WO2024001086A1 - 一种基于共享密钥进行数据通信的方法、装置、设备和介质 - Google Patents

一种基于共享密钥进行数据通信的方法、装置、设备和介质 Download PDF

Info

Publication number
WO2024001086A1
WO2024001086A1 PCT/CN2022/140617 CN2022140617W WO2024001086A1 WO 2024001086 A1 WO2024001086 A1 WO 2024001086A1 CN 2022140617 W CN2022140617 W CN 2022140617W WO 2024001086 A1 WO2024001086 A1 WO 2024001086A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
key
identifier
platform
terminal device
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2022/140617
Other languages
English (en)
French (fr)
Inventor
林奕琳
刘洁
朱红梅
何宇锋
陈思柏
毕奇
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Telecom Corp Ltd
Original Assignee
China Telecom Corp Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Telecom Corp Ltd filed Critical China Telecom Corp Ltd
Publication of WO2024001086A1 publication Critical patent/WO2024001086A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/085—Secret sharing or secret splitting, e.g. threshold schemes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords

Definitions

  • the disclosure relates to the field of communication technology, and specifically to a method, device, equipment and medium for data communication based on a shared key.
  • AKMA authentication and key management for applications
  • a shared key between the APP side and the application backend can be generated for the application based on the shared key between the terminal and the network (denoted as K AUSF ) generated during the initial network authentication and key negotiation process. KAF .
  • the remote UE User Equipment, terminal equipment
  • the remote UE and the application platform cannot directly use
  • the AKMA mechanism generates a shared key for the application layer.
  • the purpose of this disclosure is to provide a method, device, equipment and medium for data communication based on a shared key, so as to overcome, at least to a certain extent, the problems between the remote UE and the application platform caused by the limitations and defects of related technologies.
  • the problem of poor communication reliability is to provide a method, device, equipment and medium for data communication based on a shared key, so as to overcome, at least to a certain extent, the problems between the remote UE and the application platform caused by the limitations and defects of related technologies.
  • the problem of poor communication reliability is to provide a method, device, equipment and medium for data communication based on a shared key, so as to overcome, at least to a certain extent, the problems between the remote UE and the application platform caused by the limitations and defects of related technologies.
  • a method for data communication based on a shared key including: obtaining identification information of a remote terminal device; generating a terminal application identification according to the identification information of the remote terminal device; The terminal application identifier and the application platform key generate a corresponding application key; the terminal application identifier, the application key and the application key identifier are fed back to the remote terminal device, and the remote terminal device is Configured to send an application key identifier and a terminal application identifier to the relay application management platform through an application session request, so that the relay application management platform is configured to generate a corresponding application based on the terminal application identifier and the application platform key.
  • the remote terminal device and the relay application management platform perform data communication based on the application key.
  • the method before obtaining the identification information of the remote terminal device, further includes: performing primary authentication with the application layer and generating an anchor key; and generating an application platform based on the anchor key.
  • key and the application key identifier requesting the establishment of an application session with the relay application management platform; sending the application key identifier to the relay application management platform, and the relay application management platform is configured to
  • the application layer authentication and key management anchor function sends the application key identifier and the application platform identifier, and the application layer authentication and key management anchor function is configured to determine the application platform password based on the anchor key. key, and feedback the application platform key, the validity period of the application platform key and the terminal general public user identification to the relay application management platform; through the shared application platform key and the relay application Management platform for data communication.
  • generating the corresponding application key according to the terminal application identifier and the application platform key includes: substituting the terminal application identifier and the application platform key into a key derivation function for calculation; The corresponding application key is determined according to the key derivation function.
  • the method further includes: obtaining a communication identifier of the remote terminal device; generating an IPv6 interface identifier according to the communication identifier, and determining the corresponding remote terminal device according to the IPv6 interface identifier.
  • the identification information ; allocate the IPv6 interface identification to the corresponding remote terminal device.
