WO2023226051A1 - 为个人物联网设备选择认证机制的方法及装置、ue、网络功能及存储介质 - Google Patents

为个人物联网设备选择认证机制的方法及装置、ue、网络功能及存储介质 Download PDF

Info

Publication number
WO2023226051A1
WO2023226051A1 PCT/CN2022/095773 CN2022095773W WO2023226051A1 WO 2023226051 A1 WO2023226051 A1 WO 2023226051A1 CN 2022095773 W CN2022095773 W CN 2022095773W WO 2023226051 A1 WO2023226051 A1 WO 2023226051A1
Authority
WO
WIPO (PCT)
Prior art keywords
pin
primitive
authentication
identifier
gateway
Prior art date
Application number
PCT/CN2022/095773
Other languages
English (en)
French (fr)
Inventor
梁浩然
陆伟
Original Assignee
北京小米移动软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京小米移动软件有限公司 filed Critical 北京小米移动软件有限公司
Priority to PCT/CN2022/095773 priority Critical patent/WO2023226051A1/zh
Priority to CN202280001894.9A priority patent/CN117480796A/zh
Publication of WO2023226051A1 publication Critical patent/WO2023226051A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H04W8/20—Transfer of user or subscriber data

Definitions

  • the present disclosure relates to an identity authentication technology in a Personal IoT Network (Personal IoT Network, PIN), and in particular to a method and device for selecting an authentication mechanism for a personal IoT device, user equipment (User Equipment, UE), and network functions. and storage media.
  • PIN Personal IoT Network
  • UE User Equipment
  • a Personal IoT Network consists of PIN primitives that communicate using a PIN direct connection or a direct network connection, and is managed locally using a PIN primitive (Personal IoT Network Element, PINE) with management capabilities.
  • PINs include wearable device networks and smart home and smart office devices.
  • PIN base can access 5G network services and can communicate with PIN bases that are not in range to connect directly using a PIN.
  • the PIN includes at least one PIN element with gateway function (PIN Element with Gateway Capability, PEGC) and at least one PIN element with management capability (PIN Element with Management Capability, PEMC).
  • PEGC and PEMC can also be UEs directly connected to 5GS. PEMC is able to access 5GS through PEGC.
  • embodiments of the present disclosure provide a method and device for selecting an authentication mechanism for a personal Internet of Things device, a UE, network functions and a storage medium.
  • a method of selecting an authentication mechanism for a personal Internet of Things device is provided, applied to a UE, including:
  • the method further includes:
  • PIN primitive authentication indicator the name of the authentication method supported by the PIN primitive, the Subscription Concealed Identifier (SUCI) of the PIN element with gateway capability, or the 5G Globally Unique Temporary Identifier, 5G-GUTI), PIN primitive identifier.
  • SUCI Subscription Concealed Identifier
  • 5G-GUTI 5G Globally Unique Temporary Identifier
  • sending the first message to the first network function includes:
  • the first message is sent to the first network function.
  • sending the first message to the first network function includes:
  • the first message is encapsulated into a non-access layer NAS message and sent to the first network function.
  • the UE is enabled as a PIN primitive gateway.
  • a method of selecting an authentication mechanism for a personal Internet of Things device is provided, applied to the second network function, and the method includes:
  • the authentication request carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of PIN primitive gateway identification information of PIN primitive gateway
  • authentication method name supported by PIN primitive authentication method name supported by PIN primitive
  • service network identifier such as serving network (Serving Network, SN) name.
  • the PIN primitive identifier is protected information or unprotected information; wherein the protection method of the PIN primitive identifier includes at least one of the following: encryption, anonymization ;
  • the authorization of the authentication request of the PIN primitive gateway includes:
  • the authentication request of the PIN primitive gateway is authorized after the PIN primitive identifier is deprotected.
  • authorizing the authentication request for the PIN primitive gateway includes:
  • the PIN primitive gateway is a legal gateway and is the required gateway. Gateway for the PIN primitive.
  • authorizing the authentication request for the PIN primitive gateway includes:
  • the identification information of the PIN elementary gateway is SUCI
  • the SUCI is converted into SUPI, and then the authentication request of the PIN elementary gateway is authorized.
  • the method further includes:
  • selecting an authentication method supported by the PIN primitive for the PIN primitive includes:
  • An authentication method is selected for the PIN primitive based on the PIN primitive identifier sent by the PIN primitive and the authentication method name supported by the PIN primitive.
  • the method further includes:
  • the second network function can recognize the PIN primitive authentication indicator.
  • a method of selecting an authentication mechanism for a personal Internet of Things device is provided, applied to the first network function, and the method includes:
  • the third message carries at least one of the following information:
  • PIN primitive authentication indicator the name of the authentication method supported by the PIN primitive, the subscription hidden identifier SUCI of the PIN primitive gateway, the 5G globally unique temporary identifier 5G-GUTI, and the PIN primitive identifier.
  • the method further includes:
  • the fourth message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • authentication method name supported by the PIN primitive and service network identifier.
  • the method further includes:
  • the first network function can recognize the PIN primitive authentication indicator.
  • a method of selecting an authentication mechanism for a personal Internet of Things device is provided, applied to a third network function, and the method includes:
  • the fifth message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • authentication method name supported by the PIN primitive and service network identifier.
  • the method further includes:
  • the sixth message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • authentication method name supported by the PIN primitive and service network identifier.
  • the method further includes:
  • the third network function can recognize the PIN primitive authentication indicator.
  • a method of selecting an authentication mechanism for a personal Internet of Things device is provided, applied to the fourth network function, and the method includes:
  • the seventh message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • authentication method name supported by the PIN primitive and service network identifier.
  • the method further includes:
  • the eighth message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • authentication method name supported by the PIN primitive and service network identifier.
  • the method further includes:
  • the fourth network function can recognize the PIN primitive authentication indicator.
  • an apparatus for selecting an authentication mechanism for a personal Internet of Things device including:
  • the receiving unit is configured to receive at least one of the following information sent by the personal Internet of Things PIN primitive: the name of the authentication method supported by the PIN primitive, the PIN primitive identifier, and the PIN primitive authentication indicator.
  • the device further includes:
  • a sending unit configured to send a first message to the first network function to indicate the PIN primitive authentication process to the first network function
  • the first message carries at least one of the following information:
  • PIN primitive authentication indicator the name of the authentication method supported by the PIN primitive, the subscription hidden identifier SUCI of the PIN primitive gateway or the 5G Globally Unique Temporary Identifier 5G-GUTI, the PIN primitive identifier.
  • an apparatus for selecting an authentication mechanism for a personal Internet of Things device comprising:
  • the authorization unit is configured to authorize the authentication request of the PIN primitive gateway; wherein the PIN primitive gateway allows the PIN primitive gateway to perform an authentication process on the PIN primitive based on the identification information of the PIN primitive gateway and the PIN primitive identifier.
  • the device further includes:
  • a selection unit configured to select an authentication method supported by the PIN primitive for the PIN primitive.
  • the selection unit is further configured to:
  • An authentication method is selected for the PIN primitive based on the PIN primitive identifier sent by the PIN primitive and the authentication method name supported by the PIN primitive.
  • a device for selecting an authentication mechanism for a personal Internet of Things device comprising:
  • a receiving unit configured to receive the third message sent by the PIN primitive gateway
  • the third message carries at least one of the following information:
  • PIN primitive authentication indicator the name of the authentication method supported by the PIN primitive, the subscription hidden identifier SUCI of the PIN primitive gateway, the 5G globally unique temporary identifier 5G-GUTI, and the PIN primitive identifier.
  • the device further includes:
  • a sending unit configured to send a fourth message to the third network function to indicate the PIN primitive authentication process
  • the fourth message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • authentication method name supported by the PIN primitive and service network identifier.
  • an apparatus for selecting an authentication mechanism for a personal Internet of Things device comprising:
  • a receiving unit configured to receive the fifth message sent by the first network function
  • the fifth message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • authentication method name supported by the PIN primitive and service network identifier.
  • the device further includes:
  • a sending unit configured to send the sixth message to the fourth network function
  • the sixth message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • authentication method name supported by the PIN primitive and service network identifier.
  • a device for selecting an authentication mechanism for a personal Internet of Things device comprising:
  • a receiving unit configured to receive the seventh message sent by the third network function
  • the seventh message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • authentication method name supported by the PIN primitive and service network identifier.
  • the device further includes:
  • a sending unit configured to send the eighth message to the second network function
  • the eighth message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • authentication method name supported by the PIN primitive and service network identifier.
  • a user equipment including a processor, a transceiver, a memory, and an executable program stored on the memory and capable of being run by the processor.
  • the processor runs the executable program.
  • the program executes the steps of the method of selecting an authentication mechanism for the personal Internet of Things device described in the first aspect.
  • a network function including a processor, a transceiver, a memory, and an executable program stored on the memory and capable of being run by the processor.
  • the processor runs the executable program.
  • the program executes the steps of the method of selecting an authentication mechanism for the personal Internet of Things device described in the second aspect.
  • a network function including a processor, a transceiver, a memory, and an executable program stored on the memory and capable of being run by the processor.
  • the processor runs the executable program.
  • the program executes the steps of the method of selecting an authentication mechanism for the personal Internet of Things device described in the third aspect.
  • a network function including a processor, a transceiver, a memory, and an executable program stored on the memory and capable of being run by the processor.
  • the processor runs the executable program.
  • the program executes the steps of the method of selecting an authentication mechanism for the personal Internet of Things device described in the fourth aspect.
  • a network function including a processor, a transceiver, a memory, and an executable program stored on the memory and capable of being run by the processor.
  • the processor runs the executable program.
  • the program executes the steps of the method of selecting an authentication mechanism for the personal Internet of Things device described in the fifth aspect.
  • a storage medium on which an executable program is stored.
  • the executable program is executed by a processor, the steps of the method of selecting an authentication mechanism for a personal Internet of Things device are implemented.
  • the network when the PIN base unit accesses the PIN through the gateway, the network needs to authenticate the PIN base unit, establish a secure non-3GPP link between the PIN base unit and the PEGC, and negotiate the corresponding identity authentication. method and initiate authentication.
  • the disclosed embodiment realizes the identity authentication of PIN primitives by the 5G core network and improves the communication security of PIN.
  • Figure 1 is a schematic structural diagram of a wireless communication system according to an exemplary embodiment
  • Figure 2 is a schematic flowchart of a method for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment
  • Figure 3 is a schematic flowchart of a method for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment
  • Figure 4 is a schematic flowchart of a method for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment
  • Figure 5 is a schematic flowchart of a method for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment
  • Figure 6 is a schematic flowchart of a method for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment
  • Figure 7 is a schematic flowchart of a method for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment
  • Figure 8 is a schematic structural diagram of a device for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment
  • Figure 9 is a schematic structural diagram of a device for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment
  • Figure 10 is a schematic structural diagram of a device for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment
  • Figure 11 is a schematic structural diagram of a device for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment
  • Figure 12 is a schematic structural diagram of a device for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment
  • Figure 13 is a schematic structural diagram of a user equipment according to an exemplary embodiment.
  • first, second, third, etc. may be used to describe various information in the embodiments of the present disclosure, the information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other.
  • first information may also be called second information, and similarly, the second information may also be called first information.
  • word “if” as used herein may be interpreted as "when” or "when” or "in response to determining.”
  • FIG. 1 shows a schematic structural diagram of a wireless communication system provided by an embodiment of the present disclosure.
  • the wireless communication system is a communication system based on cellular mobile communication technology.
  • the wireless communication system may include several terminals 11 and several base stations 12 .
  • the terminal 11 may be a device that provides voice and/or data connectivity to the user.
  • Terminal 11 can communicate with one or more core networks via a Radio Access Network (RAN).
  • RAN Radio Access Network
  • Terminal 11 can be an Internet of Things terminal, such as a sensor device, a mobile phone (or "cellular" phone) and a device with The computer of the Internet of Things terminal, for example, can be a fixed, portable, pocket-sized, handheld, computer-built-in or vehicle-mounted device.
  • station STA
  • subscriber unit subscriber unit
  • subscriber station subscriber station
  • mobile station mobile station
  • remote station remote station
  • access terminal remote terminal
  • user terminal user agent, user device, or user equipment (UE).
  • UE user equipment
  • the terminal 11 may be a device of an unmanned aerial vehicle.
  • the terminal 11 may also be a vehicle-mounted device, for example, it may be an on-board computer with a wireless communication function, or a wireless communication device connected to an external on-board computer.
  • the terminal 11 may also be a roadside device, for example, it may be a streetlight, a signal light or other roadside device with wireless communication function.
  • the base station 12 may be a network-side device in a wireless communication system.
  • the wireless communication system can be the 4th generation mobile communication technology (the 4th generation mobile communication, 4G) system, also known as the Long Term Evolution (LTE) system; or the wireless communication system can also be a 5G system, Also called new radio (NR) system or 5G NR system.
  • the wireless communication system may be any generation system.
  • the access network in the 5G system can be called the New Generation-Radio Access Network (NG-RAN). Or, MTC system.
  • NG-RAN New Generation-Radio Access Network
  • the base station 12 may be an evolved base station (eNB) used in the 4G system.
  • the base station 12 may also be a base station (gNB) that adopts a centralized distributed architecture in the 5G system.
  • eNB evolved base station
  • gNB base station
  • the base station 12 adopts a centralized distributed architecture it usually includes a centralized unit (Central Unit, CU) and at least two distributed units (Distributed Unit, DU).
  • the centralized unit is equipped with a protocol stack including the Packet Data Convergence Protocol (PDCP) layer, the Radio Link Control protocol (Radio Link Control, RLC) layer, and the Media Access Control (Media Access Control, MAC) layer; distributed
  • PDCP Packet Data Convergence Protocol
  • RLC Radio Link Control
  • MAC Media Access Control
  • the unit is provided with a physical (Physical, PHY) layer protocol stack, and the embodiment of the present disclosure does not limit the specific implementation of the base station 12.
  • a wireless connection can be established between the base station 12 and the terminal 11 through a wireless air interface.
  • the wireless air interface is a wireless air interface based on the fourth generation mobile communication network technology (4G) standard; or the wireless air interface is a wireless air interface based on the fifth generation mobile communication network technology (5G) standard, such as
  • the wireless air interface is a new air interface; alternatively, the wireless air interface may also be a wireless air interface based on the next generation mobile communication network technology standard of 5G.
  • end-to-end (End to End, E2E) connections can also be established between terminals 11.
  • V2V vehicle to vehicle
  • vehicle-to-vehicle vehicle-to-vehicle
  • vehicle-to-roadside equipment vehicle to Infrastructure, V2I
  • vehicle-to-person vehicle to Pedestrian, V2P
