WO2024000134A1

WO2024000134A1 - Verification method and apparatus, device, and storage medium

Info

Publication number: WO2024000134A1
Application number: PCT/CN2022/101696
Authority: WO
Inventors: 梁浩然; 陆伟
Original assignee: 北京小米移动软件有限公司
Priority date: 2022-06-27
Filing date: 2022-06-27
Publication date: 2024-01-04
Also published as: WO2024000134A9; CN117643087A

Abstract

The present application relates to the field of mobile communications, and discloses a verification method and apparatus, a device, and a storage medium. The method comprises: a terminal receiving a first verification request sent by a first network element, wherein the first verification request is used for verifying a service network identifier corresponding to the terminal in an NPN scenario; and in response to the first verification request, sending a first verification response to the first network element, wherein the first verification response indicates a verification result in respect of the service network identifier. The present application provides a method for verifying an identifier of a service network accessed by a terminal. Upon verification, whether the identifier of the service network accessed by the terminal is the same as a service network identifier stored in a core network device can be confirmed, so that the accuracy of the service network accessed by the terminal is ensured, and then the reliability of providing network service to the terminal by the core network device is ensured.

Description

Verification methods, devices, equipment and storage media

Technical field

This application relates to the field of mobile communications, and in particular to a verification method, device, equipment and storage medium.

Background technique

In the mobile communication system, an NPN (Non-Public Network, non-public network) is provided, which does not depend on the PLMN (Public Land Mobile Network, public land mobile network), and the NPN is other than the operator. User built. For the terminal, the terminal completes the NPN registration through the core network device. However, the core network device cannot verify the terminal's service network name.

Contents of the invention

The embodiments of the present application provide a verification method, device, equipment and storage medium to ensure the accuracy of the service network accessed by the terminal, thereby ensuring the reliability of the core network equipment providing network services to the terminal. The technical solutions are as follows:

According to one aspect of the present application, a verification method is provided, the method is executed by a terminal, the method includes:

Receive a first verification request sent by the first network element, where the first verification request is used to verify the service network identity of the terminal in a non-public network NPN scenario;

In response to the first verification request, a first verification response is sent to the first network element, where the first verification response indicates a verification result of the serving network identity.

According to one aspect of the present application, a verification method is provided. The method is executed by the first network element. The method includes:

Receive the second verification request sent by the second network element;

Send a first verification request to the terminal, the first verification request being used to verify the service network identity of the terminal in a non-public network NPN scenario, the first verification request being determined based on the second verification request;

Receive a first verification response, the first verification request indicating the verification result of the service network identity;

Send the first verification response to the second network element.

According to one aspect of the present application, a verification method is provided, the method is executed by the second network element, and the method includes:

Send a second verification request to the first network element;

Receive a first verification response sent by the first network element, where the first verification response indicates a verification result of the service network identity.

According to one aspect of the present application, a verification device is provided, and the device includes:

A receiving module configured to receive a first verification request sent by the first network element, where the first verification request is used to verify the service network identity of the terminal in a non-public network NPN scenario;

A sending module, configured to send a first verification response to the first network element in response to the first verification request, where the first verification response indicates the verification result of the service network identity.

According to one aspect of the present application, a verification device is provided, which device includes:

A receiving module, configured to receive the second verification request sent by the second network element;

A sending module, configured to send a first verification request to the terminal. The first verification request is used to verify the service network identity of the terminal in a non-public network NPN scenario. The first verification request is based on the second Verification request confirmed;

A receiving module, configured to receive a first verification response, where the first verification request indicates the verification result of the service network identity;

A sending module, configured to send the first verification response to the second network element.

According to one aspect of the present application, a terminal is provided. The terminal includes: a processor; a transceiver connected to the processor; a memory for storing executable instructions of the processor; wherein the processor is configured to load and execute the executable instructions. Execute instructions to implement verification methods as described above.

According to one aspect of the present application, a first network element is provided. The first network element includes: a processor; a transceiver connected to the processor; a memory for storing executable instructions of the processor; wherein the processor is Configured to load and execute executable instructions to implement verification methods as described above.

According to one aspect of the present application, a second network element is provided. The second network element includes: a processor; a transceiver connected to the processor; a memory for storing executable instructions of the processor; wherein the processor is Configured to load and execute executable instructions to implement verification methods as described above.

According to one aspect of the present application, a computer-readable storage medium is provided. The readable storage medium stores executable program code. The executable program code is loaded and executed by a processor to implement the verification method in the above aspect.

According to one aspect of the present application, a chip is provided. The chip includes programmable logic circuits and/or program instructions. When the chip is run on a terminal or a first network element or a second network element, it is used to implement the above aspects. Authentication method.

According to one aspect of the present application, a computer program product is provided. When the computer program product is executed by a terminal or a processor of a first network element or a second network element, it is used to implement the verification method of the above aspect.

The solution provided by the embodiment of this application provides a method for verifying the service network identifier accessed by the terminal. Through verification, it can be confirmed whether the service network identifier accessed by the terminal itself is the same as the service network identifier stored in the core network device. , ensuring the accuracy of the service network that the terminal accesses, and thereby ensuring the reliability of the core network equipment providing network services to the terminal.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings without exerting creative efforts.

Figure 1 shows a block diagram of a communication system provided by an exemplary embodiment of the present application;

Figure 2 shows a flow chart of an identity verification method provided by an exemplary embodiment of the present application;

Figure 3 shows a flow chart of a verification method provided by an exemplary embodiment of the present application;

Figure 4 shows a flow chart of another verification method provided by an exemplary embodiment of the present application;

Figure 5 shows a flow chart of yet another verification method provided by an exemplary embodiment of the present application;

Figure 6 shows a flow chart of yet another verification method provided by an exemplary embodiment of the present application;

Figure 7 shows a block diagram of a verification device provided by an exemplary embodiment of the present application;

Figure 8 shows a block diagram of another verification device provided by an exemplary embodiment of the present application;

Figure 9 shows a block diagram of yet another verification device provided by an exemplary embodiment of the present application;

Figure 10 shows a block diagram of yet another verification device provided by an exemplary embodiment of the present application;

Figure 11 shows a block diagram of yet another verification device provided by an exemplary embodiment of the present application;

Figure 12 shows a schematic structural diagram of a communication device provided by an exemplary embodiment of the present application.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present application clearer, the embodiments of the present application will be further described in detail below in conjunction with the accompanying drawings.

Exemplary embodiments will be described in detail herein, examples of which are illustrated in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings refer to the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this application. Rather, they are merely examples of apparatus and methods consistent with aspects of the application as detailed in the appended claims.

The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in this application and the appended claims, the singular forms "a," "the" and "the" are intended to include the plural forms as well, unless the context clearly dictates otherwise. It will also be understood that the term "and/or" as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

It should be understood that although the terms first, second, third, etc. may be used in this application to describe various information, the information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of the present application, the first information may also be called second information, and similarly, the second information may also be called first information. Depending on the context, for example, the word "if" as used herein may be interpreted as "when" or "when" or "in response to determining."

It should be noted that the information (including but not limited to user equipment information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application, All are authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

Below, the application scenarios of this application are explained:

Figure 1 shows a block diagram of a communication system provided by an exemplary embodiment of the present application. The communication system may include: a terminal 10, a core network device 20 and a verification server 30.

The number of terminals 10 is usually multiple and distributed in one or more cells. The terminal 10 is managed by the core network equipment 20 . The terminal 10 may include various handheld devices, vehicle-mounted devices, wearable devices, computing devices or other processing devices connected to wireless modems with wireless communication functions, as well as various forms of user equipment (User Equipment, UE), mobile stations ( Mobile Station, MS) and so on. For convenience of description, in the embodiments of this application, the above-mentioned devices are collectively referred to as terminals.

The core network device 20 is a device deployed in the core network. The core network device 20 mainly functions to provide user connections, manage users, and carry services, and serves as an interface for the bearer network to provide to external networks. And the core network device 20 can communicate with the authentication server 30, so as to verify the identity information of the terminal 10 through the authentication server 30. For example, the core network equipment 20 in the 5G NR system may include AMF (Access and Mobility Management Function) network elements, AUSF (Authentication Service Function), UDM (Unified Data Management, Unified data management), UPF (User Plane Function, user plane function), SMF (Session Management Function, network element and session management function) network element, etc.