  • the method further includes: obtaining a communication identifier of the remote terminal device; generating an IPv6 interface identifier according to the communication identifier, and determining the corresponding remote terminal device according to the IPv6 interface identifier. identification information; in response to the received data stream of the remote terminal device, use the generated IPv6 interface identifier to replace the IPv6 interface identifier in the data stream.
  • the communication identifier includes at least one of MSISDN, GPSI, IMSI, SUPI, and MAC address.
  • a device for data communication based on a shared key including: an acquisition module configured to acquire identification information of a remote terminal device; and a generating module configured to obtain identification information of a remote terminal device according to the The identification information of the device generates a terminal application identification; the generation module is configured to generate a corresponding application key according to the terminal application identification and the application platform key; the interaction module is configured to generate the terminal application identification, the application password The key and the application key identification are fed back to the remote terminal device.
  • the remote terminal device is configured to send the application key identification and the terminal application identification to the relay application management platform through an application session request for the relay.
  • the application management platform is configured to generate a corresponding application key according to the terminal application identification and application platform key, and the remote terminal device and the relay application management platform perform data communication based on the application key.
  • an electronic device including: a memory; and a processor coupled to the memory, the processor being configured to perform any one of the above based on instructions stored in the memory. method described in the item.
  • a computer-readable storage medium on which a program is stored.
  • the program is executed by a processor, the method for data communication based on a shared key as described in any one of the above is implemented.
  • the terminal application is finally The identity, application key and application key identification are fed back to the remote terminal device, and the remote terminal device is configured to send the application key identification and terminal application identification to the relay application management platform through the application session request for relay application management.
  • the platform is configured to generate the corresponding application key based on the terminal application identification and application platform key.
  • the remote terminal device and the relay application management platform conduct data communication based on the application key without upgrading the core network. This meets the secure communication requirements between the remote UE and the application management platform, and expands the application scenarios for near-domain communication.
  • Figure 1 shows a schematic diagram of an exemplary system architecture in which a solution for data communication based on a shared key according to an embodiment of the present invention can be applied;
  • Figure 2 is a schematic diagram of the 3GPP application layer authentication and key management architecture applied to the external application platform AF in an exemplary embodiment of the present disclosure
  • Figure 3 is a schematic diagram of the authentication and key agreement process in an exemplary embodiment of the present disclosure
  • Figure 4 is an interactive schematic diagram of data communication based on a shared key in an exemplary embodiment of the present disclosure
  • Figure 5 is an interactive schematic diagram of the application layer key derivation process in an exemplary embodiment of the present disclosure
  • Figure 6 is a flow chart of a method for data communication based on a shared key in an exemplary embodiment of the present disclosure
  • Figure 7 is a flow chart of another method for data communication based on a shared key in an exemplary embodiment of the present disclosure.
  • Figure 8 is a flow chart of another method for data communication based on a shared key in an exemplary embodiment of the present disclosure
  • Figure 9 is a flow chart of another method for data communication based on a shared key in an exemplary embodiment of the present disclosure.
  • Figure 10 is a flow chart of another method for data communication based on a shared key in an exemplary embodiment of the present disclosure
  • Figure 11 shows a schematic diagram of an application layer key derivation process to which embodiments of the present invention can be applied;
  • Figure 12 shows a schematic diagram of the system architecture of a data communication scheme based on a shared key that can apply an embodiment of the present invention
  • Figure 13 shows a schematic diagram of a data communication solution based on a shared key to which embodiments of the present invention can be applied;
  • Figure 14 shows a schematic diagram of a data communication interaction process based on a shared key to which embodiments of the present invention can be applied;
  • Figure 15 is a block diagram of a device for data communication based on a shared key in an exemplary embodiment of the present disclosure
  • Figure 16 is a block diagram of an electronic device in an exemplary embodiment of the present disclosure.
  • Example embodiments will now be described more fully with reference to the accompanying drawings.
  • Example embodiments may, however, be embodied in various forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concepts of the example embodiments.
  • the described features, structures or characteristics may be combined in any suitable manner in one or more embodiments.
  • numerous specific details are provided to provide a thorough understanding of embodiments of the disclosure.
  • those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details described, or other methods, components, devices, steps, etc. may be adopted.