  • V2X vehicle networking communication
  • the above-mentioned wireless communication system may also include a network management device 13.
  • the execution subjects involved in the embodiments of this disclosure include but are not limited to: terminals (UE, User Equipment) in the cellular mobile communication system, and base stations of cellular mobile communication, etc.
  • Figure 2 is a schematic flow chart of a method of selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment. As shown in Figure 2, the method of selecting an authentication mechanism for a personal Internet of Things device according to an embodiment of the present disclosure is applied to a UE. The method of selecting an authentication mechanism for a personal Internet of Things device includes the following processing steps:
  • Step 201 Receive at least one of the following information sent by the personal Internet of Things PIN primitive: the name of the authentication method supported by the PIN primitive, the PIN primitive identifier, and the PIN primitive authentication indicator.
  • the UE can serve as an access gateway for a PIN element, that is, it can be enabled as a private IoT gateway such as PEGC.
  • the PIN primitive can be accessed into the 5G mobile network through the UE.
  • the UE can negotiate with the PIN primitive on how to establish a secure non-3GPP link, and negotiate the corresponding PIN primitive identity authentication method, etc.
  • Step 202 Send a first message to the first network function to instruct the first network function to perform the PIN primitive authentication process.
  • the UE when the UE receives the second message sent by the PIN element, the UE sends the first message to the first network function.
  • the second message may be a trigger message, and the second message may carry information such as the authentication method name supported by the PIN primitive and the PIN primitive identifier.
  • the first message carries at least one of the following information:
  • the first message may be encapsulated into a Non-Access-Stratum (NAS) message and then sent to the first network function.
  • NAS Non-Access-Stratum
  • Persons skilled in the art should understand that the use of NAS messages is only for security reasons, and other types of messages may also be used to transmit the above information.
  • the first network function may include an access and mobility management function AMF.
  • AMF access and mobility management function
  • FIG. 3 is a schematic flowchart of a method for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment.
  • the method for selecting an authentication mechanism for a personal Internet of Things device according to the disclosed embodiment is applied to the second Network function, the second network function may include Unified Data Management Function (Unified Data Management, UDM) or Address Resolution Protocol Function (ARPF).
  • UDM Unified Data Management
  • ARPF Address Resolution Protocol Function
  • Those skilled in the art should understand that when other network functions of the core network are configured with corresponding functions of the second network function in the embodiment of the present disclosure, they can also be enabled as the second network function.
  • the method of selecting an authentication mechanism for a personal Internet of Things device includes the following processing steps:
  • Step 301 Authorize the authentication request of the PIN primitive gateway.
  • authorizing the authentication request of the PIN element gateway includes: the second network function needs to be based on the SUCI or SUPI of the PIN element with gateway capability, the PIN element identifier, and the corresponding
  • the subscription information of the PIN primitive gateway determines whether the PEGC is a legal gateway and whether it is the gateway of the PIN primitive (PINE).
  • the second network function also needs to select the corresponding authentication method for PINE. Wherein, if the identification information of the PIN elementary gateway is SUCI, the SUCI is converted into SUPI, and then the authentication request of the PIN elementary gateway is authorized.
  • the authentication request carries at least one of the following information:
  • the PIN primitive authentication indicator includes but is not limited to the serving network name (Serving Network Name), etc.
  • Step 302 Select an authentication method for PIN primitive authentication.
  • the second network function selects an authentication method for the PIN primitive based on the PIN primitive identifier sent by the PIN primitive and the authentication method name supported by the PIN primitive.
  • the PIN primitive identifier is protected information or unprotected information; wherein the protection method of the PIN primitive identifier includes at least one of the following: encryption, anonymization; where The encryption algorithm can be MD5 algorithm, SHA1 algorithm, HMAC algorithm, AES/DES algorithm, etc.
  • the PIN primitive identifier is protected information, the authentication request of the PIN primitive gateway needs to be authorized after deprotecting the PIN primitive identifier.
  • the second network function can identify the PIN primitive authentication indicator.
  • Figure 4 is a schematic flowchart of a method for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment. As shown in Figure 4, the method for selecting an authentication mechanism for a personal Internet of Things device according to the disclosed embodiment is applied to the first Network function, the method of selecting an authentication mechanism for a personal IoT device includes the following processing steps:
  • Step 401 Receive the third message sent by the PIN elementary gateway.
  • the third message carries at least one of the following information:
  • PIN primitive authentication indicator the name of the authentication method supported by the PIN primitive, the subscription hidden identifier SUCI of the PIN primitive gateway, the 5G globally unique temporary identifier 5G-GUTI, and the PIN primitive identifier.
  • the third message may be a NAS message.
  • NAS messages are only for security reasons, and other types of messages may also be used to transmit the above information.
  • the first network function may include an access and mobility management function AMF.
  • AMF access and mobility management function
  • the PIN primitive may send the message to the first network function through PEGC.
  • PEGC message encapsulation
  • the first network function may include an access and mobility management function AMF.
  • AMF access and mobility management function
  • Step 402 Send a fourth message to the third network function to indicate the PIN primitive authentication process.
  • the third network function may include a security anchor function (SEcurity Anchor Function, SEAF).
  • SEAF Security Anchor Function
  • other network functions of the core network are configured with corresponding functions of the third network function in the embodiment of the present disclosure, they can also be enabled as the third network function.
  • the AUSF After receiving the fourth message, the AUSF checks whether the requesting AMF in the service network has the right to use the service network name in the fourth message by comparing the service network name with the expected service network name. If the service network is not authorized to use the service network name, the AUSF sends a reject message to the AMF. If the service network authorizes the use of the service network name, AUSF sends the corresponding request message to UDM.
  • the fourth message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier, identification information of the PIN primitive gateway, authentication method name supported by the PIN primitive, and service network identifier.
  • the basic function of the PIN primitive authentication indicator is to indicate that the purpose of this message is to perform PINE authentication.
  • the fourth message is a message that supports the communication protocol between AMF and SEAF, and can realize information transmission between AMF and SEAF.
  • the first network function can identify the PIN primitive authentication indicator.
  • FIG. 5 is a schematic flowchart of a method for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment.
  • the method for selecting an authentication mechanism for a personal Internet of Things device according to the disclosed embodiment is applied to a third party.
  • the third network function may include a security anchor function (SEcurity Anchor Function, SEAF).
  • SEAF Security Anchor Function
  • Those skilled in the art should understand that when other network functions of the core network implement the function of SEAF, it can also be enabled as a third network function. Alternatively, if other network functions of the core network are configured with corresponding functions of the third network function in the embodiment of the present disclosure, they can also be enabled as the third network function.
  • the method of selecting an authentication mechanism for a personal Internet of Things device includes the following processing steps:
  • Step 501 Receive the fifth message sent by the first network function.
  • the fifth message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • authentication method name supported by the PIN primitive and service network identifier.
  • the first network function may include an access and mobility management function AMF.
  • AMF access and mobility management function
  • the fifth message is a message supporting the communication protocol between the AMF and SEAF, which can realize information transmission between the AMF and SEAF.
  • Step 502 Send a sixth message to the fourth network function.
  • the sixth message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • name of the authentication method supported by the PIN primitive and service network identifier.
  • the fourth network function may include AUSF.
  • AUSF AUSF
  • other network functions of the core network are configured with corresponding functions of the fourth network function in the embodiment of the present disclosure, they can also be enabled as the fourth network function.
  • the sixth message is a message supporting the communication protocol between the Authentication Service Function (AUSF) and SEAF, which enables information transmission between the AUSF and SEAF.
  • AUSF Authentication Service Function
  • the third network function can identify the PIN primitive authentication indicator.
  • the third network function may include a security anchor function (SEcurity Anchor Function, SEAF).
  • SEAF Security Anchor Function
  • Those skilled in the art should understand that when other network functions of the core network implement the function of SEAF, it can also be enabled as a third network function.
  • other network functions of the core network are configured with corresponding functions of the third network function in the embodiment of the present disclosure, they can also be enabled as the third network function.
  • Figure 6 is a schematic flowchart of a method of selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment.
  • the method of selecting an authentication mechanism for a personal Internet of Things device according to the embodiment of the present disclosure is applied to the fourth Network function.
  • the fourth network function may include AUSF.
  • AUSF Those skilled in the art should understand that when other network functions of the core network implement the functions of the AUSF, they can also be enabled as the fourth network function. Alternatively, if other network functions of the core network are configured with corresponding functions of the fourth network function in the embodiment of the present disclosure, they can also be enabled as the fourth network function.
  • the method of selecting an authentication mechanism for a personal Internet of Things device includes the following processing steps:
  • Step 601 Receive the seventh message sent by the third network function.
  • the seventh message carries at least one of the following information:
  • the third network function may include a security anchor function (SEcurity Anchor Function, SEAF).
  • SEAF Security Anchor Function
  • the seventh message is a message supporting the communication protocol between AUSF and SEAF, which can realize information transmission between AUSF and SEAF.
  • Step 602 Send an eighth message to the second network function.
  • the eighth message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • authentication method name supported by the PIN primitive and service network identifier.
  • the seventh message is a message that supports the communication protocol between AUSF and UDM/ARPF, and can realize information transmission between AUSF and UDM/ARPF.
  • the fourth network function can identify the PIN primitive authentication indicator.
  • the second network function may include a unified data management function (Unified Data Management, UDM) or an address resolution protocol function (Address Resolution Protocol Function, ARPF).
  • UDM Unified Data Management
  • ARPF Address Resolution Protocol Function
  • IoT devices that can be placed around the human body, such as wearable devices such as cameras, headphones, watches, earphones, health monitors, etc. It can also be dispersed at home such as smart lights, cameras, thermostats, door sensors, voice assistants, speakers, refrigerators, washing machines, lawn mowers, robots, etc., or placed in small business offices such as printers, meters, in the sensor.
  • Some IoT devices have very specific requirements in terms of size, such as when placed in earbuds, and some IoT devices have very specific requirements in terms of weight, such as when placed in wearable devices such as glasses.
  • some IoT devices have very specific requirements in multiple aspects such as size, weight, and power consumption. With the rapid increase in the number of IoT devices, users need to use these IoT devices to create corresponding networks to achieve management and access to IoT devices.
  • PIN Personal IoT Network
  • PIN generally contains three types of devices (PIN Element): devices with gateway capabilities (PIN Element with Gateway Capability, PEGC), devices with management capabilities (PIN Element with Management Capability, PEMC), and devices without gateway and management functions.
  • PEGC and PEMC can also be UEs directly connected to 5GS. PEMC is able to access 5GS through PEGC.
  • the embodiment of the present disclosure provides a method for 5GC to initiate the identity authentication process for the PIN primitive and select the corresponding identity authentication method.
  • the PIN primitive identifier has been associated with PEGC subscription information. It is assumed that PEGC has been registered to 5GC. The connection between PEGC and AMF is protected by NAS security. AMF and SEAF are collocated. Of course, AMF and SEAF can also be set separately. This is only explained as an example in Figure 7.
  • Figure 7 is a schematic flowchart of a method for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment. As shown in Figure 7, the method for selecting an authentication mechanism for a personal Internet of Things device according to an embodiment of the present disclosure has the following processing steps:
  • Step 1 A secure non-3GPP connection is negotiated between the PIN primitive and PEGC.
  • the PIN primitive sends information such as the PIN primitive authentication indicator, the name of the authentication method supported by the PIN primitive, and the PIN primitive identifier to the PEGC.
  • the PIN primitive sends its identifier to PEGC.
  • the PIN primitive can support authentication over secure non-3GPP connections. How to establish a secure connection between the PIN element and the PEGC is beyond the scope of 3GPP.
  • Step 2 PEGC sends a NAS message to AMF.
  • the NAS message carries information such as the PIN primitive authentication indicator, the PIN primitive identifier, the name of the authentication method supported by the PIN primitive, PEGC's SUCI or 5G-GUTI, and other information.
  • Step 3 When AMF wants to start identity authentication, AMF calls the Nausf_UEAuthentication service by sending a Nausf_UEAuthentication_Authenticate Request message to AUSF.
  • the Nausf_UEAuthentication_Authenticate Request message can contain PIN primitive authentication indicator, PIN primitive identifier, authentication method name supported by PIN primitive, SUPI or SUCI of PEGC, and service network identification and other information.
  • Step 4 after AUSF receives the Nausf_UEAuthentication_Authenticate Request message, AUSF checks whether the requesting AMF in the service network has the right to use the service network name in the Nausf_UEAuthentication_Authenticate request by comparing the service network name with the expected service network name. AUSF will temporarily store the received service network name. If the service network is not authorized to use the service network name, the AUSF may respond to the AMF with "Service network is not authorized" in the Nausf_UEAuthentication_Authenticate response message. If the service network is authorized to use the service network name, the AUSF sends a Nudm_UEAuthentication_Get Request message to the UDM.
  • the Nudm_UEAuthentication_Get Request message sent to the UDM may include the PIN primitive authentication indicator, the PIN primitive identifier, the SUPI or SUCI of the PEGC, and the PIN base The authentication method name and service network identifier supported by the element.
  • Step 5 After receiving the Nudm_UEAuthentication_Get Request message, if the UDM receives the SUCI of the PEGC, the UDM will call the Subscription Identifier De-concealing Function (SIDF) to decrypt the PEGC SUCI into the PEGC SUPI. . If the PIN primitive identifier received by UDM is protected information such as encrypted or anonymized information, UDM will call the Subscription Identifier De-concealing Function (SIDF), that is, the recipient The protected PIN primitive identifier is decrypted or de-anonymized, and after the PIN primitive identifier is deprotected, the authentication request of the PIN primitive gateway is authorized.
  • SIDF Subscription Identifier De-concealing Function
  • the MD5 algorithm, SHA1 algorithm, HMAC algorithm, AES/DES algorithm, etc. can be selected to protect the PIN primitive identifier.
  • the DM determines that it has received the SUCI of PEGC, it converts the SUCI of PEGC into SUPI, and then selects the corresponding authentication method for the PIN primitive.
  • Step 6 UDM/ARPF allows PEGC to perform the authentication process of the PIN primitive based on PEGC's SUPI and PIN primitive identifier, and based on PEGC's subscription authentication, and then based on the PIN primitive identifier sent by the PIN primitive and the PIN primitive supported Authentication method name, select the authentication method for the authentication of the PIN primitive.
  • the disclosed embodiment realizes the identity authentication of PIN primitives by the 5G core network and improves the communication security of PIN.
  • Figure 8 is a schematic structural diagram of a device for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment. As shown in Figure 8, the device for selecting an authentication mechanism for a personal Internet of Things device according to the embodiment of the present disclosure can be applied to In the UE, the device includes:
  • the receiving unit 80 is configured to receive at least one of the following information sent by the personal Internet of Things PIN primitive: the name of the authentication method supported by the PIN primitive, the PIN primitive identifier, and the PIN primitive authentication indicator.
  • the device further includes:
  • a sending unit (not shown in Figure 8), configured to send a first message to the first network function to indicate the PIN primitive authentication process to the first network function;
  • the first message carries at least one of the following information:
  • the sending unit sends the first message to the first network function in response to the receiving unit 80 receiving the third message of the PIN primitive.
  • the first message may be encapsulated into a Non-Access-Stratum (NAS) message and then sent to the first network function.
  • NAS Non-Access-Stratum
  • the UE of embodiments of the present disclosure may be enabled as PEGC.
  • the receiving unit 80, the transmitting unit, etc. may be configured by one or more central processing units (CPU, Central Processing Unit), graphics processing units (GPU, Graphics Processing Unit), baseband processors (BP, Base Processor). ), Application Specific Integrated Circuit (ASIC, Application Specific Integrated Circuit), Digital Signal Processor (DSP), Programmable Logic Device (PLD, Programmable Logic Device), Complex Programmable Logic Device (CPLD, Complex Programmable Logic Device), field-programmable gate array (FPGA, Field-Programmable Gate Array), general-purpose processor, controller, microcontroller (MCU, Micro Controller Unit), microprocessor (Microprocessor), or other electronic components, also It can be implemented in combination with one or more radio frequency (RF, Radio Frequency) antennas to perform the steps of the method of selecting an authentication mechanism for a personal Internet of Things device in the foregoing embodiment.
  • RF Radio Frequency
  • Figure 9 is a schematic structural diagram of a device for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment. As shown in Figure 9, the device for selecting an authentication mechanism for a personal Internet of Things device according to the embodiment of the present disclosure can be applied to The second network function is as in UDM/ARPF, and the device includes:
  • the authorization unit 90 is configured to authorize the authentication request of the PIN primitive gateway; wherein the PIN primitive gateway allows the PIN primitive to perform an authentication process based on the identification information of the PIN primitive gateway and the PIN primitive identifier.
  • the authentication request carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • authentication method name supported by the PIN primitive and service network identifier.
  • the device further includes:
  • a selection unit (not shown in Figure 9) configured to select an authentication method supported by the PIN primitive for the PIN primitive.
  • the selection unit is also configured to:
  • An authentication method is selected for the PIN primitive based on the PIN primitive identifier sent by the PIN primitive and the authentication method name supported by the PIN primitive.
  • the second network function is able to recognize the PIN primitive authentication indicator.
  • the authorization unit 90, the selection unit, etc. may be configured by one or more central processing units (CPU, Central Processing Unit), graphics processing units (GPU, Graphics Processing Unit), baseband processors (BP, Base Processor). ), Application Specific Integrated Circuit (ASIC, Application Specific Integrated Circuit), Digital Signal Processor (DSP), Programmable Logic Device (PLD, Programmable Logic Device), Complex Programmable Logic Device (CPLD, Complex Programmable Logic Device), field-programmable gate array (FPGA, Field-Programmable Gate Array), general-purpose processor, controller, microcontroller (MCU, Micro Controller Unit), microprocessor (Microprocessor), or other electronic components, also It can be implemented in combination with one or more radio frequency (RF, Radio Frequency) antennas to perform the steps of the method of selecting an authentication mechanism for a personal Internet of Things device in the foregoing embodiment.
  • RF Radio Frequency
  • Figure 10 is a schematic structural diagram of a device for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment. As shown in Figure 10, the device for selecting an authentication mechanism for a personal Internet of Things device according to the embodiment of the present disclosure can be applied to The first network function is as in AMF, and the device includes:
  • the receiving unit 100 is configured to receive the third message sent by the PIN elementary gateway;
  • the third message carries at least one of the following information:
  • PIN primitive authentication indicator the name of the authentication method supported by the PIN primitive, the subscription hidden identifier SUCI of the PIN primitive gateway, the 5G globally unique temporary identifier 5G-GUTI, and the PIN primitive identifier.
  • the device further includes:
  • a sending unit (not shown in Figure 10) configured to send a fourth message to the third network function to indicate the PIN primitive authentication process
  • the fourth message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • authentication method name supported by the PIN primitive and service network identifier.
  • the first network function is able to recognize the PIN primitive authentication indicator.
  • the receiving unit 100, the transmitting unit, etc. may be configured by one or more central processing units (CPU, Central Processing Unit), graphics processing units (GPU, Graphics Processing Unit), baseband processors (BP, Base Processor). ), Application Specific Integrated Circuit (ASIC, Application Specific Integrated Circuit), Digital Signal Processor (DSP), Programmable Logic Device (PLD, Programmable Logic Device), Complex Programmable Logic Device (CPLD, Complex Programmable Logic Device), field-programmable gate array (FPGA, Field-Programmable Gate Array), general-purpose processor, controller, microcontroller (MCU, Micro Controller Unit), microprocessor (Microprocessor), or other electronic components, also It can be implemented in combination with one or more radio frequency (RF, Radio Frequency) antennas to perform the steps of the method of selecting an authentication mechanism for a personal Internet of Things device in the foregoing embodiment.
  • RF Radio Frequency
  • Figure 11 is a schematic structural diagram of a device for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment. As shown in Figure 11, the device for selecting an authentication mechanism for a personal Internet of Things device according to the embodiment of the present disclosure can be applied to The third network function is as in SEAF, and the device includes:
  • the receiving unit 110 is configured to receive the fifth message sent by the first network function
  • the fifth message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • authentication method name supported by the PIN primitive and service network identifier.
  • the device further includes:
  • a sending unit (not shown in Figure 11) configured to send the sixth message to the fourth network function
  • the sixth message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • authentication method name supported by the PIN primitive and service network identifier.
  • the third network function is able to recognize the PIN primitive authentication indicator.
  • the receiving unit 110, the transmitting unit, etc. may be configured by one or more central processing units (CPU, Central Processing Unit), graphics processing units (GPU, Graphics Processing Unit), baseband processors (BP, Base Processor). ), Application Specific Integrated Circuit (ASIC, Application Specific Integrated Circuit), Digital Signal Processor (DSP), Programmable Logic Device (PLD, Programmable Logic Device), Complex Programmable Logic Device (CPLD, Complex Programmable Logic Device), field-programmable gate array (FPGA, Field-Programmable Gate Array), general-purpose processor, controller, microcontroller (MCU, Micro Controller Unit), microprocessor (Microprocessor), or other electronic components, also It can be implemented in conjunction with one or more radio frequency (RF, Radio Frequency) antennas for performing the steps of the method of selecting an authentication mechanism for a personal Internet of Things device in the foregoing embodiment.
  • RF Radio Frequency
  • Figure 12 is a schematic structural diagram of a device for selecting an authentication mechanism for a personal Internet of Things device according to an exemplary embodiment. As shown in Figure 12, the device for selecting an authentication mechanism for a personal Internet of Things device according to the embodiment of the present disclosure can be applied to The fourth network function is as in AUSF, the device includes:
  • the receiving unit 120 is configured to receive the seventh message sent by the third network function
  • the seventh message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • name of the authentication method supported by the PIN primitive and service network identifier.
  • the device further includes:
  • a sending unit (not shown in Figure 12) configured to send the eighth message to the second network function
  • the eighth message carries at least one of the following information:
  • PIN primitive authentication indicator PIN primitive identifier
  • identification information of the PIN primitive gateway identification information of the PIN primitive gateway
  • authentication method name supported by the PIN primitive and service network identifier.
  • the fourth network function is able to recognize the PIN primitive authentication indicator.
  • the receiving unit 120, the transmitting unit, etc. may be configured by one or more central processing units (CPU, Central Processing Unit), graphics processing units (GPU, Graphics Processing Unit), baseband processors (BP, Base Processor). ), Application Specific Integrated Circuit (ASIC, Application Specific Integrated Circuit), Digital Signal Processor (DSP), Programmable Logic Device (PLD, Programmable Logic Device), Complex Programmable Logic Device (CPLD, Complex Programmable Logic Device), field-programmable gate array (FPGA, Field-Programmable Gate Array), general-purpose processor, controller, microcontroller (MCU, Micro Controller Unit), microprocessor (Microprocessor), or other electronic components, also It can be implemented in combination with one or more radio frequency (RF, Radio Frequency) antennas to perform the steps of the method of selecting an authentication mechanism for a personal Internet of Things device in the foregoing embodiment.
  • RF Radio Frequency
  • Figure 13 is a block diagram of a user equipment 8000 according to an exemplary embodiment.
  • the user device 8000 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, or the like.
  • user equipment 8000 may include one or more of the following primitives: a processing primitive 8002, a memory 8004, a power primitive 8006, a multimedia primitive 8008, an audio primitive 8010, and an input/output (I/O) interface. 8012, sensor primitive 8014, and communication primitive 8016.
  • the processing primitive 8002 generally controls the overall operations of the user device 8000, such as operations associated with display, phone calls, data communications, camera operations, and recording operations.
  • the processing unit 8002 may include one or more processors 8020 to execute instructions to complete all or part of the steps of the above method of selecting an authentication mechanism for a personal Internet of Things device.
  • processing primitive 8002 may include one or more modules that facilitate interaction between processing primitive 8002 and other primitives.
  • processing primitive 8002 may include a multimedia module to facilitate interaction between multimedia primitive 8008 and processing primitive 8002.
  • Memory 8004 is configured to store various types of data to support operations at device 8000. Examples of such data include instructions for any application or method operating on the user device 8000, contact data, phonebook data, messages, pictures, videos, etc.
  • Memory 8004 may be implemented by any type of volatile or non-volatile storage device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EEPROM), Programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disk.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read-only memory
  • EEPROM erasable programmable read-only memory
  • EPROM Programmable read-only memory
  • PROM programmable read-only memory
  • ROM read-only memory
  • magnetic memory flash memory, magnetic or optical disk.
  • Power supply primitive 8006 provides power to various primitives of user equipment 8000.
  • Power supply primitives 8006 may include a power management system, one or more power supplies, and other primitives associated with generating, managing, and distributing power to user device 8000.
  • Multimedia primitive 8008 includes a screen that provides an output interface between user device 8000 and the user.
  • the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user.
  • the touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. A touch sensor can not only sense the boundaries of a touch or swipe action, but also detect the duration and pressure associated with the touch or swipe action.
  • multimedia primitive 8008 includes a front-facing camera and/or a rear-facing camera.
  • the front camera and/or the rear camera may receive external multimedia data.
  • Each front-facing camera and rear-facing camera can be a fixed optical lens system or have a focal length and optical zoom capabilities.
  • Audio primitive 8010 is configured to output and/or input audio signals.
  • the audio primitive 8010 includes a microphone (MIC) configured to receive external audio signals when the user device 8000 is in operating modes, such as call mode, recording mode, and speech recognition mode.
  • the received audio signal may be further stored in memory 8004 or sent via communication primitive 8016.
  • audio primitive 8010 also includes a speaker for outputting audio signals.
  • the I/O interface 8012 provides an interface between the processing primitive 8002 and a peripheral interface module.
  • the peripheral interface module may be a keyboard, a click wheel, a button, etc. These buttons may include, but are not limited to: Home button, Volume buttons, Start button, and Lock button.
  • Sensor primitive 8014 includes one or more sensors that provide various aspects of status assessment for user device 8000 .
  • the sensor primitive 8014 can detect the open/closed state of the device 8000, the relative positioning of the primitive, such as the display and keypad of the user device 8000, the sensor primitive 8014 can also detect the user device 8000 or the user device 8000 Changes in the position of one of the primitives, the presence or absence of user contact with the user device 8000, the orientation or acceleration/deceleration of the user device 8000 and the temperature change of the user device 8000.
  • Sensor primitive 8014 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact.
  • Sensor cell 8014 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications.
  • the sensor primitive 8014 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.
  • Communication primitive 8016 is configured to facilitate wired or wireless communication between user device 8000 and other devices.
  • User equipment 8000 may access a wireless network based on a communication standard, such as Wi-Fi, 2G or 3G, or a combination thereof.
  • the communication unit 8016 receives broadcast signals or broadcast related information from an external broadcast management system via a broadcast channel.
  • communication primitive 8016 also includes a near field communication (NFC) module to facilitate short-range communications.
  • NFC near field communication
  • the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.
  • RFID radio frequency identification
  • IrDA infrared data association
  • UWB ultra-wideband
  • Bluetooth Bluetooth
  • user equipment 8000 may be configured by one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable A programmable gate array (FPGA), controller, microcontroller, microprocessor or other electronic component is implemented for performing the steps of the above method of selecting an authentication mechanism for a personal Internet of Things device.
  • ASICs application specific integrated circuits
  • DSPs digital signal processors
  • DSPDs digital signal processing devices
  • PLDs programmable logic devices
  • FPGA field programmable A programmable gate array
  • controller microcontroller, microprocessor or other electronic component is implemented for performing the steps of the above method of selecting an authentication mechanism for a personal Internet of Things device.
  • non-transitory computer-readable storage medium including instructions, such as a memory 8004 including instructions, which can be executed by the processor 8020 of the user device 8000 to complete the above for the personal Internet of Things device is also provided. Steps for selecting an authentication mechanism method.
  • non-transitory computer-readable storage media may be ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.
  • Embodiments of the present disclosure also describe a first network function, which includes a processor, a transceiver, a memory, and an executable program stored in the memory and capable of being run by the processor.
  • the processor runs the executable program.
  • the embodiment of the present disclosure also describes a second network function, which includes a processor, a transceiver, a memory, and an executable program stored in the memory and capable of being run by the processor.
  • the processor runs the executable program.
  • the embodiment of the present disclosure also describes a third network function, which includes a processor, a transceiver, a memory, and an executable program stored in the memory and capable of being run by the processor.
  • the processor runs the executable program.
  • the embodiment of the present disclosure also describes a fourth network function, which includes a processor, a transceiver, a memory, and an executable program stored in the memory and capable of being run by the processor.
  • the processor runs the executable program.
  • An embodiment of the present disclosure also describes a user equipment, which includes a processor, a transceiver, a memory, and an executable program stored in the memory and capable of being run by the processor.
  • the processor runs the executable program, it is executed. The steps of the method of selecting an authentication mechanism for a personal Internet of Things device in the foregoing embodiment.
  • An embodiment of the present disclosure also describes a storage medium on which an executable program is stored, and the executable program is used by a processor to execute the steps of the method of selecting an authentication mechanism for a personal Internet of Things device in the aforementioned embodiment.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Databases & Information Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本公开是关于一种为个人物联网设备选择认证机制的方法及装置、UE、网络功能及存储介质，所述方法包括：接收个人物联网PIN基元发送的以下信息的至少之一：PIN基元支持的认证方法名称、PIN基元标识符、PIN基元认证指示符。向第一网络功能发送第一消息，以向所述第一网络功能指示PIN基元认证过程；其中，所述第一消息中携带有以下信息的至少之一：PIN基元认证指示符、PIN基元支持的认证方法名称、PIN基元网关的订阅隐藏标识符SUCI或5G全球唯一临时标识5G-GUTI、PIN基元标识符。本公开实现了5G核心网对PIN基元的身份认证，提升了PIN的通信安全。