The verification server 30 is used to verify the identity of any user, authorize any user, or perform other steps. The terminal 10 sends verification information to the core network device 20 so that the core network device 20 verifies the identity of the terminal 10 through the verification server 30 based on the verification information.

In some embodiments, the authentication server is an AAA (Authentication Authorization Accounting) server, or other types of servers, which are not limited in this application.

In addition, for terminals, core network equipment and authentication servers, the terminal will start the registration process, and the core network equipment and authentication server will verify the identity of the terminal.

In some embodiments, the core network device includes a first network element, a second network element, a third network element and a fourth network element.

Optionally, the first network element is an AMF network element or a SEAF (Security Anchor Function) network element. The second network element is the AUSF network element. The third network element is a UDM network element. The fourth network element is an NSSAAF (a core network element) network element. The authentication server is an AAA server.

In the following, the first network element is an AMF network element, the second network element is an AUSF network element, the third network element is a UDM network element, the fourth network element is an NSSAAF network element, and the authentication server is an AAA server. Figure 2 shows a flow chart of an identity verification method provided by an exemplary embodiment of the present application. Referring to Figure 2, the method includes:

Step 201: The terminal sends identity verification information including SUCI (Subscription Concealed Identifier) and service network identifier to the AMF network element.

Step 202: The AMF network element receives the identity verification information sent by the terminal, and sends the main authentication information including SUCI and service network identification to the AUSF network element.

Step 203: The AUSF network element receives the primary authentication information and sends the identity acquisition information including SUCI and service network identity to the UDM network element.

Step 204: The UDM network element receives the identity acquisition information and parses SUCI into SUPI based on the identity acquisition information.

Step 205: The UDM network element returns SUPI (Subscription Permanent Identifier) and AAA server identification to the AUSF network element.

Step 206: The AUSF network element receives the SUPI and AAA server identifier, and sends SUPI to the NSSAAF network element.

Step 207: The NSSAAF network element performs protocol conversion based on SUPI and sends SUPI to the AAA server.

Step 208: The AAA server and the terminal perform identity authentication on each other.

In the embodiment of this application, during the identity authentication process between the AAA server and the terminal, an MSK will be generated, that is, both the AAA server and the terminal can determine the MSK generated when the identity authentication is successful.

Step 209: The AAA server sends identity authentication success information, SUPI and MSK to the NSSAAF network element.

Step 210: The NSSAAF network element sends identity authentication success information, SUPI and MSK to the AUSF network element.

In the embodiment of this application, after the AUSF network element receives the identity authentication success information, SUPI and MSK, it can perform the terminal's service network identity verification process.

In the method provided by the embodiment of this application, the terminal starts the registration process, so that the core network equipment and the verification server can perform the process of verifying the identity of the terminal, ensuring that the verification server and the terminal perform mutual identity verification, and then complete the identity registration. In addition, the AUSF network element will also trigger the terminal's service network identification verification process to ensure the accuracy of the service network the terminal accesses, thereby ensuring the reliability of the core network equipment in providing network services to the terminal.

Figure 3 shows a flow chart of a verification method provided by an exemplary embodiment of the present application. The exemplary method can be applied to the terminal, the first network element and the second network element as shown in Figure 1. The method includes the following content At least some of:

Step 301: The second network element sends a second verification request to the first network element.

The second verification request is used to verify the service network identity of the terminal in the NPN scenario.

In some embodiments, the NPN scenario is an SNPN (Stand-alone Non-Public Network, independent non-public network) scenario, that is to say, the second verification request is used to verify the service network identity of the terminal in the SNPN scenario. . The service network identifier is the service network identifier of the service network in the SNPN scenario.

In this embodiment of the present application, the terminal is registered in the service network, and for the second network element, the second network element needs to verify the service network name of the service network to which the terminal is connected. Therefore, the second network element The network element sends a second verification request to the first network element, so as to verify the service network identity of the terminal through the second verification request.

Wherein, the service network identifier indicates the service network name. For example, service network identifier 1 indicates service network name 1, service network identifier 2 indicates service network name 2, and service network identifier 3 indicates service network name 3.

In some embodiments, the second verification request includes at least one of the following:

(1) Verification identifier, the verification identifier indicates that the second verification request is used to verify the service network identity.

In this embodiment of the present application, the second network element sends a second verification request including a verification identifier to the first network element. The verification identifier indicates that the second verification request is used to verify the service network identity, then the first network element The network element can determine the role of the second verification request based on the verification identifier included in the second verification request.

(2) Authentication identifier, which indicates successful authentication of the terminal.

In the embodiment of this application, the second network element not only verifies the verification identifier, but also verifies the identity of the terminal. After the second network element verifies the identity of the terminal, it can verify the identity of the terminal in the second verification request. Carrying the authentication identifier by which the authentication of the terminal is successful.

In some embodiments, the second network element first verifies the identity of the terminal. After the identity verification of the terminal is successful, the second network element can send a second verification request to the first network element, and the second verification request indicates The endpoint's authentication is successful and the authentication service network identity is also indicated.

(3) Service network verification code.

The service network verification code refers to the verification code required to verify the service network identity. The terminal can compare the verification code calculated by itself with the service network verification code to determine whether the service network identification stored by the second network element is the same as the service network identification stored by the terminal itself, and then determine the service network identification of the second network element. Whether it has been tampered with.

The service network verification code is calculated by the second network element, and then sent to the first network element through the second verification request, so that the first network element can send it to the terminal.

(4) Verify the random number.

The verification random number refers to the random number required to verify the service network identity. The verification random number is generated by the second network element, and then sent by the second network element to the first network element, and then sent by the first network element to the terminal, so that the terminal can verify the service network identity.

(5)Time stamp.

The timestamp is used to mark time. It can also be understood that the second network element adds a timestamp to the second verification request to indicate the sending time of the second verification request.

(6) Terminal identification.

The terminal identification indicates the terminal. In this embodiment of the present application, the second network element carries the terminal identification in the second verification request. Then, after receiving the terminal identification, the first network element can determine that it needs to send a verification request to the terminal indicated by the terminal identification.

In some embodiments, the terminal identifier is SUPI, SUCI or other identifiers, which is not limited in the embodiments of the present application.

(7) Service network identification.

The service network identifier indicates the service network, and can also be understood as the service network identifier corresponding to the current service network of the second network element.

In some embodiments, the second verification request includes the service network verification code, and the second network element generates the MSK (Master Session Key, master shared key) based on the successful terminal identity verification, the verification random number and the service network identification. At least one of the fields determines the service network verification code.

Optionally, the second network element may determine the service network verification code based on the MSK and the service network identifier.

Alternatively, the second network element may determine the service network verification code based on the MSK, the verification random number and the service network identifier.

Step 302: The first network element receives the second verification request sent by the second network element.

In this embodiment of the present application, the second network element sends a second verification request to the first network element, and the first network element can receive the second verification request sent by the second network element.

Step 303: The first network element sends a first verification request to the terminal. The first verification request is used to verify the service network identity of the terminal in a non-public network NPN scenario. The first verification request is determined based on the second verification request.

In some embodiments, the first network element determines the terminal according to the second verification request, and sends the first verification request to the terminal.

Optionally, the second verification request includes a terminal identification, and the terminal identification indicates the terminal. After receiving the second verification request, the first network element determines the indicated terminal according to the terminal identification included in the second verification request, and then Send a first verification request to the determined terminal.

Step 304: The terminal receives the first verification request sent by the first network element. The first verification request is used to verify the service network identity of the terminal in the NPN scenario.

In this embodiment of the present application, after receiving the second verification request sent by the second network element, the first network element can determine the first verification request based on the second verification request, and then send the first verification request to the terminal, so that the terminal The service network identification of the terminal that needs to be verified is determined according to the first verification request.

In some embodiments, the first verification request includes at least one of the following:

(1) Verification identifier, the verification identifier indicates that the first verification request is used to verify the service network identity.

(2) Authentication identifier, which indicates successful authentication of the terminal;

(3) Service network verification code.

(4) Verify the random number.

(5)Time stamp.