  • well-known technical solutions have not been shown or described in detail to avoid obscuring aspects of the disclosure.
  • FIG. 1 shows a schematic diagram of an exemplary system architecture to which a solution for data communication based on a shared key according to an embodiment of the present invention can be applied.
  • the system architecture 100 may include one or more of terminal devices 101, 102, 103, a network 104 and a server 105.
  • the network 104 is a medium used to provide communication links between the terminal devices 101, 102, 103 and the server 105.
  • Network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.
  • the number of terminal devices, networks and servers in Figure 1 is only illustrative. Depending on implementation needs, there can be any number of end devices, networks, and servers.
  • the wireless network may also have other network functions, and the server 105 may be a server cluster composed of multiple servers, etc.
  • terminal devices 101, 102, 103 Users can use terminal devices 101, 102, 103 to interact with the server 105 through the network 104 to receive or send messages, etc.
  • the terminal devices 101, 102, and 103 may be various electronic devices with display screens, including but not limited to smart phones, tablet computers, portable computers, desktop computers, and so on.
  • the terminal equipment described here, in addition to the terminal's own software and hardware functions, may also include application APP software to realize the above functions.
  • the method for data communication based on a shared key provided by the embodiments of the present invention is generally executed by a network element in the communication network.
  • a device for data communication based on a shared key is generally provided in the network element. .
  • UDM Unified Data Management, unified data management functions, 3GPP AKA authentication, user identification, access authorization, registration, mobility, subscription, SMS management, etc.
  • AUSF AuthenticationServer Function, authentication server function, realizes 3GPP and non-3GPP access authentication.
  • AMF Access and Mobility Management Function, access and mobility management function, performs registration, connection, reachability, and mobility management.
  • NEF Network Exposure Function, network opening function, opens the ability of each NF, converts internal and external information, and can also be used in edge computing scenarios.
  • AF Application Function, application functions, various application platforms.
  • UE User Equipment
  • user equipment refers to various user terminal equipment.
  • RAN Radio Access Network, wireless access network.
  • HPLMN Home Public Land Mobile Network, local public land mobile network.
  • ME Mobile Equipment, mobile equipment.
  • IPv6 Internet Protocol Version 6, the abbreviation of Internet Protocol Version 6, is the next generation IP protocol designed by the Internet Engineering Task Force to replace IPv4.
  • AAnf Application layer authentication and key management anchor function.
  • FIG. 2 is a schematic diagram of the 3GPP application layer authentication and key management architecture applied to the external application platform AF in an exemplary embodiment of the present disclosure.
  • the 3GPP application layer authentication and key management architecture 200 applied to the external application platform AF includes UDM, AUSF, AMF, RAN, NEF, UE, AF and AAnf, and performs application layer authentication as shown in the figure. and key management.
  • Figure 3 is a schematic diagram of the authentication and key agreement process in an exemplary embodiment of the present disclosure.
  • the 3GPP application layer authentication and key management architecture 300 applied to the internal application platform AF includes UDM, AUSF, AMF, RAN, UE, AF and AAnf, and performs application layer authentication and key management as shown in Figure 3. Key management.
  • FIG. 4 is an interactive schematic diagram of data communication based on a shared key in an exemplary embodiment of the present disclosure.
  • the interactive process 400 of data communication based on a shared key includes two parts: HPLMN and Serving Network.
  • K AUSF is determined in HPLMN
  • KAMF is determined based on K SEAF in the Serving Network
  • K N3IWF and K are determined based on KAMF .
  • Figure 5 is an interactive schematic diagram of the application layer key derivation process in an exemplary embodiment of the present disclosure.
  • the application layer key derivation process 500 includes two processes of determining KAKMA by KAUSF and then determining K AF by KAKMA .
  • FIG. 6 is a flowchart of a method for data communication based on a shared key in an exemplary embodiment of the present disclosure.
  • a method for data communication based on a shared key may include:
  • Step S602 Obtain the identification information of the remote terminal device.
  • Step S604 Generate a terminal application identifier according to the identification information of the remote terminal device.