Description

为个人物联网设备选择认证机制的方法及装置、UE、网络功能及存储介质 技术领域
本公开涉及一种个人物联网网络(Personal IoT Network，PIN)中的身份认证技术，尤其涉及一种为个人物联网设备选择认证机制的方法及装置、用户设备(User Equipment，UE)、网络功能及存储介质。
背景技术
个人物联网网络(Personal IoT Network，PIN)由使用PIN直接连接或直接网络连接进行通信的PIN基元组成，并使用具有管理能力的PIN基元(Personal IoT Network Element，PINE)进行本地管理。PIN的示例包括可穿戴设备网络和智能家居、智能办公设备。通过具有网关功能的PIN基元，PIN基元可以访问5G网络服务，并且可以与不在范围内的PIN基元进行通信以使用PIN直接连接。PIN包括至少一个具有网关功能的PIN基元(PIN Element with Gateway Capability，PEGC)和至少一个具有管理能力的PIN基元(PIN Element with Management Capability，PEMC)。PEGC和PEMC也可以是直接接入5GS的UE。PEMC能够通过PEGC访问5GS。
目前，尚未有针对PIN基元启动身份认证的技术方案可供参考。
发明内容
有鉴于此，本公开实施例提供了一种为个人物联网设备选择认证机制的方法及装置、UE、网络功能及存储介质。
根据本公开的第一方面，提供一种为个人物联网设备选择认证机制的方法，应用于UE，包括：
接收个人物联网PIN基元发送的以下信息的至少之一：PIN基元支持 的认证方法名称、PIN基元标识符、PIN基元认证指示符。
在一些示例性实施例中，所述方法还包括：
向第一网络功能发送第一消息，以向所述第一网络功能指示PIN基元认证过程；其中，所述第一消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元支持的认证方法名称、PIN基元网关(PIN element with gateway capability)的订阅隐藏标识符(Subscription Concealed Identifier，SUCI)或5G全球唯一临时标识(5G Globally Unique Temporary Identifier，5G-GUTI)、PIN基元标识符。
在一些示例性实施例中，所述向第一网络功能发送第一消息，包括：
响应于接收PIN基元的第二消息，向所述第一网络功能发送所述第一消息。
在一些示例性实施例中，所述向第一网络功能发送第一消息，包括：
将所述第一消息封装为非接入层NAS消息，向所述第一网络功能发送。
在一些示例性实施例中，所述UE作为PIN基元网关使能。
根据本公开的第二方面，提供一种为个人物联网设备选择认证机制的方法，应用于第二网络功能，所述方法包括：
针对PIN基元网关的认证请求进行授权，并为PIN基元认证选择认证方式。
在一些示例性实施例中，所述认证请求中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识如服务网络(Serving Network，SN)名称。
在一些示例性实施例中，所述PIN基元标识符为受保护的信息或不受保护的信息；其中，所述PIN基元标识符的受保护方式包括以下至少之一：加密、匿名化；
所述对PIN基元网关的认证请求进行授权，包括：
在所述PIN基元标识符为受保护的信息的情况下，对所述PIN基元标识符进行去保护化后，对PIN基元网关的认证请求进行授权。
在一些示例性实施例中，所述对PIN基元网关的认证请求进行授权，包括：
根据所述PIN基元网关的订阅隐藏标识符SUCI和/或用户永久标识符SUPI、PIN基元标识符、PIN基元网关的订阅信息，确定所述PIN基元网关为合法网关，且为所述PIN基元的网关。
在一些示例性实施例中，所述对PIN基元网关的认证请求进行授权，包括：
若所述PIN基元网关的标识信息为SUCI，将SUCI转换为SUPI，再对所述PIN基元网关的认证请求进行授权。
在一些示例性实施例中，所述方法还包括：
为所述PIN基元选择PIN基元支持的认证方法。
在一些示例性实施例中，所述为PIN基元选择PIN基元支持的认证方法，包括：
基于所述PIN基元发送的PIN基元标识符和PIN基元支持的认证方法名称为所述PIN基元选择认证方法。
在一些示例性实施例中，所述方法还包括：
所述第二网络功能能辨识所述PIN基元认证指示符。
根据本公开的第三方面，提供一种为个人物联网设备选择认证机制的方法，应用于第一网络功能，所述方法包括：
接收PIN基元网关发送的第三消息；
其中，所述第三消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元支持的认证方法名称、PIN基元网关的 订阅隐藏标识符SUCI、5G全球唯一临时标识5G-GUTI、PIN基元标识符。
在一些示例性实施例中，所述方法还包括：
向第三网络功能发送第四消息，以指示PIN基元认证过程；
其中，所述第四消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
在一些示例性实施例中，所述方法还包括：
所述第一网络功能能辨识所述PIN基元认证指示符。
根据本公开的第四方面，提供一种为个人物联网设备选择认证机制的方法，应用于第三网络功能，所述方法包括：
接收第一网络功能发送的第五消息；
其中，所述第五消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
在一些示例性实施例中，所述方法还包括：
向第四网络功能发送第六消息；
其中，所述第六消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
在一些示例性实施例中，所述方法还包括：
所述第三网络功能能辨识所述PIN基元认证指示符。
根据本公开的第五方面，提供一种为个人物联网设备选择认证机制的方法，应用于第四网络功能，所述方法包括：
接收第三网络功能发送的第七消息；
其中，所述第七消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
在一些示例性实施例中，所述方法还包括：
向第二网络功能发送第八消息；
其中，所述第八消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
在一些示例性实施例中，所述方法还包括：
所述第四网络功能能辨识所述PIN基元认证指示符。
根据本公开的第六方面，提供一种为个人物联网设备选择认证机制的装置，包括：
接收单元，配置为接收个人物联网PIN基元发送的以下信息的至少之一：PIN基元支持的认证方法名称、PIN基元标识符、PIN基元认证指示符。
在一些示例性实施例中，所述装置还包括：
发送单元，配置为向第一网络功能发送第一消息，以向所述第一网络功能指示PIN基元认证过程；
其中，所述第一消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元支持的认证方法名称、PIN基元网关的订阅隐藏标识符SUCI或5G全球唯一临时标识5G-GUTI、PIN基元标识符。
根据本公开的第七方面，提供一种为个人物联网设备选择认证机制的装置，所述装置包括：
授权单元，配置为对PIN基元网关的认证请求进行授权；其中，所述PIN基元网关允许基于PIN基元网关的标识信息和PIN基元标识符对PIN基元执行认证过程。
在一些示例性实施例中，所述装置还包括：
选择单元，配置为为所述PIN基元选择PIN基元支持的认证方法。
在一些示例性实施例中，所述选择单元，还配置为：
基于所述PIN基元发送的PIN基元标识符和PIN基元支持的认证方法名称为所述PIN基元选择认证方式。
根据本公开的第八方面，提供一种为个人物联网设备选择认证机制的装置，所述装置包括：
接收单元，配置为接收PIN基元网关发送的第三消息；
其中，所述第三消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元支持的认证方法名称、PIN基元网关的订阅隐藏标识符SUCI、5G全球唯一临时标识5G-GUTI、PIN基元标识符。
在一些示例性实施例中，所述装置还包括：
发送单元，配置为向第三网络功能发送第四消息，以指示PIN基元认证过程；
其中，所述第四消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
根据本公开的第九方面，提供一种为个人物联网设备选择认证机制的装置，所述装置包括：
接收单元，配置为接收第一网络功能发送的第五消息；
其中，所述第五消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
在一些示例性实施例中，所述装置还包括：
发送单元，配置为向第四网络功能发送第六消息；
其中，所述第六消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
根据本公开的第十方面，提供一种为个人物联网设备选择认证机制的装置，所述装置包括：
接收单元，配置为接收第三网络功能发送的第七消息；
其中，所述第七消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
在一些示例性实施例中，所述装置还包括：
发送单元，配置为向第二网络功能发送第八消息；
其中，所述第八消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
根据本公开的第十一方面，提供一种用户设备，包括处理器、收发器、存储器及存储在存储器上并能够由所述处理器运行的可执行程序，所述处理器运行所述可执行程序时执行第一方面所述的为个人物联网设备选择认证机制的方法的步骤。
根据本公开的第十二方面，提供一种网络功能，包括处理器、收发器、存储器及存储在存储器上并能够由所述处理器运行的可执行程序，所述处理器运行所述可执行程序时执行第二方面所述的为个人物联网设备选择认证机制的方法的步骤。
根据本公开的第十三方面，提供一种网络功能，包括处理器、收发器、存储器及存储在存储器上并能够由所述处理器运行的可执行程序，所述处理器运行所述可执行程序时执行第三方面所述的为个人物联网设备选择认证机制的方法的步骤。
根据本公开的第十四方面，提供一种网络功能，包括处理器、收发器、存储器及存储在存储器上并能够由所述处理器运行的可执行程序，所述处理器运行所述可执行程序时执行第四方面所述的为个人物联网设备选择认证机制的方法的步骤。
根据本公开的第十五方面，提供一种网络功能，包括处理器、收发器、存储器及存储在存储器上并能够由所述处理器运行的可执行程序，所述处理器运行所述可执行程序时执行第五方面所述的为个人物联网设备选择认证机制的方法的步骤。
根据本公开的第十六方面，提供一种存储介质，其上存储有可执行程序，所述可执行程序被处理器执行时实现所述的为个人物联网设备选择认证机制的方法的步骤。
本公开实施例的技术方案，PIN基元通过网关接入PIN的情况下，网络需要对该PIN基元进行认证，PIN基元与PEGC之间建立安全的非3GPP链接，并协商相应的身份认证方式并发起认证。本公开实施例实现了5G核心网对PIN基元的身份认证，提升了PIN的通信安全。
附图说明
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本发明实施例，并与说明书一起用于解释本发明实施例的原理。
图1是根据一示例性实施例示出的无线通信系统的结构示意图；
图2是根据一示例性实施例示出的为个人物联网设备选择认证机制的方法的流程示意图；
图3是根据一示例性实施例示出的为个人物联网设备选择认证机制的方法的流程示意图；
图4是根据一示例性实施例示出的为个人物联网设备选择认证机制的方法的流程示意图；
图5是根据一示例性实施例示出的为个人物联网设备选择认证机制的方法的流程示意图；
图6是根据一示例性实施例示出的为个人物联网设备选择认证机制的方法的流程示意图；
图7是根据一示例性实施例示出的为个人物联网设备选择认证机制的方法的流程示意图；
图8是根据一示例性实施例示出的为个人物联网设备选择认证机制的装置的组成结构示意图；
图9是根据一示例性实施例示出的为个人物联网设备选择认证机制的装置的组成结构示意图；
图10是根据一示例性实施例示出的为个人物联网设备选择认证机制的装置的组成结构示意图；
图11是根据一示例性实施例示出的为个人物联网设备选择认证机制的装置的组成结构示意图；
图12是根据一示例性实施例示出的为个人物联网设备选择认证机制的装置的组成结构示意图；
图13是根据一示例性实施例示出的一种用户设备的组成结构示意图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本公开实施例相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本公开实施例的一些方面相一致的装置和方法的例子。
