UE. (AF should be able to receive A-KID and serving network identifier from the UE.)
  • the AF in the home network should be able to understand the serving network identifier.
  • the AF in the home network can request K AF from AAnF in the home network of UE by sending A-KID, AF_ID, and serving network identifier to it (AF should be able to request K AF from AAnF in the home network of UE by sending A-KID,AF_ID,serving network identifier to it.).
  • the UE in the roaming scenario, sends the serving network identifier to the AF in the home network, and the AF in the home network sends the service network identifier carrying the serving network identifier to the AAnF in the home network.
  • the application key acquisition request of the symbol is obtained, so that when the AAnF in the home network determines that the UE is in a roaming scenario based on the service network identifier, it can determine the AAnFProxy in the service network in the network element of the service network and send it the application key.
  • the key confirmation request allows relevant network elements in the serving network to know that the UE and the AF in the home network can establish AKMA-based communication, thereby providing AKMA services in roaming scenarios.
  • Figure 13 shows a structural block diagram of a key management device provided by an exemplary embodiment of the present application. This device is used in roaming scenarios, as shown in Figure 13.
  • the device includes:
  • the receiving module 1301 is configured to receive an application key confirmation request sent by the anchor function network element AAnF of the application authentication and key management AKMA in the home network.
  • the application key confirmation request includes at least one of the following:
  • the terminal s contracted permanent identification SUPI
  • the AF identifier is the identifier of the AF in the home network
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the application key confirmation request is sent by the AAnF to the proxy entity when the terminal's serving network identifier is different from the home network identifier.
  • the device also includes:
  • the sending module 1302 is used to send an application key confirmation response to AAnF.
  • the device also includes:
  • the proxy entity is determined by the AAnF in the network element of the serving network when the serving network identifier of the terminal is different from the home network identifier.
  • the proxy entity is discovered by the AAnF in the network element of the serving network through the network storage function NRF in the serving network and the home network.
  • the proxy entity information is configured locally in AAnF.
  • the proxy entity is a separate network function NF in the service network;
  • the proxy entity is part of any NF in the service network.
  • the proxy entity is a trusted application function within the 3GPP operator domain.
  • Figure 14 shows a structural block diagram of a key management device provided by an exemplary embodiment of the present application. This device is used in roaming scenarios, as shown in Figure 14.
  • the device includes:
  • the receiving module 1401 is used to receive the service network identifier and the AKMA key identifier sent by the terminal;
  • the sending module 1402 is used to send an application key acquisition request to the AAnF in the home network.
  • the application key acquisition request carries the service network identifier.
  • the service network identifier is used to trigger the service network identifier and home network identifier of the AAnF in the terminal. If the credentials are different, send an application key confirmation request to the proxy entity in the service network;
  • the receiving module 1401 is also configured to receive an application key acquisition response fed back by the AAnF.
  • the application key acquisition response includes the AKMA application key information of the AF.
  • the AKMA application key information includes at least one of the following:
  • sending module 1402 is used to:
  • the AF When the AF needs the terminal identification, it sends a first application key acquisition request to the AAnF.
  • the first application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key
  • the AF identifier is the identifier of the AF in the home network.
  • the first application key acquisition request includes an AKMA key identifier and a service network identifier
  • the AKMA key identifier carries the service network identifier; or the first application key acquisition request carries the service network identifier through a separate field.
  • sending module 1402 is used to:
  • a second application key acquisition request is sent to the AAnF in the home network.
  • the second application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key
  • the AF identifier is the identifier of the AF in the home network.
  • the second application key acquisition request includes an AKMA key identifier and a service network identifier
  • the AKMA key identifier carries the service network identifier; or the second application key acquisition request carries the service network identifier through a separate field.
  • the receiving module 1401 is used for:
  • the error response is sent when the AKMA key of the terminal is not stored in AAnF;
  • the sending module 1402 is used to send an error response to the terminal.
  • the device also includes:
  • Discovery module 1403 is used to discover AAnF through the NRF in the home network.
  • the receiving module 1401 is used for:
  • the sending module 1402 is used to feed back an application session establishment response to the terminal.
  • the application session establishment request includes the AKMA key identifier of AKMA, and the AKMA key identifier carries the service network identifier; or the application session establishment request includes the AKMA key identifier and the service network identifier;
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • sending module 1402 is used to:
  • rejection information of the application session is fed back to the terminal, and the rejection information includes the reason for the response failure.
  • the AKMA key identifier is in the Network Access Identifier NAI format.
  • Figure 15 shows a structural block diagram of a key management device provided by an exemplary embodiment of the present application. This device is used in roaming scenarios, as shown in Figure 15.
  • the device includes:
  • the receiving module 1501 is configured to receive an application key acquisition request sent by the AF in the home network, where the application key acquisition request carries the service network identifier;
  • Generating module 1502 configured to generate the AKMA application key of AF based on the AKMA key of the terminal;
  • the sending module 1503 is configured to feed back an application key acquisition response to the AF, where the application key acquisition response includes the AKMA application key information of the AF;
  • the sending module 1503 is also used to send an application key confirmation request to the proxy entity in the service network.
  • the AKMA application key information includes at least one of the following:
  • the receiving module 1501 is used for:
  • the first application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key
  • the AF identifier is the identifier of the AF.
  • the first application key acquisition request includes an AKMA key identifier and a service network identifier
  • the AKMA key identifier carries the service network identifier; or the first application key acquisition request carries the service network identifier through a separate field.
  • the receiving module 1501 is used for:
  • the second application key acquisition request includes at least one of the following:
  • the AKMA key identifier is the identifier of the terminal's AKMA key
  • the AF identifier is the identifier of the AF.
  • the second application key acquisition request includes an AKMA key identifier and a service network identifier
  • the AKMA key identifier carries the service network identifier; or the second application key acquisition request carries the service network identifier through a separate field.
  • the AKMA application key information fed back by AAnF does not include the terminal's SUPI.
  • sending module 1503 is used to:
  • the device also includes:
  • the determination module 1504 is used to determine that the AAnF provides services to the AF and the proxy entity in the service network based on authorization information or policies.
  • authorization information or policies are provided by local policy or the NRF in the home network.
  • the application key confirmation request includes at least one of the following:
  • the AF identifier is the identifier of the AF
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • sending module 1503 is used to:
  • an application key confirmation request is sent to the proxy entity.
  • the receiving module 1501 is used for:
  • the device also includes:
  • the determining module 1504 is configured to determine the proxy entity in the network element of the serving network when the serving network identifier of the terminal is different from the home network identifier.
  • the proxy entity is discovered through the NRF in the serving network and the home network.
  • Figure 16 shows a structural block diagram of a key management device provided by an exemplary embodiment of the present application. This device is used in roaming scenarios, as shown in Figure 16.
  • the device includes:
  • the sending module 1601 is used to send the service network identifier and the AKMA key identifier to the AF in the home network.
  • the service network identifier is used to trigger the AAnF in the home network when the service network identifier of the terminal is different from the home network identifier.
  • an application key confirmation request is sent to the proxy entity in the service network, and the AKMA key identifier is the identifier of the terminal's AKMA key.
  • sending module 1601 is used to:
  • the installation also includes:
  • the receiving module 1602 is configured to receive an application session establishment response of AF feedback.
  • the application session establishment request includes the AKMA key identifier of AKMA, and the AKMA key identifier carries the service network identifier; or the application session establishment request includes the AKMA key identifier and the service network identifier;
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • the device provided in the above embodiment implements its functions, only the division of the above functional modules is used as an example. In practical applications, the above functions can be allocated to different functional modules according to actual needs. That is, the content structure of the device is divided into different functional modules to complete all or part of the functions described above.
  • Figure 17 shows a schematic structural diagram of a communication device (terminal or network device) provided by an exemplary embodiment of the present application.
  • the communication device 170 includes: a processor 1701, a receiver 1702, a transmitter 1703, a memory 1704 and a bus 1705.
  • the processor 1701 includes one or more processing cores.
  • the processor 1701 executes various functional applications and information processing by running software programs and modules.
  • the receiver 1702 and the transmitter 1703 can be implemented as a communication component, and the communication component can be a communication chip.
  • Memory 1704 is connected to processor 1701 through bus 1705.
  • the memory 1704 can be used to store at least one instruction, and the processor 1701 is used to execute the at least one instruction to implement each step in the above method embodiment.
  • memory 1704 may be implemented by any type of volatile or non-volatile storage device, or combination thereof, including but not limited to: magnetic or optical disks, electrically erasable programmable Read-only memory (Erasable Programmable Read Only Memory, EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, EPROM), static random access memory (Static Random Access Memory, SRAM), read-only memory (Read -Only Memory (ROM), magnetic memory, flash memory, Programmable Read-Only Memory (PROM).
  • magnetic or optical disks electrically erasable programmable Read-only memory (Erasable Programmable Read Only Memory, EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, EPROM), static random access memory (Static Random Access Memory, SRAM), read-only memory (Read -Only Memory (ROM), magnetic memory, flash memory, Programmable Read-Only Memory (PROM).
  • EEPROM electrically erasable programm
  • the processor and transceiver in the communication device involved in the embodiment of the present application can be implemented together as a communication chip, or the transceiver alone forms a communication chip.
  • the transmitter in the transceiver performs the sending steps performed by the terminal in any of the above methods
  • the receiver in the transceiver performs the receiving steps performed by the terminal in any of the above methods
  • the processor performs the sending The steps other than the receiving step will not be described here.
  • the processor and transceiver in the communication device involved in the embodiment of the present application can be implemented together as a communication chip, or the transceiver alone forms a communication chip.
  • the transmitter in the transceiver performs the sending step performed by the network device in any of the above methods
  • the receiver in the transceiver performs the receiving step performed by the network device in any of the above methods
  • the processor Perform steps other than sending and receiving steps, which will not be described here.
  • Figure 18 shows a schematic structural diagram of a network element device provided by an exemplary embodiment of the present application.
  • the network element device includes: a processor 1801, a memory 1802, and a communication component 1803.
  • the processor 1801 is connected to the memory 1802, and the memory 1802 is connected to the memory 1803.
  • the memory 1802 can be used to store at least one instruction and computer program, and the processor 1801 is used to execute the at least one instruction and computer program to implement the processing steps of the key management method performed by the core network element in the above method embodiment.
  • the processing steps refer to other steps except the receiving step and the sending step.
  • the communication component 1803 is used to implement the receiving steps and sending steps of the key management method executed by the core network element in the above method embodiment.
  • the embodiment of the present application also provides a proxy entity in the service network.
  • the proxy entity includes a communication component; the communication component is used to receive the application key sent by the anchor function network element AAnF of the application authentication and key management AKMA in the home network. Key confirmation request.
  • the embodiment of the present application also provides an application function AF.
  • the AF includes a communication component; the communication component is used to receive the service network identifier and the AKMA key identifier sent by the terminal; and sends an application key acquisition request to the AAnF in the home network.
  • the application key acquisition request carries the service network identifier.
  • the service network identifier is used to trigger the AAnF in the home network to send the message to the proxy entity in the service network when the service network identifier of the terminal is different from the home network identifier.
  • Application key confirmation request ; receiving an application key acquisition response fed back by the AAnF in the home network, where the application key acquisition response includes the AKMA application key information of the AF in the home network.
  • the embodiment of the present application also provides an anchor function network element AAnF for application authentication and key management AKMA.
  • AAnF includes a communication component and a processor; the communication component is used to receive an application key acquisition request sent by the AF in the home network. , the application key acquisition request carries the service network identifier; the processor is used to generate the AKMA application key of the AF in the home network based on the terminal's AKMA key; the communication component is used to feed back the application key to the AF in the home network Key acquisition response, the application key acquisition response includes the AKMA application key information of the AF in the home network; the communication component is used to send an application key confirmation request to the proxy entity in the service network.
  • the embodiment of the present application also provides a terminal.
  • the terminal includes a transceiver; the transceiver is used to send a service network identifier and an AKMA key identifier to the AF in the home network, and the service network identifier is used to trigger the AF in the home network.
  • AAnF sends an application key confirmation request to the proxy entity in the serving network
  • the AKMA key identifier is the identifier of the terminal's AKMA key.
  • a computer-readable storage medium in which at least one instruction, at least a program, a code set or an instruction set is stored, and the at least one instruction, the At least a program, the code set or the instruction set is loaded and executed by the processor to implement the key management method provided by each of the above method embodiments.
  • a chip is also provided.
  • the chip includes programmable logic circuits and/or program instructions. When the chip is run on a communication device, it is used to implement the encryption provided by each of the above method embodiments. Key management methods.
  • a computer program product which when run on a processor of a computer device causes the computer device to execute the above key management method.
  • Computer-readable media includes computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
  • Storage media can be any available media that can be accessed by a general purpose or special purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开了一种密钥管理方法、装置、设备及存储介质，涉及移动通信领域。该方法包括：接收归属网络中的AAnF发送的应用密钥确认请求。在漫游场景中，通过由归属网络中的AAnF向服务网络中的代理实体发送应用密钥确认请求，使得服务网络中的相关网元能够获知终端在漫游的场景下，与归属网络中的AF可建立基于AKMA的通信，从而实现在漫游场景下提供AKMA服务。