  • Step S606 Generate a corresponding application key according to the terminal application identification and application platform key.
  • Step S608 Feed back the terminal application identifier, the application key, and the application key identifier to a remote terminal device.
  • the remote terminal device is configured to send an application to the relay application management platform through an application session request. Key identification and terminal application identification, so that the relay application management platform is configured to generate a corresponding application key according to the terminal application identification and application platform key, and the remote terminal device and the relay The application management platform performs data communication based on the application key.
  • the terminal application is finally The identity, application key and application key identification are fed back to the remote terminal device, and the remote terminal device is configured to send the application key identification and terminal application identification to the relay application management platform through the application session request for relay application management.
  • the platform is configured to generate the corresponding application key based on the terminal application identification and application platform key.
  • the remote terminal device and the relay application management platform conduct data communication based on the application key without upgrading the core network. This meets the secure communication requirements between the remote UE and the application management platform, and expands the application scenarios for near-domain communication.
  • the method before obtaining the identification information of the remote terminal device, the method further includes:
  • Step S702 Perform primary authentication with the application layer and generate an anchor key.
  • Step S704 Generate an application platform key and the application key identifier based on the anchor key.
  • Step S706 Request to establish an application session with the relay application management platform.
  • Step S708 Send the application key identification to the relay application management platform.
  • the relay application management platform is configured to send the application key identification and application platform to the application layer authentication and key management anchor function.
  • identification, the application layer authentication and key management anchor function is configured to determine the application platform key based on the anchor key, and combine the application platform key, the validity period of the application platform key, and The terminal's general public user identity is fed back to the relay application management platform.
  • Step S710 Perform data communication with the relay application management platform through the shared application platform key.
  • generating a corresponding application key according to the terminal application identification and application platform key includes:
  • Step S802 Substitute the terminal application identifier and the application platform key into a key derivation function for calculation.
  • Step S804 Determine the corresponding application key according to the key derivation function.
  • 3GPP refers to "HMAC: Keyed-Hashing for Message Authentication” in IETF RFC 2104 and ISO/IEC 10118-3:2004. "Information Technology–Security techniques–Hash-functions–Part 3: Dedicated hash-functions”.
  • the above parameter expression may also be in the following manner:
  • FC You can select one of the fields 0xF0-0xFE reserved by 3GPP (0xF0 and 0xFE are both hexadecimal);
  • UE-APP-ID UE-ID
  • HMAC is a method of using a one-way hash function to construct a message authentication code, where the H in HMAC means Hash.
  • the one-way hash function used in HMAC is not limited to one type. Any high-strength one-way hash function can be used for HMAC. If a new one-way hash function is designed in the future, it can also be used.
  • HMAC constructed using SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512 are called HMAC-SHA1, HMAC-SHA-224, HMAC-SHA-384, and HMAC-SHA-512 respectively.
  • the calculation steps of HMAC include:
  • Key padding If the key is shorter than the block length of the one-way hash function, 0s need to be padded at the end until its length reaches the block length of the one-way hash function. If the key is longer than the block length, a one-way hash function is used to find the hash value of the key, and then this hash value is used as the HMAC key.
  • XOR the padded key and ipad XOR the padded key with the bit sequence called ipad.
  • ipad is a bit sequence formed by repeating the bit sequence 00110110 until it reaches the packet length, where i in ipad means inner.
  • the value obtained by the XOR operation is a bit sequence with the same block length as the one-way hash function and related to the key. This bit sequence is called ipadkey here.
  • XOR of the padded key and opad XOR the padded key with a bit sequence called opad.
  • opad is a bit sequence formed by repeating the bit sequence 01011100 until the packet length is reached. , where o in opad means outer.
  • the result of the XOR operation is also a bit sequence with the same block length as the one-way hash function and related to the key. This bit sequence is called opadkey here.
  • the method for data communication based on a shared key further includes:
  • Step S902 Obtain the communication identifier of the remote terminal device.
  • Step S904 Generate an IPv6 interface identifier based on the communication identifier, and determine identification information of the corresponding remote terminal device based on the IPv6 interface identifier.