在本公开实施例使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本公开实施例。在本公开实施例和所附权利要求书中所使用的单 数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本公开实施例可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本公开实施例范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
请参考图1，其示出了本公开实施例提供的一种无线通信系统的结构示意图。如图1所示，无线通信系统是基于蜂窝移动通信技术的通信系统，该无线通信系统可以包括：若干个终端11以及若干个基站12。
其中，终端11可以是指向用户提供语音和/或数据连通性的设备。终端11可以经无线接入网(Radio Access Network，RAN)与一个或多个核心网进行通信，终端11可以是物联网终端，如传感器设备、移动电话(或称为“蜂窝”电话)和具有物联网终端的计算机，例如，可以是固定式、便携式、袖珍式、手持式、计算机内置的或者车载的装置。例如，站(Station，STA)、订户单元(subscriber unit)、订户站(subscriber station)，移动站(mobile station)、移动台(mobile)、远程站(remote station)、接入点、远程终端(remote terminal)、接入终端(access terminal)、用户装置(user terminal)、用户代理(user agent)、终端(user device)、或用户终端(user equipment，UE)。或者，终端11也可以是无人飞行器的设备。或者，终端11也可以是车载设备，比如，可以是具有无线通信功能的行车电脑，或者是外接行车电脑的无线通信设备。或者，终端11也可以是路边设备，比如，可以是具有无线通信功能的路灯、信号灯或者其它路边设备等。
基站12可以是无线通信系统中的网络侧设备。其中，该无线通信系统可以是第四代移动通信技术(the 4th generation mobile communication，4G)系统，又称长期演进(Long Term Evolution，LTE)系统；或者，该无线通信系统也可以是5G系统，又称新空口(new radio，NR)系统或5G NR系统。或者，该无线通信系统也可以是任一代系统。其中，5G系统中的接入网可以称为新一代无线接入网(New Generation-Radio Access Network，NG-RAN)。或者，MTC系统。
其中，基站12可以是4G系统中采用的演进型基站(eNB)。或者，基站12也可以是5G系统中采用集中分布式架构的基站(gNB)。当基站12采用集中分布式架构时，通常包括集中单元(Central Unit，CU)和至少两个分布单元(Distributed Unit，DU)。集中单元中设置有分组数据汇聚协议(Packet Data Convergence Protocol，PDCP)层、无线链路层控制协议(Radio Link Control，RLC)层、媒体访问控制(Media Access Control，MAC)层的协议栈；分布单元中设置有物理(Physical，PHY)层协议栈，本公开实施例对基站12的具体实现方式不加以限定。
基站12和终端11之间可以通过无线空口建立无线连接。在不同的实施方式中，该无线空口是基于第四代移动通信网络技术(4G)标准的无线空口；或者，该无线空口是基于第五代移动通信网络技术(5G)标准的无线空口，比如该无线空口是新空口；或者，该无线空口也可以是基于5G的更下一代移动通信网络技术标准的无线空口。
在一些实施例中，终端11之间还可以建立端到端(End to End，E2E)连接。比如车联网通信(vehicle to everything，V2X)中的V2V(vehicle to vehicle，车对车)通信、车对路边设备(vehicle to Infrastructure，V2I)通信和车对人(vehicle to Pedestrian，V2P)通信等场景。
在一些实施例中，上述无线通信系统还可以包含网络管理设备13。
本公开实施例涉及的执行主体包括但不限于：蜂窝移动通信系统中的终端(UE，User Equipment)，以及蜂窝移动通信的基站等。
图2是根据一示例性实施例示出的为个人物联网设备选择认证机制的方法的流程示意图，如图2所示，本公开实施例的为个人物联网设备选择认证机制的方法应用于UE，所述为个人物联网设备选择认证机制的方法包括以下处理步骤：
步骤201，接收个人物联网PIN基元发送的以下信息的至少之一：PIN基元支持的认证方法名称、PIN基元标识符、PIN基元认证指示符。
本公开实施例中，UE可以作为PIN基元(PIN element)的接入网关，即可以作为私有物联网网关如PEGC使能。PIN基元可以通过UE接入5G移动网中。
作为PEGC的UE可以与PIN基元之间协商如何建立安全的非3GPP链接，并协商相应的PIN基元身份认证方式等。
步骤202，向第一网络功能发送第一消息，以向所述第一网络功能指示PIN基元认证过程。
其中，在UE接收到PIN基元发送的第二消息的情况下，向所述第一网络功能发送所述第一消息。这里，第二消息可以是触发消息，该第二消息中可以携带PIN基元支持的认证方法名称、PIN基元标识符等信息。
所述第一消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元支持的认证方法名称、PIN基元网关的订阅隐藏标识符SUCI或5G全球唯一临时标识5G-GUTI、PIN基元标识符。这里，为了保证网络功能之间消息传输的安全性，可以将所述第一消息封装为非接入层(Non-Access-Stratum，NAS)消息，再向所述第一网络功能发送。本领域技术人员应当理解，采用NAS消息仅为处于安全性考虑，也可以采用其他类型的消息实现上述信息的传输。
第一网络功能可以包括接入及移动性管理功能AMF。本领域技术人员应当理解，当核心网的其他网络功能实现AMF的功能的情况下，也可以作为第一网络功能使能。或者，核心网的其他网络功能配置了本公开实施例的第一网络功能的相应功能的情况下，也可以作为第一网络功能使能。
图3是根据一示例性实施例示出的为个人物联网设备选择认证机制的方法的流程示意图，如图3所示，本公开实施例的为个人物联网设备选择认证机制的方法应用于第二网络功能，所述第二网络功能可以包括统一数据管理功能(Unified Data Management，UDM)或地址解析协议功能(Address Resolution Protocol Function，ARPF)。本领域技术人员应当理解，当核心网的其他网络功能配置了本公开实施例的第二网络功能的相应功能的情况下，也可以作为第二网络功能使能。所述为个人物联网设备选择认证机制的方法包括以下处理步骤：
步骤301，针对PIN基元网关的认证请求进行授权。
本公开实施例中，对PIN基元网关的认证请求进行授权，包括：第二网络功能需要根据PIN基元网关(PIN element with gateway capability)的SUCI或者SUPI、PIN基元标识符、以及相应的PIN基元网关的订阅信息，判断PEGC是否是合法的网关，以及是否是PIN基元(PINE)的网关。第二网络功能还需要为PINE选择相应的认证方式。其中，若所述PIN基元网关的标识信息为SUCI，将SUCI转换为SUPI，再对所述PIN基元网关的认证请求进行授权。
本公开实施例中，所述认证请求中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。服务网络标识包括但不限于服务网络名称(Serving Network Name)等。
步骤302，为PIN基元认证选择认证方式。
本公开实施例中，第二网络功能基于所述PIN基元发送的PIN基元标识符和PIN基元支持的认证方法名称为所述PIN基元选择认证方式。
本公开实施例中，所述PIN基元标识符为受保护的信息或不受保护的信息；其中，所述PIN基元标识符的受保护方式包括以下至少之一：加密、匿名化；这里的加密算法可以是MD5算法、SHA1算法、HMAC算法、AES/DES算法等。在所述PIN基元标识符为受保护的信息的情况下，需要对所述PIN基元标识符进行去保护化后，对PIN基元网关的认证请求进行授权。
本公开实施例中，所述第二网络功能能辨识所述PIN基元认证指示符。
图4是根据一示例性实施例示出的为个人物联网设备选择认证机制的方法的流程示意图，如图4所示，本公开实施例的为个人物联网设备选择认证机制的方法应用于第一网络功能，所述为个人物联网设备选择认证机制的方法包括以下处理步骤：
步骤401，接收PIN基元网关发送的第三消息。
其中，所述第三消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元支持的认证方法名称、PIN基元网关的订阅隐藏标识符SUCI、5G全球唯一临时标识5G-GUTI、PIN基元标识符。
本公开实施例中，这里，第三消息可以是NAS消息。本领域技术人员应当理解，采用NAS消息仅为处于安全性考虑，也可以采用其他类型的消息实现上述信息的传输。
第一网络功能可以包括接入及移动性管理功能AMF。本领域技术人员应当理解，当核心网的其他网络功能实现AMF的功能的情况下，也可以作为第一网络功能使能。或者，核心网的其他网络功能配置了本公开实施例的第一网络功能的相应功能的情况下，也可以作为第一网络功能使能。
作为一种实现方式，第一网络功能接收PIN基元网关发送的第三消息，可以是由PIN基元通过PEGC向第一网络功能发送该消息。本领域技术人员应当理解，不同网络功能之间传输相关信息的情况下，需要根据不同的网络接口进行相应的消息封装，这里不限定具体的消息格式，只要能进行信息的传输即可。
作为一种示例，第一网络功能可以包括接入及移动性管理功能AMF。本领域技术人员应当理解，当核心网的其他网络功能实现AMF的功能的情况下，也可以作为第一网络功能使能。或者，核心网的其他网络功能配置了本公开实施例的第一网络功能的相应功能的情况下，也可以作为第一网络功能使能。
步骤402，向第三网络功能发送第四消息，以指示PIN基元认证过程。
本公开实施例中，第三网络功能可以包括安全锚定功能(SEcurity Anchor Function，SEAF)。本领域技术人员应当理解，当核心网的其他网络功能实现SEAF的功能的情况下，也可以作为第三网络功能使能。或者，核心网的其他网络功能配置了本公开实施例的第三网络功能的相应功能的情况下，也可以作为第三网络功能使能。
AUSF在接收到第四消息后，通过将服务网络名称与预期的服务网络名称进行比较来检查服务网络中的请求AMF是否有权使用第四消息中的服务网络名称。如果服务网络未被授权使用服务网络名称，则AUSF向AMF发送拒绝消息。如果服务网络授权使用服务网络名，则AUSF向UDM发送相应的请求消息。
本公开实施例中，所述第四消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。这里，PIN基元认证指示符的基本作用是：指示本条消息的目的是进行PINE的认证。
作为一种实现方式，第四消息是支持AMF和SEAF之间通信协议的消息，能够实现在AMF和SEAF之间进行信息传输。
本公开实施例中，第一网络功能能辨识所述PIN基元认证指示符。
图5是根据一示例性实施例示出的为个人物联网设备选择认证机制的方法的流程示意图，如图5所示，本公开实施例的为个人物联网设备选择认证机制的方法应用于第三网络功能，本公开实施例中，第三网络功能可以包括安全锚定功能(SEcurity Anchor Function，SEAF)。本领域技术人员应当理解，当核心网的其他网络功能实现SEAF的功能的情况下，也可以作为第三网络功能使能。或者，核心网的其他网络功能配置了本公开实施例的第三网络功能的相应功能的情况下，也可以作为第三网络功能使能。所述为个人物联网设备选择认证机制的方法包括以下处理步骤：
步骤501，接收第一网络功能发送的第五消息。
其中，所述第五消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
在本实施例中，第一网络功能可以包括接入及移动性管理功能AMF。本领域技术人员应当理解，当核心网的其他网络功能实现AMF的功能的情况下，也可以作为第一网络功能使能。或者，核心网的其他网络功能配置了本公开实施例的第一网络功能的相应功能的情况下，也可以作为第一网络功能使能。
本公开实施例中，第五消息是支持AMF和SEAF之间通信协议的消息，能够实现在AMF和SEAF之间进行信息传输。
步骤502，向第四网络功能发送第六消息。
其中，所述第六消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN 基元支持的认证方法名称、服务网络标识。
本公开实施例中，第四网络功能可以包括AUSF。本领域技术人员应当理解，当核心网的其他网络功能实现AUSF的功能的情况下，也可以作为第四网络功能使能。或者，核心网的其他网络功能配置了本公开实施例的第四网络功能的相应功能的情况下，也可以作为第四网络功能使能。
本公开实施例中，第六消息是支持鉴权服务功能(Authentication Service Function，AUSF)和SEAF之间通信协议的消息，能够实现在AUSF和SEAF之间进行信息传输。