Description

密钥管理方法、装置、设备及存储介质 技术领域
本申请涉及移动通信领域，特别涉及一种密钥管理方法、装置、设备及存储介质。
背景技术
目前，基于第三代合作伙伴项目(3rd Generation Partnership Project，3GPP)凭证的应用认证与密钥管理(Authentication and Key Management for Applications，AKMA)已在邻近服务(Proximity based Service，ProSe)和第五代移动通信技术消息业务(Message within 5G，MSGin5G)等场景中，作为一种解决方案来保护终端与应用功能(Application Function，AF)之间通信。
但相关技术中，漫游场景下如何进行AKMA尚没有可行方案。
发明内容
本申请实施例提供了一种密钥管理方法、装置、设备及存储介质。所述技术方案如下：
根据本申请的一方面，提供了一种密钥管理方法，所述方法应用于漫游场景中，所述方法由服务网络中的代理实体执行，所述方法包括：
接收归属网络中的应用认证与密钥管理AKMA的锚点功能网元AAnF发送的应用密钥确认请求。
根据本申请的另一方面，提供了一种密钥管理方法，所述方法应用于漫游场景中，所述方法由归属网络中的AF执行，所述方法包括：
接收终端发送的服务网络标识符和AKMA密钥标识符；
向所述归属网络中的AAnF发送应用密钥获取请求，所述应用密钥获取请求携带有所述服务网络标识符，所述服务网络标识符用于触发所述AAnF在所述终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求；
接收所述AAnF反馈的应用密钥获取响应，所述应用密钥获取响应包括所述AF的AKMA应用密钥信息。
根据本申请的另一方面，提供了一种密钥管理方法，所述方法应用于漫游场景中，所述方法由归属网络中的AAnF执行，所述方法包括：
接收所述归属网络中的AF发送的应用密钥获取请求，所述应用密钥获取请求携带有服务网络标识符；
基于终端的AKMA密钥生成所述AF的AKMA应用密钥；
向所述AF反馈应用密钥获取响应，所述应用密钥获取响应包括所述AF的AKMA应用密钥信息；
向服务网络中的代理实体发送应用密钥确认请求。
根据本申请的另一方面，提供了一种密钥管理方法，所述方法应用于漫游场景中，所述方法由终端执行，所述方法包括：
向归属网络中的AF发送服务网络标识符和AKMA密钥标识符，所述服务网络标识符用于触发所述归属网络中的AAnF在所述终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求，所述AKMA密钥标识符为所述终端的AKMA密钥的标识符。
根据本申请的另一方面，提供了一种密钥管理装置，所述装置应用于漫游场景中，所述装置包括：
接收模块，用于接收归属网络中的应用认证与密钥管理AKMA的锚点功能网元AAnF发 送的应用密钥确认请求。
在一个可选的设计中，应用密钥确认请求包括如下中的至少一种：
AKMA应用密钥；
AKMA应用密钥的过期时间；
AF标识符；
AKMA密钥标识符；
终端的签约永久标识SUPI；
其中，AF标识符为归属网络中的AF的标识符，AKMA密钥标识符为终端的AKMA密钥的标识符。
在一个可选的设计中，应用密钥确认请求是AAnF在终端的服务网络标识符与归属网络标识符不同的情况下，向代理实体发送的。
在一个可选的设计中，所述装置还包括：
发送模块，用于向AAnF发送应用密钥确认响应。
在一个可选的设计中，所述装置还包括：
存储模块，用于存储应用密钥确认请求。
在一个可选的设计中，代理实体是在终端的服务网络标识符与归属网络标识符不同的情况下，由AAnF在服务网络的网元中确定的。
在一个可选的设计中，代理实体是由AAnF在服务网络的网元中，通过服务网络和归属网络中的网络存储功能NRF发现的。
在一个可选的设计中，代理实体的信息是在AAnF的本地配置的。
在一个可选的设计中，代理实体是服务网络中单独的网络功能NF；或
代理实体是服务网络中任一NF的一部分；或
代理实体是3GPP运营商域内的可信应用功能。
根据本申请的另一方面，提供了一种密钥管理装置，所述装置应用于漫游场景中，所述装置包括：
接收模块，用于接收终端发送的服务网络标识符和AKMA密钥标识符；
发送模块，用于向归属网络中的AAnF发送应用密钥获取请求，应用密钥获取请求携带有服务网络标识符，服务网络标识符用于触发AAnF在终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求；
接收模块，还用于接收AAnF反馈的应用密钥获取响应，应用密钥获取响应包括AF的AKMA应用密钥信息。
在一个可选的设计中，AKMA应用密钥信息包括如下中的至少一种：
AKMA应用密钥；
AKMA应用密钥的过期时间；
终端的SUPI。
在一个可选的设计中，发送模块，用于：
在AF需要终端标识的情况下，向AAnF发送第一应用密钥获取请求。
在一个可选的设计中，第一应用密钥获取请求包括如下中的至少一种：
AKMA密钥标识符；
AF标识符；
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为归属网络中的AF的标识符。
在一个可选的设计中，第一应用密钥获取请求包括AKMA密钥标识符和服务网络标识符；
AKMA密钥标识符携带有服务网络标识符；或第一应用密钥获取请求通过单独的字段携 带服务网络标识符。
在一个可选的设计中，发送模块，用于：
在归属网络中的AF不需要终端标识的情况下，向归属网络中的AAnF发送第二应用密钥获取请求。
在一个可选的设计中，第二应用密钥获取请求包括如下中的至少一种：
AKMA密钥标识符；
AF标识符；
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为归属网络中的AF的标识符。
在一个可选的设计中，第二应用密钥获取请求包括AKMA密钥标识符和服务网络标识符；
AKMA密钥标识符携带有服务网络标识符；或第二应用密钥获取请求通过单独的字段携带服务网络标识符。
在一个可选的设计中，AF是否需要终端标识，是由AF中的策略指示的。
在一个可选的设计中，接收模块，用于：
接收AAnF反馈的错误响应，错误响应是在AAnF中未存储有终端的AKMA密钥的情况下发送的；
发送模块，用于向终端发送错误响应。
在一个可选的设计中，所述装置还包括：
发现模块，用于通过归属网络中的NRF发现AAnF。
在一个可选的设计中，接收模块，用于：
接收终端发送的应用会话建立请求，应用会话建立请求携带有服务网络标识符；
发送模块，用于向终端反馈应用会话建立响应。
在一个可选的设计中，应用会话建立请求包括AKMA的AKMA密钥标识符，AKMA密钥标识符携带有服务网络标识符；或应用会话建立请求包括AKMA密钥标识符和服务网络标识符；
其中，AKMA密钥标识符为终端的AKMA密钥的标识符。
在一个可选的设计中，发送模块，用于：
在接收到AAnF反馈的错误响应的情况下，向终端反馈应用会话的拒绝信息，拒绝信息中包括响应失败原因。
在一个可选的设计中，AKMA密钥标识符采用网络访问标识符NAI格式。
根据本申请的另一方面，提供了一种密钥管理装置，所述装置应用于漫游场景中，所述装置包括：
接收模块，用于接收归属网络中的AF发送的应用密钥获取请求，应用密钥获取请求携带有服务网络标识符；
生成模块，用于基于终端的AKMA密钥生成AF的AKMA应用密钥；
发送模块，用于向AF反馈应用密钥获取响应，应用密钥获取响应包括AF的AKMA应用密钥信息；
发送模块，还用于向服务网络中的代理实体发送应用密钥确认请求。
在一个可选的设计中，AKMA应用密钥信息包括如下中的至少一种：
AKMA应用密钥；
AKMA应用密钥的过期时间；
终端的SUPI。
在一个可选的设计中，接收模块，用于：
接收AF发送的第一应用密钥获取请求，第一应用密钥获取请求用于指示AF需要终端标 识。
在一个可选的设计中，第一应用密钥获取请求包括如下中的至少一种：
AKMA密钥标识符；
AF标识符；
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为AF的标识符。
在一个可选的设计中，第一应用密钥获取请求包括AKMA密钥标识符和服务网络标识符；
AKMA密钥标识符携带有服务网络标识符；或第一应用密钥获取请求通过单独的字段携带服务网络标识符。
在一个可选的设计中，接收模块，用于：
接收AF发送的第二应用密钥获取请求，第二应用密钥获取请求用于指示AF不需要终端标识。
在一个可选的设计中，第二应用密钥获取请求包括如下中的至少一种：
AKMA密钥标识符；
AF标识符；
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为AF的标识符。
在一个可选的设计中，第二应用密钥获取请求包括AKMA密钥标识符和服务网络标识符；
AKMA密钥标识符携带有服务网络标识符；或第二应用密钥获取请求通过单独的字段携带服务网络标识符。
在一个可选的设计中，在AAnF接收到第二应用密钥获取请求的情况下，AAnF反馈的AKMA应用密钥信息不包括终端的SUPI。
在一个可选的设计中，发送模块，用于：
在AAnF中未存储有终端的AKMA密钥的情况下，向AF反馈错误响应。
在一个可选的设计中，所述装置还包括：
确定模块，用于根据授权信息或策略，确定AAnF向AF及服务网络中的代理实体提供服务。
在一个可选的设计中，授权信息或策略，由本地策略或归属网络中的NRF提供。
在一个可选的设计中，应用密钥确认请求包括如下中的至少一种：
AKMA应用密钥；
AKMA应用密钥的过期时间；
AF标识符；
AKMA密钥标识符；
终端的SUPI；
其中，AF标识符为AF的标识符，AKMA密钥标识符为终端的AKMA密钥的标识符。
在一个可选的设计中，发送模块，用于：
在终端的服务网络标识符与归属网络标识符不同的情况下，向代理实体发送应用密钥确认请求。
在一个可选的设计中，接收模块，用于：
接收代理实体发送的应用密钥确认响应。
在一个可选的设计中，所述装置还包括：
确定模块，用于在终端的服务网络标识符与归属网络标识符不同的情况下，在服务网络的网元中确定代理实体。
在一个可选的设计中，确定模块，用于：
在终端的服务网络标识符与归属网络标识符不同的情况下，在服务网络的网元中，通过 服务网络和归属网络中的NRF发现代理实体。
根据本申请的另一方面，提供了一种密钥管理装置，装置应用于漫游场景中，装置包括：
发送模块，用于向归属网络中的AF发送服务网络标识符和AKMA密钥标识符，服务网络标识符用于触发归属网络中的AAnF在终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求，AKMA密钥标识符为终端的AKMA密钥的标识符。
在一个可选的设计中，发送模块，用于：
向AF发送应用会话建立请求，应用会话建立请求携带有服务网络标识符；
装置还包括：
接收模块，用于接收AF反馈的应用会话建立响应。
在一个可选的设计中，应用会话建立请求包括AKMA的AKMA密钥标识符，AKMA密钥标识符携带有服务网络标识符；或应用会话建立请求包括AKMA密钥标识符和服务网络标识符；
其中，AKMA密钥标识符为终端的AKMA密钥的标识符。
根据本申请的另一方面，提供了一种服务网络中的代理实体，所述代理实体包括通信组件；
通信组件，用于接收归属网络中的应用认证与密钥管理AKMA的锚点功能网元AAnF发送的应用密钥确认请求。
根据本申请的另一方面，提供了一种应用功能AF，所述AF包括通信组件；
通信组件，用于接收终端发送的服务网络标识符和AKMA密钥标识符；
向所述归属网络中的AAnF发送应用密钥获取请求，所述应用密钥获取请求携带有所述服务网络标识符，所述服务网络标识符用于触发所述归属网络中的AAnF在所述终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求；
接收所述归属网络中的AAnF反馈的应用密钥获取响应，所述应用密钥获取响应包括所述归属网络中的AF的AKMA应用密钥信息。
根据本申请的另一方面，提供了一种应用认证与密钥管理AKMA的锚点功能网元AAnF，所述AAnF包括通信组件和处理器；
通信组件，用于接收所述归属网络中的AF发送的应用密钥获取请求，所述应用密钥获取请求携带有服务网络标识符；
处理器，用于基于终端的AKMA密钥生成所述归属网络中的AF的AKMA应用密钥；
通信组件，用于向所述归属网络中的AF反馈应用密钥获取响应，所述应用密钥获取响应包括所述归属网络中的AF的AKMA应用密钥信息；
通信组件，用于向服务网络中的代理实体发送应用密钥确认请求。
根据本申请的另一方面，提供了一种终端，所述终端包括收发器；
收发器，用于向归属网络中的AF发送服务网络标识符和AKMA密钥标识符，所述服务网络标识符用于触发所述归属网络中的AAnF在所述终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求，所述AKMA密钥标识符为所述终端的AKMA密钥的标识符。
根据本申请的另一方面，提供了一种计算机可读存储介质，所述可读存储介质中存储有可执行指令，所述可执行指令由处理器加载并执行以实现如上述方面所述的密钥管理方法。
根据本申请的另一方面，提供了一种芯片，所述芯片包括可编程逻辑电路和/或程序指令，当所述芯片在计算机设备上运行时，用于实现上述方面所述的密钥管理方法。
根据本申请的另一方面，提供了一种计算机程序产品或计算机程序，所述计算机程序产品或计算机程序包括计算机指令，所述计算机指令存储在计算机可读存储介质中，处理器从 所述计算机可读存储介质读取并执行所述计算机指令，使得计算机设备执行上述方面所述的密钥管理方法。
本申请提供的技术方案至少包括如下有益效果：
在漫游场景中，通过由归属网络中的AAnF向服务网络中的代理实体发送应用密钥确认请求，使得服务网络中的相关网元能够获知终端在漫游的场景下，与归属网络中的AF可建立基于AKMA的通信，从而实现在漫游场景下提供AKMA服务。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请一个示例性实施例提供的AKAM服务的网络架构图；
图2是本申请一个示例性实施例提供的生成AKMA密钥的流程图；
图3是本申请一个示例性实施例提供的通信系统的系统架构的示意图；
图4是本申请一个示例性实施例提供的密钥管理方法的流程图；
图5是本申请一个示例性实施例提供的密钥管理方法的流程图；
图6是本申请一个示例性实施例提供的密钥管理方法的流程图；
图7是本申请一个示例性实施例提供的密钥管理方法的流程图；
图8是本申请一个示例性实施例提供的密钥管理方法的流程图；
图9是本申请一个示例性实施例提供的密钥管理方法的流程图；
图10是本申请一个示例性实施例提供的密钥管理方法的流程图；
图11是本申请一个示例性实施例提供的密钥管理方法的流程图；
图12是本申请一个示例性实施例提供的密钥管理方法的流程图；
图13是本申请一个示例性实施例提供的密钥管理装置的结构框图；
图14是本申请一个示例性实施例提供的密钥管理装置的结构框图；
图15是本申请一个示例性实施例提供的密钥管理装置的结构框图；
图16是本申请一个示例性实施例提供的密钥管理装置的结构框图；
图17是本申请一个示例性实施例提供的通信设备的结构示意图；
图18是本申请一个示例性实施例提供的网元设备的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本申请相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本申请的一些方面相一致的装置和方法的例子。
在本公开使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本公开。在本公开和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本公开可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本公开范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
首先，对本申请实施例涉及的相关技术背景进行介绍：
第五代移动通信技术(5th Generation Mobile Communication Technology，5G)系统：
5G系统包括终端、接入网和核心网。其中，终端是具有无线收发功能的设备，该终端可以部署在陆地上、水面上和空中等。该终端可以应用于无人驾驶(Self Driving)、远程医疗(Remote Medical)、智能电网(Smart Grid)、运输安全(Transportation Safety)、智慧城市(Smart City)、智慧家庭(Smart Home)等中的至少一个场景中。
接入网用于实现接入有关的功能，可以为特定区域的授权用户提供入网功能。接入网在终端与核心网之间转发控制信号和用户数据。接入网可以包括接入网设备，接入网设备可以是为终端提供接入的设备，可以包括无线接入网(Radio Access Network，RAN)设备和接入网(Access Network，AN)设备。RAN设备主要是3GPP网络中的无线网络设备，AN设备可以是非3GPP定义的接入网设备。在采用不同的无线接入技术的系统中，具备基站功能的设备的名称可能会有所不同。例如，在5G系统中，称为RAN或下一代基站(Next Generation Node Basestation，gNB)；在长期演进(Long Term Evolution，LTE)系统中，称为演进的节点B(evolved NodeB，eNB或eNodeB)。
核心网负责维护移动网络的签约数据，为终端提供会话管理、移动性管理、策略管理以及安全认证等功能。核心网可以包括如下网元：用户面功能(User Plane Function，UPF)、认证服务功能(Authentication Server Function，AUSF)、接入和移动性管理功能(Access and Mobility Management Function，AMF)、会话管理功能(Session Management Function，SMF)、网络开放功能(Network Exposure Function，NEF)、网络功能仓储功能(Network Function Repository Function，NRF)、策略控制功能(Policy Control Function，PCF)和统一数据管理(Unified Data Management，UDM)。可选地，还可以包括应用功能(Application Function，AF)和统一数据存储库(Unified Data Repository，UDR)。
AMF，主要负责移动网络中的移动性管理，例如用户位置更新、用户注册网络、用户切换等。SMF，主要负责移动网络中的会话管理，例如会话建立、修改、释放。UPF，负责终端中用户数据的转发和接收，可以从数据网络接收用户数据，通过接入网设备传输给终端；还可以通过接入网设备从终端接收用户数据，转发至数据网络。PCF，主要支持提供统一的策略框架来控制网络行为，提供策略规则给控制层网络功能，同时负责获取与策略决策相关的用户签约信息。AUSF，用于执行终端的安全认证。NEF，主要用于支持能力和事件的开放。NRF，用于为其它网元提供网络功能实体信息的存储功能和选择功能。UDM，用于存储用户数据，例如签约数据、鉴权/授权数据等。AF与3GPP核心网交互用于提供应用层服务，例如提供关于应用层数据路由，提供接入网络能力开放功能，与策略框架进行交互以提供策略控制，与5G网络的IP多媒体子系统(IP Multimedia Subsystem，IMS)交互等。
数据网络(Data Network，DN)用于为用户提供业务服务，可以是私有网络，例如局域网；也可以是不受运营商管控的外部网络，例如互联网(Internet)；还可以是运营商共同部署的专有网络，例如IMS的网络。终端可通过建立的协议数据单元(Protocol Data Unit，PDU)会话，来访问DN。
应当理解，在本申请的一些实施例中，“5G”也可以称为“5G新空口(New Radio，NR)”或“NR”，“终端”也可以称为“终端设备”或“用户设备(User Equipment，UE)”。本申请的一些实施例中描述的技术方案可以适用于5G系统，也可以适用于5G系统后续的演进系统，还可以适用于6G以及后续的演进系统。
基于3GPP凭证的AKMA服务：
支持AKMA服务的UE，在与支持AKMA服务的AF进行数据传输时，可以基于AKMA流程的安全保护以提高数据传输的安全性。例如，AF对应于某个视频应用服务器，支持AKMA服务的UE与该AF进行数据传输时，相比于传统UE和AF的无保护的传输方法，使用AKMA服务可提高数据传输的安全性。
示例性的，图1是本申请一个示例性实施例提供的AKAM服务的网络架构图。如图1所示，该网络架构包括UE、接入网(Radio Access Network，(R)AN)、AUSF、AMF、AF、NEF、AKMA的锚点功能网元(AKMA Anchor Function，AAnF)和UDM。如图1所示，UE与AF进行通信存在三种方式，第一种是UE通过(R)AN和AMF与AF进行通信，第二种是UE通过AMF与AF进行通信，第三种是UE通过Ua*接口直接与AF进行通信。其中，Ua*接口为UE与AF之间的通信接口。在AKMA服务中，AUSF可以生成AKMA服务的密钥(即AKMA密钥)，并向AAnF提供UE的AKMA服务的密钥。其中，AKMA服务的密钥可以是K AKMA，也可以称为AKMA服务的根密钥。UE侧也会自己生成相同的AKMA服务的密钥，即生成相同的K AKMA。
图2是本申请一个示例性实施例提供的生成AKMA密钥的流程图。如图2所示，UE在向5G核心网注册的过程中，UE通过RAN向AMF发送注册请求，注册请求携带UE的身份信息(例如隐藏的身份标识(Subscriber Concealed Identifier，SUCI))。AMF根据UE的身份信息选择AUSF，向选择的AUSF发送消息触发主鉴权流程。该AUSF对UE进行鉴权，向AMF发送鉴权参数，之后AMF通过RAN向UE发送鉴权参数，UE根据鉴权参数对AUSF进行鉴权，并通过RAN向AMF发送响应，AMF对比响应，符合则鉴权成功。图2中的主鉴权(Primary Authentication)，即为注册过程中，AUSF对UE进行鉴权，以及UE对AUSF进行鉴权的过程，主鉴权也可以称为双向鉴权。在主鉴权之后，AUSF可以使用主鉴权过程中生成的中间密钥，如K AUSF，生成K AKMA，以及为K AKMA生成密钥标识信息，密钥标识信息可用于标识K AKMA，例如可以是K AKMA标识(K AKMA Identifier，A-KID)。UE可在主鉴权之后，发起AKMA服务之前，使用主鉴权过程中生成的中间密钥，如K AUSF，生成K AKMA以及为K AKMA生成密钥标识信息。需要说明的是，UE和AUSF分别在本地生成相同的K AUSF、K AKMA以及密钥标识信息。
结合图1以及图2的示例，AAnF可以与AUSF进行交互，从AUSF获取AKMA服务的密钥，并根据AKMA服务的密钥和AF的标识，生成该AF与UE之间的通信密钥以及该通信密钥的有效时间。AAnF可将该通信密钥以及该通信密钥的有效时间发送至该AF，以便该AF可以使用该通信密钥与UE进行数据传输，从而提高该AF与UE之间的数据传输的安全性。其中，AF与UE之间的通信密钥，例如可以是K AF。
对于不同AF与同一UE之间的K AF可以不同，例如AF1与UE1之间的K AF为K AF1，AF2与UE1之间的K AF为K AF2。图1中，AF可以与3GPP核心网网元交互。例如，AF可以从PCF获得服务质量(Quality of Service，QoS)参数，或AF向PCF提供QoS参数，进而可以影响应用程序的数据传输。再例如，AF可以与NEF交互。在AKMA服务的场景中，AF从AAnF获取该AF与UE之间的通信密钥以及该通信密钥的有效时间。AF可以位于5G核心网内部，也可以位于5G核心网外部。若AF位于5G核心网内部，那么AF可直接与PCF进行交互；若AF位于5G核心网外部，那么AF可通过NEF与PCF进行交互。
需要说明的是，上述AKMA服务的方案应用于非漫游场景，即终端当前的服务网络与终端的归属网络相同，并且AAnF以及AF属于终端的归属网络。而在漫游场景下，即终端当前的服务网络与终端的归属网络不同，或终端的服务网络为访问网络(也可称为拜访网络)的情况下，如何进行AKMA目前尚没有可行方案。其中，终端的归属网络与访问网络不同。
本申请实施例提供的方法，在漫游场景中，通过终端向归属网络中的AF发送服务网络标识符，并由归属网络中的AF向归属网络中的AAnF发送携带有服务网络标识符的应用密钥获取请求，从而使得归属网络中的AAnF根据服务网络标识符判断终端处于漫游场景的情况下，能够在服务网络的网元中确定服务网络中的代理实体，并向其发送应用密钥确认请求，使得服务网络中的相关网元获知终端与归属网络中的AF可建立基于AKMA的通信，从而实现在漫游场景下提供AKMA服务。
图3示出了本申请一个实施例提供的通信系统的系统架构的示意图。该系统架构可以包括：终端10、接入网设备20和核心网设备30。
终端10可以指UE(User Equipment，用户设备)、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、无线通信设备、用户代理或用户装置。可选地，终端还可以是蜂窝电话、无绳电话、SIP(Session Initiation Protocol，会话启动协议)电话、WLL(Wireless Local Loop，无线本地环路)站、PDA(Personal Digita1Assistant，个人数字处理)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，5GS(5th Generation System，第五代移动通信系统)中的终端或未来演进的PLMN(Pub1ic Land Mobi1e Network，公用陆地移动通信网络)中的终端等，本申请实施例对此并不限定。为方便描述，上面提到的设备统称为终端。终端10的数量通常为多个，每一个接入网设备20所管理的小区内可以分布一个或多个终端10。
接入网设备20是一种部署在接入网中用以为终端10提供无线通信功能的设备。接入网设备20可以包括各种形式的宏基站，微基站，中继站，接入点等等。在采用不同的无线接入技术的系统中，具备接入网设备功能的设备的名称可能会有所不同，例如在5G NR系统中，称为gNodeB或gNB。随着通信技术的演进，“接入网设备”这一名称可能会变化。为方便描述，本申请实施例中，上述为终端10提供无线通信功能的装置统称为接入网设备。可选地，通过接入网设备20，终端10和核心网设备30之间可以建立通信关系。示例性地，在LTE系统中，接入网设备20可以是EUTRAN(Evolved Universal Terrestrial Radio Access Network，演进的通用陆地无线网)或EUTRAN中的一个或多个eNodeB；在5G NR系统中，接入网设备20可以是RAN或RAN中的一个或多个gNB。