  • Step S906 Allocate the IPv6 interface identifier to the corresponding remote terminal device.
  • the relay UE needs to obtain the ID of the remote UE.
  • the ID of the remote UE can be MSISDN/GPSI, IMSI/SUPI, MAC address, etc.
  • the subsequent UE can allocate the IPv6 interface ID to the remote UE after generating the IPv6 interface ID using the remote UE ID.
  • the method for data communication based on a shared key further includes:
  • Step S1002 Obtain the communication identifier of the remote terminal device.
  • Step S1004 Generate an IPv6 interface identifier based on the communication identifier, and determine identification information of the corresponding remote terminal device based on the IPv6 interface identifier.
  • Step S1006 In response to the received data stream of the remote terminal device, use the generated IPv6 interface identifier to replace the IPv6 interface identifier in the data stream.
  • the source IPv6 interface ID needs to be replaced in the data stream of the remote UE with the IPv6 interface ID generated using the remote UE ID.
  • the core network while realizing data communication between the remote terminal device and the relay application management platform based on the application key, the core network needs to separately count the traffic of different source IPv6 interface IDs, respectively. Generate traffic records and send them to the IT system for billing.
  • the communication identifier includes at least one of MSISDN, GPSI, IMSI, SUPI, and MAC address.
  • IMSI International Mobile Subscriber Identification Number (International Mobile Subscriber Identification Number). It is a symbol that distinguishes mobile users. It is stored in the EF-IMSI file of the SIM card and can be used to distinguish effective information about mobile users. IMSI is the ID number of the SIM card, which can distinguish each SIM card. IMSI consists of a string of decimal digits, with a maximum length of 15 digits. Most of the actual IMSI lengths are 15 digits.
  • MSISDN MobileSubscriber International ISDN number
  • MSISDN numbers MobileSubscriber International ISDN number
  • NDC National Destination Code
  • domestic destination code also known as network access code
  • network access code is assigned to each network operator by the communications authorities of each country.
  • China Mobile's network access codes are 134 ⁇ 139, 150 ⁇ 152, 188, etc.
  • China Unicom's are 130 ⁇ 132, 185 ⁇ 186, etc.
  • China Telecom's are 133, 153, 180, 189, etc.
  • SUPI Subscription Permanent Identifier, user permanent identification, similar to 4G's IMSI.
  • the true identity of the mobile phone is called SUPI (SUbscription Permanent Identifier, user permanent identifier) in 5G, similar to IMSI.
  • the ciphertext encrypted by the public key is called SUCI (Subscription Concealed Identifier, user hidden identifier), and SUCI is transmitted to the base station Then, the base station directly uploads it to the core network.
  • GPSI Generic PublicSubscription Identifier, a universal public user identifier, which is equivalent to the MSISDN of 4G. There is not necessarily a one-to-one correspondence between SUPI and GPSI. If a user accesses different data networks, there will be multiple GPSI identifiers, and the network needs to add the external network GPSI Build a relationship with SUPI. NEF can realize the mapping relationship between External GPSI and Inter GPSI, and the UDR stores the mapping relationship between Internal GPSI and SUPI.
  • MAC Medium/Media Access Control address, used to represent the identifier of each site on the Internet, expressed in hexadecimal numbers, with a total of six bytes (48 bits). Among them, the first three bytes are codes (high-order 24 bits) assigned to different manufacturers by the IEEE registration management agency RA, also known as "Organizationally Unique Identifier", and the last three bytes are (lower 24 bits) is assigned by each manufacturer to the adapter interface produced, called an extended identifier (uniqueness). An address block can generate 2 different addresses. The MAC address is actually the adapter address or adapter identifier.
  • Figure 11 shows a schematic diagram of an application layer key derivation process to which embodiments of the present invention can be applied.
  • the application layer key derivation process 1100 includes: adding a new KAPP derived from K AF (the required number is determined according to the number of remote UEs).
  • the KAPPn is generated and sent by the relay ME ad hoc network.
  • FIG. 12 shows a schematic diagram of a system architecture of a data communication scheme based on a shared key that can be applied according to an embodiment of the present invention.