本公开实施例中，所述第三网络功能能辨识所述PIN基元认证指示符。本公开实施例中，第三网络功能可以包括安全锚定功能(SEcurity Anchor Function，SEAF)。本领域技术人员应当理解，当核心网的其他网络功能实现SEAF的功能的情况下，也可以作为第三网络功能使能。或者，核心网的其他网络功能配置了本公开实施例的第三网络功能的相应功能的情况下，也可以作为第三网络功能使能。
图6是根据一示例性实施例示出的为个人物联网设备选择认证机制的方法的流程示意图，如图6所示，本公开实施例的为个人物联网设备选择认证机制的方法应用于第四网络功能，本公开实施例中，第四网络功能可以包括AUSF。本领域技术人员应当理解，当核心网的其他网络功能实现AUSF的功能的情况下，也可以作为第四网络功能使能。或者，核心网的其他网络功能配置了本公开实施例的第四网络功能的相应功能的情况下，也可以作为第四网络功能使能。所述为个人物联网设备选择认证机制的方法包括以下处理步骤：
步骤601，接收第三网络功能发送的第七消息。
其中，所述第七消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN 基元支持的认证方法名称、服务网络标识。本公开实施例中，第三网络功能可以包括安全锚定功能(SEcurity Anchor Function，SEAF)。本领域技术人员应当理解，当核心网的其他网络功能实现SEAF的功能的情况下，也可以作为第三网络功能使能。或者，核心网的其他网络功能配置了本公开实施例的第三网络功能的相应功能的情况下，也可以作为第三网络功能使能。
本公开实施例中，第七消息是支持AUSF和SEAF之间通信协议的消息，能够实现在AUSF和SEAF之间进行信息传输。
步骤602，向第二网络功能发送第八消息。
其中，所述第八消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
本公开实施例中，第七消息是支持AUSF和UDM/ARPF之间通信协议的消息，能够实现在AUSF和UDM/ARPF之间进行信息传输。
本公开实施例中，所述第四网络功能能辨识所述PIN基元认证指示符。所述第二网络功能可以包括统一数据管理功能(Unified Data Management，UDM)或地址解析协议功能(Address Resolution Protocol Function，ARPF)。本领域技术人员应当理解，当核心网的其他网络功能配置了本公开实施例的第二网络功能的相应功能的情况下，也可以作为第二网络功能使能。
以下通过具体示例，进一步阐明本公开实施例的技术方案的本质。
目前，随着物联网技术及设备的不断发展，有一些类型的物联网设备可以放置于人的身体周围，如可以置放于可穿戴设备如相机、耳机、手表、耳机、健康监视器等中，也可以分散在家里如置放于智能灯、摄像头、恒温器、门传感器、语音助手、扬声器、冰箱、洗衣机、割草机、机器人等中，或置放于小型企业的办公室如打印机、仪表、传感器中。一些物联网 设备在尺寸方面有非常具体的要求例如设置于耳塞中的情况下，一些物联网设备在重量方面有非常具体的要求例如设置于穿戴设备如眼镜中的情况下。此外，一些物联网设备在多个方面如尺寸、重量和功耗等均有非常具体的要求。随着物联网设备数量的急剧增加，用户需要使用这些物联网设备创建相应的网络，以实现对物联网设备的管理和访问等。
用户创建的网络由构成个人物联网网络(PIN)的设备组成。PIN中一般包含三种设备(PIN Element)：具有网关能力的设备(PIN Element with Gateway Capability，PEGC)、具有管理能力的设备(PIN Element with Management Capability，PEMC)和没有网关和管理功能的设备。PEGC和PEMC也可以是直接接入5GS的UE。PEMC能够通过PEGC访问5GS。
本公开实施例即提供一种由5GC启动针对PIN基元的身份认证过程，并为其选择相应的身份认证方式。
本公开实施例中，假设PIN基元标识符已与PEGC的订阅信息相关联。假设PEGC已经注册到5GC。PEGC和AMF之间的连接受NAS安全性保护。AMF和SEAF并置。当然，也AMF和SEAF也可以分开设置，这里仅作为一示例如图7进行解释。
图7是根据一示例性实施例示出的为个人物联网设备选择认证机制的方法的流程示意图，如图7所示，本公开实施例的为个人物联网设备选择认证机制的方法以下处理步骤：
步骤1，PIN基元与PEGC之间协商安全的非3GPP连接。PIN基元向PEGC发送PIN基元认证指示符、PIN基元支持的认证方法名称、PIN基元标识符等信息。
具体地，PIN基元将其标识符发送给PEGC。PIN基元可以通过安全的非3GPP连接支持身份认证。如何在PIN元件和PEGC之间建立安全连接超出了3GPP的范围。
步骤2，PEGC向AMF发送NAS消息，该NAS消息中携带有PIN基元认证指示符、PIN基元标识符、PIN基元支持的认证方法名称、PEGC的SUCI或5G-GUTI等信息。
步骤3，当AMF希望启动身份认证的情况下，AMF通过向AUSF发送Nausf_UEAuthentication_Authenticate Request消息来调用Nausf_UEAuthentication服务。其中，Nausf_UEAuthentication_Authenticate Request消息可以包含PIN基元认证指示符、PIN基元标识符、PIN基元支持的认证方法名称、PEGC的SUPI或SUCI，以及服务网络标识等信息。
步骤4，AUSF在接收到Nausf_UEAuthentication_Authenticate Request消息后，AUSF通过将服务网络名称与预期的服务网络名称进行比较来检查服务网络中的请求AMF是否有权使用Nausf_UEAuthentication_Authenticate请求中的服务网络名称。AUSF将临时存储接收到的服务网络名称。如果服务网络未被授权使用服务网络名称，则AUSF可以在Nausf_UEAuthentication_Authenticate响应消息中以“服务网络未授权”，向AMF进行响应。如果服务网络被授权使用服务网络名称，则AUSF向UDM发送Nudm_UEAuthentication_Get Request消息，该发送至UDM的Nudm_UEAuthentication_Get Request消息可以包括PIN基元认证指示符、PIN基元标识符、PEGC的SUPI或SUCI、PIN基元支持的认证方法名称、服务网络标识。
步骤5，UDM在接收到Nudm_UEAuthentication_Get Request消息后，如果接收到PEGC的SUCI，则UDM将调用订阅标识符去隐藏功能(Subscription Identifier De-concealing Function，SIDF)，以将PEGC的SUCI解密为PEGC的SUPI。若UDM接收到的PIN基元标识符为受保护的信息如经过加密或匿名化方式处理的信息，则UDM将调用订阅标识符去隐藏功能(Subscription Identifier De-concealing Function，SIDF)，即对受保护的 PIN基元标识符进行解密或去匿名化处理等，在对所述PIN基元标识符进行去保护化后，对PIN基元网关的认证请求进行授权。这里，可以选用MD5算法、SHA1算法、HMAC算法、AES/DES算法等对所述PIN基元标识符进行保护化处理。DM确定接收到PEGC的SUCI的情况下，将PEGC的SUCI转换为SUPI，再为PIN基元选择相应的认证方法。
步骤6，UDM/ARPF根据PEGC的SUPI和PIN基元标识符，根据PEGC的订阅认证允许PEGC执行PIN基元的认证过程，然后基于PIN基元发送的PIN基元标识符和PIN基元支持的认证方法名称，为PIN基元的认证选择认证方式。
本公开实施例实现了5G核心网对PIN基元的身份认证，提升了PIN的通信安全。
图8是根据一示例性实施例示出的为个人物联网设备选择认证机制的装置的组成结构示意图，如图8所示，本公开实施例的为个人物联网设备选择认证机制的装置可以应用于UE中，所述装置包括：
接收单元80，配置为接收个人物联网PIN基元发送的以下信息的至少之一：PIN基元支持的认证方法名称、PIN基元标识符、PIN基元认证指示符。
在图8所示的为个人物联网设备选择认证机制的装置的基础上，所述装置还包括：
发送单元(图8中未示出)，配置为向第一网络功能发送第一消息，以向所述第一网络功能指示PIN基元认证过程；
其中，所述第一消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元支持的认证方法名称、PIN基元网关的订阅隐藏标识符SUCI或5G全球唯一临时标识5G-GUTI、PIN基元标识符。这里，所述发送单元响应于接收单元80接收PIN基元的第三消息，向所述 第一网络功能发送所述第一消息。为了保证网络功能之间消息传输的安全性，可以将所述第一消息封装为非接入层(Non-Access-Stratum，NAS)消息，再向所述第一网络功能发送。
本公开实施例的UE可以作为PEGC而使能。
在示例性实施例中，接收单元80、发送单元等可以被一个或多个中央处理器(CPU，Central Processing Unit)、图形处理器(GPU，Graphics Processing Unit)、基带处理器(BP，Base Processor)、应用专用集成电路(ASIC，Application Specific Integrated Circuit)、数字信号处理器(Digital Signal Processor，DSP)、可编程逻辑器件(PLD，Programmable Logic Device)、复杂可编程逻辑器件(CPLD，Complex Programmable Logic Device)、现场可编程门阵列(FPGA，Field-Programmable Gate Array)、通用处理器、控制器、微控制器(MCU，Micro Controller Unit)、微处理器(Microprocessor)、或其他电子元件实现，也可以结合一个或多个射频(RF，Radio Frequency)天线实现，用于执行前述实施例的为个人物联网设备选择认证机制的方法的步骤。
在本公开实施例中，图8示出的装置中各个单元执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
图9是根据一示例性实施例示出的为个人物联网设备选择认证机制的装置的组成结构示意图，如图9所示，本公开实施例的为个人物联网设备选择认证机制的装置可以应用于第二网络功能如UDM/ARPF中，所述装置包括：
授权单元90，配置为对PIN基元网关的认证请求进行授权；其中，所述PIN基元网关允许基于PIN基元网关的标识信息和PIN基元标识符对PIN基元执行认证过程。
所述认证请求中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
在图9所示的为个人物联网设备选择认证机制的装置的基础上，所述装置还包括：
选择单元(图9中未示出)，配置为为所述PIN基元选择PIN基元支持的认证方法。
所述选择单元，还配置为：
基于所述PIN基元发送的PIN基元标识符和PIN基元支持的认证方法名称为所述PIN基元选择认证方式。
这里，第二网络功能能够识别PIN基元认证指示符。
在示例性实施例中，授权单元90、选择单元等可以被一个或多个中央处理器(CPU，Central Processing Unit)、图形处理器(GPU，Graphics Processing Unit)、基带处理器(BP，Base Processor)、应用专用集成电路(ASIC，Application Specific Integrated Circuit)、数字信号处理器(Digital Signal Processor，DSP)、可编程逻辑器件(PLD，Programmable Logic Device)、复杂可编程逻辑器件(CPLD，Complex Programmable Logic Device)、现场可编程门阵列(FPGA，Field-Programmable Gate Array)、通用处理器、控制器、微控制器(MCU，Micro Controller Unit)、微处理器(Microprocessor)、或其他电子元件实现，也可以结合一个或多个射频(RF，Radio Frequency)天线实现，用于执行前述实施例的为个人物联网设备选择认证机制的方法的步骤。
在本公开实施例中，图9示出的装置中各个单元执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
图10是根据一示例性实施例示出的为个人物联网设备选择认证机制的 装置的组成结构示意图，如图10所示，本公开实施例的为个人物联网设备选择认证机制的装置可以应用于第一网络功能如AMF中，所述装置包括：
接收单元100，配置为接收PIN基元网关发送的第三消息；
其中，所述第三消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元支持的认证方法名称、PIN基元网关的订阅隐藏标识符SUCI、5G全球唯一临时标识5G-GUTI、PIN基元标识符。