核心网设备30的功能主要是提供用户连接、对用户的管理以及对业务完成承载，作为承载网络提供到外部网络的接口。例如，5G NR系统中的核心网设备可以包括AMF(Access and Mobility Management Function，接入和移动性管理功能)实体、UPF(User Plane Function，用户平面功能)实体、SMF(Session Management Function，会话管理功能)实体、AKMA的锚点功能(AKMA Anchor Function，AAnF)实体和应用功能(Application Function，AF)实体等设备。接入网设备20和核心网设备30可统称为网络设备。
在一个示例中，接入网设备20与核心网设备30之间通过某种空中技术相互通信，例如5G NR系统中的NG接口。接入网设备20与终端10之间通过某种空中技术互相通信，例如Uu接口。
本申请实施例提供了一种密钥管理方法，用于在漫游场景下，生成位于归属网络中的AF与终端之间的通信密钥。其中，同一个终端与不同的AF之间的通信密钥可以相同或不同，本申请实施例仅针对位于归属网络中的某一个AF与终端之间的通信密钥进行说明。
在本申请实施例提供的密钥管理方法中，存在至少一个终端、至少一个AF、至少一个AAnF、至少一个代理实体。示意性的，本申请实施例提供的密钥管理方法应用于漫游场景中，AF和AAnF位于终端的归属网络中，终端和代理实体位于服务网络中。
其中，终端可使用UE表示，服务网络中的代理实体可使用AAnFProxy表示；归属网络与服务网络的覆盖范围不同，或相同，或有重合。
在一些实施例中，该AAnFProxy是服务网络中的单独的网络功能(Nextwork Function，NF)；或该AAnFProxy是服务网络中任一NF中的一部分；或该AAnFProxy是3GPP运营商域内的可信应用功能(Trusted AF)。
在一些实施例中，该终端类型包括但不限于手持设备、可穿戴设备、车载设备和物联网设备等，该终端可以是手机、平板电脑、电子书阅读器、膝上便携计算机、台式计算机、电视机、游戏机、增强现实(Augmented Reality，AR)终端、虚拟现实(Virtual Reality，VR)终端和混合现实(Mixed Reality，MR)终端、可穿戴设备、手柄和控制器等中的至少一种。
图4示出了本申请一个实施例提供的密钥管理方法的流程图。该方法应用于漫游场景中，该方法可以应用于图3所示的系统中。该方法包括：
步骤402：终端向归属网络中的AF发送应用会话建立请求。
示意性的，在归属网络中的AF与终端进行通信之前，需要确定二者之间是否可以使用AKMA服务。在步骤402之前，通过终端与AUSF之间的主鉴权流程，以使得终端和AUSF分别在本地生成相同的K AUSF、K AKMA以及A-KID。其中，主鉴权流程可参考前述内容，不再赘述。
可选地，归属网络中的AF与终端进行通信的先决条件是隐式特定应用于终端和AF的，或是由AF向终端显式指示的。
示意性的，应用会话建立请求用于触发应用会话的建立请求，应用会话建立请求可用Application Session Establishment Request表示。其中，应用会话建立请求中携带有AKMA密钥标识符和服务网络标识符，AKMA密钥标识符可用A-KID表示。
其中，A-KID为终端的AKMA密钥的标识符，服务网络标识符用于指示终端的服务网络，用于触发归属网络中的AAnF在终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求。
可选地，TS 33.535中限定了A-KID应采用国际互联网工程任务组(The Internet Engineering Task Force，IETF)请求注解(Request For Comments，RFC)7542中条款2.2规定的归属网络标识(Network Access Identifier，NAI)格式，比如：用户名@安全域。该用户名部分应包含路由指示(Routing Indicator，RID)和AKMA临时终端标识(AKMA Temporary UE Identifier，A-TID)，该安全域部分应包含归属网络标识。
可选地，该应用会话建立请求携带有终端的服务网络标识符可包括如下至少两种情况：
第一种情况：应用会话建立请求包括AKMA的AKMA密钥标识符，AKMA密钥标识符携带有服务网络标识符；
第二种情况：应用会话建立请求包括AKMA密钥标识符和服务网络标识符。其中，AKMA密钥标识符为终端的AKMA密钥的标识符。
可选地，应用会话建立请求中包括A-KID，终端还可以在应用会话建立请求之前或之后单独发送终端的服务网络标识符，可选地，该服务网络标识符指示有对应的应用会话建立请求或A-KID。
步骤404：归属网络中的AF向归属网络中的AAnF发送应用密钥获取请求。
该应用密钥获取请求携带有终端的服务网络标识符。归属网络中的AF在接收到终端发送的应用会话建立请求后，会向归属网络中的AAnF发送应用密钥获取请求。该应用密钥获取请求用于向归属网络中的AAnF请求归属网络中的AF的AKMA应用密钥信息。
在步骤404中，根据归属网络中的AF中的策略的不同，归属网络中的AF向归属网络中的AAnF发送的应用密钥获取请求也不同。
针对归属网络中的AF需要终端标识的情况：
在归属网络中的AF需要终端标识的情况下，归属网络中的AF向归属网络中的AAnF发送第一应用密钥获取请求。示例性的，第一应用密钥获取请求可使用Naanf_AKMA_ApplicationKey_Get Request表示。
可选地，第一应用密钥获取请求包括如下中的至少一种：
·AKMA密钥标识符；
·AF标识符。
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为归属网络中的AF的标识符。示例性的，AKMA密钥标识符可用A-KID表示，AF标识符可用AF_ID表示。A-KID由归属网络中的AF从终端处获取。可选地，AF_ID包含AF的全限定域名(Fully Qualified Domain Name，FQDN)和Ua*安全协议标识符。其中，Ua*安全协议标识符用于指 示AF将与UE一起使用的安全协议。
可选地，第一应用密钥获取请求包括AKMA密钥标识符和服务网络标识符(还可以包括AF标识符)。AKMA密钥标识符携带有服务网络标识符；或第一应用密钥获取请求通过单独的字段携带服务网络标识符。即第一应用密钥获取请求能够通过上述两种方式，实现携带服务网络标识符。
针对归属网络中的AF不需要终端标识的情况：
在归属网络中的AF不需要终端标识的情况下，归属网络中的AF向归属网络中的AAnF发送第二应用密钥获取请求。示例性的，第二应用密钥获取请求可使用Naanf_AKMA_ApplicationKey_AnonUser_Get Request表示。
可选地，第二应用密钥获取请求包括如下中的至少一种：
·AKMA密钥标识符；
·AF标识符。
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为归属网络中的AF的标识符。A-KID和AF_ID的相关描述可参考前述内容，此处不再赘述。
可选地，第二应用密钥获取请求包括AKMA密钥标识符和服务网络标识符(还可以包括AF标识符)。AKMA密钥标识符携带有服务网络标识符；或第二应用密钥获取请求通过单独的字段携带服务网络标识符。即第二应用密钥获取请求能够通过上述两种方式，实现携带服务网络标识符。
可选地，归属网络中的AF是否需要终端标识，是由归属网络中的AF中的策略指示的。
可选地，AKMA密钥标识符采用网络访问标识符NAI格式。示例地，TS 33.535中限定了A-KID应采用IETF RFC 7542中条款2.2规定的归属网络标识(Network Access Identifier，NAI)格式，比如：用户名@安全域。该用户名部分应包含路由指示(Routing Indicator，RID)和AKMA临时终端标识(AKMA Temporary UE Identifier，A-TID)，该安全域部分应包含归属网络标识。
可选地，在执行步骤103之前，归属网络中的AF还需要确定归属网络中的AAnF，例如归属网络中的AF通过归属网络中的NRF发现归属网络中的AAnF。
步骤406：归属网络中的AAnF基于终端的AKMA密钥生成归属网络中的AF的AKMA应用密钥。
其中，AKMA应用密钥(AKMA Application Key，K AF)用于指示终端和归属网络中的AF之间的通信密钥。示意性的，AKMA应用密钥基于终端的AKMA密钥生成。因此，执行步骤406需要满足如下条件：归属网络中的AAnF存储有终端的AKMA密钥。
其中，AKMA应用密钥的获取可通过如下方式实现：归属网络中的AAnF根据应用密钥获取请求得到A-KID和AF_ID。之后，归属网络中的AAnF可基于AKMA密钥和AF_ID生成AKMA应用密钥。
可选地，归属网络中的AAnF可根据A-KID对应的终端的AKMA密钥的存在，来验证终端是否被授权使用AKMA服务。
可选地，在执行步骤406之前，归属网络中的AAnF还需要执行如下步骤：根据授权信息或策略，确定归属网络中的AAnF向归属网络中的AF及服务网络中的代理实体提供服务。可选地，授权信息或策略，由本地策略或归属网络中的NRF提供。示例地，归属网络中的AAnF根据AF_ID关联的授权信息或策略，确定归属网络中的AAnF是否可以向归属网络中的AF及服务网络中的代理实体提供服务。
其中，在归属网络中的AAnF可以向归属网络中的AF及服务网络中的代理实体提供服务的情况下，归属网络中的AAnF执行步骤406；在归属网络中的AAnF不可以向归属网络中的AF及服务网络中的代理实体提供服务的情况下，归属网络中的AAnF可拒绝执行步骤406，并向归属网络中的AF反馈错误响应。
步骤408：归属网络中的AAnF向归属网络中的AF反馈应用密钥获取响应。
该应用密钥获取响应包括归属网络中的AF的AKMA应用密钥信息。可选地，AKMA应用密钥信息包括如下中的至少一种：
·AKMA应用密钥；
·AKMA应用密钥的过期时间；
·终端的签约永久标识(Subscription Permanent Identifier，SUPI)。
可选地，在归属网络中的AAnF中未存储有终端的AKMA密钥的情况下，归属网络中的AAnF会向归属网络中的AF反馈错误响应。
根据步骤404，归属网络中的AF向归属网络中的AAnF发送的应用密钥获取请求可能不同。相应的，归属网络中的AAnF向访问归属网络中的AF发送的应用密钥获取响应也不同。
针对归属网络中的AF需要终端标识的情况：
可选地，在归属网络中的AF需要终端标识的情况下，归属网络中的AAnF会接收到第一应用密钥获取请求。在生成AKMA应用密钥后，归属网络中的AAnF向归属网络中的AF发送第一应用密钥获取响应。
可选地，第一应用密钥获取响应可使用Naanf_AKMA_ApplicationKey_Get Response表示。
其中，第一应用密钥获取响应中携带的AF的AKMA应用密钥信息包括如下信息中的至少一种：AKMA应用密钥、AKMA应用密钥的过期时间、终端的SUPI。AKMA应用密钥的过期时间可使用K AF expTime表示。
针对归属网络中的AF不需要终端标识的情况：
可选地，在归属网络中的AF不需要终端标识的情况下，归属网络中的AAnF会接收到第二应用密钥获取请求。在生成AKMA应用密钥后，归属网络中的AAnF向归属网络中的AF发送第二应用密钥获取响应。
可选地，第二应用密钥获取响应可使用Naanf_AKMA_ApplicationKey_AnonUser_Get Response表示。
可选地，在归属网络中的AAnF接收到第二应用密钥获取请求的情况下，归属网络中的AAnF反馈的AKMA应用密钥信息不包括终端的SUPI，即该第二应用密钥获取响应不包括终端的SUPI。其中，第二应用密钥获取响应中携带的AF的AKMA应用密钥信息包括如下信息中的至少一种：AKMA应用密钥、AKMA应用密钥的过期时间。
步骤410：归属网络中的AAnF向服务网络中的代理实体发送应用密钥确认请求。
该应用密钥确认请求可通过AKMA Application Key Comfirmation Request表示。可选地，在终端的服务网络标识符与归属网络标识符不同的情况下，即终端处于漫游的情况下，归属网络中的AAnF会向服务网络中的代理实体发送应用密钥确认请求。在终端的服务网络标识符与归属网络标识符相同的情况下，则不会执行步骤410，而是在步骤408之后直接执行步骤414。
可选地，归属网络中的AAnF向服务网络中的代理实体发送应用密钥确认请求，是在归属网络中的AAnF向归属网络中的AF反馈应用密钥获取响应之前、之后或同时进行的。可选地，应用密钥确认请求包括如下中的至少一种：
·AKMA应用密钥；
·AKMA应用密钥的过期时间；
·AF标识符；
·AKMA密钥标识符；
·终端的SUPI。
其中，AF标识符为归属网络中的AF的标识符，AKMA密钥标识符为终端的AKMA密钥的标识符。可选地，AKMA密钥标识符中存储有终端的归属网络标识符。
需要说明的是，在终端的服务网络标识符与归属网络标识符不同的情况下，归属网络中的AAnF需要先在服务网络的网元中确定服务网络中的代理实体，之后才能够向服务网络中的代理实体发送应用密钥确认请求。可选地，在终端的服务网络标识符与归属网络标识符不同的情况下，归属网络中的AAnF在服务网络的网元中，通过服务网络和归属网络中的NRF发现服务网络中的代理实体。
其中，以归属网络中的NRF使用hNRF表示，服务网络中的NRF使用vNRF表示为例，归属网络中的AAnF发现服务网络中的代理实体的过程可实现为如下：归属网络中的AAnF通过服务网络标识符确定hNRF；hNRF根据归属网络中的AAnF传送的服务网络标识符，能够确定vNRF；vNRF根据预设策略判断归属网络中的AAnF有权为归属网络中的AF服务，随后授权归属网络中的AAnF访问服务网络中的代理实体。或服务网络中的代理实体的信息是在归属网络中的AAnF的本地配置的。此时归属网络中的AAnF无需通过NRF来发现服务网络中的代理实体。
可选地，上述服务网络中的代理实体是服务网络中单独的NF；或服务网络中的代理实体是服务网络中任一NF的一部分；或服务网络中的代理实体是3GPP运营商域内的可信应用功能。
步骤412：服务网络中的代理实体向归属网络中的AAnF发送应用密钥确认响应。
该应用密钥确认响应可通过AKMA Application Key Confirmation Response表示。该应用密钥确认响应用于服务网络中的代理实体向归属网络中的AAnF通知其已获知终端与归属网络中的AF可建立基于AKMA的通信，以及相关的AKMA应用密钥信息。可选地，在接收到归属网络中的AAnF发送的应用密钥确认请求后，服务网络中的代理实体会存储该应用密钥确认请求，之后再向归属网络中的AAnF发送应用密钥确认响应。
步骤414：归属网络中的AF向终端反馈应用会话建立响应。
该应用会话建立响应与应用会话建立请求对应，用于反馈归属网络中的AF的AKMA应用密钥信息，可用Application Session Establishment Response表示。终端在接收到应用会话建立响应后，可根据应用会话建立响应中携带的AF的AKMA应用密钥信息，确定AKMA应用密钥。
在一种实现场景下，归属网络中的AAnF中未携带终端的AKMA密钥。
在该情况下，归属网络中的AAnF向归属网络中的AF发送错误响应。在接收到归属网络中的AAnF反馈的错误响应的情况下，归属网络中的AF会向终端反馈应用会话的拒绝信息，拒绝信息中包括响应失败原因。基于此，归属网络中的AF通过包含响应失败原因来拒绝建立应用会话。
可选地，在终端接收到归属网络中的AF反馈的应用会话的拒绝信息后，终端可重新发送应用会话建立请求，该应用会话建立请求中携带有新的A-KID和/或服务网络标识符。
应当理解的是，上述内容中给出的实施例中，UE一侧的步骤可单独成为应用于终端中的密钥管理方法的一个实施例，归属网络中的AAnF一侧的步骤可单独成为应用于归属网络中的AAnF中的密钥管理方法的一个实施例，归属网络中的AF一侧的步骤可单独成为应用于归属网络中的AF中的密钥管理方法的一个实施例，服务网络中的代理实体一侧的步骤可单独成为应用于服务网络中的代理实体中的密钥管理方法的一个实施例。其中，密钥管理方法的步骤的具体阐释可参考上述内容，不再赘述。
综上所述，本实施例提供的方法，在漫游场景中，通过终端向归属网络中的AF发送服务网络标识符，并由归属网络中的AF向归属网络中的AAnF发送携带有服务网络标识符的应用密钥获取请求，从而使得归属网络中的AAnF根据服务网络标识符判断终端处于漫游场景的情况下，能够在服务网络的网元中确定服务网络中的代理实体，并向其发送应用密钥确认请求，使得服务网络中的相关网元获知终端与归属网络中的AF可建立基于AKMA的通信，从而实现在漫游场景下提供AKMA服务。
图5示出了本申请一个实施例提供的密钥管理方法的流程图。该方法应用于漫游场景中，该方法可以应用于服务网络中的代理实体。该方法包括：
步骤502：接收归属网络中的AAnF发送的应用密钥确认请求。
该应用密钥确认请求可通过AKMA Application Key Comfirmation Request表示。该应用密钥确认请求是在归属网络中的AAnF根据归属网络中的AF发送的应用密钥获取请求，确定了归属网络中的AF的AKMA应用密钥，并向归属网络中的AF反馈应用密钥获取响应的情况下，由归属网络中的AAnF向服务网络中的代理实体发送的。该应用密钥确认请求用于归属网络中的AAnF向服务网络中的代理实体通知在漫游的场景下，终端与归属网络中的AF可建立基于AKMA的通信，以及相关的AKMA应用密钥信息。
可选地，应用密钥确认请求是归属网络中的AAnF，在终端的服务网络标识符与归属网络标识符不同的情况下，即终端处于漫游的情况下，向服务网络中的代理实体发送的。终端会向归属网络中的AF发送服务网络标识符，归属网络中的AF向归属网络中的AAnF发送的应用密钥获取请求中携带有该服务网络标识符，归属网络中的AAnF根据该服务网络标识符能够判断终端是否处于漫游。
可选地，AKMA密钥标识符中存储有终端的服务网络标识符。终端通过向归属网络中的AF发送AKMA密钥标识符，从而实现向归属网络中的AF发送服务网络标识符。或终端的服务网络标识符也能够是终端直接向归属网络中的AF发送的。例如，终端向归属网络中的AF发送应用会话建立请求，该应用会话建立请求包括AKMA密钥标识符以及服务网络标识符。或终端在向归属网络中的AF发送应用会话建立请求之前或之后，单独发送服务网络标识符。该服务网络标识符用于触发归属网络中的AAnF在终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求。
可选地，应用密钥确认请求包括如下中的至少一种：
·AKMA应用密钥；
·AKMA应用密钥的过期时间；
·AF标识符；
·AKMA密钥标识符；
·终端的SUPI。
其中，AF标识符为归属网络中的AF的标识符，AKMA密钥标识符为终端的AKMA密钥的标识符。可选地，AKMA密钥标识符中存储有终端的归属网络标识符。
可选地，服务网络中的代理实体在接收归属网络中的AAnF发送的应用密钥确认请求后，还会向归属网络中的AAnF发送应用密钥确认响应。可选地，服务网络中的代理实体会先存储应用密钥确认请求，之后再向归属网络中的AAnF发送应用密钥确认响应。该应用密钥确认响应可通过AKMA Application Key Confirmation Response表示。
可选地，服务网络中的代理实体是在终端的服务网络标识符与归属网络标识符不同的情况下，由归属网络中的AAnF在服务网络的网元中确定的。例如，服务网络中的代理实体是在终端的服务网络标识符与归属网络标识符不同的情况下，由归属网络中的AAnF在服务网络的网元中，通过服务网络和归属网络中的网络存储功能NRF发现的。或服务网络中的代理实体的信息是在归属网络中的AAnF的本地配置的。此时归属网络中的AAnF无需通过NRF来发现服务网络中的代理实体。
可选地，上述服务网络中的代理实体是服务网络中单独的NF；或服务网络中的代理实体是服务网络中任一NF的一部分；或服务网络中的代理实体是3GPP运营商域内的可信应用功能。
综上所述，本实施例提供的方法，在漫游场景中，通过由归属网络中的AAnF向服务网络中的代理实体发送应用密钥确认请求，使得服务网络中的相关网元能够获知终端在漫游的 场景下，与归属网络中的AF可建立基于AKMA的通信，从而实现在漫游场景下提供AKMA服务。
图6示出了本申请一个实施例提供的密钥管理方法的流程图。该方法应用于漫游场景中，该方法可以应用于归属网络中的AF。该方法包括：
步骤602：接收终端发送的服务网络标识符和AKMA密钥标识符。
示意性的，服务网络标识符用于指示终端的服务网络，该服务网络标识符用于触发归属网络中的AAnF在终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求。AKMA密钥标识符为终端的AKMA密钥的标识符。
在一种可选的实现场景下，终端发生移动，从归属网络的覆盖区域移动到服务网络的覆盖区域内。此时，终端向归属网络中的AF发送服务网络标识符，该服务网络标识符与服务网络对应，由此可判断终端处于漫游场景下。
服务网络标识符可由终端单独发送给归属网络中的AF，也可以在终端向归属网络中的AF发送的应用会话建立请求中携带。例如，归属网络中的AF接收终端发送的应用会话建立请求，应用会话建立请求携带有服务网络标识符。
其中，服务网络标识符可由应用会话建立请求中的AKMA密钥标识符携带，也可由专用字段携带。比如，应用会话建立请求包括AKMA的AKMA密钥标识符，AKMA密钥标识符携带有服务网络标识符；或应用会话建立请求包括AKMA密钥标识符和服务网络标识符。其中，AKMA密钥标识符为终端的AKMA密钥的标识符。应用会话建立请求用于触发应用会话的建立请求，应用会话建立请求可用Application Session Establishment Request表示。
步骤604：向归属网络中的AAnF发送应用密钥获取请求。
该应用密钥获取请求携带有终端的服务网络标识符。归属网络中的AF在接收到终端发送的服务网络标识符(应用会话建立请求)后，会向归属网络中的AAnF发送应用密钥获取请求。该应用密钥获取请求用于向归属网络中的AAnF请求归属网络中的AF的AKMA应用密钥信息。
可选地，根据归属网络中的AF中的策略的不同，归属网络中的AF向归属网络中的AAnF发送的应用密钥获取请求也不同。
针对归属网络中的AF需要终端标识的情况：
在归属网络中的AF需要终端标识的情况下，归属网络中的AF向归属网络中的AAnF发送第一应用密钥获取请求。示例性的，第一应用密钥获取请求可使用Naanf_AKMA_ApplicationKey_Get Request表示。
可选地，第一应用密钥获取请求包括如下中的至少一种：
·AKMA密钥标识符；
·AF标识符。
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为归属网络中的AF的标识符。可选地，第一应用密钥获取请求包括AKMA密钥标识符和服务网络标识符(还可以包括AF标识符)。AKMA密钥标识符携带有服务网络标识符；或第一应用密钥获取请求通过单独的字段携带服务网络标识符。即第一应用密钥获取请求能够通过上述两种方式，实现携带服务网络标识符。
针对归属网络中的AF不需要终端标识的情况：
在归属网络中的AF不需要终端标识的情况下，归属网络中的AF向归属网络中的AAnF发送第二应用密钥获取请求。示例性的，第二应用密钥获取请求可使用Naanf_AKMA_ApplicationKey_AnonUser_Get Request表示。
可选地，第二应用密钥获取请求包括如下中的至少一种：
·AKMA密钥标识符；
·AF标识符。
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为归属网络中的AF的标识符。可选地，第二应用密钥获取请求包括AKMA密钥标识符和服务网络标识符(还可以包括AF标识符)。AKMA密钥标识符携带有服务网络标识符；或第二应用密钥获取请求通过单独的字段携带服务网络标识符。即第二应用密钥获取请求能够通过上述两种方式，实现携带服务网络标识符。
可选地，归属网络中的AF是否需要终端标识，是由归属网络中的AF中的策略指示的。
可选地，AKMA密钥标识符采用网络访问标识符NAI格式。可选地，归属网络中的AF还需要确定归属网络中的AAnF，例如归属网络中的AF通过归属网络中的NRF发现归属网络中的AAnF。
步骤606：接收归属网络中的AAnF反馈的应用密钥获取响应。
该应用密钥获取响应包括归属网络中的AF的AKMA应用密钥信息。在归属网络中的AAnF存储有终端的AKMA密钥的情况下，归属网络中的AAnF会基于终端的AKMA密钥生成归属网络中的AF的AKMA应用密钥。AKMA应用密钥用于指示终端和归属网络中的AF之间的通信密钥。
可选地，上述AKMA应用密钥信息包括如下中的至少一种：
·AKMA应用密钥；
·AKMA应用密钥的过期时间；
·终端的SUPI。
在步骤604中，归属网络中的AF向归属网络中的AAnF发送的应用密钥获取请求可能不同。相应的，归属网络中的AAnF向访问归属网络中的AF发送的应用密钥获取响应也不同。
针对归属网络中的AF需要终端标识的情况：
可选地，在归属网络中的AF需要终端标识的情况下，归属网络中的AAnF会接收到第一应用密钥获取请求。在生成AKMA应用密钥后，归属网络中的AAnF向归属网络中的AF发送第一应用密钥获取响应。
可选地，第一应用密钥获取响应可使用Naanf_AKMA_ApplicationKey_Get Response表示。
其中，第一应用密钥获取响应中携带的AF的AKMA应用密钥信息包括如下信息中的至少一种：AKMA应用密钥、AKMA应用密钥的过期时间、终端的SUPI。AKMA应用密钥的过期时间可使用K AF expTime表示。
针对归属网络中的AF不需要终端标识的情况：
可选地，在归属网络中的AF不需要终端标识的情况下，归属网络中的AAnF会接收到第二应用密钥获取请求。在生成AKMA应用密钥后，归属网络中的AAnF向归属网络中的AF发送第二应用密钥获取响应。
可选地，第二应用密钥获取响应可使用Naanf_AKMA_ApplicationKey_AnonUser_Get Response表示。
可选地，在归属网络中的AAnF接收到第二应用密钥获取请求的情况下，归属网络中的AAnF反馈的AKMA应用密钥信息不包括终端的SUPI，即该第二应用密钥获取响应不包括终端的SUPI。其中，第二应用密钥获取响应中携带的AF的AKMA应用密钥信息包括如下信息中的至少一种：AKMA应用密钥、AKMA应用密钥的过期时间。
归属网络中的AF在接收到终端发送的应用会话建立请求的情况下，会基于上述应用密钥获取响应，向终端反馈应用会话建立响应。
可选地，在归属网络中的AAnF中未存储有终端的AKMA密钥的情况下，归属网络中的AF会接收归属网络中的AAnF反馈的错误响应，该错误响应是在归属网络中的AAnF中未存 储有终端的AKMA密钥的情况下发送的。在该情况下，归属网络中的AF会向终端发送错误响应。例如，在接收到归属网络中的AAnF反馈的错误响应的情况下，归属网络中的AF会向终端反馈应用会话的拒绝信息，拒绝信息中包括响应失败原因。