(6) Service network identification.

It should be noted that in the embodiment of the present application, the information included in the first verification request is similar to the information included in the second verification request, and will not be described again here.

Step 305: In response to the first verification request, the terminal sends a first verification response to the first network element, where the first verification response indicates the verification result of the service network identity.

In this embodiment of the present application, after receiving the first verification request, the terminal can perform verification based on the information included in the first verification request to determine the verification result, and then send a first verification response to the first network element, instructing the terminal The result of the verification of the service network identity.

Step 306: The first network element receives the first verification response, and the first verification request indicates the verification result of the service network identity.

Step 307: The first network element sends the first verification response to the second network element.

Step 308: The second network element receives the first verification response sent by the first network element, where the first verification response indicates the verification result of the serving network identity.

In this embodiment of the present application, after the first network element receives the first verification response, it can forward the first verification response to the second network element. After the second network element receives the first verification response, it can determine The first verification response indicates the verification result of the service network identity.

In some embodiments, the first network element is an AMF network element or a SEAF network element. That is to say, the first network element in this application can be replaced by an AMF network element. Alternatively, the first network element in this application can be replaced by a SEAF network element.

In some embodiments, the second network element is an AUSF network element. That is to say, the second network element in this application can be replaced by an AUSF network element.

It should be noted that the steps performed by the terminal in the embodiment of the present application may separately form an embodiment, the steps performed by the first network element may separately form an embodiment, and the steps performed by the second network element may separately form an embodiment. Example.

The embodiment shown in Figure 3 explains the verification of the service network identification of the terminal. Specifically, how the terminal verifies the service network identity is explained.

In some embodiments, the first verification response indicates that the service network identity of the terminal is successfully verified, and the terminal sends the first verification response if it is determined that certain conditions are met.

In the embodiment of the present application, in the NPN scenario, when the service network identity of the first verification request has not been tampered with, and the service network identity of the terminal is the same as the service network identity included in the first verification request, in response to the first verification request , sending the first verification response to the first network element.

Among them, when the terminal interacts with the second network element, the information needs to be forwarded through the first network element. However, when passing through the first network element, the service network name identifier reported by the terminal may be tampered with by the first network element, causing the second network element to be tampered with. The service network identity received by the network element is different from the service network identity of the terminal itself. Therefore, after receiving the first verification request, the terminal needs to determine whether the service network identity in the first verification request has been tampered with based on the first verification request, and Determine whether the service network identifier of the terminal is the same as the service network identifier included in the first verification request, and determine the first verification response to be sent.

If the terminal determines that the service network identifier of the first verification request has not been tampered with in the NPN scenario, it will continue to compare the terminal's own service network identifier with the service network identifier included in the first verification request. If it is determined to be the same, the terminal will respond to the first verification request. A verification request, sending a first verification response to the first network element, indicating that the terminal successfully verified the service network identity through the first verification response.

In some embodiments, the first verification response includes at least one of the following:

(2)Terminal verification code.

The terminal verification code refers to the verification code verified by the second network element. Moreover, the terminal verification code is sent after the terminal successfully verifies the service network identity sent by the second network element. The terminal verification code can also indicate that the terminal successfully verifies the service network identity.

(3)Time stamp.

(4) Terminal identification.

In some embodiments, the terminal determines the first information verification code according to the first verification request, and when the first information verification code matches the first verification request, determines that the service network identifier of the first verification request in the NPN scenario has not been tamper.

In this embodiment of the present application, after receiving the first verification request, the terminal can determine the first information verification code based on the information included in the first verification request. The first information verification code can be used with the first verification request. If the first information verification code matches the first verification request, it is determined that the service network identifier of the first verification request in the NPN scenario has not been tampered with.

Optionally, the first verification request includes a service network verification code and a service network identification, and the first information verification code is determined based on at least one of the MSK generated by successful terminal identity verification, a verification random number, and the service network identification. When the information verification code is the same as the service network verification code, it is determined that the first verification request in the NPN scenario has not been tampered with.

In the embodiment of this application, the terminal will obtain the MSK after performing identity authentication, and the first verification request also includes the service network verification code, then the terminal can determine the third verification code based on at least one of the MSK, verification random number and service network identification. First information verification code, and then comparing the first information verification code with the service network verification code, it can be determined whether the service network identification in the NPN scenario has been tampered with. Specifically, if the first information verification code is the same as the service network verification code, it means that the service network identity in the NPN scenario has not been tampered with. If the first information verification code is different from the service network verification code, it means that the service network in the NPN scenario has not been tampered with. The logo has been tampered with.

It should be noted that the embodiment of the present application is explained by taking the terminal returning a first verification response indicating that the service network identity verification is successful as an example. In some other embodiments, the terminal also returns a first verification response indicating that the service network identity verification fails.

In the embodiment of the present application, the first verification response indicates that the terminal's service network identity verification failed. In the NPN scenario, the service network identity of the first verification request has not been tampered with, and the terminal's service network identity is consistent with the service included in the first verification request. If the network identifiers are different, the first verification response is sent to the first network element.

In the embodiment of this application, the terminal verifies the service network identification in the first verification request to confirm whether the service network identification has been tampered with. If the terminal determines that the service network identification has not been tampered with, but the service network identification of the terminal is different from the first verification request. If the service network identifiers in are different, the terminal will consider that communication cannot be performed using the terminal's service network identifier, and the terminal will send a first verification response.

In some embodiments, the first verification response includes a terminal verification code, where the terminal verification code refers to a verification code verified by the second network element. Moreover, the terminal verification code is sent after the terminal fails to verify the service network identity sent by the second network element. The terminal verification code can also indicate that the terminal fails to verify the service network identity.

It should be noted that the embodiment of the present application is explained by taking the terminal returning a first verification response indicating that the service network identity verification is successful as an example. In another embodiment, the terminal also receives a second verification response sent by the first network element, and the second verification response instructs the second network element to confirm the first verification response sent by the terminal.

In this embodiment of the present application, the first network element will send a second verification response to the terminal, so as to inform the second network element to confirm the first verification response sent by the terminal through the second verification response.

Specifically, the interaction between the terminal, the first network element, and the second network element is described using the embodiment shown in FIG. 4 . Figure 4 shows a flow chart of another verification method provided by an exemplary embodiment of the present application. The method can be applied to the terminal, the first network element and the second network element as shown in Figure 1. This method Include at least some of the following:

Step 401: In response to the first verification response, the second network element sends a fifth verification response to the first network element. The fifth verification response instructs the second network element to confirm the first verification response sent by the terminal.

In this embodiment of the present application, after receiving the first verification response sent by the first network element, the second network element will also confirm the first verification response. If the second network element confirms the first verification response, it will send the second verification response. Five verification responses.

In some embodiments, the second network element determines the second information verification code based on at least one of the MSK generated by successful terminal identity verification and the verification result of the service network identity predicted by the second network element. The verification result of the service network identity includes at least one of successful verification of the service network identity and failure of verification of the service network identity; based on the matching result of the second information verification code and the first verification response, it is determined whether to confirm the first verification response sent by the terminal.

In this embodiment of the present application, the second network element will determine the second information verification code in advance, and determine the second information verification code by considering the success or failure of the service network identity verification. Then the second network element will determine the second information verification code based on the MSK and the third information verification code. The verification result of the service network identifier predicted by the second network element determines two second information verification codes. The second network element then determines which second information verification code the first verification response matches based on the two determined information verification codes, and then determines whether to confirm the first verification response sent by the terminal.

For example, the second network element determines a second information verification code corresponding to the service network identity verification failure based on the MSK and the service network identity predicted by the second network element. The verification result is to successfully determine a second information verification code corresponding to the successful verification of a service network identity.

Optionally, the first verification response includes a terminal verification code, and the second information verification is determined based on at least one of the MSK generated by successful terminal identity verification, the verification random number, and the verification result of the service network identification predicted by the second network element. code; when the verification result of the service network identity predicted by the second network element is the second information verification code corresponding to the failure, and the second information verification code is the same as the terminal verification code, it is determined that the first verification response failed; and when If the verification result of the service network identity predicted by the second network element is the second information verification code corresponding to success, and the second information verification code is the same as the terminal verification code, it is determined that the first verification response is successful.