在图10所示的为个人物联网设备选择认证机制的装置的基础上，所述装置还包括：
发送单元(图10中未示出)，配置为向第三网络功能发送第四消息，以指示PIN基元认证过程；
其中，所述第四消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
这里，第一网络功能能够识别PIN基元认证指示符。
在示例性实施例中，接收单元100、发送单元等可以被一个或多个中央处理器(CPU，Central Processing Unit)、图形处理器(GPU，Graphics Processing Unit)、基带处理器(BP，Base Processor)、应用专用集成电路(ASIC，Application Specific Integrated Circuit)、数字信号处理器(Digital Signal Processor，DSP)、可编程逻辑器件(PLD，Programmable Logic Device)、复杂可编程逻辑器件(CPLD，Complex Programmable Logic Device)、现场可编程门阵列(FPGA，Field-Programmable Gate Array)、通用处理器、控制器、微控制器(MCU，Micro Controller Unit)、微处理器(Microprocessor)、或其他电子元件实现，也可以结合一个或多个射频(RF，Radio Frequency)天线实现，用于执行前述实施例的为个人物联网设备选择认证机制的方法的步骤。
在本公开实施例中，图10示出的装置中各个单元执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
图11是根据一示例性实施例示出的为个人物联网设备选择认证机制的装置的组成结构示意图，如图11所示，本公开实施例的为个人物联网设备选择认证机制的装置可以应用于第三网络功能如SEAF中，所述装置包括：
接收单元110，配置为接收第一网络功能发送的第五消息；
其中，所述第五消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
在图11所示的为个人物联网设备选择认证机制的装置的基础上，所述装置还包括：
发送单元(图11中未示出)，配置为向第四网络功能发送第六消息；
其中，所述第六消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
这里，第三网络功能能够识别PIN基元认证指示符。
在示例性实施例中，接收单元110、发送单元等可以被一个或多个中央处理器(CPU，Central Processing Unit)、图形处理器(GPU，Graphics Processing Unit)、基带处理器(BP，Base Processor)、应用专用集成电路(ASIC，Application Specific Integrated Circuit)、数字信号处理器(Digital Signal Processor，DSP)、可编程逻辑器件(PLD，Programmable Logic Device)、复杂可编程逻辑器件(CPLD，Complex Programmable Logic Device)、现场可编程门阵列(FPGA，Field-Programmable Gate Array)、通用处理器、控制器、微控制器(MCU，Micro Controller Unit)、微处理器(Microprocessor)、或其他电子元件实现，也可以结合一个或多个射频(RF， Radio Frequency)天线实现，用于执行前述实施例的为个人物联网设备选择认证机制的方法的步骤。
在本公开实施例中，图11示出的装置中各个单元执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
图12是根据一示例性实施例示出的为个人物联网设备选择认证机制的装置的组成结构示意图，如图12所示，本公开实施例的为个人物联网设备选择认证机制的装置可以应用于第四网络功能如AUSF中，所述装置包括：
接收单元120，配置为接收第三网络功能发送的第七消息；
其中，所述第七消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
在图12所示的为个人物联网设备选择认证机制的装置的基础上，所述装置还包括：
发送单元(图12中未示出)，配置为向第二网络功能发送第八消息；
其中，所述第八消息中携带有以下信息的至少之一：
PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
这里，第四网络功能能够识别PIN基元认证指示符。
在示例性实施例中，接收单元120、发送单元等可以被一个或多个中央处理器(CPU，Central Processing Unit)、图形处理器(GPU，Graphics Processing Unit)、基带处理器(BP，Base Processor)、应用专用集成电路(ASIC，Application Specific Integrated Circuit)、数字信号处理器(Digital Signal Processor，DSP)、可编程逻辑器件(PLD，Programmable Logic Device)、复杂可编程逻辑器件(CPLD，Complex Programmable Logic Device)、现场可编程门阵列(FPGA，Field-Programmable Gate Array)、通 用处理器、控制器、微控制器(MCU，Micro Controller Unit)、微处理器(Microprocessor)、或其他电子元件实现，也可以结合一个或多个射频(RF，Radio Frequency)天线实现，用于执行前述实施例的为个人物联网设备选择认证机制的方法的步骤。
在本公开实施例中，图12示出的装置中各个单元执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
图13是根据一示例性实施例示出的一种用户设备8000的框图。例如，用户设备8000可以是移动电话，计算机，数字广播终端，消息收发设备，游戏控制台，平板设备，医疗设备，健身设备，个人数字助理等。
参照图13，用户设备8000可以包括以下一个或多个基元：处理基元8002，存储器8004，电源基元8006，多媒体基元8008，音频基元8010，输入/输出(I/O)的接口8012，传感器基元8014，以及通信基元8016。
处理基元8002通常控制用户设备8000的整体操作，诸如与显示，电话呼叫，数据通信，相机操作和记录操作相关联的操作。处理基元8002可以包括一个或多个处理器8020来执行指令，以完成上述的为个人物联网设备选择认证机制的方法的全部或部分步骤。此外，处理基元8002可以包括一个或多个模块，便于处理基元8002和其他基元之间的交互。例如，处理基元8002可以包括多媒体模块，以方便多媒体基元8008和处理基元8002之间的交互。
存储器8004被配置为存储各种类型的数据以支持在设备8000的操作。这些数据的示例包括用于在用户设备8000上操作的任何应用程序或方法的指令，联系人数据，电话簿数据，消息，图片，视频等。存储器8004可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(SRAM)，电可擦除可编程只读存储器(EEPROM)，可擦除可编程只读存储器(EPROM)，可编程只读存储器(PROM)，只读存储器 (ROM)，磁存储器，快闪存储器，磁盘或光盘。
电源基元8006为用户设备8000的各种基元提供电力。电源基元8006可以包括电源管理系统，一个或多个电源，及其他与为用户设备8000生成、管理和分配电力相关联的基元。
多媒体基元8008包括在用户设备8000和用户之间的提供一个输出接口的屏幕。在一些实施例中，屏幕可以包括液晶显示器(LCD)和触摸面板(TP)。如果屏幕包括触摸面板，屏幕可以被实现为触摸屏，以接收来自用户的输入信号。触摸面板包括一个或多个触摸传感器以感测触摸、滑动和触摸面板上的手势。触摸传感器可以不仅感测触摸或滑动动作的边界，而且还检测与触摸或滑动操作相关的持续时间和压力。在一些实施例中，多媒体基元8008包括一个前置摄像头和/或后置摄像头。当设备8000处于操作模式，如拍摄模式或视频模式时，前置摄像头和/或后置摄像头可以接收外部的多媒体数据。每个前置摄像头和后置摄像头可以是一个固定的光学透镜系统或具有焦距和光学变焦能力。
音频基元8010被配置为输出和/或输入音频信号。例如，音频基元8010包括一个麦克风(MIC)，当用户设备8000处于操作模式，如呼叫模式、记录模式和语音识别模式时，麦克风被配置为接收外部音频信号。所接收的音频信号可以被进一步存储在存储器8004或经由通信基元8016发送。在一些实施例中，音频基元8010还包括一个扬声器，用于输出音频信号。
I/O接口8012为处理基元8002和外围接口模块之间提供接口，上述外围接口模块可以是键盘，点击轮，按钮等。这些按钮可包括但不限于：主页按钮、音量按钮、启动按钮和锁定按钮。
传感器基元8014包括一个或多个传感器，用于为用户设备8000提供各个方面的状态评估。例如，传感器基元8014可以检测到设备8000的打开/关闭状态，基元的相对定位，例如基元为用户设备8000的显示器和小键 盘，传感器基元8014还可以检测用户设备8000或用户设备8000中一个基元的位置改变，用户与用户设备8000接触的存在或不存在，用户设备8000方位或加速/减速和用户设备8000的温度变化。传感器基元8014可以包括接近传感器，被配置用来在没有任何的物理接触时检测附近物体的存在。传感器基元8014还可以包括光传感器，如CMOS或CCD图像传感器，用于在成像应用中使用。在一些实施例中，该传感器基元8014还可以包括加速度传感器，陀螺仪传感器，磁传感器，压力传感器或温度传感器。
通信基元8016被配置为便于用户设备8000和其他设备之间有线或无线方式的通信。用户设备8000可以接入基于通信标准的无线网络，如Wi-Fi，2G或3G，或它们的组合。在一个示例性实施例中，通信基元8016经由广播信道接收来自外部广播管理系统的广播信号或广播相关信息。在一个示例性实施例中，通信基元8016还包括近场通信(NFC)模块，以促进短程通信。例如，在NFC模块可基于射频识别(RFID)技术，红外数据协会(IrDA)技术，超宽带(UWB)技术，蓝牙(BT)技术和其他技术来实现。
在示例性实施例中，用户设备8000可以被一个或多个应用专用集成电路(ASIC)、数字信号处理器(DSP)、数字信号处理设备(DSPD)、可编程逻辑器件(PLD)、现场可编程门阵列(FPGA)、控制器、微控制器、微处理器或其他电子元件实现，用于执行上述为个人物联网设备选择认证机制的方法的步骤。
在示例性实施例中，还提供了一种包括指令的非临时性计算机可读存储介质，例如包括指令的存储器8004，上述指令可由用户设备8000的处理器8020执行以完成上述为个人物联网设备选择认证机制的方法的步骤。例如，非临时性计算机可读存储介质可以是ROM、随机存取存储器(RAM)、CD-ROM、磁带、软盘和光数据存储设备等。
本公开实施例还记载了一种第一网络功能，包括处理器、收发器、存 储器及存储在存储器上并能够由所述处理器运行的可执行程序，所述处理器运行所述可执行程序时执行前述实施例的为个人物联网设备选择认证机制的方法的步骤。
本公开实施例还记载了一种第二网络功能，包括处理器、收发器、存储器及存储在存储器上并能够由所述处理器运行的可执行程序，所述处理器运行所述可执行程序时执行前述实施例的为个人物联网设备选择认证机制的方法的步骤。
本公开实施例还记载了一种第三网络功能，包括处理器、收发器、存储器及存储在存储器上并能够由所述处理器运行的可执行程序，所述处理器运行所述可执行程序时执行前述实施例的为个人物联网设备选择认证机制的方法的步骤。
本公开实施例还记载了一种第四网络功能，包括处理器、收发器、存储器及存储在存储器上并能够由所述处理器运行的可执行程序，所述处理器运行所述可执行程序时执行前述实施例的为个人物联网设备选择认证机制的方法的步骤。
本公开实施例还记载了一种用户设备，包括处理器、收发器、存储器及存储在存储器上并能够由所述处理器运行的可执行程序，所述处理器运行所述可执行程序时执行前述实施例的为个人物联网设备选择认证机制的方法的步骤。
本公开实施例还记载了一种存储介质，其上存储有可执行程序，所述可执行程序被处理器执行前述实施例的为个人物联网设备选择认证机制的方法的步骤。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本发明实施例的其它实施方案。本申请旨在涵盖本发明实施例的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本发明实施例 的一般性原理并包括本公开实施例未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本发明实施例的真正范围和精神由下面的权利要求指出。
应当理解的是，本发明实施例并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本发明实施例的范围仅由所附的权利要求来限制。