综上所述，本实施例提供的方法，在漫游场景中，通过终端向归属网络中的AF发送服务网络标识符，并由归属网络中的AF向归属网络中的AAnF发送携带有服务网络标识符的应用密钥获取请求，从而使得归属网络中的AAnF根据服务网络标识符判断终端处于漫游场景的情况下，能够向服务网络中的代理实体发送应用密钥确认请求，使得服务网络中的相关网元获知终端与归属网络中的AF可建立基于AKMA的通信，从而实现在漫游场景下提供AKMA服务。
图7示出了本申请一个实施例提供的密钥管理方法的流程图。该方法应用于漫游场景中，该方法可以应用于归属网络中的AAnF。该方法包括：
步骤702：接收归属网络中的AF发送的应用密钥获取请求，应用密钥获取请求携带有服务网络标识符。
该应用密钥获取请求携带有终端的服务网络标识符。该服务网络标识符用于触发归属网络中的AAnF在终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求。
归属网络中的AF在接收到终端发送的应用会话建立请求后，会向归属网络中的AAnF发送应用密钥获取请求。该应用密钥获取请求用于向归属网络中的AAnF请求归属网络中的AF的AKMA应用密钥信息。
可选地，根据归属网络中的AF中的策略的不同，归属网络中的AF向归属网络中的AAnF发送的应用密钥获取请求也不同。
针对归属网络中的AF需要终端标识的情况：
在归属网络中的AF需要终端标识的情况下，归属网络中的AF向归属网络中的AAnF发送第一应用密钥获取请求。示例性的，第一应用密钥获取请求可使用Naanf_AKMA_ApplicationKey_Get Request表示。
可选地，第一应用密钥获取请求包括如下中的至少一种：
·AKMA密钥标识符；
·AF标识符。
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为归属网络中的AF的标识符。示例性的，AKMA密钥标识符可用A-KID表示，AF标识符可用AF_ID表示。可选地，第一应用密钥获取请求包括AKMA密钥标识符和服务网络标识符(还可以包括AF标识符)。AKMA密钥标识符携带有服务网络标识符；或第一应用密钥获取请求通过单独的字段携带服务网络标识符。即第一应用密钥获取请求能够通过上述两种方式，实现携带服务网络标识符。
针对归属网络中的AF不需要终端标识的情况：
在归属网络中的AF不需要终端标识的情况下，归属网络中的AF向归属网络中的AAnF发送第二应用密钥获取请求。示例性的，第二应用密钥获取请求可使用Naanf_AKMA_ApplicationKey_AnonUser_Get Request表示。
可选地，第二应用密钥获取请求包括如下中的至少一种：
·AKMA密钥标识符；
·AF标识符。
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为归属网络中的AF的标识符。可选地，第二应用密钥获取请求包括AKMA密钥标识符和服务网络标识符(还可以包括AF标识符)。AKMA密钥标识符携带有服务网络标识符；或第二应用密钥获取请求 通过单独的字段携带服务网络标识符。即第二应用密钥获取请求能够通过上述两种方式，实现携带服务网络标识符。
可选地，归属网络中的AF是否需要终端标识，是由归属网络中的AF中的策略指示的。
可选地，AKMA密钥标识符采用网络访问标识符NAI格式。
可选地，在执行步骤702之前，归属网络中的AF还需要确定归属网络中的AAnF。例如归属网络中的AF通过归属网络中的NRF发现归属网络中的AAnF。
步骤704：基于终端的AKMA密钥生成归属网络中的AF的AKMA应用密钥。
AKMA应用密钥用于指示终端和归属网络中的AF之间的通信密钥。示意性的，AKMA应用密钥基于终端的AKMA密钥生成。因此，在归属网络中的AAnF存储有终端的AKMA密钥的情况下，归属网络中的AAnF基于终端的AKMA密钥生成归属网络中的AF的AKMA应用密钥。
其中，AKMA应用密钥的获取可通过如下方式实现：归属网络中的AAnF根据应用密钥获取请求得到A-KID和AF_ID。之后，归属网络中的AAnF可基于AKMA密钥和AF_ID生成AKMA应用密钥。
可选地，归属网络中的AAnF可根据A-KID对应的终端的AKMA密钥的存在，来验证终端是否被授权使用AKMA服务。
可选地，在执行步骤704之前，归属网络中的AAnF还需要执行如下步骤：根据授权信息或策略，确定归属网络中的AAnF向归属网络中的AF及服务网络中的代理实体提供服务。可选地，授权信息或策略，由本地策略或归属网络中的NRF提供。示例地，归属网络中的AAnF根据AF_ID关联的授权信息或策略，确定归属网络中的AAnF是否可以向归属网络中的AF及服务网络中的代理实体提供服务。
其中，在归属网络中的AAnF可以向归属网络中的AF及服务网络中的代理实体提供服务的情况下，归属网络中的AAnF执行步骤704；在归属网络中的AAnF不可以向归属网络中的AF及服务网络中的代理实体提供服务的情况下，归属网络中的AAnF可拒绝执行步骤704，并向归属网络中的AF反馈错误响应。
步骤706：向归属网络中的AF反馈应用密钥获取响应。
该应用密钥获取响应包括归属网络中的AF的AKMA应用密钥信息。可选地，AKMA应用密钥信息包括如下中的至少一种：
·AKMA应用密钥；
·AKMA应用密钥的过期时间；
·终端的SUPI。
可选地，在归属网络中的AAnF中未存储有终端的AKMA密钥的情况下，归属网络中的AAnF会向归属网络中的AF反馈错误响应。
可选地，归属网络中的AF向归属网络中的AAnF发送的应用密钥获取请求可能不同。相应的，归属网络中的AAnF向访问归属网络中的AF发送的应用密钥获取响应也不同。
针对归属网络中的AF需要终端标识的情况：
可选地，在归属网络中的AF需要终端标识的情况下，归属网络中的AAnF会接收到第一应用密钥获取请求。在生成AKMA应用密钥后，归属网络中的AAnF向归属网络中的AF发送第一应用密钥获取响应。
可选地，第一应用密钥获取响应可使用Naanf_AKMA_ApplicationKey_Get Response表示。
其中，第一应用密钥获取响应中携带的AF的AKMA应用密钥信息包括如下信息中的至少一种：AKMA应用密钥、AKMA应用密钥的过期时间、终端的SUPI。AKMA应用密钥的过期时间可使用K AF expTime表示。
针对归属网络中的AF不需要终端标识的情况：
可选地，在归属网络中的AF不需要终端标识的情况下，归属网络中的AAnF会接收到第二应用密钥获取请求。在生成AKMA应用密钥后，归属网络中的AAnF向归属网络中的AF发送第二应用密钥获取响应。
可选地，第二应用密钥获取响应可使用Naanf_AKMA_ApplicationKey_AnonUser_Get Response表示。
可选地，在归属网络中的AAnF接收到第二应用密钥获取请求的情况下，归属网络中的AAnF反馈的AKMA应用密钥信息不包括终端的SUPI，即该第二应用密钥获取响应不包括终端的SUPI。其中，第二应用密钥获取响应中携带的AF的AKMA应用密钥信息包括如下信息中的至少一种：AKMA应用密钥、AKMA应用密钥的过期时间。
步骤708：向服务网络中的代理实体发送应用密钥确认请求。
该应用密钥确认请求可通过AKMA Application Key Comfirmation Request表示。可选地，在终端的服务网络标识符与归属网络标识符不同的情况下，即终端处于漫游的情况下，归属网络中的AAnF会向服务网络中的代理实体发送应用密钥确认请求。可选地，应用密钥确认请求包括如下中的至少一种：
·AKMA应用密钥；
·AKMA应用密钥的过期时间；
·AF标识符；
·AKMA密钥标识符；
·终端的SUPI。
其中，AF标识符为归属网络中的AF的标识符，AKMA密钥标识符为终端的AKMA密钥的标识符。可选地，AKMA密钥标识符中存储有终端的归属网络标识符。
需要说明的是，在终端的服务网络标识符与归属网络标识符不同的情况下，归属网络中的AAnF需要先在服务网络的网元中确定服务网络中的代理实体，之后才能够向服务网络中的代理实体发送应用密钥确认请求。可选地，在终端的服务网络标识符与归属网络标识符不同的情况下，归属网络中的AAnF在服务网络的网元中，通过服务网络和归属网络中的NRF发现服务网络中的代理实体。
可选地，上述服务网络中的代理实体是服务网络中单独的NF；或服务网络中的代理实体是服务网络中任一NF的一部分；或服务网络中的代理实体是3GPP运营商域内的可信应用功能。
可选地，归属网络中的AAnF在向服务网络中的代理实体发送应用密钥确认请求后，还会接收服务网络中的代理实体发送的应用密钥确认响应。该应用密钥确认响应可通过AKMA Application Key Confirmation Response表示。可选地，在接收到归属网络中的AAnF发送的应用密钥确认请求后，服务网络中的代理实体会存储该应用密钥确认请求，之后再向归属网络中的AAnF发送应用密钥确认响应。
综上所述，本实施例提供的方法，在漫游场景中，通过接收归属网络中的AF发送的携带有服务网络标识符的应用密钥获取请求，使得归属网络中的AAnF根据服务网络标识符判断终端处于漫游场景的情况下，能够在服务网络的网元中确定服务网络中的代理实体，并向其发送应用密钥确认请求，使得服务网络中的相关网元获知终端与归属网络中的AF可建立基于AKMA的通信，从而实现在漫游场景下提供AKMA服务。
图8示出了本申请一个实施例提供的密钥管理方法的流程图。该方法应用于漫游场景中，该方法可以应用于终端。该方法包括：
步骤802：向归属网络中的AF发送服务网络标识符和AKMA密钥标识符。
服务网络标识符用于指示终端的服务网络，该服务网络标识符用于触发归属网络中的AAnF在终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体 发送应用密钥确认请求。AKMA密钥标识符为终端的AKMA密钥的标识符。
在一种可选的实现场景下，终端发生移动，从归属网络的覆盖区域移动到服务网络的覆盖区域内。此时，终端向归属网络中的AF发送服务网络标识符，该服务网络标识符与服务网络对应，由此可判断终端处于漫游场景下。
服务网络标识符可由终端单独发送给归属网络中的AF，也可以在终端向归属网络中的AF发送的应用会话建立请求中携带。例如，归属网络中的AF接收终端发送的应用会话建立请求，应用会话建立请求携带有服务网络标识符。
其中，服务网络标识符可由应用会话建立请求中的AKMA密钥标识符携带，也可由专用字段携带。比如，应用会话建立请求包括AKMA的AKMA密钥标识符，AKMA密钥标识符携带有服务网络标识符；或应用会话建立请求包括AKMA密钥标识符和服务网络标识符。其中，AKMA密钥标识符为终端的AKMA密钥的标识符。应用会话建立请求用于触发应用会话的建立请求，应用会话建立请求可用Application Session Establishment Request表示。
终端在向归属网络中的AF发送应用会话建立请求后，归属网络中的AF会向归属网络中的AAnF发送应用密钥获取请求，该应用密钥获取请求携带有终端的服务网络标识符。之后由归属网络中的AAnF基于终端的AKMA密钥生成归属网络中的AF的AKMA应用密钥，并向归属网络中的AF反馈应用密钥获取响应，从而使得归属网络中的AF向终端反馈应用会话建立响应。并且，在终端的服务网络标识符与归属网络标识符不同的情况下，即终端处于漫游的情况下，归属网络中的AAnF会向服务网络中的代理实体发送应用密钥确认请求。该应用密钥确认请求用于归属网络中的AAnF向服务网络中的代理实体通知在漫游的场景下，终端与归属网络中的AF可建立基于AKMA的通信，以及相关的AKMA应用密钥信息。
综上所述，本实施例提供的方法，在漫游场景中，通过终端向归属网络中的AF发送服务网络标识符，使得归属网络中的AAnF根据服务网络标识符判断终端处于漫游场景的情况下，能够向服务网络中的代理实体发送应用密钥确认请求，使得服务网络中的相关网元获知终端与归属网络中的AF可建立基于AKMA的通信，从而实现在漫游场景下提供AKMA服务。
参考图5-8，图9示出了本申请一个示例性实施例提供的密钥管理方法的流程图，应用于漫游场景下。该方法包括：
步骤902：终端向归属网络中的AF发送服务网络标识符和AKMA密钥标识符。
服务网络标识符用于指示终端的服务网络，该服务网络标识符用于触发归属网络中的AAnF在终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求。AKMA密钥标识符为终端的AKMA密钥的标识符。
在一种可选的实现场景下，终端发生移动，从归属网络的覆盖区域移动到服务网络的覆盖区域内。此时，终端向归属网络中的AF发送服务网络标识符，该服务网络标识符与服务网络对应，由此可判断终端处于漫游场景下。
服务网络标识符可由终端单独发送给归属网络中的AF，也可以在终端向归属网络中的AF发送的应用会话建立请求中携带。例如，归属网络中的AF接收终端发送的应用会话建立请求，应用会话建立请求携带有服务网络标识符。
其中，服务网络标识符可由应用会话建立请求中的AKMA密钥标识符携带，也可由专用字段携带。比如，应用会话建立请求包括AKMA的AKMA密钥标识符，AKMA密钥标识符携带有服务网络标识符；或应用会话建立请求包括AKMA密钥标识符和服务网络标识符。其中，AKMA密钥标识符为终端的AKMA密钥的标识符。应用会话建立请求用于触发应用会话的建立请求，应用会话建立请求可用Application Session Establishment Request表示。
步骤904：归属网络中的AF向归属网络中的AAnF发送应用密钥获取请求。
该应用密钥获取请求携带有终端的服务网络标识符。归属网络中的AF在接收到终端发 送的应用会话建立请求后，会向归属网络中的AAnF发送应用密钥获取请求。该应用密钥获取请求用于向归属网络中的AAnF请求归属网络中的AF的AKMA应用密钥信息。
在步骤904中，根据归属网络中的AF中的策略的不同，归属网络中的AF向归属网络中的AAnF发送的应用密钥获取请求也不同。
针对归属网络中的AF需要终端标识的情况：
在归属网络中的AF需要终端标识的情况下，归属网络中的AF向归属网络中的AAnF发送第一应用密钥获取请求。示例性的，第一应用密钥获取请求可使用Naanf_AKMA_ApplicationKey_Get Request表示。
可选地，第一应用密钥获取请求包括如下中的至少一种：
·AKMA密钥标识符；
·AF标识符。
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为归属网络中的AF的标识符。可选地，第一应用密钥获取请求包括AKMA密钥标识符和服务网络标识符(还可以包括AF标识符)。AKMA密钥标识符携带有服务网络标识符；或第一应用密钥获取请求通过单独的字段携带服务网络标识符。即第一应用密钥获取请求能够通过上述两种方式，实现携带服务网络标识符。
针对归属网络中的AF不需要终端标识的情况：
在归属网络中的AF不需要终端标识的情况下，归属网络中的AF向归属网络中的AAnF发送第二应用密钥获取请求。示例性的，第二应用密钥获取请求可使用Naanf_AKMA_ApplicationKey_AnonUser_Get Request表示。
可选地，第二应用密钥获取请求包括如下中的至少一种：
·AKMA密钥标识符；
·AF标识符。
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为归属网络中的AF的标识符。可选地，第二应用密钥获取请求包括AKMA密钥标识符和服务网络标识符(还可以包括AF标识符)。AKMA密钥标识符携带有服务网络标识符；或第二应用密钥获取请求通过单独的字段携带服务网络标识符。即第二应用密钥获取请求能够通过上述两种方式，实现携带服务网络标识符。
可选地，归属网络中的AF是否需要终端标识，是由归属网络中的AF中的策略指示的。
可选地，AKMA密钥标识符采用网络访问标识符NAI格式。
可选地，在执行步骤904之前，归属网络中的AF还需要确定归属网络中的AAnF，例如归属网络中的AF通过归属网络中的NRF发现归属网络中的AAnF。
步骤906：归属网络中的AAnF基于终端的AKMA密钥生成归属网络中的AF的AKMA应用密钥。
AKMA应用密钥用于指示终端和归属网络中的AF之间的通信密钥。示意性的，AKMA应用密钥基于终端的AKMA密钥生成。因此，执行步骤906需要满足如下条件：归属网络中的AAnF存储有终端的AKMA密钥。
其中，AKMA应用密钥的获取可通过如下方式实现：归属网络中的AAnF根据应用密钥获取请求得到A-KID和AF_ID。之后，归属网络中的AAnF可基于AKMA密钥和AF_ID生成AKMA应用密钥。
可选地，归属网络中的AAnF可根据A-KID对应的终端的AKMA密钥的存在，来验证终端是否被授权使用AKMA服务。
可选地，在执行步骤906之前，归属网络中的AAnF还需要执行如下步骤：根据授权信息或策略，确定归属网络中的AAnF向归属网络中的AF及服务网络中的代理实体提供服务。可选地，授权信息或策略，由本地策略或归属网络中的NRF提供。示例地，归属网络中的 AAnF根据AF_ID关联的授权信息或策略，确定归属网络中的AAnF是否可以向归属网络中的AF及服务网络中的代理实体提供服务。
其中，在归属网络中的AAnF可以向归属网络中的AF及服务网络中的代理实体提供服务的情况下，归属网络中的AAnF执行步骤906；在归属网络中的AAnF不可以向归属网络中的AF及服务网络中的代理实体提供服务的情况下，归属网络中的AAnF可拒绝执行步骤906，并向归属网络中的AF反馈错误响应。
步骤908：归属网络中的AAnF向归属网络中的AF反馈应用密钥获取响应。
该应用密钥获取响应包括归属网络中的AF的AKMA应用密钥信息。可选地，AKMA应用密钥信息包括如下中的至少一种：
·AKMA应用密钥；
·AKMA应用密钥的过期时间；
·终端的SUPI。
可选地，在归属网络中的AAnF中未存储有终端的AKMA密钥的情况下，归属网络中的AAnF会向归属网络中的AF反馈错误响应。
归属网络中的AF向归属网络中的AAnF发送的应用密钥获取请求可能不同。相应的，归属网络中的AAnF向访问归属网络中的AF发送的应用密钥获取响应也不同。
针对归属网络中的AF需要终端标识的情况：
可选地，在归属网络中的AF需要终端标识的情况下，归属网络中的AAnF会接收到第一应用密钥获取请求。在生成AKMA应用密钥后，归属网络中的AAnF向归属网络中的AF发送第一应用密钥获取响应。
可选地，第一应用密钥获取响应可使用Naanf_AKMA_ApplicationKey_Get Response表示。
其中，第一应用密钥获取响应中携带的AF的AKMA应用密钥信息包括如下信息中的至少一种：AKMA应用密钥、AKMA应用密钥的过期时间、终端的SUPI。AKMA应用密钥的过期时间可使用K AF expTime表示。
针对归属网络中的AF不需要终端标识的情况：
可选地，在归属网络中的AF不需要终端标识的情况下，归属网络中的AAnF会接收到第二应用密钥获取请求。在生成AKMA应用密钥后，归属网络中的AAnF向归属网络中的AF发送第二应用密钥获取响应。
可选地，第二应用密钥获取响应可使用Naanf_AKMA_ApplicationKey_AnonUser_Get Response表示。
可选地，在归属网络中的AAnF接收到第二应用密钥获取请求的情况下，归属网络中的AAnF反馈的AKMA应用密钥信息不包括终端的SUPI，即该第二应用密钥获取响应不包括终端的SUPI。其中，第二应用密钥获取响应中携带的AF的AKMA应用密钥信息包括如下信息中的至少一种：AKMA应用密钥、AKMA应用密钥的过期时间。
步骤910：归属网络中的AAnF向服务网络中的代理实体发送应用密钥确认请求。
该应用密钥确认请求可通过AKMA Application Key Comfirmation Request表示。可选地，在终端的服务网络标识符与归属网络标识符不同的情况下，即终端处于漫游的情况下，归属网络中的AAnF会向服务网络中的代理实体发送应用密钥确认请求。可选地，应用密钥确认请求包括如下中的至少一种：
·AKMA应用密钥；
·AKMA应用密钥的过期时间；
·AF标识符；
·AKMA密钥标识符；
·终端的SUPI。
其中，AF标识符为归属网络中的AF的标识符，AKMA密钥标识符为终端的AKMA密钥的标识符。可选地，AKMA密钥标识符中存储有终端的归属网络标识符。
需要说明的是，在终端的服务网络标识符与归属网络标识符不同的情况下，归属网络中的AAnF需要先在服务网络的网元中确定服务网络中的代理实体，之后才能够向服务网络中的代理实体发送应用密钥确认请求。可选地，在终端的服务网络标识符与归属网络标识符不同的情况下，归属网络中的AAnF在服务网络的网元中，通过服务网络和归属网络中的NRF发现服务网络中的代理实体。
其中，以归属网络中的NRF使用hNRF表示，服务网络中的NRF使用vNRF表示为例，归属网络中的AAnF发现服务网络中的代理实体的过程可实现为如下：归属网络中的AAnF通过服务网络标识符确定hNRF；hNRF根据归属网络中的AAnF传送的服务网络标识符，能够确定vNRF；vNRF根据预设策略判断归属网络中的AAnF有权为归属网络中的AF服务，随后授权归属网络中的AAnF访问服务网络中的代理实体。或服务网络中的代理实体的信息是在归属网络中的AAnF的本地配置的。此时归属网络中的AAnF无需通过NRF来发现服务网络中的代理实体。
可选地，上述服务网络中的代理实体是服务网络中单独的NF；或服务网络中的代理实体是服务网络中任一NF的一部分；或服务网络中的代理实体是3GPP运营商域内的可信应用功能。
可选地，服务网络中的代理实体在接收到归属网络中的AAnF发送的应用密钥确认请求后，还会向归属网络中的AAnF发送应用密钥确认响应。该应用密钥确认响应可通过AKMA Application Key Confirmation Response表示。该应用密钥确认响应用于服务网络中的代理实体向归属网络中的AAnF通知其已获知终端与归属网络中的AF可建立基于AKMA的通信，以及相关的AKMA应用密钥信息。可选地，在接收到归属网络中的AAnF发送的应用密钥确认请求后，服务网络中的代理实体会存储该应用密钥确认请求，之后再向归属网络中的AAnF发送应用密钥确认响应。
可选地，归属网络中的AF在接收到归属网络中的AAnF反馈的应用密钥获取响应后，还会向终端反馈应用会话建立响应。该应用会话建立响应与应用会话建立请求对应，用于反馈归属网络中的AF的AKMA应用密钥信息，可用Application Session Establishment Response表示。终端在接收到应用会话建立响应后，可根据应用会话建立响应中携带的AF的AKMA应用密钥信息，确定AKMA应用密钥。
在一种实现场景下，归属网络中的AAnF中未携带终端的AKMA密钥。在该情况下，归属网络中的AAnF向归属网络中的AF发送错误响应。在接收到归属网络中的AAnF反馈的错误响应的情况下，归属网络中的AF会向终端反馈应用会话的拒绝信息，拒绝信息中包括响应失败原因。基于此，归属网络中的AF通过包含响应失败原因来拒绝建立应用会话。
可选地，在终端接收到归属网络中的AF反馈的应用会话的拒绝信息后，终端可重新发送应用会话建立请求，该应用会话建立请求中携带有新的A-KID和/或服务网络标识符。
应当理解的是，上述内容中给出的实施例中，UE一侧的步骤可单独成为应用于终端中的密钥管理方法的一个实施例，归属网络中的AAnF一侧的步骤可单独成为应用于归属网络中的AAnF中的密钥管理方法的一个实施例，归属网络中的AF一侧的步骤可单独成为应用于归属网络中的AF中的密钥管理方法的一个实施例，服务网络中的代理实体一侧的步骤可单独成为应用于服务网络中的代理实体中的密钥管理方法的一个实施例。其中，密钥管理方法的步骤的具体阐释可参考上述内容，不再赘述。
综上所述，本实施例提供的方法，在漫游场景中，通过终端向归属网络中的AF发送服务网络标识符，并由归属网络中的AF向归属网络中的AAnF发送携带有服务网络标识符的应用密钥获取请求，从而使得归属网络中的AAnF根据服务网络标识符判断终端处于漫游场景的情况下，能够在服务网络的网元中确定服务网络中的代理实体，并向其发送应用密钥确 认请求，使得服务网络中的相关网元获知终端与归属网络中的AF可建立基于AKMA的通信，从而实现在漫游场景下提供AKMA服务。
根据前述内容，基于归属网络中的AF中的策略的不同，应用密钥获取请求和应用密钥获取响应存在差异，由此导致归属网络中的AF的AKMA应用密钥信息也存在差异。
可选的，AKMA应用密钥信息包括如下中的至少一种：归属网络中的AF的AKMA应用密钥；AKMA应用密钥的过期时间；终端的SUPI。其中，该种情况是在归属网络中的AF需要终端标识的情况下实现的。
可选的，AKMA应用密钥信息包括如下中的至少一种：服务网络中的AF的AKMA应用密钥；AKMA应用密钥的过期时间。其中，该种情况是在归属网络中的AF不需要终端标识的情况下实现的。
上述两种实现方式中，基于归属网络中的AF的策略的不同，来确定归属网络中的AF是否需要终端标识，从而确定需要请求的AF的AKMA应用密钥信息。以下将根据归属网络中的AF是否需要终端标识进行举例：
一、针对归属网络中的AF需要终端标识的情况。
图10示出了本申请一个示例性实施例提供的密钥管理方法的流程图，应用于漫游场景下。该方法包括：
步骤1002：终端向归属网络中的AF发送应用会话建立请求。
应用会话建立请求用于触发应用会话的建立请求，应用会话建立请求可用Application Session Establishment Request表示。其中，应用会话建立请求中携带有AKMA密钥标识符和服务网络标识符，AKMA密钥标识符可用A-KID表示。其中，A-KID用于指示终端的AKMA密钥的标识符，服务网络标识符用于指示终端的服务网络。
可选地，该应用会话建立请求携带有终端的服务网络标识符可包括如下至少两种情况：
第一种情况：应用会话建立请求包括AKMA的AKMA密钥标识符，AKMA密钥标识符携带有服务网络标识符；
第二种情况：应用会话建立请求包括AKMA密钥标识符和服务网络标识符。其中，AKMA密钥标识符为终端的AKMA密钥的标识符。
可选地，应用会话建立请求中包括A-KID，终端还可以在应用会话建立请求之前或之后发送终端的服务网络标识符，可选地，该服务网络标识符指示有对应的应用会话建立请求或A-KID。
步骤1004：归属网络中的AF向归属网络中的AAnF发送第一应用密钥获取请求。
第一应用密钥获取请求携带有终端的服务网络标识符。该第一应用密钥获取请求用于向归属网络中的AAnF请求归属网络中的AF的AKMA应用密钥信息。
在归属网络中的AF需要终端标识的情况下，归属网络中的AF向归属网络中的AAnF发送第一应用密钥获取请求。示例性的，第一应用密钥获取请求可使用Naanf_AKMA_ApplicationKey_Get Request表示。
可选地，第一应用密钥获取请求包括如下中的至少一种：
·AKMA密钥标识符；
·AF标识符。
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为归属网络中的AF的标识符。示例性的，AKMA密钥标识符可用A-KID表示，AF标识符可用AF_ID表示。可选地，第一应用密钥获取请求包括AKMA密钥标识符和服务网络标识符(还可以包括AF标识符)。AKMA密钥标识符携带有服务网络标识符；或第一应用密钥获取请求通过单独的字段携带服务网络标识符。即第一应用密钥获取请求能够通过上述两种方式，实现携带服务网络标识符。
可选地，归属网络中的AF需要终端标识，是由归属网络中的AF中的策略指示的。