It should be noted that the embodiment of the present application takes the case where the second information verification code and the terminal verification code are the same as an example for explanation. In another embodiment, if the second information verification code and the terminal verification code are different, the process is terminated. In this process, no further operations will be performed.

It should be noted that if the first verification response indicates that the terminal's service network identity verification is successful, then after the second network element sends the fifth verification response, it sends update information to the third network element, and the update information indicates that the third network element stores the terminal. The service network identifier is used to receive an update response, and the update response instructs the third network element to confirm the update information.

In some embodiments, the update information includes at least one of the following:

terminal identification;

service network identifier;

Identity verification identifier. The identity verification identifier indicates that the service network identity verification was successful.

Optionally, the third network element is a unified data management UDM network element.

If the first verification response indicates that the terminal's service network identity verification fails, the second network element will not update the service network identity after sending the fifth verification response, nor will it derive the key based on the service network identity.

Step 402: The first network element receives the fifth verification response sent by the second network element.

Step 403: In response to the fifth verification response, the first network element sends a second verification response to the terminal. The second verification response instructs the second network element to confirm the first verification response sent by the terminal.

In this embodiment of the present application, after receiving the fifth verification response sent by the second network element, the first network element will notify the terminal of the fifth verification response sent by the second network element, and the first network element will then notify the terminal according to the fifth verification response. The verification response determines the second verification response, and the second verification response is sent to the terminal.

In some embodiments, the first network element determines the terminal according to the fifth verification response, and sends the second verification response to the terminal.

Optionally, the fifth verification response includes at least one of the following:

(2) Identity verification identifier, which instructs the second network element to confirm the first verification response sent by the terminal.

(3) Service network identification.

(4) Terminal identification.

In some embodiments, the fifth verification response includes the terminal identification, and the first network element determines the terminal indicated by the terminal identification and sends the second verification response to the terminal.

In this embodiment of the present application, the terminal identifier indicates the terminal. After receiving the fifth verification response, the first network element can determine the terminal indicated by the terminal identifier based on the fifth verification response and send the second verification response to the terminal.

Step 404: The terminal receives the second verification response sent by the first network element, and the second verification response instructs the second network element to confirm the first verification response sent by the terminal.

In this embodiment of the present application, when the terminal receives the second verification response sent by the first network element, it determines that the second network element confirms the first verification response sent by the terminal.

It should be noted that in the embodiment of this application, if the terminal determines that the service network identity verification is successful, the terminal determines the key corresponding to the second network element based on the MSK generated by the current terminal identity verification success and the service network identity in the first verification request. .

The key corresponding to the second network element determined by the terminal is used for data transmission by the terminal.

In the embodiment of this application, after the terminal determines that the service network identity verification is successful, the terminal can determine the key corresponding to the second network element based on the MSK and the service network identity in the first verification request, and then the transmitted data can be processed based on the key. The data is encrypted and decrypted to facilitate data transmission by the terminal and ensure the reliability of the transmission.

In the solution provided by the embodiment of this application, the second network element will confirm the first verification response sent by the terminal, so that the terminal can determine that the second network element has also confirmed the service network identifier, ensuring that the service network the terminal accesses accuracy, thereby ensuring the reliability of core network equipment providing network services to terminals.

The above embodiment describes an example in which the terminal's first verification response indicates that the terminal's service network identity verification is successful. In another embodiment, the first verification response is alarm information, which means that the terminal updates the currently used service network identifier. The following describes the situation in which the terminal determines that the first verification response is alarm information.

In some embodiments, the first verification response is alarm information, and the terminal sends the first verification response when it is determined that certain conditions are met.

In the embodiment of the present application, when the service network identifier of the first verification request has not been tampered with in the NPN scenario, and the service network identifier of the terminal is different from the service network identifier included in the first verification request, alarm information is generated in response to The first verification request sends alarm information to the first network element, and uses the service network identifier in the first verification request as the service network identifier used by the terminal.

In the embodiment of the present application, in the NPN scenario, when the service network identity of the first verification request has not been tampered with, and the service network identity of the terminal is different from the service network identity included in the first verification request, in response to the first verification Request to send alarm information to the first network element. Furthermore, the terminal uses the service network identifier in the first verification request as the service network identifier used by the terminal. Therefore, the service network identifier used by the terminal is the same as the service network identifier confirmed by the second network element.

Among them, when the terminal interacts with the second network element, the information needs to be forwarded through the first network element. However, when passing through the first network element, the service network name identifier reported by the terminal may be tampered with by the first network element, causing the second network element to be tampered with. The service network identity received by the network element is different from the service network identity of the terminal itself. Therefore, after receiving the first verification request, the terminal needs to determine whether the service network identity in the first verification request has been tampered with based on the first verification request, and Determine whether the service network identifier of the terminal is the same as the service network identifier included in the first verification request, and determine the alarm information to be sent.

If the terminal determines that the service network identifier of the first verification request has not been tampered with in the NPN scenario, it will continue to compare the terminal's own service network identifier with the service network identifier included in the first verification request. If it is determined to be different, the terminal will respond to the third verification request. A verification request is sent to the first network element, and the first verification response indicates that the terminal has updated the service network identification, that is, the terminal uses the service network identification included in the first verification request.

(2)Terminal verification code.

(3)Time stamp.

(4) Terminal identification.

In this embodiment of the present application, after receiving the first verification request, the terminal can determine the first information verification code based on the information included in the first verification request, and the first information verification code can be used with the first verification request. If the first information verification code matches the first verification request, it is determined that the service network identifier of the first verification request in the NPN scenario has not been tampered with.

It should be noted that the embodiment of the present application takes the terminal returning alarm information indicating updating the service network identifier as an example for explanation. In another embodiment, the terminal will also receive a third verification response sent by the first network element, and the third verification response instructs the second network element to confirm the alarm information sent by the terminal.

In this embodiment of the present application, the first network element will send a third verification response to the terminal, so as to inform the second network element to confirm the alarm information sent by the terminal through the third verification response.

Specifically, the interaction between the terminal, the first network element, and the second network element is described using the embodiment shown in FIG. 5 . Figure 5 shows a flow chart of yet another verification method provided by an exemplary embodiment of the present application. The method can be applied to the terminal, the first network element and the second network element as shown in Figure 1. This method Include at least some of the following:

Step 501: When the second network element determines that the first verification response is successful, in response to the alarm information, it sends a sixth verification response to the first network element. The sixth verification response instructs the second network element to confirm the alarm information sent by the terminal, The alarm information is sent when the service network identifier of the first verification request has not been tampered with in the NPN scenario, and the service network identifier of the terminal is different from the service network identifier included in the first verification request.

In this embodiment of the present application, after receiving the alarm information sent by the first network element, the second network element will also confirm the alarm information. If the second network element confirms the alarm information, it will send a sixth verification response.

Step 502: The first network element receives the sixth verification response sent by the second network element.

Step 503: In response to the sixth verification response, the first network element sends a third verification response to the terminal. The third verification response instructs the second network element to confirm the alarm information sent by the terminal. The alarm information serves the first verification request in the NPN scenario. It is sent when the network identity has not been tampered with and the service network identity of the terminal is different from the service network identity included in the first verification request.

In this embodiment of the present application, after receiving the sixth verification response sent by the second network element, the first network element will notify the terminal of the sixth verification response sent by the second network element, and the first network element will then notify the terminal according to the sixth verification response. The verification response determines the third verification response, and the third verification response is sent to the terminal.

In some embodiments, the first network element determines the terminal according to the sixth verification response, and sends the third verification response to the terminal.

Optionally, the sixth verification response includes at least one of the following:

(2) Identity verification identifier, which instructs the second network element to confirm the alarm information sent by the terminal.

(3) Service network identification.

(4) Terminal identification.

In some embodiments, the sixth verification response includes the terminal identification, and the first network element determines the terminal indicated by the terminal identification, and sends the third verification response to the terminal.

In this embodiment of the present application, the terminal identifier indicates the terminal. After receiving the sixth verification response, the first network element can determine the terminal indicated by the terminal identifier based on the sixth verification response and send the third verification response to the terminal.