  • the system architecture may include a remote terminal device 1202, a relay terminal device 1204, a wireless network and the Internet 1210.
  • a wireless network is a medium used to provide a communication link between end devices and servers.
  • the wireless network may include base stations 1206, user plane functions 1208, access and mobility management functions 1212, and session management functions 1214. Connection types of wireless networks include, but are not limited to, wired, wireless communication links, or fiber optic cables.
  • Figure 13 shows a schematic diagram of a data communication solution based on a shared key to which embodiments of the present invention can be applied.
  • the solution for data communication based on shared keys includes the following processes:
  • Step S1302 The relay UE completes the main authentication, generates the shared key K AUSF , generates the anchor key KAKMA and the application key identification A-KID based on K AUSF , and completes the negotiation and generation of K AF with the platform AF.
  • Step S1304 The remote UE establishes a connection with the relay UE, and the relay UE obtains the remote UE ID.
  • Step S1306 The relay UE generates a UE-APP-ID for the remote UE, and uses the UE-APP-ID and K AF to generate K-app.
  • Step S1308 The relay UE sends the UE-APP-ID, application key K-app and A-KID to the remote UE.
  • Step S1310 The application platform AF uses the UE-APP-ID and the application platform key K AF to generate the application key K-app.
  • Step S1312 K-app is used for secure communication between the remote UE and the platform AF.
  • Figure 14 shows a schematic diagram of a data communication interaction process based on a shared key to which embodiments of the present invention can be applied.
  • the data communication interaction process based on the shared key mainly involves the remote UE1402, the relay UE1404, the authentication server function 1406, the application layer authentication and key management anchor function (AAnf) 1408, and the network opening function (NEF).
  • the relay UE 1404 and the application layer authentication and key management anchor function (AAnf) 1408 perform master authentication and K AKMA key establishment, and the relay UE 1404 generates A-KID and K AF , carried out between the relay UE1404 and the relay application management platform (AF) 1412.
  • the relay application management platform AF1412 sends A-KID and AF_ID, and obtains K AF , K AF validity period, and mobile phone number GPSI from AAnF via NEF. Waiting, the application session establishment response between the relay UE1404 and the relay application management platform (AF) 1412, the relay UE1404 uses the shared key K AF to perform secure communication, and then the remote UE and the relay application management platform (AF) Secure communication between 1412 is mainly achieved through the following steps:
  • the remote UE1402 establishes a secure connection with the relay UE1404, and the relay UE1404 obtains the ID of the remote UE1402.
  • the relay UE1404 uses the ID of the remote UE1402 to generate UE_APP_ID.
  • Relay UE1404 uses UE_APP_ID and K AF to generate K_app.
  • the relay UE1404 sends UE_APP_ID, K_app, and A-KID to the remote UE1402.
  • Application session establishment request (A-KID, UE_APP_ID) between the remote UE 1402 and the relay application management platform (AF) 1412.
  • the relay application management platform (AF) 1412 uses UE_APP_ID and K AF to generate K_app.
  • the remote UE 1402 and the relay application management platform (AF) 1412 use the shared key K_app to communicate securely.
  • the present disclosure also provides a device for data communication based on a shared key, which can be used to execute the above method embodiments.
  • Figure 15 is a block diagram of a device for data communication based on a shared key in an exemplary embodiment of the present disclosure.
  • a device 1500 for data communication based on a shared key may include:
  • the acquisition module 1502 is configured to obtain the identification information of the remote terminal device.
  • the generation module 1504 is configured to generate a terminal application identification according to the identification information of the remote terminal device.
  • the generation module 1504 is configured to generate a corresponding application key according to the terminal application identification and application platform key.
  • the interaction module 1506 is configured to feed back the terminal application identifier, the application key, and the application key identifier to a remote terminal device, and the remote terminal device is configured to request relay application management through an application session request.
  • the platform sends the application key identification and the terminal application identification so that the relay application management platform is configured to generate the corresponding application key according to the terminal application identification and the application platform key, and the remote terminal device communicates with the The relay application management platform performs data communication based on the application key.