可选地，AKMA密钥标识符采用网络访问标识符NAI格式。可选地，在执行步骤1004之前，归属网络中的AF还需要确定归属网络中的AAnF，即本实施例提供的方法，还包括步骤1003：归属网络中的AF确定归属网络中的AAnF。例如，归属网络中的AF通过归属网络中的NRF发现归属网络中的AAnF。
步骤1006：归属网络中的AAnF基于终端的AKMA密钥生成归属网络中的AF的AKMA应用密钥。
其中，AKMA应用密钥(AKMA Application Key，K AF)用于指示终端和归属网络中的AF之间的通信密钥。示意性的，AKMA应用密钥基于终端的AKMA密钥生成。因此，执行步骤1006需要满足如下条件：归属网络中的AAnF存储有终端的AKMA密钥。
其中，AKMA应用密钥的获取可通过如下方式实现：归属网络中的AAnF根据应用密钥获取请求得到A-KID和AF_ID。之后，归属网络中的AAnF可基于AKMA密钥和AF_ID生成AKMA应用密钥。
可选地，归属网络中的AAnF可根据A-KID对应的终端的AKMA密钥的存在，来验证终端是否被授权使用AKMA服务。
可选地，在执行步骤1006之前，归属网络中的AAnF还需要执行如下步骤：根据授权信息或策略，确定归属网络中的AAnF向归属网络中的AF及服务网络中的代理实体提供服务。即本实施例提供的方法，还包括步骤1005：归属网络中的AAnF根据授权信息或策略，确定归属网络中的AAnF向归属网络中的AF及服务网络中的代理实体提供服务。可选地，授权信息或策略，由本地策略或归属网络中的NRF提供。示例地，归属网络中的AAnF根据AF_ID关联的授权信息或策略，确定归属网络中的AAnF是否可以向归属网络中的AF及服务网络中的代理实体提供服务。
其中，在归属网络中的AAnF可以向归属网络中的AF及服务网络中的代理实体提供服务的情况下，归属网络中的AAnF执行步骤1006；在归属网络中的AAnF不可以向归属网络中的AF及服务网络中的代理实体提供服务的情况下，归属网络中的AAnF可拒绝执行步骤1006，并向归属网络中的AF反馈错误响应。
步骤1008：归属网络中的AAnF向归属网络中的AF反馈第一应用密钥获取响应。
在归属网络中的AF需要终端标识的情况下，归属网络中的AAnF会接收到第一应用密钥获取请求。在生成AKMA应用密钥后，归属网络中的AAnF向归属网络中的AF发送第一应用密钥获取响应。
可选地，第一应用密钥获取响应可使用Naanf_AKMA_ApplicationKey_Get Response表示。
其中，第一应用密钥获取响应中携带的AF的AKMA应用密钥信息包括如下信息中的至少一种：AKMA应用密钥、AKMA应用密钥的过期时间、终端的SUPI。AKMA应用密钥的过期时间可使用K AF expTime表示。
可选地，在归属网络中的AAnF中未存储有终端的AKMA密钥的情况下，归属网络中的AAnF会向归属网络中的AF反馈错误响应。
步骤1010：归属网络中的AAnF向服务网络中的代理实体发送应用密钥确认请求。
该应用密钥确认请求可通过AKMA Application Key Comfirmation Request表示。可选地，在终端的服务网络标识符与归属网络标识符不同的情况下，即终端处于漫游的情况下，归属网络中的AAnF会向服务网络中的代理实体发送应用密钥确认请求。可选地，应用密钥确认请求包括如下中的至少一种：
·AKMA应用密钥；
·AKMA应用密钥的过期时间；
·AF标识符；
·AKMA密钥标识符；
·终端的SUPI。
其中，AF标识符为归属网络中的AF的标识符，AKMA密钥标识符为终端的AKMA密钥的标识符。可选地，AKMA密钥标识符中存储有终端的归属网络标识符。
需要说明的是，在终端的服务网络标识符与归属网络标识符不同的情况下，归属网络中的AAnF需要先在服务网络的网元中确定服务网络中的代理实体，之后才能够向服务网络中的代理实体发送应用密钥确认请求。即本实施例提供的方法，还包括步骤1009：归属网络中的AAnF在服务网络的网元中确定服务网络中的代理实体。可选地，在终端的服务网络标识符与归属网络标识符不同的情况下，归属网络中的AAnF在服务网络的网元中，通过服务网络和归属网络中的NRF发现服务网络中的代理实体。或服务网络中的代理实体的信息是在归属网络中的AAnF的本地配置的。此时归属网络中的AAnF无需通过NRF来发现服务网络中的代理实体。
可选地，上述服务网络中的代理实体是服务网络中单独的NF；或服务网络中的代理实体是服务网络中任一NF的一部分；或服务网络中的代理实体是3GPP运营商域内的可信应用功能。
步骤1012：服务网络中的代理实体向归属网络中的AAnF发送应用密钥确认响应。
该应用密钥确认响应可通过AKMA Application Key Confirmation Response表示。该应用密钥确认响应用于服务网络中的代理实体向归属网络中的AAnF通知其已获知终端与归属网络中的AF可建立基于AKMA的通信，以及相关的AKMA应用密钥信息。可选地，在接收到归属网络中的AAnF发送的应用密钥确认请求后，服务网络中的代理实体会存储该应用密钥确认请求，之后再向归属网络中的AAnF发送应用密钥确认响应。
步骤1014：归属网络中的AF向终端反馈应用会话建立响应。
该应用会话建立响应与应用会话建立请求对应，用于反馈归属网络中的AF的AKMA应用密钥信息，可用Application Session Establishment Response表示。终端在接收到应用会话建立响应后，可根据应用会话建立响应中携带的AF的AKMA应用密钥信息，确定AKMA应用密钥。
在一种实现场景下，归属网络中的AAnF中未携带终端的AKMA密钥。
在该情况下，归属网络中的AAnF向归属网络中的AF发送错误响应。在接收到归属网络中的AAnF反馈的错误响应的情况下，归属网络中的AF会向终端反馈应用会话的拒绝信息，拒绝信息中包括响应失败原因。基于此，归属网络中的AF通过包含响应失败原因来拒绝建立应用会话。
可选地，在终端接收到归属网络中的AF反馈的应用会话的拒绝信息后，终端可重新发送应用会话建立请求，该应用会话建立请求中携带有新的A-KID和/或服务网络标识符。
应当理解的是，上述内容中给出的实施例中，UE一侧的步骤可单独成为应用于终端中的密钥管理方法的一个实施例，归属网络中的AAnF一侧的步骤可单独成为应用于归属网络中的AAnF中的密钥管理方法的一个实施例，归属网络中的AF一侧的步骤可单独成为应用于归属网络中的AF中的密钥管理方法的一个实施例，服务网络中的代理实体一侧的步骤可单独成为应用于服务网络中的代理实体中的密钥管理方法的一个实施例。其中，密钥管理方法的步骤的具体阐释可参考上述内容，不再赘述。
综上所述，本实施例提供的方法，在漫游场景中，通过终端向归属网络中的AF发送服务网络标识符，并由归属网络中的AF向归属网络中的AAnF发送携带有服务网络标识符的应用密钥获取请求，从而使得归属网络中的AAnF根据服务网络标识符判断终端处于漫游场景的情况下，能够在服务网络的网元中确定服务网络中的代理实体，并向其发送应用密钥确认请求，使得服务网络中的相关网元获知终端与归属网络中的AF可建立基于AKMA的通信，从而实现在漫游场景下提供AKMA服务。
二、针对归属网络中的AF不需要终端标识的情况。
图11示出了本申请一个示例性实施例提供的密钥管理方法的流程图，应用于漫游场景下。该方法包括：
步骤1102：终端向归属网络中的AF发送应用会话建立请求。
应用会话建立请求用于触发应用会话的建立请求，应用会话建立请求可用Application Session Establishment Request表示。其中，应用会话建立请求中携带有AKMA密钥标识符和服务网络标识符，AKMA密钥标识符可用A-KID表示。其中，A-KID用于指示终端的AKMA密钥的标识符，服务网络标识符用于指示终端的服务网络。
可选地，该应用会话建立请求携带有终端的服务网络标识符可包括如下至少两种情况：
第一种情况：应用会话建立请求包括AKMA的AKMA密钥标识符，AKMA密钥标识符携带有服务网络标识符；
第二种情况：应用会话建立请求包括AKMA密钥标识符和服务网络标识符。其中，AKMA密钥标识符为终端的AKMA密钥的标识符。
可选地，应用会话建立请求中包括A-KID，终端还可以在应用会话建立请求之前或之后发送终端的服务网络标识符，可选地，该服务网络标识符指示有对应的应用会话建立请求或A-KID。
步骤1104：归属网络中的AF向归属网络中的AAnF发送第二应用密钥获取请求。
第二应用密钥获取请求携带有终端的服务网络标识符。该第二应用密钥获取请求用于向归属网络中的AAnF请求归属网络中的AF的AKMA应用密钥信息。
在归属网络中的AF不需要终端标识的情况下，归属网络中的AF向归属网络中的AAnF发送第二应用密钥获取请求。示例性的，第二应用密钥获取请求可使用Naanf_AKMA_ApplicationKey_AnonUser_Get Request表示。
可选地，第二应用密钥获取请求包括如下中的至少一种：
·AKMA密钥标识符；
·AF标识符。
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为归属网络中的AF的标识符。A-KID和AF_ID的相关描述可参考前述内容，此处不再赘述。可选地，第二应用密钥获取请求包括AKMA密钥标识符和服务网络标识符(还可以包括AF标识符)。AKMA密钥标识符携带有服务网络标识符；或第二应用密钥获取请求通过单独的字段携带服务网络标识符。即第二应用密钥获取请求能够通过上述两种方式，实现携带服务网络标识符。
可选地，归属网络中的AF不需要终端标识，是由归属网络中的AF中的策略指示的。
可选地，AKMA密钥标识符采用网络访问标识符NAI格式。可选地，在执行步骤1104之前，归属网络中的AF还需要确定归属网络中的AAnF，即本实施例提供的方法，还包括步骤1103：归属网络中的AF确定归属网络中的AAnF。例如，归属网络中的AF通过归属网络中的NRF发现归属网络中的AAnF。
步骤1106：归属网络中的AAnF基于终端的AKMA密钥生成归属网络中的AF的AKMA应用密钥。
其中，AKMA应用密钥(AKMA Application Key，K AF)用于指示终端和归属网络中的AF之间的通信密钥。示意性的，AKMA应用密钥基于终端的AKMA密钥生成。因此，执行步骤1106需要满足如下条件：归属网络中的AAnF存储有终端的AKMA密钥。
其中，AKMA应用密钥的获取可通过如下方式实现：归属网络中的AAnF根据应用密钥获取请求得到A-KID和AF_ID。之后，归属网络中的AAnF可基于AKMA密钥和AF_ID生成AKMA应用密钥。
可选地，归属网络中的AAnF可根据A-KID对应的终端的AKMA密钥的存在，来验证 终端是否被授权使用AKMA服务。
可选地，在执行步骤1106之前，归属网络中的AAnF还需要执行如下步骤：根据授权信息或策略，确定归属网络中的AAnF向归属网络中的AF及服务网络中的代理实体提供服务。即本实施例提供的方法，还包括步骤1105：归属网络中的AAnF根据授权信息或策略，确定归属网络中的AAnF向归属网络中的AF及服务网络中的代理实体提供服务。可选地，授权信息或策略，由本地策略或归属网络中的NRF提供。示例地，归属网络中的AAnF根据AF_ID关联的授权信息或策略，确定归属网络中的AAnF是否可以向归属网络中的AF及服务网络中的代理实体提供服务。
其中，在归属网络中的AAnF可以向归属网络中的AF及服务网络中的代理实体提供服务的情况下，归属网络中的AAnF执行步骤1106；在归属网络中的AAnF不可以向归属网络中的AF及服务网络中的代理实体提供服务的情况下，归属网络中的AAnF可拒绝执行步骤1106，并向归属网络中的AF反馈错误响应。
步骤1108：归属网络中的AAnF向归属网络中的AF反馈第二应用密钥获取响应。
在归属网络中的AF不需要终端标识的情况下，归属网络中的AAnF会接收到第二应用密钥获取请求。在生成AKMA应用密钥后，归属网络中的AAnF向归属网络中的AF发送第二应用密钥获取响应。
可选地，第二应用密钥获取响应可使用Naanf_AKMA_ApplicationKey_AnonUser_Get Response表示。
可选地，在归属网络中的AAnF接收到第二应用密钥获取请求的情况下，归属网络中的AAnF反馈的AKMA应用密钥信息不包括终端的SUPI，即该第二应用密钥获取响应不包括终端的SUPI。其中，第二应用密钥获取响应中携带的AF的AKMA应用密钥信息包括如下信息中的至少一种：AKMA应用密钥、AKMA应用密钥的过期时间。AKMA应用密钥的过期时间可使用K AF expTime表示。
可选地，在归属网络中的AAnF中未存储有终端的AKMA密钥的情况下，归属网络中的AAnF会向归属网络中的AF反馈错误响应。
步骤1110：归属网络中的AAnF向服务网络中的代理实体发送应用密钥确认请求。
该应用密钥确认请求可通过AKMA Application Key Comfirmation Request表示。可选地，在终端的服务网络标识符与归属网络标识符不同的情况下，即终端处于漫游的情况下，归属网络中的AAnF会向服务网络中的代理实体发送应用密钥确认请求。可选地，应用密钥确认请求包括如下中的至少一种：
·AKMA应用密钥；
·AKMA应用密钥的过期时间；
·AF标识符；
·AKMA密钥标识符；
·终端的SUPI。
其中，AF标识符为归属网络中的AF的标识符，AKMA密钥标识符为终端的AKMA密钥的标识符。可选地，AKMA密钥标识符中存储有终端的归属网络标识符。
需要说明的是，在终端的服务网络标识符与归属网络标识符不同的情况下，归属网络中的AAnF需要先在服务网络的网元中确定服务网络中的代理实体，之后才能够向服务网络中的代理实体发送应用密钥确认请求。即本实施例提供的方法，还包括步骤1109：归属网络中的AAnF在服务网络的网元中确定服务网络中的代理实体。可选地，在终端的服务网络标识符与归属网络标识符不同的情况下，归属网络中的AAnF在服务网络的网元中，通过服务网络和归属网络中的NRF发现服务网络中的代理实体。或服务网络中的代理实体的信息是在归属网络中的AAnF的本地配置的。此时归属网络中的AAnF无需通过NRF来发现服务网络中的代理实体。
可选地，上述服务网络中的代理实体是服务网络中单独的NF；或服务网络中的代理实体是服务网络中任一NF的一部分；或服务网络中的代理实体是3GPP运营商域内的可信应用功能。
步骤1112：服务网络中的代理实体向归属网络中的AAnF发送应用密钥确认响应。
该应用密钥确认响应可通过AKMA Application Key Confirmation Response表示。该应用密钥确认响应用于服务网络中的代理实体向归属网络中的AAnF通知其已获知终端与归属网络中的AF可建立基于AKMA的通信，以及相关的AKMA应用密钥信息。可选地，在接收到归属网络中的AAnF发送的应用密钥确认请求后，服务网络中的代理实体会存储该应用密钥确认请求，之后再向归属网络中的AAnF发送应用密钥确认响应。
步骤1114：归属网络中的AF向终端反馈应用会话建立响应。
该应用会话建立响应与应用会话建立请求对应，用于反馈归属网络中的AF的AKMA应用密钥信息，可用Application Session Establishment Response表示。终端在接收到应用会话建立响应后，可根据应用会话建立响应中携带的AF的AKMA应用密钥信息，确定AKMA应用密钥。
在一种实现场景下，归属网络中的AAnF中未携带终端的AKMA密钥。
在该情况下，归属网络中的AAnF向归属网络中的AF发送错误响应。在接收到归属网络中的AAnF反馈的错误响应的情况下，归属网络中的AF会向终端反馈应用会话的拒绝信息，拒绝信息中包括响应失败原因。基于此，归属网络中的AF通过包含响应失败原因来拒绝建立应用会话。
可选地，在终端接收到归属网络中的AF反馈的应用会话的拒绝信息后，终端可重新发送应用会话建立请求，该应用会话建立请求中携带有新的A-KID和/或服务网络标识符。
应当理解的是，上述内容中给出的实施例中，UE一侧的步骤可单独成为应用于终端中的密钥管理方法的一个实施例，归属网络中的AAnF一侧的步骤可单独成为应用于归属网络中的AAnF中的密钥管理方法的一个实施例，归属网络中的AF一侧的步骤可单独成为应用于归属网络中的AF中的密钥管理方法的一个实施例，服务网络中的代理实体一侧的步骤可单独成为应用于服务网络中的代理实体中的密钥管理方法的一个实施例。其中，密钥管理方法的步骤的具体阐释可参考上述内容，不再赘述。
综上所述，本实施例提供的方法，在漫游场景中，通过终端向归属网络中的AF发送服务网络标识符，并由归属网络中的AF向归属网络中的AAnF发送携带有服务网络标识符的应用密钥获取请求，从而使得归属网络中的AAnF根据服务网络标识符判断终端处于漫游场景的情况下，能够在服务网络的网元中确定服务网络中的代理实体，并向其发送应用密钥确认请求，使得服务网络中的相关网元获知终端与归属网络中的AF可建立基于AKMA的通信，从而实现在漫游场景下提供AKMA服务。
图12示出了本申请一个示例性实施例提供的密钥管理方法的流程图，应用于漫游场景下。该方法包括：
示意性的，在归属网络中的AF与UE进行通信之前，需要确定二者之间是否可以使用AKMA服务。在执行以下步骤之前，通过UE与AUSF之间的主鉴权流程，以使得UE和AUSF分别在本地生成相同的K AUSF、K AKMA以及A-KID。
其中，主鉴权流程可参考前述内容，不再赘述。
可选地，归属网络中的AF与UE进行通信的先决条件是隐式特定应用于UE和AF的，或是由AF向UE显式指示的。
步骤1202：UE向归属网络中的AF发送应用会话建立请求。
应用会话建立请求用于触发应用会话的建立请求，应用会话建立请求可用Application Session Establishment Request表示。
其中，应用会话建立请求中携带有A-KID和服务网络标识符。其中，A-KID用于指示UE的AKMA密钥的标识符，服务网络标识符用于指示UE的服务网络。服务网络标识符用于触发归属网络中的AAnF在UE的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的AAnFProxy发送应用密钥确认请求。
在一些实施例中，应用会话建立请求中包括A-KID，A-KID中携带有UE的服务网络标识符；或应用会话建立请求中包括A-KID和UE的服务网络标识符；或应用会话建立请求中包括A-KID，UE在应用会话建立请求之前或之后发送UE的服务网络标识符，可选地，该服务网络标识符指示有对应的应用会话建立请求或A-KID。
可选的，TS 33.535中限定了A-KID应采用IETF RFC 7542中条款2.2规定的NAI格式，比如：用户名@安全域。
步骤12041：归属网络中的AF向归属网络中的AAnF发送第一应用密钥获取请求。
第一应用密钥获取请求携带有UE的服务网络标识符。该第一应用密钥获取请求用于向归属网络中的AAnF请求归属网络中的AF的AKMA应用密钥信息。
在归属网络中的AF需要UE标识的情况下，归属网络中的AF向归属网络中的AAnF发送第一应用密钥获取请求。示例性的，第一应用密钥获取请求可使用Naanf_AKMA_ApplicationKey_Get Request表示。(The AF sends the request to AAnF via the Naanf_AKMA_ApplicationKey_Get service operation if the policy in AF indicates it needs the UE identity.)
可选地，第一应用密钥获取请求包括如下中的至少一种：
·A-KID；
·AF_ID。
可选地，第一应用密钥获取请求包括A-KID和服务网络标识符(还可以包括AF_ID)。A-KID携带有服务网络标识符；或第一应用密钥获取请求通过单独的字段携带服务网络标识符。即第一应用密钥获取请求能够通过上述两种方式，实现携带UE的服务网络标识符。
可选地，归属网络中的AF需要UE标识，是由归属网络中的AF中的策略指示的。
可选地，在执行步骤12041(12042)之前，归属网络中的AF还需要确定归属网络中的AAnF。例如，归属网络中的AF通过归属网络中的NRF发现归属网络中的AAnF。
在一些实施例中，NRF委托服务通信代理(Service Communication Proxy，SCP)来发现和选择出至少一个归属网络中的AAnfProxy。在此情况下，归属网络中的AAnfProxy NF向SCP发送所有可用的因素。
步骤12042：归属网络中的AF向归属网络中的AAnF发送第二应用密钥获取请求。
第二应用密钥获取请求携带有UE的服务网络标识符。该第二应用密钥获取请求用于向归属网络中的AAnF请求归属网络中的AF的AKMA应用密钥信息。
在归属网络中的AF不需要UE标识的情况下，归属网络中的AF向归属网络中的AAnF发送第二应用密钥获取请求。示例性的，第二应用密钥获取请求可使用Naanf_AKMA_ApplicationKey_AnonUser_Get Request表示。(The AF sends the request via the Naanf_AKMA_ApplicationKey_AnonUser_Get service operation if the policy in AF indicates it does not need the UE identity.)
可选地，第二应用密钥获取请求包括如下中的至少一种：
·A-KID；
·AF_ID。
可选地，第二应用密钥获取请求包括A-KID和服务网络标识符(还可以包括AF_ID)。A-KID携带有服务网络标识符；或第二应用密钥获取请求通过单独的字段携带服务网络标识符。即第二应用密钥获取请求能够通过上述两种方式，实现携带UE的服务网络标识符。
可选地，归属网络中的AF不需要UE标识，是由归属网络中的AF中的策略指示的。
应当理解的是，步骤12041和步骤12042择一执行，不能同时执行。
步骤1206：归属网络中的AAnF基于UE的AKMA密钥生成归属网络中的AF的AKMA应用密钥。
其中，AKMA应用密钥(K AF)用于指示UE和归属网络中的AF之间的通信密钥。示意性的，AKMA应用密钥基于UE的AKMA密钥生成。因此，执行步骤1206需要满足如下条件：归属网络中的AAnF存储有UE的AKMA密钥。
其中，AKMA应用密钥的获取可通过如下方式实现：归属网络中的AAnF根据第一应用密钥获取请求或第二应用密钥获取请求得到A-KID和AF_ID。之后，归属网络中的AAnF可基于AKMA密钥和AF_ID生成AKMA应用密钥。
可选地，归属网络中的AAnF可根据A-KID对应的UE的AKMA密钥的存在，来验证UE是否被授权使用AKMA服务。(The AAnF shall verify whether the AF is authorized to use AKMA based on the presence of the UE specific K AKMA key identified by the A-KID.)
可选地，在执行步骤1206之前，归属网络中的AAnF还需要执行如下步骤：根据AF_ID关联的授权信息或策略，确定归属网络中的AAnF是否可以向归属网络中的AF及服务网络中的代理实体提供服务。可选地，授权信息或策略，由本地策略或归属网络中的NRF提供。
其中，在归属网络中的AAnF可以向归属网络中的AF及服务网络中的代理实体提供服务的情况下，归属网络中的AAnF执行步骤1206；在归属网络中的AAnF不可以向归属网络中的AF及服务网络中的代理实体提供服务的情况下，归属网络中的AAnF可拒绝执行步骤1206，并向归属网络中的AF反馈错误响应。(The AAnF shall check whether the AAnF can provide the service to the AF based on the configured local policy or based on the authorization information or policy provided by the NRF in the home network using the AF_ID.If it succeeds,the following procedures are executed.Otherwise,the AAnF shall reject the procedure.)
在一种实现场景下，归属网络中的AAnF可能存储有UE的AKMA密钥，也可未存储UE的AKMA密钥。归属网络中的AAnF存储有UE的AKMA密钥的情况下，归属网络中的AAnF基于UE的AKMA密钥生成服务网络中的AF的AKMA应用密钥(If K AKMA is present in AAnF,the AAnF shall derive K AF for the AF.)；在归属网络中的AAnF未存储有UE的AKMA密钥的情况下，归属网络中的AAnF反馈错误响应(If K AKMA is not present in the AAnF,the AAnF shall continue with step 12081or 12082with an error response.)。
步骤12081：归属网络中的AAnF向归属网络中的AF反馈第一应用密钥获取响应。
在归属网络中的AF需要UE标识的情况下，归属网络中的AAnF会接收到第一应用密钥获取请求。在生成AKMA应用密钥后，归属网络中的AAnF向归属网络中的AF发送第一应用密钥获取响应。可选地，第一应用密钥获取响应可使用Naanf_AKMA_ApplicationKey_Get Response表示。(The AAnF sends Naanf_AKMA_ApplicationKey_Get response to the AF with SUPI,K AF and the K AF expiration time.)
其中，第一应用密钥获取响应中携带的AF的AKMA应用密钥信息包括如下信息中的至少一种：AKMA应用密钥、AKMA应用密钥的过期时间、UE的SUPI。
可选地，在归属网络中的AAnF中未存储有UE的AKMA密钥的情况下，归属网络中的AAnF会向归属网络中的AF反馈错误响应。
步骤12082：归属网络中的AAnF向归属网络中的AF反馈第二应用密钥获取响应。
在归属网络中的AF不需要UE标识的情况下，归属网络中的AAnF会接收到第二应用密钥获取请求。在生成AKMA应用密钥后，归属网络中的AAnF向归属网络中的AF发送第二应用密钥获取响应。可选地，第二应用密钥获取响应可使用Naanf_AKMA_ApplicationKey_AnonUser_Get Response表示。(The AAnF sends Naanf_AKMA_ApplicationKey_AnonUser_Get response to the AF with K AF and the K AF expiration time.)
可选地，在归属网络中的AAnF接收到第二应用密钥获取请求的情况下，该第二应用密钥获取响应不包括UE的SUPI。其中，第二应用密钥获取响应中携带的AF的AKMA应用密 钥信息包括如下信息中的至少一种：AKMA应用密钥、AKMA应用密钥的过期时间。
可选地，在归属网络中的AAnF中未存储有UE的AKMA密钥的情况下，归属网络中的AAnF会向归属网络中的AF反馈错误响应。
应当理解的是，步骤12081和步骤12082择一执行，不能同时执行。