It should be noted that if the second network element receives the alarm information sent by the terminal, the second network element will also send update information to the third network element. The update information instructs the third network element to store the service network identifier used by the terminal and receive Update response, the update response instructs the third network element to confirm the update information.

In this embodiment of the present application, the second network element sends update information to the third network element. After receiving the update information, the third network element can store the information included in the update information in the third network element according to the update information. in the network element, and the third network element will also return an update response to inform the second network element that the information has been stored.

terminal identification;

Service network identifier;

If the terminal does not generate alarm information and does not send alarm information to the second network element, the service network identifier will no longer be updated, and the key will not be derived based on the service network identifier.

Step 504: The terminal receives the third verification response sent by the first network element.

In this embodiment of the present application, when the terminal receives the third verification response sent by the first network element, it determines that the second network element confirms the alarm information sent by the terminal, and then the terminal can transmit data through the service network element corresponding to the service network identifier.

It should be noted that in the embodiment of the present application, if the terminal determines to receive the third verification response, the terminal determines the second network element corresponding to the MSK generated by the current terminal identity verification successfully and the service network identifier in the first verification request. key.

In the solution provided by the embodiment of this application, when the terminal determines that the service network identifier stored by itself is different from the service network identifier sent by the second network element, the terminal can update the service network identifier used by itself to the one in the first verification request. The service network identification ensures the accuracy of the service network that the terminal accesses, thereby ensuring the reliability of the core network equipment in providing network services to the terminal.

It should be noted that, in the above embodiment, the terminal sends a first verification response to indicate successful verification of the service network identity or sends alarm information as an example. In another embodiment, the terminal will also send error information to end the process under certain circumstances.

In some embodiments, the first verification response is error information. If the terminal cannot parse the first verification request, the terminal sends the error information to the first network element in response to the first verification request.

In the embodiment of this application, the terminal receives the first verification request. If the terminal cannot parse the first verification request, it means that the terminal and the core network cannot communicate normally, so the terminal sends an error message to indicate that the verification cannot continue, and the end Verification process for service network identities.

In some other embodiments, the first verification response is error information. When the service network identifier of the first verification request is tampered with in the NPN scenario, the error information is sent to the first network element in response to the first verification request.

In the embodiment of this application, if the terminal determines that the service network identifier of the first verification request has been tampered with, it means that the terminal and the core network device cannot communicate normally, so the terminal sends an error message to indicate that the verification cannot continue and ends the service network Identification verification process.

Optionally, the terminal determines the first information verification code according to the first verification request, and determines that the service network identity of the first verification request in the NPN scenario has been tampered with when the first information verification code does not match the first verification request.

Optionally, the first verification request includes a service network verification code and a service network identification. The first information verification code is determined according to the first verification request, including:

Determine the first information verification code based on at least one of the MSK generated by successful terminal identity verification, verification random number and service network identification. If the first information verification code is different from the service network verification code, determine the NPN scenario. The service network identifier in has been tampered with.

Among them, the solution for the terminal to determine whether the service network identifier has been tampered with in the embodiment of the present application is similar to the above embodiment, and will not be described again here.

Next, FIG. 6 is used as an example to describe the interaction between the terminal, the first network element, and the second network element after the terminal sends error information in this application. Figure 6 shows a flow chart of yet another verification method provided by an exemplary embodiment of the present application. Referring to Figure 6, the method includes:

Step 601: The terminal sends error information to the first network element.

Step 602: The first network element receives the error information and sends the error information to the second network element.

Step 603: The second network element receives the error information.

Step 604: In response to the error information, the second network element sends a seventh verification response to the first network element. The seventh verification response instructs the second network element to confirm the error information sent by the terminal. The error information occurs when the terminal cannot parse the first verification request. In this case, it is sent in response to the first verification request, or, in the case where the service network identifier of the first verification request is tampered with in the NPN scenario, it is sent in response to the first verification request.

In this embodiment of the present application, after the second network element confirms the received error information, it will terminate the key derivation process and will not store any information in the UDM.

Step 605: The first network element receives the seventh verification response sent by the second network element.

Step 606: In response to the seventh verification response, the first network element sends a fourth verification response to the terminal. The fourth verification response instructs the second network element to confirm the error information sent by the terminal. The error information occurs when the terminal cannot parse the first verification request. In this case, it is sent in response to the first verification request, or, in the case where the service network identifier of the first verification request is tampered with in the NPN scenario, it is sent in response to the first verification request.

Step 607: The first network element receives the fourth verification response sent by the first network element, and the fourth verification response instructs the second network element to confirm the error information sent by the terminal.

In the solution provided by the embodiment of this application, if the terminal determines that it needs to send error information, it means that the terminal has determined that the current status cannot communicate with the core network equipment, so the error information is sent to end the verification process of the service network identity, ensuring that the terminal verifies the service network The reliability of the identification, thereby ensuring the reliability of communication.

It should be noted that the above embodiments can be split into new embodiments, or combined with other embodiments to form new embodiments. This application does not limit the combination of embodiments.

Figure 7 shows a block diagram of a verification device provided by an exemplary embodiment of the present application. Referring to Figure 7, the device includes:

The receiving module 701 is configured to receive a first verification request sent by the first network element, where the first verification request is used to verify the service network identity of the terminal in a non-public network NPN scenario;

The sending module 702 is configured to send a first verification response to the first network element in response to the first verification request, where the first verification response indicates the verification result of the service network identity.

The verification identifier indicates that the first verification request is used to verify the service network identity;

Authentication identifier, which indicates successful authentication of the terminal;

Service network verification code;

Verify random number;

timestamp;

Service network identifier.

In some embodiments, the first verification response indicates that the service network identity of the terminal has been successfully verified, and the sending module 702 is used to perform the first verification request in the NPN scenario. The service network identity of the first verification request has not been tampered with, and the service network identity of the terminal is the same as the first verification response. If the service network identifiers included in the verification requests are the same, a first verification response is sent to the first network element in response to the first verification request.

In some embodiments, referring to Figure 8, the device further includes:

The determination module 703 is configured to determine the key corresponding to the second network element based on the MSK generated by the current terminal identity verification successfully and the service network identifier in the first verification request.

In some embodiments, the first verification response is alarm information. The sending module 702 is also used to ensure that the service network identifier of the first verification request has not been tampered with in the NPN scenario, and the service network identifier of the terminal is consistent with the service network identifier included in the first verification request. When the service network identifiers are different, alarm information is generated, the alarm information is sent to the first network element in response to the first verification request, and the service network identifier in the first verification request is used as the service network identifier used by the terminal.

Terminal verification code;

timestamp;

Terminal ID.

In some embodiments, the first verification response indicates that the terminal's service network identification fails to be verified. The sending module 702 is also used to ensure that the service network identification of the first verification request has not been tampered with in the NPN scenario, and the terminal's service network identification is consistent with the third verification response. When the service network identifiers included in the verification requests are different, a first verification response is sent to the first network element.

In some embodiments, the receiving module 701 is also configured to receive a second verification response sent by the first network element, where the second verification response instructs the second network element to confirm the first verification response sent by the terminal.

In some embodiments, referring to Figure 8, the device further includes:

Determining module 703, configured to determine the first information verification code according to the first verification request;

The determination module 703 is configured to determine that the service network identifier of the first verification request in the NPN scenario has not been tampered with when the first information verification code matches the first verification request.

In some embodiments, the first verification request includes the service network verification code and the service network identification, and the determination module 703 is also used to generate at least one of the MSK, verification random number and service network identification based on successful terminal identity verification, Determine the first information verification code;

The determination module 703 is also configured to determine that the service network identifier in the NPN scenario has not been tampered with when the first information verification code and the service network verification code are the same.

In some embodiments, the receiving module 701 is also configured to receive a third verification response sent by the first network element, where the third verification response instructs the second network element to confirm the alarm information sent by the terminal.

In some embodiments, the first verification response is error information, and the sending module 702 is also configured to respond to the first verification request and send error information to the first network element when the terminal cannot parse the first verification request.

In some embodiments, the first verification response is error information, and the sending module 702 is also configured to respond to the first verification request when the service network identifier of the first verification request is tampered with in the NPN scenario. Yuan sends error message.