Claims (26)

  1. 一种为个人物联网设备选择认证机制的方法，应用于用户设备UE，所述方法包括：
    接收个人物联网PIN基元发送的以下信息的至少之一：PIN基元支持的认证方法名称、PIN基元标识符、PIN基元认证指示符。
  2. 根据权利要求1所述的方法，其中，所述方法还包括：
    向第一网络功能发送第一消息，以向所述第一网络功能指示PIN基元认证过程；其中，所述第一消息中携带有以下信息的至少之一：
    PIN基元认证指示符、PIN基元支持的认证方法名称、PIN基元网关的订阅隐藏标识符SUCI或5G全球唯一临时标识5G-GUTI、PIN基元标识符。
  3. 根据权利要求2所述的方法，其中，所述向第一网络功能发送第一消息，包括：
    响应于接收PIN基元的第二消息，向所述第一网络功能发送所述第一消息。
  4. 根据权利要求2所述的方法，其中，所述向第一网络功能发送第一消息，包括：
    将所述第一消息封装为非接入层NAS消息，向所述第一网络功能发送。
  5. 根据权利要求1至4任一项所述的方法，其中，所述UE作为PIN基元网关使能。
  6. 一种为个人物联网设备选择认证机制的方法，应用于第二网络功能，所述方法包括：
    针对PIN基元网关的认证请求进行授权并为PIN基元认证选择认证方式方法。
  7. 根据权利要求6所述的方法，其中，所述认证请求中携带有以下信息的至少之一：
    PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
  8. 根据权利要求7所述的方法，其中，所述PIN基元标识符为受保护的信息或不受保护的信息；其中，所述PIN基元标识符的受保护方式包括以下至少之一：加密、匿名化；
    所述对PIN基元网关的认证请求进行授权，包括：
    在所述PIN基元标识符为受保护的信息的情况下，对所述PIN基元标识符进行去保护化后，对PIN基元网关的认证请求进行授权。
  9. 根据权利要求7所述的方法，其中，所述对PIN基元网关的认证请求进行授权，包括：
    根据所述PIN基元网关的订阅隐藏标识符SUCI和/或用户永久标识符SUPI、PIN基元标识符、PIN基元网关的订阅信息，确定所述PIN基元网关为合法网关，且为所述PIN基元的网关。
  10. 根据权利要求9所述的方法，其中，所述对PIN基元网关的认证请求进行授权，包括：
    若所述PIN基元网关的标识信息为SUCI，将SUCI转换为SUPI，再对所述PIN基元网关的认证请求进行授权。
  11. 根据权利要求6至10任一项所述的方法，其中，所述方法还包括：
    为所述PIN基元选择PIN基元支持的认证方法。
  12. 根据权利要求11所述的方法，其中，所述为PIN基元选择PIN基元支持的认证方法，包括：
    基于所述PIN基元发送的PIN基元标识符和PIN基元支持的认证方法名称为所述PIN基元选择认证方式。
  13. 一种为个人物联网设备选择认证机制的方法，应用于第一网络功能，所述方法包括：
    接收PIN基元网关发送的第三消息；
    其中，所述第三消息中携带有以下信息的至少之一：
    PIN基元认证指示符、PIN基元支持的认证方法名称、PIN基元网关的订阅隐藏标识符SUCI、5G全球唯一临时标识5G-GUTI、PIN基元标识符。
  14. 根据权利要求13所述的方法，其中，所述方法还包括：
    向第三网络功能发送第四消息，以指示PIN基元认证过程；
    其中，所述第四消息中携带有以下信息的至少之一：
    PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
  15. 一种为个人物联网设备选择认证机制的方法，应用于第三网络功能，所述方法包括：
    接收第一网络功能发送的第五消息；
    其中，所述第五消息中携带有以下信息的至少之一：
    PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、认证方式、服务网络标识。
  16. 根据权利要求15所述的方法，其中，所述方法还包括：
    向第四网络功能发送第六消息；
    其中，所述第六消息中携带有以下信息的至少之一：
    PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
  17. 一种为个人物联网设备选择认证机制的方法，应用于第四网络功能，所述方法包括：
    接收第三网络功能发送的第七消息；
    其中，所述第七消息中携带有以下信息的至少之一：
    PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN 基元支持的认证方法名称、服务网络标识。
  18. 根据权利要求17所述的方法，其中，所述方法还包括：
    向第二网络功能发送第八消息；
    其中，所述第八消息中携带有以下信息的至少之一：
    PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
  19. 一种为个人物联网设备选择认证机制的装置，所述装置包括：
    接收单元，配置为接收个人物联网PIN基元发送的以下信息的至少之一：PIN基元支持的认证方法名称、PIN基元标识符、PIN基元认证指示符。
  20. 一种为个人物联网设备选择认证机制的装置，所述装置包括：
    授权单元，配置为对PIN基元网关的认证请求进行授权；其中，所述PIN基元网关允许基于PIN基元网关的标识信息和PIN基元标识符对PIN基元执行授权过程。
  21. 一种为个人物联网设备选择认证机制的装置，所述装置包括：
    接收单元，配置为接收PIN基元网关发送的第三消息；
    其中，所述第三消息中携带有以下信息的至少之一：
    PIN基元认证指示符、PIN基元支持的认证方法名称、PIN基元网关的订阅隐藏标识符SUCI、5G全球唯一临时标识5G-GUTI、PIN基元标识符。
  22. 一种为个人物联网设备选择认证机制的装置，所述装置包括：
    接收单元，配置为接收第一网络功能发送的第五消息；
    其中，所述第五消息中携带有以下信息的至少之一：
    PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
  23. 一种为个人物联网设备选择认证机制的装置，所述装置包括：
    接收单元，配置为接收第三网络功能发送的第七消息；
    其中，所述第七消息中携带有以下信息的至少之一：
    PIN基元认证指示符、PIN基元标识符、PIN基元网关的标识信息、PIN基元支持的认证方法名称、服务网络标识。
  24. 一种用户设备，包括处理器、收发器、存储器及存储在存储器上并能够由所述处理器运行的可执行程序，所述处理器运行所述可执行程序时执行如权利要求1至5任一项所述的为个人物联网设备选择认证机制的方法的步骤。
  25. 一种网络功能，包括处理器、收发器、存储器及存储在存储器上并能够由所述处理器运行的可执行程序，所述处理器运行所述可执行程序时执行如权利要求6至12或13至14或15至16或17至18中任一项所述的为个人物联网设备选择认证机制的方法的步骤。
  26. 一种存储介质，其上存储有可执行程序，所述可执行程序被处理器执行时实现如权利要求1至18任一项所述的为个人物联网设备选择认证机制的方法的步骤。
PCT/CN2022/095773 2022-05-27 2022-05-27 为个人物联网设备选择认证机制的方法及装置、ue、网络功能及存储介质 WO2023226051A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2022/095773 WO2023226051A1 (zh) 2022-05-27 2022-05-27 为个人物联网设备选择认证机制的方法及装置、ue、网络功能及存储介质
CN202280001894.9A CN117480796A (zh) 2022-05-27 2022-05-27 为个人物联网设备选择认证机制的方法及装置、ue、网络功能及存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/095773 WO2023226051A1 (zh) 2022-05-27 2022-05-27 为个人物联网设备选择认证机制的方法及装置、ue、网络功能及存储介质

Publications (1)

Publication Number Publication Date
WO2023226051A1 true WO2023226051A1 (zh) 2023-11-30

Family

ID=88918187

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/095773 WO2023226051A1 (zh) 2022-05-27 2022-05-27 为个人物联网设备选择认证机制的方法及装置、ue、网络功能及存储介质

Country Status (2)

Country Link
CN (1) CN117480796A (zh)
WO (1) WO2023226051A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110891270A (zh) * 2018-09-10 2020-03-17 大唐移动通信设备有限公司 一种鉴权算法的选择方法和装置
US20210368341A1 (en) * 2020-08-10 2021-11-25 Ching-Yu LIAO Secure access for 5g iot devices and services
CN114503630A (zh) * 2019-10-04 2022-05-13 三星电子株式会社 激活5g用户的方法和装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110891270A (zh) * 2018-09-10 2020-03-17 大唐移动通信设备有限公司 一种鉴权算法的选择方法和装置
CN114503630A (zh) * 2019-10-04 2022-05-13 三星电子株式会社 激活5g用户的方法和装置
US20210368341A1 (en) * 2020-08-10 2021-11-25 Ching-Yu LIAO Secure access for 5g iot devices and services

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
INTERDIGITAL INC.: "KI #5, New Sol: Authorization of a PINE for PIN Access", 3GPP DRAFT; S2-2205237, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. e-meeting; 20220516 - 20220520, 20 May 2022 (2022-05-20), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP052160709 *
NOKIA, NOKIA SHANGHAI BELL: "23.700-88: Solution for KI#3; PIN Management by 5GS", 3GPP DRAFT; S2-2202460, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. e-meeting ;20220406 - 20220412, 29 March 2022 (2022-03-29), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP052133297 *

Also Published As

Publication number Publication date
CN117480796A (zh) 2024-01-30

Similar Documents

Publication Publication Date Title
US20180007583A1 (en) Methods And Devices For Establishing Radio Resource Control (RRC) Connection
WO2022036649A1 (zh) 扩展非连续接收参数确定方法、通信设备和存储介质
WO2023184561A1 (zh) 中继通信方法、装置、通信设备及存储介质
WO2023065124A1 (zh) 寻呼参数确定方法、装置、通信设备和存储介质
WO2023184195A1 (zh) 支持增强现实业务能力协商方法及装置、网元、ue及存储介质
WO2023226051A1 (zh) 为个人物联网设备选择认证机制的方法及装置、ue、网络功能及存储介质
WO2022193191A1 (zh) 资源配置方法、装置、终端设备、接入网设备及存储介质
WO2023070560A1 (zh) 信息传输方法、装置、通信设备和存储介质
WO2023231018A1 (zh) 个人物联网pin基元凭证配置方法、装置、通信设备及存储介质
WO2023245354A1 (zh) 安全保护方法、装置、通信设备及存储介质
WO2023178703A1 (zh) 个人物联网网络建立方法及装置、网元、ue及存储介质
WO2023230924A1 (zh) 认证方法、装置、通信设备和存储介质
WO2023240659A1 (zh) 认证方法、装置、通信设备和存储介质
WO2024000123A1 (zh) 密钥生成方法及装置、通信设备及存储介质
WO2023197274A1 (zh) 资源配置的方法、装置、通信设备及存储介质
WO2024055329A1 (zh) 邻近服务ProSe的无线通信方法、装置、通信设备及存储介质
WO2024031392A1 (zh) 个人物联网信息更新方法、装置、通信设备及存储介质
WO2023216259A1 (zh) 卫星覆盖信息确定方法、装置、通信设备和存储介质
WO2023240574A1 (zh) 信息处理方法及装置、通信设备及存储介质
WO2023070685A1 (zh) 中继通信的方法、装置、通信设备及存储介质
WO2022027484A1 (zh) 随机接入的方法、装置、通信设备及存储介质
WO2023206529A1 (zh) 一种系统消息传输方法、装置、通信设备及存储介质
WO2023173260A1 (zh) 信息处理方法及装置、通信设备及存储介质
WO2024031640A1 (zh) 一种信息传输方法、装置、通信设备及存储介质
WO2023201454A1 (zh) 中继通信方法、装置、通信设备及存储介质

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 202280001894.9

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22943248

Country of ref document: EP

Kind code of ref document: A1