步骤1212：归属网络中的AAnF向服务网络中的AAnFProxy发送应用密钥确认请求。
该应用密钥确认请求可通过AKMA Application Key Comfirmation Request表示。可选地，在UE的服务网络标识符与归属网络标识符不同的情况下，即UE处于漫游的情况下，归属网络中的AAnF会向服务网络中的AAnFProxy发送应用密钥确认请求。(If the serving network identifier of UE is different from the home network identifier of UE,the AAnF sends AKMA Application Key Confirmation request to the AAnFProxy in the visited network with K AF,K AF expiration time,AF_ID,A-KID,and SUPI of the UE.)
可选地，应用密钥确认请求包括如下中的至少一种：
·AKMA应用密钥；
·AKMA应用密钥的过期时间；
·AF_ID；
·A-KID；
·UE的SUPI。
可选地，AKMA密钥标识符中存储有UE的归属网络标识符。(Home network identifier is stored in the A-KID of the UE.)
需要说明的是，在UE的服务网络标识符与归属网络标识符不同的情况下，归属网络中的AAnF需要先在服务网络的网元中确定服务网络中的AAnFProxy，之后才能够向服务网络中的AAnFProxy发送应用密钥确认请求。(If the serving network identifier of UE is different from the home network identifier of UE,the AAnF in the home network performs AAnFProxy selection to allocate an AAnFProxy Instance in the visited network that handles the AKMA request.Otherwise,the AAnF does not need to discovery AAnFProxy in the serving network of UE.)
可选地，在UE的服务网络标识符与归属网络标识符不同的情况下，归属网络中的AAnF在服务网络的网元中，通过服务网络和归属网络中的NRF发现服务网络中的AAnFProxy。或服务网络中的AAnFProxy的信息是在归属网络中的AAnF的本地配置的。此时归属网络中的AAnF无需通过NRF来发现服务网络中的AAnFProxy。(The AAnF in the home network shall utilize the NRF in the home network and NRF in the visited network to discover the AAnFProxy instance(s)unless AAnFProxy information is available by other means,e.g.locally configured on the AAnF.)
可选地，上述服务网络中的AAnFProxy是服务网络中单独的NF；或服务网络中的AAnFProxy是服务网络中任一NF的一部分；或服务网络中的AAnFProxy是3GPP运营商域内的可信应用功能。
步骤1212：服务网络中的AAnFProxy向归属网络中的AAnF发送应用密钥确认响应。
该应用密钥确认响应可通过AKMA Application Key Confirmation Response表示。该应用密钥确认响应用于服务网络中的AAnFProxy向归属网络中的AAnF通知其已获知UE与归属网络中的AF可建立基于AKMA的通信，以及相关的AKMA应用密钥信息。
可选地，在接收到归属网络中的AAnF发送的应用密钥确认请求后，服务网络中的AAnFProxy会存储该应用密钥确认请求，之后再向归属网络中的AAnF发送应用密钥确认响应。(The AAnFProxy in the visited network firstly stores K AF,K AF expiration time,AF_ID,A-KID,and SUPI of the UE.Then it sends the AKMA Application Key Confirmation response to the AAnF in the home network of UE.)
步骤1214：归属网络中的AF向UE反馈应用会话建立响应。
该应用会话建立响应与应用会话建立请求对应，用于反馈归属网络中的AF的AKMA应 用密钥信息，可用Application Session Establishment Response表示。UE在接收到应用会话建立响应后，可根据应用会话建立响应中携带的AF的AKMA应用密钥信息，确定AKMA应用密钥。
在一种实现场景下，归属网络中的AAnF中未携带UE的AKMA密钥。
在该情况下，归属网络中的AAnF向归属网络中的AF发送错误响应。在接收到归属网络中的AAnF反馈的错误响应的情况下，归属网络中的AF会向UE反馈应用会话的拒绝信息，拒绝信息中包括响应失败原因。基于此，归属网络中的AF通过包含响应失败原因来拒绝建立应用会话。可选地，在UE接收到归属网络中的AF反馈的应用会话的拒绝信息后，UE可重新发送应用会话建立请求，该应用会话建立请求中携带有新的A-KID和/或服务网络标识符。(The AF sends the Application Session Establishment Response to the UE.If the information in step 12081 or 12082 indicates failure of AKMA key request,the AF shall reject the Application Session Establishment by including a failure cause.Afterwards,UE may trigger a new Application Session Establishment request with the latest A-KID to the AKMA AF.)
应当理解的是，上述内容中给出的实施例中，UE一侧的步骤可单独成为应用于UE中的密钥管理方法的一个实施例，归属网络中的AAnF一侧的步骤可单独成为应用于归属网络中的AAnF中的密钥管理方法的一个实施例，归属网络中的AF一侧的步骤可单独成为应用于归属网络中的AF中的密钥管理方法的一个实施例，服务网络中的AAnFProxy一侧的步骤可单独成为应用于服务网络中的AAnFProxy中的密钥管理方法的一个实施例。其中，密钥管理方法的步骤的具体阐释可参考上述内容，不再赘述。
示意性的，参考图12，不同的执行主体具有如下不同的功能。
1、UE一侧(UE side)：
UE能够通过应用会话建立请求消息向AF发送服务网络标识符。(The UE should be able to send serving network identifier to the AF via Application Session Establishment Request message.)。
2、服务网络中的AAnFProxy一侧(AAnFProxy side)：
服务网络中的AAnFProxy功能可以实现为服务网络中单独的网络功能，或是服务网络中任何NF的一部分，或是3GPP运营商域内的可信应用功能(AAnfProxy functionality may be implemented as a separate network function in the visited network,or be part of any NF in the visited network,or as a trusted AF.)。
服务网络中的AAnFProxy能够从UE归属网络中的AAnF获取K AF、K AF过期时间、AF_ID、A-KID和SUPI(AAnFProxy should be able to obtain K AF,K AF expiration time,AF_ID,A-KID,and SUPI of the UE from AAnF in the home network of UE.)。
3、归属网络中的AAnF一侧(AAnF side)：
归属网络中的AAnF能够从归属网络中的AF接收UE的服务网络标识符(AAnF should be able to receive Serving Network Identifier information of UE from the AF.)。
归属网络中的AAnF能够理解存储在A-KID中的服务网络标识符(AAnF should be able to understand Serving Network Identifier which is stored in the A-KID.)。
获取到UE的服务网络标识符的情况下，归属网络中的AAnf能够利用归属网络和服务网络中的NRF来选择服务网络中的AAnFProxy(With serving network identifier of UE,AAnf should be able to leverage NRFs in the home network and visited network to select AAnFProxy in the visited network.)。
归属网络中的AAnF能够将UE的K AF、K AF过期时间、AF_ID、A-KID和SUPI发送到服务网络中的AAnFProxy(AAnF should be able to send K AF,K AF expiration time,AF_ID,A-KID,and SUPI of the UE to AAnFProxy in the visited network of UE.)。
如果UE的服务网络标识符与UE的归属网络标识符不同，归属网络中的AAnF能够执行AAnFProxy选择以在服务网络中分配一个AAnFProxy实例来处理AKMA请求(If the  serving network identifier of UE is different from the home network identifier of UE,the AAnF in the home network should be able to perform AAnFProxy selection to allocate an AAnFProxy Instance in the visited network that handles the AKMA request.)。
4、归属网络中的AF(AF side)：
归属网络中的AF能够从UE接收A-KID和服务网络标识符(AF should be able to receive A-KID and serving network identifier from the UE.)。
归属网络中的AF能够理解服务网络标识符(AF should be able to understand the serving network identifier.)。
归属网络中的AF能够通过向其发送A-KID、AF_ID、服务网络标识符来向UE的归属网络中的AAnF请求K AF(AF should be able to request K AF from AAnF in the home network of UE by sending A-KID,AF_ID,serving network identifier to it.)。
综上所述，本实施例提供的方法，在漫游场景中，通过UE向归属网络中的AF发送服务网络标识符，并由归属网络中的AF向归属网络中的AAnF发送携带有服务网络标识符的应用密钥获取请求，从而使得归属网络中的AAnF根据服务网络标识符判断UE处于漫游场景的情况下，能够在服务网络的网元中确定服务网络中的AAnFProxy，并向其发送应用密钥确认请求，使得服务网络中的相关网元获知UE与归属网络中的AF可建立基于AKMA的通信，从而实现在漫游场景下提供AKMA服务。
需要说明的是，本申请实施例提供的方法步骤的先后顺序可以进行适当调整，步骤也可以根据情况进行相应增减，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化的方法，都应涵盖在本申请的保护范围之内，因此不再赘述。
图13示出了本申请一个示例性实施例提供的密钥管理装置的结构框图。该装置应用于漫游场景中，如图13所示，该装置包括：
接收模块1301，用于接收归属网络中的应用认证与密钥管理AKMA的锚点功能网元AAnF发送的应用密钥确认请求。
在一个可选的设计中，应用密钥确认请求包括如下中的至少一种：
AKMA应用密钥；
AKMA应用密钥的过期时间；
AF标识符；
AKMA密钥标识符；
终端的签约永久标识SUPI；
其中，AF标识符为归属网络中的AF的标识符，AKMA密钥标识符为终端的AKMA密钥的标识符。
在一个可选的设计中，应用密钥确认请求是AAnF在终端的服务网络标识符与归属网络标识符不同的情况下，向代理实体发送的。
在一个可选的设计中，所述装置还包括：
发送模块1302，用于向AAnF发送应用密钥确认响应。
在一个可选的设计中，所述装置还包括：
存储模块1303，用于存储应用密钥确认请求。
在一个可选的设计中，代理实体是在终端的服务网络标识符与归属网络标识符不同的情况下，由AAnF在服务网络的网元中确定的。
在一个可选的设计中，代理实体是由AAnF在服务网络的网元中，通过服务网络和归属网络中的网络存储功能NRF发现的。
在一个可选的设计中，代理实体的信息是在AAnF的本地配置的。
在一个可选的设计中，代理实体是服务网络中单独的网络功能NF；或
代理实体是服务网络中任一NF的一部分；或
代理实体是3GPP运营商域内的可信应用功能。
图14示出了本申请一个示例性实施例提供的密钥管理装置的结构框图。该装置应用于漫游场景中，如图14所示，该装置包括：
接收模块1401，用于接收终端发送的服务网络标识符和AKMA密钥标识符；
发送模块1402，用于向归属网络中的AAnF发送应用密钥获取请求，应用密钥获取请求携带有服务网络标识符，服务网络标识符用于触发AAnF在终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求；
接收模块1401，还用于接收AAnF反馈的应用密钥获取响应，应用密钥获取响应包括AF的AKMA应用密钥信息。
在一个可选的设计中，AKMA应用密钥信息包括如下中的至少一种：
AKMA应用密钥；
AKMA应用密钥的过期时间；
终端的SUPI。
在一个可选的设计中，发送模块1402，用于：
在AF需要终端标识的情况下，向AAnF发送第一应用密钥获取请求。
在一个可选的设计中，第一应用密钥获取请求包括如下中的至少一种：
AKMA密钥标识符；
AF标识符；
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为归属网络中的AF的标识符。
在一个可选的设计中，第一应用密钥获取请求包括AKMA密钥标识符和服务网络标识符；
AKMA密钥标识符携带有服务网络标识符；或第一应用密钥获取请求通过单独的字段携带服务网络标识符。
在一个可选的设计中，发送模块1402，用于：
在归属网络中的AF不需要终端标识的情况下，向归属网络中的AAnF发送第二应用密钥获取请求。
在一个可选的设计中，第二应用密钥获取请求包括如下中的至少一种：
AKMA密钥标识符；
AF标识符；
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为归属网络中的AF的标识符。
在一个可选的设计中，第二应用密钥获取请求包括AKMA密钥标识符和服务网络标识符；
AKMA密钥标识符携带有服务网络标识符；或第二应用密钥获取请求通过单独的字段携带服务网络标识符。
在一个可选的设计中，AF是否需要终端标识，是由AF中的策略指示的。
在一个可选的设计中，接收模块1401，用于：
接收AAnF反馈的错误响应，错误响应是在AAnF中未存储有终端的AKMA密钥的情况下发送的；
发送模块1402，用于向终端发送错误响应。
在一个可选的设计中，所述装置还包括：
发现模块1403，用于通过归属网络中的NRF发现AAnF。
在一个可选的设计中，接收模块1401，用于：
接收终端发送的应用会话建立请求，应用会话建立请求携带有服务网络标识符；
发送模块1402，用于向终端反馈应用会话建立响应。
在一个可选的设计中，应用会话建立请求包括AKMA的AKMA密钥标识符，AKMA密钥标识符携带有服务网络标识符；或应用会话建立请求包括AKMA密钥标识符和服务网络标识符；
其中，AKMA密钥标识符为终端的AKMA密钥的标识符。
在一个可选的设计中，发送模块1402，用于：
在接收到AAnF反馈的错误响应的情况下，向终端反馈应用会话的拒绝信息，拒绝信息中包括响应失败原因。
在一个可选的设计中，AKMA密钥标识符采用网络访问标识符NAI格式。
图15示出了本申请一个示例性实施例提供的密钥管理装置的结构框图。该装置应用于漫游场景中，如图15所示，该装置包括：
接收模块1501，用于接收归属网络中的AF发送的应用密钥获取请求，应用密钥获取请求携带有服务网络标识符；
生成模块1502，用于基于终端的AKMA密钥生成AF的AKMA应用密钥；
发送模块1503，用于向AF反馈应用密钥获取响应，应用密钥获取响应包括AF的AKMA应用密钥信息；
发送模块1503，还用于向服务网络中的代理实体发送应用密钥确认请求。
在一个可选的设计中，AKMA应用密钥信息包括如下中的至少一种：
AKMA应用密钥；
AKMA应用密钥的过期时间；
终端的SUPI。
在一个可选的设计中，接收模块1501，用于：
接收AF发送的第一应用密钥获取请求，第一应用密钥获取请求用于指示AF需要终端标识。
在一个可选的设计中，第一应用密钥获取请求包括如下中的至少一种：
AKMA密钥标识符；
AF标识符；
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为AF的标识符。
在一个可选的设计中，第一应用密钥获取请求包括AKMA密钥标识符和服务网络标识符；
AKMA密钥标识符携带有服务网络标识符；或第一应用密钥获取请求通过单独的字段携带服务网络标识符。
在一个可选的设计中，接收模块1501，用于：
接收AF发送的第二应用密钥获取请求，第二应用密钥获取请求用于指示AF不需要终端标识。
在一个可选的设计中，第二应用密钥获取请求包括如下中的至少一种：
AKMA密钥标识符；
AF标识符；
其中，AKMA密钥标识符为终端的AKMA密钥的标识符，AF标识符为AF的标识符。
在一个可选的设计中，第二应用密钥获取请求包括AKMA密钥标识符和服务网络标识符；
AKMA密钥标识符携带有服务网络标识符；或第二应用密钥获取请求通过单独的字段携带服务网络标识符。
在一个可选的设计中，在AAnF接收到第二应用密钥获取请求的情况下，AAnF反馈的AKMA应用密钥信息不包括终端的SUPI。
在一个可选的设计中，发送模块1503，用于：
在AAnF中未存储有终端的AKMA密钥的情况下，向AF反馈错误响应。
在一个可选的设计中，所述装置还包括：
确定模块1504，用于根据授权信息或策略，确定AAnF向AF及服务网络中的代理实体提供服务。
在一个可选的设计中，授权信息或策略，由本地策略或归属网络中的NRF提供。
在一个可选的设计中，应用密钥确认请求包括如下中的至少一种：
AKMA应用密钥；
AKMA应用密钥的过期时间；
AF标识符；
AKMA密钥标识符；
终端的SUPI；
其中，AF标识符为AF的标识符，AKMA密钥标识符为终端的AKMA密钥的标识符。
在一个可选的设计中，发送模块1503，用于：
在终端的服务网络标识符与归属网络标识符不同的情况下，向代理实体发送应用密钥确认请求。
在一个可选的设计中，接收模块1501，用于：
接收代理实体发送的应用密钥确认响应。
在一个可选的设计中，所述装置还包括：
确定模块1504，用于在终端的服务网络标识符与归属网络标识符不同的情况下，在服务网络的网元中确定代理实体。
在一个可选的设计中，确定模块1504，用于：
在终端的服务网络标识符与归属网络标识符不同的情况下，在服务网络的网元中，通过服务网络和归属网络中的NRF发现代理实体。
图16示出了本申请一个示例性实施例提供的密钥管理装置的结构框图。该装置应用于漫游场景中，如图16所示，该装置包括：
发送模块1601，用于向归属网络中的AF发送服务网络标识符和AKMA密钥标识符，服务网络标识符用于触发归属网络中的AAnF在终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求，AKMA密钥标识符为终端的AKMA密钥的标识符。
在一个可选的设计中，发送模块1601，用于：
向AF发送应用会话建立请求，应用会话建立请求携带有服务网络标识符；
装置还包括：
接收模块1602，用于接收AF反馈的应用会话建立响应。
在一个可选的设计中，应用会话建立请求包括AKMA的AKMA密钥标识符，AKMA密钥标识符携带有服务网络标识符；或应用会话建立请求包括AKMA密钥标识符和服务网络标识符；
其中，AKMA密钥标识符为终端的AKMA密钥的标识符。
需要说明的一点是，上述实施例提供的装置在实现其功能时，仅以上述各个功能模块的划分进行举例说明，实际应用中，可以根据实际需要而将上述功能分配由不同的功能模块完成，即将设备的内容结构划分成不同的功能模块，以完成以上描述的全部或部分功能。
关于上述实施例中的装置，其中各个模块执行操作的具体方式已经在有关该方法的实施 例中进行了详细描述，此处将不做详细阐述说明。
图17示出了本申请一个示例性实施例提供的通信设备(终端或网络设备)的结构示意图，该通信设备170包括：处理器1701、接收器1702、发射器1703、存储器1704和总线1705。
处理器1701包括一个或一个以上处理核心，处理器1701通过运行软件程序以及模块，从而执行各种功能应用以及信息处理。
接收器1702和发射器1703可以实现为一个通信组件，该通信组件可以是一块通信芯片。
存储器1704通过总线1705与处理器1701相连。
存储器1704可用于存储至少一个指令，处理器1701用于执行该至少一个指令，以实现上述方法实施例中的各个步骤。
此外，存储器1704可以由任何类型的易失性或非易失性存储设备或它们的组合实现，易失性或非易失性存储设备包括但不限于：磁盘或光盘，电可擦除可编程只读存储器(Erasable Programmable Read Only Memory，EEPROM)，可擦除可编程只读存储器(Erasable Programmable Read Only Memory，EPROM)，静态随时存取存储器(Static Random Access Memory，SRAM)，只读存储器(Read-Only Memory，ROM)，磁存储器，快闪存储器，可编程只读存储器(Programmable Read-Only Memory，PROM)。
其中，当通信设备实现为终端时，本申请实施例涉及的通信设备中的处理器和收发器，可以一起实现成为一个通信芯片，或收发器单独形成通信芯片。其中，收发器中的发射器执行上述任一所示的方法中由终端执行的发送步骤，收发器中的接收器执行上述任一所示的方法中由终端执行的接收步骤，处理器执行发送和接收步骤之外的步骤，此处不再赘述。
其中，当通信设备实现为网络设备时，本申请实施例涉及的通信设备中的处理器和收发器，可以一起实现成为一个通信芯片，或收发器单独形成通信芯片。其中，收发器中的发射器执行上述任一所示的方法中由网络设备执行的发送步骤，收发器中的接收器执行上述任一所示的方法中由网络设备执行的接收步骤，处理器执行发送和接收步骤之外的步骤，此处不再赘述。
图18示出了本申请一个示例性实施例提供的网元设备的结构示意图，该网元设备包括：处理器1801、存储器1802和通信组件1803。
处理器1801与存储器1802相连，存储器1802与存储器1803相连。
存储器1802可用于存储至少一个指令和计算机程序，处理器1801用于执行该至少一个指令和计算机程序，以实现上述方法实施例中由核心网网元执行的密钥管理方法的处理步骤。其中，处理步骤是指除接收步骤和发送步骤之外的其他步骤。
通信组件1803用于实现上述方法实施例中由核心网网元执行的密钥管理方法的接收步骤和发送步骤。
本申请实施例还提供了一种服务网络中的代理实体，代理实体包括通信组件；通信组件，用于接收归属网络中的应用认证与密钥管理AKMA的锚点功能网元AAnF发送的应用密钥确认请求。
本申请实施例还提供了一种应用功能AF，AF包括通信组件；通信组件，用于接收终端发送的服务网络标识符和AKMA密钥标识符；向归属网络中的AAnF发送应用密钥获取请求，应用密钥获取请求携带有服务网络标识符，服务网络标识符用于触发归属网络中的AAnF在终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求；接收归属网络中的AAnF反馈的应用密钥获取响应，应用密钥获取响应包括归属网络中的AF的AKMA应用密钥信息。
本申请实施例还提供了一种应用认证与密钥管理AKMA的锚点功能网元AAnF，AAnF包括通信组件和处理器；通信组件，用于接收归属网络中的AF发送的应用密钥获取请求， 应用密钥获取请求携带有服务网络标识符；处理器，用于基于终端的AKMA密钥生成归属网络中的AF的AKMA应用密钥；通信组件，用于向归属网络中的AF反馈应用密钥获取响应，应用密钥获取响应包括归属网络中的AF的AKMA应用密钥信息；通信组件，用于向服务网络中的代理实体发送应用密钥确认请求。
本申请实施例还提供了一种终端，终端包括收发器；收发器，用于向归属网络中的AF发送服务网络标识符和AKMA密钥标识符，服务网络标识符用于触发归属网络中的AAnF在终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求，AKMA密钥标识符为终端的AKMA密钥的标识符。
在示例性实施例中，还提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有至少一条指令、至少一段程序、代码集或指令集，所述至少一条指令、所述至少一段程序、所述代码集或指令集由所述处理器加载并执行以实现上述各个方法实施例提供的密钥管理方法。
在示例性实施例中，还提供了一种芯片，所述芯片包括可编程逻辑电路和/或程序指令，当所述芯片在通信设备上运行时，用于实现上述各个方法实施例提供的密钥管理方法。
在示例性实施例中，还提供了一种计算机程序产品，该计算机程序产品在计算机设备的处理器上运行时，使得计算机设备执行上述密钥管理方法。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本申请实施例所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上所述仅为本申请的示例性实施例，并不用以限制本申请，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (40)