In some embodiments, referring to Figure 8, the device further includes:

The determination module 703 is also configured to determine that the service network identifier of the first verification request in the NPN scenario has been tampered with when the first information verification code does not match the first verification request.

The determination module 703 is also configured to determine that the first verification request in the NPN scenario has been tampered with when the first information verification code and the service network verification code are different.

In some embodiments, the receiving module 701 is also configured to receive a fourth verification response sent by the first network element. The fourth verification response instructs the second network element to confirm the error information sent by the terminal.

In some embodiments, the first network element is an AMF network element or a SEAF network element.

It should be noted that when implementing the functions of the device provided by the above embodiments, only the division of the above functional modules is used as an example. In practical applications, the above functions can be allocated to different functional modules according to needs, that is, The internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be described again here.

Figure 9 shows a block diagram of another verification device provided by an exemplary embodiment of the present application. Referring to Figure 9, the device includes:

The receiving module 901 is used to receive the second verification request sent by the second network element;

The sending module 902 is configured to send a first verification request to the terminal. The first verification request is used to verify the service network identity of the terminal in a non-public network NPN scenario. The first verification request is determined based on the second verification request;

The receiving module 901 is configured to receive a first verification response, and the first verification request indicates the verification result of the service network identity;

The sending module 902 is configured to send the first verification response to the second network element.

In some embodiments, the sending module 902 is used to:

Determine the terminal according to the second verification request;

Send a first verification request to the terminal.

Service network verification code;

Verify random number;

timestamp;

Terminal ID.

In some embodiments, the second verification request includes a terminal identification, and the sending module is configured to determine the terminal indicated by the terminal identification.

In some embodiments, the device further includes:

The receiving module 901 is configured to receive the fifth verification response sent by the second network element;

The sending module 902 is also configured to send a second verification response to the terminal in response to the fifth verification response, where the second verification response instructs the second network element to confirm the first verification response sent by the terminal.

In some embodiments, the sending module 902 is also used to:

Determine the terminal according to the fifth verification response;

Send a second verification response to the terminal.

In some embodiments, the fifth verification response includes at least one of the following:

Identifies the verification identifier, which instructs the second network element to confirm the first verification response sent by the terminal;

service network identifier;

Terminal ID.

In some embodiments, the fifth verification response includes the terminal identification, the sending module, and is also used for:

Determine the terminal indicated by the terminal ID.

In some embodiments, the receiving module 901 is also configured to receive the sixth verification response sent by the second network element;

The sending module 902 is also configured to send a third verification response to the terminal in response to the sixth verification response. The third verification response instructs the second network element to confirm the alarm information sent by the terminal. The alarm information serves the first verification request in the NPN scenario. It is sent when the network identity has not been tampered with and the service network identity of the terminal is different from the service network identity included in the first verification request.

In some embodiments, the sending module 902 is also used to:

Determine the terminal according to the sixth verification response;

Send a third verification response to the terminal.

In some embodiments, the sixth verification response includes at least one of the following:

The identification verification identifier instructs the second network element to confirm the alarm information sent by the terminal;

service network identifier;

Terminal ID.

In some embodiments, the sixth verification response includes the terminal identification, and the sending module is also used to determine the terminal indicated by the terminal identification.

In some embodiments, the receiving module 901 is also configured to receive the seventh verification response sent by the second network element;

The sending module 902 is also configured to send a fourth verification response to the terminal in response to the seventh verification response. The fourth verification response instructs the second network element to confirm the error information sent by the terminal. The error information occurs when the terminal cannot parse the first verification request. In this case, it is sent in response to the first verification request, or, in the case where the service network identifier of the first verification request is tampered with in the NPN scenario, it is sent in response to the first verification request.

In some embodiments, the sending module 902 is also used to:

Determine the terminal according to the seventh verification response;

Send a fourth verification response to the terminal.

In some embodiments, the seventh verification response includes at least one of the following:

The identification verification identifier instructs the second network element to confirm the error information sent by the terminal;

Terminal ID.

In some embodiments, the seventh verification response includes the terminal identification, and the sending module 902 is also used to determine the terminal indicated by the terminal identification.

In some embodiments, the second network element is an AUSF network element.

Figure 10 shows a block diagram of yet another verification device provided by an exemplary embodiment of the present application. Referring to Figure 10, the device includes:

Sending module 1001, configured to send a second verification request to the first network element;

The receiving module 1002 is configured to receive a first verification response sent by the first network element, where the first verification response indicates the verification result of the service network identity.

A verification identifier indicating that the second verification request is used to verify the service network identity;

Service network verification code;

Verify random number;

timestamp;

Terminal ID.

In some embodiments, the second verification request includes the service network verification code. Referring to Figure 10, the device further includes:

The determination module 1003 is configured to determine the service network verification code based on at least one of the MSK generated by successful terminal identity verification, a verification random number, and a service network identification.

Terminal verification code;

timestamp;

Terminal ID.

In some embodiments, referring to Figure 11, the device further includes:

Determining module 1003, configured to determine a second information verification code based on at least one of the MSK generated by successful terminal identity verification and the verification result of the service network identity predicted by the second network element. The verification result includes a successful verification of the service network identity and a service At least one of the network identity verification failures;

The determination module 1003 is also configured to determine whether to confirm the first verification response sent by the terminal based on the matching result of the second information verification code and the first verification response.

In some embodiments, the first verification response includes the terminal verification code, and the determination module 1003 is also used in the verification result based on the MSK generated by successful terminal identity verification, the verification random number, and the service network identification predicted by the second network element. At least one item determines the second information verification code;

The determination module 1003 is also configured to determine the first verification response when the verification result of the service network identity predicted by the second network element is the second information verification code corresponding to the failure, and the second information verification code is the same as the terminal verification code. fail;

Alternatively, when the verification result of the service network identity predicted by the second network element is the second information verification code corresponding to success, and the second information verification code is the same as the terminal verification code, it is determined that the first verification response is successful.

In some embodiments, the first verification response indicates that the service network identity verification is successful or indicates that the service network identity verification fails, and the sending module 1001 is further configured to respond to the first verification response when it is determined that the first verification response is successful, A fifth verification response is sent to the first network element, and the fifth verification response instructs the second network element to confirm the first verification response sent by the terminal.

service network identifier;

Terminal ID.

In some embodiments, the first verification response is alarm information, and the sending module 1001 is configured to, when it is determined that the first verification response is successful, send a sixth verification response to the first network element in response to the alarm information. The sixth verification The response instructs the second network element to confirm the alarm information sent by the terminal. The alarm information has not been tampered with in the NPN scenario, and the service network identification of the terminal is different from the service network identification included in the first verification request. Send next.

service network identifier;

Terminal ID.

In some embodiments, the sending module 1001 is also configured to send update information to the third network element, where the update information instructs the third network element to store the service network identifier used by the terminal;

The receiving module 1002 is also configured to receive an update response, where the update response instructs the third network element to confirm the update information.

terminal identification;

service network identifier;

In some embodiments, the third network element is a unified data management UDM network element.

In some embodiments, the first verification response is error information. The sending module 1001 is also configured to send a seventh verification response to the first network element in response to the error information. The seventh verification response instructs the second network element to confirm the error message sent by the terminal. The error message is sent in response to the first verification request when the terminal is unable to parse the first verification request, or in response to the first verification when the service network identifier of the first verification request is tampered with in the NPN scenario. Request sent.

In some embodiments, the second network element is an AUSF network element.

Figure 12 shows a schematic structural diagram of a communication device provided by an exemplary embodiment of the present application. The communication device includes: a processor 1201, a receiver 1202, a transmitter 1203, a memory 1204 and a bus 1205.

The processor 1201 includes one or more processing cores. The processor 1201 executes various functional applications and information processing by running software programs and modules.

The receiver 1202 and the transmitter 1203 can be implemented as a communication component, and the communication component can be a communication chip.

Memory 1204 is connected to processor 1201 through bus 1205.

The memory 1204 can be used to store at least one program code, and the processor 1201 is used to execute the at least one program code to implement each step in the above method embodiment.

In addition, the communication device may be a terminal, a first network element or a second network element. Memory 1204 may be implemented by any type of volatile or non-volatile storage device, or combination thereof, including but not limited to: magnetic or optical disks, electrically erasable programmable read-only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Static Read-Only Memory (SRAM), Read-Only Memory (ROM), Magnetic Memory, Flash Memory, Programmable Read-Only Memory (PROM).