  1. 一种密钥管理方法，其特征在于，所述方法应用于漫游场景中，所述方法由服务网络中的代理实体执行，所述方法包括：
    接收归属网络中的应用认证与密钥管理AKMA的锚点功能网元AAnF发送的应用密钥确认请求。
  2. 根据权利要求1所述的方法，其特征在于，所述应用密钥确认请求包括如下中的至少一种：
    AKMA应用密钥；
    所述AKMA应用密钥的过期时间；
    AF标识符；
    AKMA密钥标识符；
    终端的签约永久标识SUPI；
    其中，所述AF标识符为所述归属网络中的AF的标识符，所述AKMA密钥标识符为所述终端的AKMA密钥的标识符。
  3. 根据权利要求1所述的方法，其特征在于，所述应用密钥确认请求是所述AAnF在终端的服务网络标识符与归属网络标识符不同的情况下，向所述代理实体发送的。
  4. 根据权利要求1至3任一所述的方法，其特征在于，所述方法还包括：
    向所述AAnF发送应用密钥确认响应。
  5. 根据权利要求4所述的方法，其特征在于，所述方法还包括：
    存储所述应用密钥确认请求。
  6. 根据权利要求1至3任一所述的方法，其特征在于，
    所述代理实体是所述服务网络中单独的网络功能NF；或
    所述代理实体是所述服务网络中任一NF的一部分；或
    所述代理实体是第三代合作伙伴项目3GPP运营商域内的可信应用功能。
  7. 一种密钥管理方法，其特征在于，所述方法应用于漫游场景中，所述方法由归属网络中的AF执行，所述方法包括：
    接收终端发送的服务网络标识符和AKMA密钥标识符；
    向所述归属网络中的AAnF发送应用密钥获取请求，所述应用密钥获取请求携带有所述服务网络标识符，所述服务网络标识符用于触发所述AAnF在所述终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求；
    接收所述AAnF反馈的应用密钥获取响应，所述应用密钥获取响应包括所述AF的AKMA应用密钥信息。
  8. 根据权利要求7所述的方法，其特征在于，所述AKMA应用密钥信息包括如下中的至少一种：
    AKMA应用密钥；
    所述AKMA应用密钥的过期时间；
    所述终端的SUPI。
  9. 根据权利要7所述的方法，其特征在于，所述向所述归属网络中的AAnF发送应用密钥获取请求，包括：
    在所述AF需要终端标识的情况下，向所述AAnF发送第一应用密钥获取请求。
  10. 根据权利要求9所述的方法，其特征在于，所述第一应用密钥获取请求包括如下中的至少一种：
    AKMA密钥标识符；
    AF标识符；
    其中，所述AKMA密钥标识符为所述终端的AKMA密钥的标识符，所述AF标识符为所述归属网络中的AF的标识符。
  11. 根据权利要求10所述的方法，其特征在于，所述第一应用密钥获取请求包括所述AKMA密钥标识符和所述服务网络标识符；
    所述AKMA密钥标识符携带有所述服务网络标识符；或所述第一应用密钥获取请求通过单独的字段携带所述服务网络标识符。
  12. 根据权利要求7所述的方法，其特征在于，所述向所述归属网络中的AAnF发送应用密钥获取请求，包括：
    在所述归属网络中的AF不需要终端标识的情况下，向所述归属网络中的AAnF发送第二应用密钥获取请求。
  13. 根据权利要求12所述的方法，其特征在于，所述第二应用密钥获取请求包括如下中的至少一种：
    AKMA密钥标识符；
    AF标识符；
    其中，所述AKMA密钥标识符为所述终端的AKMA密钥的标识符，所述AF标识符为所述归属网络中的AF的标识符。
  14. 根据权利要求13所述的方法，其特征在于，所述第二应用密钥获取请求包括所述AKMA密钥标识符和所述服务网络标识符；
    所述AKMA密钥标识符携带有所述服务网络标识符；或所述第二应用密钥获取请求通过单独的字段携带所述服务网络标识符。
  15. 根据权利要求9或12所述的方法，其特征在于，所述AF是否需要所述终端标识，是由所述AF中的策略指示的。
  16. 根据权利要求7至14任一所述的方法，其特征在于，所述方法还包括：
    接收所述AAnF反馈的错误响应，所述错误响应是在所述AAnF中未存储有所述终端的AKMA密钥的情况下发送的；
    向所述终端发送所述错误响应。
  17. 根据权利要求7至14任一所述的方法，其特征在于，所述方法还包括：
    通过所述归属网络中的NRF发现所述AAnF。
  18. 根据权利要求7至14任一所述的方法，其特征在于，所述接收终端发送的服务网络标识符，包括：
    接收所述终端发送的应用会话建立请求，所述应用会话建立请求携带有所述服务网络标识符；
    所述方法还包括：
    向所述终端反馈应用会话建立响应。
  19. 根据权利要求18所述的方法，其特征在于，
    所述应用会话建立请求包括AKMA的AKMA密钥标识符，所述AKMA密钥标识符携带有所述服务网络标识符；或所述应用会话建立请求包括所述AKMA密钥标识符和所述服务网络标识符；
    其中，所述AKMA密钥标识符为所述终端的AKMA密钥的标识符。
  20. 根据权利要求18所述的方法，其特征在于，所述方法还包括：
    在接收到所述AAnF反馈的错误响应的情况下，向所述终端反馈应用会话的拒绝信息，所述拒绝信息中包括响应失败原因。
  21. 一种密钥管理方法，其特征在于，所述方法应用于漫游场景中，所述方法由归属网络中的AAnF执行，所述方法包括：
    接收所述归属网络中的AF发送的应用密钥获取请求，所述应用密钥获取请求携带有服务网络标识符；
    基于终端的AKMA密钥生成所述AF的AKMA应用密钥；
    向所述AF反馈应用密钥获取响应，所述应用密钥获取响应包括所述AF的AKMA应用密钥信息；
    向服务网络中的代理实体发送应用密钥确认请求。
  22. 根据权利要21所述的方法，其特征在于，所述接收所述归属网络中的AF发送的应用密钥获取请求，包括：
    接收所述AF发送的第一应用密钥获取请求，所述第一应用密钥获取请求用于指示所述AF需要终端标识。
  23. 根据权利要21所述的方法，其特征在于，所述接收所述归属网络中的AF发送的应用密钥获取请求，包括：
    接收所述AF发送的第二应用密钥获取请求，所述第二应用密钥获取请求用于指示所述AF不需要终端标识。
  24. 根据权利要求23所述的方法，其特征在于，在所述AAnF接收到所述第二应用密钥获取请求的情况下，所述AAnF反馈的所述AKMA应用密钥信息不包括所述终端的SUPI。
  25. 根据权利要求21至24任一所述的方法，其特征在于，所述方法还包括：
    根据授权信息或策略，确定所述AAnF向所述AF及所述服务网络中的代理实体提供服务。
  26. 根据权利要求25所述的方法，其特征在于，
    所述授权信息或策略，由本地策略或所述归属网络中的NRF提供。
  27. 根据权利要求21至24任一所述的方法，其特征在于，所述向服务网络中的代理实体发送应用密钥确认请求，包括：
    在所述终端的服务网络标识符与归属网络标识符不同的情况下，向所述代理实体发送所述应用密钥确认请求。
  28. 根据权利要求21至24任一所述的方法，其特征在于，所述方法还包括：
    接收所述代理实体发送的应用密钥确认响应。
  29. 根据权利要求21至24任一所述的方法，其特征在于，所述方法还包括：
    在所述终端的服务网络标识符与归属网络标识符不同的情况下，在所述服务网络的网元中确定所述代理实体。
  30. 根据权利要求29所述的方法，其特征在于，所述在所述终端的服务网络标识符与归属网络标识符不同的情况下，在所述服务网络的网元中确定所述代理实体，包括：
    在所述终端的服务网络标识符与归属网络标识符不同的情况下，在所述服务网络的网元中，通过所述服务网络和所述归属网络中的NRF发现所述代理实体。
  31. 一种密钥管理方法，其特征在于，所述方法应用于漫游场景中，所述方法由终端执行，所述方法包括：
    向归属网络中的AF发送服务网络标识符和AKMA密钥标识符，所述服务网络标识符用于触发所述归属网络中的AAnF在所述终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求，所述AKMA密钥标识符为所述终端的AKMA密钥的标识符。
  32. 一种密钥管理装置，其特征在于，所述装置应用于漫游场景中，所述装置包括：
    接收模块，用于接收归属网络中的AAnF发送的应用密钥确认请求。
  33. 一种密钥管理装置，其特征在于，所述装置应用于漫游场景中，所述装置包括：
    接收模块，用于接收终端发送的服务网络标识符和AKMA密钥标识符；
    发送模块，用于向归属网络中的AAnF发送应用密钥获取请求，所述应用密钥获取请求携带有所述服务网络标识符，所述服务网络标识符用于触发所述AAnF在所述终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求；
    所述接收模块，还用于接收所述AAnF反馈的应用密钥获取响应，所述应用密钥获取响应包括所述归属网络中的AF的AKMA应用密钥信息。
  34. 一种密钥管理装置，其特征在于，所述装置应用于漫游场景中，所述装置包括：
    接收模块，用于接收归属网络中的AF发送的应用密钥获取请求，所述应用密钥获取请求携带有服务网络标识符；
    生成模块，用于基于终端的AKMA密钥生成所述AF的AKMA应用密钥；
    发送模块，用于向所述AF反馈应用密钥获取响应，所述应用密钥获取响应包括所述AF的AKMA应用密钥信息；
    所述发送模块，还用于向服务网络中的代理实体发送应用密钥确认请求。
  35. 一种密钥管理装置，其特征在于，所述装置应用于漫游场景中，所述装置包括：
    发送模块，用于向归属网络中的AF发送服务网络标识符和AKMA密钥标识符，所述服务网络标识符用于触发所述归属网络中的AAnF在所述终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求，所述AKMA密钥标识符为所述终端的AKMA密钥的标识符。
  36. 一种服务网络中的代理实体，其特征在于，所述代理实体包括通信组件；
    所述通信组件，用于接收归属网络中的AAnF发送的应用密钥确认请求。
  37. 一种应用功能AF，其特征在于，所述AF包括通信组件；
    所述通信组件，用于接收终端发送的服务网络标识符和AKMA密钥标识符；
    向归属网络中的AAnF发送应用密钥获取请求，所述应用密钥获取请求携带有所述服务网络标识符，所述服务网络标识符用于触发所述AAnF在所述终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求；
    接收所述AAnF反馈的应用密钥获取响应，所述应用密钥获取响应包括所述归属网络中的AF的AKMA应用密钥信息。
  38. 一种应用认证与密钥管理AKMA的锚点功能网元AAnF，其特征在于，所述AAnF包括通信组件和处理器；
    所述通信组件，用于接收归属网络中的AF发送的应用密钥获取请求，所述应用密钥获取请求携带有服务网络标识符；
    所述处理器，用于基于终端的AKMA密钥生成所述AF的AKMA应用密钥；
    所述通信组件，用于向所述AF反馈应用密钥获取响应，所述应用密钥获取响应包括所述AF的AKMA应用密钥信息；
    所述通信组件，用于向服务网络中的代理实体发送应用密钥确认请求。
  39. 一种终端，其特征在于，所述终端包括收发器；
    所述收发器，用于向归属网络中的AF发送服务网络标识符和AKMA密钥标识符，所述服务网络标识符用于触发所述归属网络中的AAnF在所述终端的服务网络标识符与归属网络标识符不同的情况下，向服务网络中的代理实体发送应用密钥确认请求，所述AKMA密钥标识符为所述终端的AKMA密钥的标识符。
  40. 一种计算机可读存储介质，其特征在于，所述可读存储介质中存储有可执行指令，所述可执行指令由处理器加载并执行以实现如权利要求1至31中任一所述的密钥管理方法。
PCT/CN2022/092886 2022-05-13 2022-05-13 密钥管理方法、装置、设备及存储介质 WO2023216273A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2022/092886 WO2023216273A1 (zh) 2022-05-13 2022-05-13 密钥管理方法、装置、设备及存储介质
CN202280001699.6A CN117413553A (zh) 2022-05-13 2022-05-13 密钥管理方法、装置、设备及存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/092886 WO2023216273A1 (zh) 2022-05-13 2022-05-13 密钥管理方法、装置、设备及存储介质

Publications (1)

Publication Number Publication Date
WO2023216273A1 true WO2023216273A1 (zh) 2023-11-16

Family

ID=88729536

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/092886 WO2023216273A1 (zh) 2022-05-13 2022-05-13 密钥管理方法、装置、设备及存储介质

Country Status (2)

Country Link
CN (1) CN117413553A (zh)
WO (1) WO2023216273A1 (zh)

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113225176A (zh) * 2020-02-04 2021-08-06 华为技术有限公司 密钥获取方法及装置

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113225176A (zh) * 2020-02-04 2021-08-06 华为技术有限公司 密钥获取方法及装置

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
LENOVO, MOTOROLA MOBILITY: "AKMA roaming", 3GPP DRAFT; S3-214091, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. e-meeting; 20211108 - 20211119, 1 November 2021 (2021-11-01), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP052073503 *
S3: "AKMA service support for roaming UE", 3GPP DRAFT; S3-214236, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. e-meeting; 20211108 - 20211119, 1 November 2021 (2021-11-01), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP052073645 *

Also Published As

Publication number Publication date
CN117413553A (zh) 2024-01-16

Similar Documents

Publication Publication Date Title
US11716621B2 (en) Apparatus and method for providing mobile edge computing services in wireless communication system
US11304170B2 (en) Apparatus and method for registration on network in wireless communication system
US20220225263A1 (en) Interworking function using untrusted network
US20220095111A1 (en) Flexible authorization in 5g service based core network
CN112534851B (zh) 委托数据连接
US20220337995A1 (en) Apparatus and method for providing subscription data to non-subscriber registered terminal in wireless communication system
US11659621B2 (en) Selection of IP version
CN112753234A (zh) 3gpp专用lan
US20230319556A1 (en) Key obtaining method and communication apparatus
US10499245B2 (en) Method for performing multiple authentications within service registration procedure
US20230239686A1 (en) Secure communication method, apparatus, and system
CN113541925A (zh) 通信系统、方法及装置
CN113676904B (zh) 切片认证方法及装置
US20230396602A1 (en) Service authorization method and system, and communication apparatus
WO2023213301A1 (zh) 鉴权方法、通信装置和计算机可读存储介质
WO2023016160A1 (zh) 一种会话建立方法和相关装置
WO2023216273A1 (zh) 密钥管理方法、装置、设备及存储介质
WO2023216272A1 (zh) 密钥管理方法、装置、设备及存储介质
WO2023216274A1 (zh) 密钥管理方法、装置、设备和存储介质
JP2022529234A (ja) テレスコピックｆｑｄｎをハンドリングするためのシステムおよび方法
US20240179525A1 (en) Secure communication method and apparatus
CN118120201A (zh) 私有物联网单元pine的接入认证方法和装置
KR20230156685A (ko) 무선 네트워크에서의 코어 네트워크 디바이스 재할당을 위한 방법, 디바이스 및 시스템

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 202280001699.6

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22941223

Country of ref document: EP

Kind code of ref document: A1