In an exemplary embodiment, a computer-readable storage medium is also provided, with executable program code stored in the readable storage medium, and the executable program code is loaded and executed by the processor to implement each of the above methods. The example provides an authentication method performed by a communication device.

In an exemplary embodiment, a chip is provided. The chip includes programmable logic circuits and/or program instructions. When the chip is run on a terminal, a first network element or a second network element, it is used to implement Verification methods as provided by various method embodiments.

In an exemplary embodiment, a computer program product is provided. When the computer program product is executed by a processor of a terminal, a first network element, or a second network element, it is used to implement the verification method provided by each of the above method embodiments. .

Those of ordinary skill in the art can understand that all or part of the steps to implement the above embodiments can be completed by hardware, or can be completed by instructing relevant hardware through a program. The program can be stored in a computer-readable storage medium. The above-mentioned The storage media mentioned can be read-only memory, magnetic disks or optical disks, etc.

The above are only optional embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection of the present application. within the range.

Claims

A verification method, characterized in that the method is executed by a terminal, and the method includes:

Receive a first verification request sent by the first network element, where the first verification request is used to verify the service network identity of the terminal in a non-public network NPN scenario;

In response to the first verification request, a first verification response is sent to the first network element, where the first verification response indicates a verification result of the serving network identity.
The method of claim 1, wherein the first verification request includes at least one of the following:

a verification identifier, the verification identifier indicating that the first verification request is used to verify the service network identity;

An identity verification identifier indicating successful identity verification of the terminal;

Service network verification code;

Verify random number;

timestamp;

Service network ID.
The method according to claim 1 or 2, characterized in that the first verification response indicates that the service network identity of the terminal is successfully verified, and in response to the first verification request, the first verification request is sent to the first verification request. The network element sends the first verification response, including:

In the NPN scenario, if the service network identity of the first verification request has not been tampered with, and the service network identity of the terminal is the same as the service network identity included in the first verification request, in response to the A verification request, sending the first verification response to the first network element.
The method of claim 3, further comprising:

The key corresponding to the second network element is determined based on the MSK generated by the current successful terminal identity verification and the service network identifier in the first verification request.
The method according to claim 1 or 2, characterized in that the first verification response is alarm information, and in response to the first verification request, sending a first verification response to the first network element includes: :

The alarm information is generated when the service network identifier of the first verification request has not been tampered with in the NPN scenario, and the service network identifier of the terminal is different from the service network identifier included in the first verification request. , in response to the first verification request, sending the alarm information to the first network element, and using the service network identification in the first verification request as the service network identification used by the terminal.
The method according to claim 3 or 5, characterized in that the first verification response includes at least one of the following:

a verification identifier, the verification identifier indicating that the first verification request is used to verify the service network identity;

Terminal verification code;

timestamp;

Terminal ID.
The method according to claim 1 or 2, characterized in that the first verification response indicates that the service network identity verification of the terminal fails, and in response to the first verification request, the first verification request is sent to the first verification request. The network element sends the first verification response, including:

In the NPN scenario, when the service network identifier of the first verification request has not been tampered with, and the service network identifier of the terminal is different from the service network identifier included in the first verification request, the first network element Send the first verification response.
The method according to claim 3 or 7, characterized in that, the method further includes:

A second verification response sent by the first network element is received, and the second verification response instructs the second network element to confirm the first verification response sent by the terminal.
The method according to any one of claims 3 to 8, characterized in that the method further includes:

Determine a first information verification code according to the first verification request;

If the first information verification code matches the first verification request, it is determined that the service network identifier of the first verification request in the NPN scenario has not been tampered with.
The method according to claim 9, wherein the first verification request includes a service network verification code and a service network identification, and determining the first information verification code according to the first verification request includes:

Determine the first information verification code based on at least one of the master shared key MSK generated by successful terminal identity verification, a verification random number, and a service network identification;

Determining that the service network identifier of the first verification request in the NPN scenario has not been tampered with when the first information verification code matches the first verification request includes:

If the first information verification code is the same as the service network verification code, it is determined that the service network identifier in the NPN scenario has not been tampered with.
The method according to claim 7, characterized in that after using the service network identifier in the first verification request as the service network identifier used by the terminal, the method further includes:

Receive a third verification response sent by the first network element, where the third verification response instructs the second network element to confirm the alarm information sent by the terminal.
The method according to claim 1 or 2, characterized in that the first verification response is error information, and the first verification response is sent to the first network element in response to the first verification request. ,include:

If the terminal is unable to parse the first verification request, in response to the first verification request, the error information is sent to the first network element.
The method according to claim 1 or 2, characterized in that the first verification response is error information, and the first verification response is sent to the first network element in response to the first verification request. ,include:

In the case where the service network identifier of the first verification request is tampered with in the NPN scenario, the error information is sent to the first network element in response to the first verification request.
The method of claim 13, further comprising:

Determine a first information verification code according to the first verification request;

If the first information verification code does not match the first verification request, it is determined that the service network identifier of the first verification request in the NPN scenario has been tampered with.
The method of claim 14, wherein the first verification request includes a service network verification code and a service network identification, and determining the first information verification code according to the first verification request includes:

Determine the first information verification code based on at least one of the master shared key MSK generated by successful terminal identity verification, a verification random number, and a service network identification;

Determining that the service network identifier of the first verification request in the NPN scenario has been tampered with when the first information verification code does not match the first verification request includes:

If the first information verification code is different from the service network verification code, it is determined that the first verification request in the NPN scenario has been tampered with.
The method according to any one of claims 12 to 15, characterized in that the method further includes:

Receive a fourth verification response sent by the first network element, where the fourth verification response instructs the second network element to confirm the error information sent by the terminal.
The method according to any one of claims 1 to 16, characterized in that the first network element is an access and mobility management function AMF network element, or a security anchoring function SEAF network element.
A verification method, characterized in that the method is executed by the first network element, and the method includes:

Receive the second verification request sent by the second network element;

Send a first verification request to the terminal, the first verification request being used to verify the service network identity of the terminal in a non-public network NPN scenario, the first verification request being determined based on the second verification request;

Receive a first verification response, the first verification request indicating the verification result of the service network identity;

Send the first verification response to the second network element.
The method according to claim 18, characterized in that sending a first verification request to the terminal includes:

Determine the terminal according to the second verification request;

Send the first verification request to the terminal.
The method of claim 19, wherein the second verification request includes at least one of the following:

a verification identifier, the verification identifier indicating that the first verification request is used to verify the service network identity;

An identity verification identifier indicating successful identity verification of the terminal;

Service network verification code;

Verify random number;

timestamp;

Terminal ID.
The method according to claim 20, wherein the second verification request includes the terminal identification, and determining the terminal according to the second verification request includes:

Determine the terminal indicated by the terminal identifier.
The method of claim 18, further comprising:

Receive the fifth verification response sent by the second network element;

In response to the fifth verification response, a second verification response is sent to the terminal, and the second verification response instructs the second network element to confirm the first verification response sent by the terminal.
The method according to claim 22, characterized in that, in response to the fifth verification response, sending a second verification response to the terminal includes:

Determine the terminal according to the fifth verification response;

Send the second verification response to the terminal.
The method of claim 23, wherein the fifth verification response includes at least one of the following:

a verification identifier, the verification identifier indicating that the first verification request is used to verify the service network identity;

An identification verification identifier that instructs the second network element to confirm the first verification response sent by the terminal;

service network identifier;

Terminal ID.
The method according to claim 24, wherein the fifth verification response includes the terminal identification, and determining the terminal according to the fifth verification response includes:

Determine the terminal indicated by the terminal identifier.
The method of claim 18, further comprising:

Receive the sixth verification response sent by the second network element;

In response to the sixth verification response, a third verification response is sent to the terminal, the third verification response instructs the second network element to confirm the alarm information sent by the terminal, and the alarm information is in the NPN scenario. The service network identifier of the first verification request is sent when the service network identifier of the first verification request has not been tampered with and the service network identifier of the terminal is different from the service network identifier included in the first verification request.
The method according to claim 26, characterized in that, in response to the sixth verification response, sending a third verification response to the terminal includes:

Determine the terminal according to the sixth verification response;

Send the third verification response to the terminal.
The method of claim 27, wherein the sixth verification response includes at least one of the following:

a verification identifier, the verification identifier indicating that the first verification request is used to verify the service network identity;

An identification verification identifier, the identification verification identifier instructs the second network element to confirm the alarm information sent by the terminal;

service network identifier;

Terminal ID.
The method according to claim 28, wherein the sixth verification response includes the terminal identification, and determining the terminal according to the sixth verification response includes:

Determine the terminal indicated by the terminal identifier.
The method of claim 18, further comprising:

Receive the seventh verification response sent by the second network element;

In response to the seventh verification response, a fourth verification response is sent to the terminal, the fourth verification response instructs the second network element to confirm the error information sent by the terminal, and the error information cannot be detected by the terminal. When the first verification request is parsed, it is sent in response to the first verification request, or, in the case where the service network identifier of the first verification request is tampered with in the NPN scenario, it is sent in response to the first verification request. A verification request is sent.
The method according to claim 30, characterized in that, in response to the seventh verification response, sending a fourth verification response to the terminal includes:

Determine the terminal according to the seventh verification response;

Send the fourth verification response to the terminal.
The method of claim 31, wherein the seventh verification response includes at least one of the following:

a verification identifier, the verification identifier indicating that the first verification request is used to verify the service network identity;

An identification verification identifier, the identification verification identifier instructs the second network element to confirm the error information sent by the terminal;

Terminal ID.
The method according to claim 32, wherein the seventh verification response includes the terminal identification, and determining the terminal according to the seventh verification response includes:

Determine the terminal indicated by the terminal identifier.
The method according to any one of claims 18 to 33, characterized in that the first network element is an AMF network element or a SEAF network element.
The method according to any one of claims 18 to 34, characterized in that the second network element is an authentication service function AUSF network element.
A verification method, characterized in that the method is executed by a second network element, and the method includes:

Send a second verification request to the first network element;

Receive a first verification response sent by the first network element, where the first verification response indicates a verification result of the service network identity.
The method of claim 36, wherein the second verification request includes at least one of the following:

a verification identifier, the verification identifier indicating that the second verification request is used to verify the service network identity;

An identity verification identifier indicating successful identity verification of the terminal;

Service network verification code;

Verify random number;

timestamp;

Terminal ID.
The method according to claim 36 or 37, characterized in that the second verification request includes the service network verification code, and the method further includes:

The service network verification code is determined based on at least one of the master shared key MSK generated by successful terminal identity verification, a verification random number, and a service network identification.
The method according to claim 36 or 37, characterized in that the first verification response includes at least one of the following:

A verification identifier indicating that the first verification request is used to verify the service network identity;

Terminal verification code;

timestamp;

Terminal ID.
The method according to claim 36 or 37, characterized in that, the method further includes:

A second information verification code is determined based on at least one of the master shared key MSK generated by successful terminal identity verification and the verification result of the service network identity predicted by the second network element, and the verification result includes the service At least one of successful network identity verification and failure in verification of the service network identity;

Based on the matching result of the second information verification code and the first verification response, it is determined whether to confirm the first verification response sent by the terminal.
The method of claim 40, wherein the first verification response includes a terminal verification code, the master shared key MSK generated based on successful terminal identity verification and the second network element predicted At least one of the verification results of the service network identification determines the second information verification code, including:

Determine the second information verification code based on at least one of the master shared key MSK generated by successful terminal identity verification, a verification random number, and a verification result of the service network identification predicted by the second network element;

Determining whether to confirm the first verification response sent by the terminal based on the matching result of the second information verification code and the first verification response includes:

When the verification result of the service network identity predicted by the second network element is the second information verification code corresponding to the failure, and the second information verification code is the same as the terminal verification code, determine the first verification The verification result of the service network identifier in the response is failed;

Alternatively, when the service network verification result predicted by the second network element is a second information verification code corresponding to success, and the second information verification code is the same as the terminal verification code, determine the first verification The service network ID in the response was verified successfully.
The method according to any one of claims 36 to 41, wherein the first verification response indicates that the service network identity verification is successful or indicates that the service network identity verification fails, and the method further includes:

In response to the first verification response, a fifth verification response is sent to the first network element, and the fifth verification response instructs the second network element to confirm the first verification response sent by the terminal.
The method of claim 42, wherein the fifth verification response includes at least one of the following:

a verification identifier, the verification identifier indicating that the first verification request is used to verify the service network identity;

An identification verification identifier that instructs the second network element to confirm the first verification response sent by the terminal;

service network identifier;

Terminal ID.
The method according to any one of claims 36 to 41, wherein the first verification response is alarm information, and the method further includes:

If it is determined that the first verification response is successful, in response to the alarm information, send a sixth verification response to the first network element, the sixth verification response instructs the second network element to confirm the terminal The alarm information sent, the alarm information has not been tampered with in the service network identification of the first verification request in the NPN scenario, and the service network identification of the terminal is consistent with the service network included in the first verification request. Sent with different identifiers.
The method of claim 44, wherein the sixth verification response includes at least one of the following:

a verification identifier, the verification identifier indicating that the first verification request is used to verify the service network identity;

An identification verification identifier, the identification verification identifier instructs the second network element to confirm the alarm information sent by the terminal;

service network identifier;

Terminal ID.
The method according to any one of claims 36 to 45, characterized in that the method further includes:

Send update information to a third network element, where the update information instructs the third network element to store the service network identifier used by the terminal;

An update response is received, where the update response instructs the third network element to confirm the update information.
The method according to claim 46, characterized in that the update information includes at least one of the following:

terminal identification;

service network identifier;

An identity verification identifier indicating that the service network identity verification is successful.
The method according to claim 46 or 47, characterized in that the third network element is a unified data management UDM network element.
The method according to claim 36 or 37, characterized in that the first verification response is error information, and the method further includes:

In response to the error information, sending a seventh verification response to the first network element, the seventh verification response instructs the second network element to confirm the error information sent by the terminal, and the error information cannot be parsed by the terminal. In the case of the first verification request, it is sent in response to the first verification request, or, in the case of the service network identifier of the first verification request being tampered with in the NPN scenario, in response to the first verification request Verification request sent.
The method according to any one of claims 36 to 49, characterized in that the first network element is an AMF network element or a SEAF network element.
The method according to any one of claims 36 to 50, characterized in that the second network element is an AUSF network element.
A verification device, characterized in that the device includes:

A receiving module configured to receive a first verification request sent by the first network element, where the first verification request is used to verify the service network identity of the terminal in a non-public network NPN scenario;

A sending module, configured to send a first verification response to the first network element in response to the first verification request, where the first verification response indicates the verification result of the service network identity.
A verification device, characterized in that the device includes:

A receiving module, configured to receive the second verification request sent by the second network element;

A sending module, configured to send a first verification request to the terminal. The first verification request is used to verify the service network identity of the terminal in a non-public network NPN scenario. The first verification request is based on the second Verification request confirmed;

The receiving module is configured to receive a first verification response, where the first verification request indicates the verification result of the service network identity;

The sending module is configured to send the first verification response to the second network element.
A verification device, characterized in that the device includes:

A sending module, configured to send a second verification request to the first network element;

A receiving module, configured to receive a first verification response sent by the first network element, where the first verification response indicates the verification result of the service network identity.
A terminal, characterized in that the terminal includes:

processor;

a transceiver coupled to said processor;

Wherein, the processor is configured to load and execute executable instructions to implement the verification method according to any one of claims 1 to 17.
A first network element, characterized in that the first network element includes:

processor;

a transceiver coupled to said processor;

Wherein, the processor is configured to load and execute executable instructions to implement the verification method according to any one of claims 18 to 35.
A second network element, characterized in that the second network element includes:

processor;

a transceiver coupled to said processor;

Wherein, the processor is configured to load and execute executable instructions to implement the verification method according to any one of claims 36 to 51.
A computer-readable storage medium, characterized in that executable program code is stored in the readable storage medium, and the executable program code is loaded and executed by a processor to implement any one of claims 1 to 51 verification method.