  • the interaction module 1506 is further configured to: perform primary authentication with the application layer and generate an anchor key; generate an application platform key and the application secret key based on the anchor key.
  • Key identification requesting the establishment of an application session with the relay application management platform; sending the application key identification to the relay application management platform, the relay application management platform being configured to provide application layer authentication and key management
  • the anchor point function sends the application key identification and application platform identification
  • the application layer authentication and key management anchor point function is configured to determine the application platform key according to the anchor point key and transfer the application
  • the platform key, the validity period of the application platform key and the terminal general public user identification are fed back to the relay application management platform; data communication is performed with the relay application management platform through the shared application platform key.
  • the generation module 1504 is further configured to: substitute the terminal application identifier and the application platform key into a key derivation function for calculation; determine the corresponding key derivation function according to the key derivation function. Application key.
  • the interaction module 1506 is further configured to: obtain the communication identifier of the remote terminal device; generate an IPv6 interface identifier based on the communication identifier, and determine the corresponding IPv6 interface identifier based on the IPv6 interface identifier. Identification information of the remote terminal device; allocate the IPv6 interface identifier to the corresponding remote terminal device.
  • the interaction module 1506 is further configured to: obtain the communication identifier of the remote terminal device; generate an IPv6 interface identifier based on the communication identifier, and determine the corresponding IPv6 interface identifier based on the IPv6 interface identifier. Identification information of the remote terminal device; in response to the received data stream of the remote terminal device, use the generated IPv6 interface identifier to replace the IPv6 interface identifier in the data stream.
  • the communication identifier includes at least one of MSISDN, GPSI, IMSI, SUPI, and MAC address.
  • an electronic device capable of implementing the above method is also provided.
  • FIG. 16 An electronic device 1600 according to this embodiment of the invention is described below with reference to FIG. 16 .
  • the electronic device 1600 shown in FIG. 16 is only an example and should not bring any limitations to the functions and scope of use of the embodiments of the present invention.
  • electronic device 1600 is embodied in the form of a general computing device.
  • the components of the electronic device 1600 may include, but are not limited to: the above-mentioned at least one processing unit 1610, the above-mentioned at least one storage unit 1620, and a bus 1630 connecting different system components (including the storage unit 1620 and the processing unit 1610).
  • the storage unit stores program code, and the program code can be executed by the processing unit 1610, so that the processing unit 1610 performs various exemplary methods according to the present invention described in the above-mentioned "Example Method" section of this specification. Implementation steps.
  • the processing unit 1610 may perform the method shown in the embodiment of the present disclosure.
  • the storage unit 1620 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 16201 and/or a cache storage unit 16202, and may further include a read-only storage unit (ROM) 16203.
  • RAM random access storage unit
  • ROM read-only storage unit
  • Storage unit 1620 may also include a program/utility 16204 having a set of (at least one) program modules 16205 including, but not limited to: an operating system, one or more application programs, other program modules, and program data, Each of these examples, or some combination, may include the implementation of a network environment.
  • program/utility 16204 having a set of (at least one) program modules 16205 including, but not limited to: an operating system, one or more application programs, other program modules, and program data, Each of these examples, or some combination, may include the implementation of a network environment.
  • Bus 1630 may be a local area representing one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or using any of a variety of bus structures. bus.
  • Electronic device 1600 may also communicate with one or more external devices 1640 (e.g., keyboard, pointing device, Bluetooth device, etc.), may also communicate with one or more devices that enable a user to interact with electronic device 1600, and/or with Any device (eg, router, modem, etc.) that enables the electronic device 1600 to communicate with one or more other computing devices. This communication may occur through input/output (I/O) interface 1650.
  • the electronic device 1600 may also communicate with one or more networks (eg, a local area network (LAN), a wide area network (WAN), and/or a public network, such as the Internet) through the network adapter 1660. As shown, network adapter 1660 communicates with other modules of electronic device 1600 via bus 1630.
  • network adapter 1660 communicates with other modules of electronic device 1600 via bus 1630.
  • the example embodiments described here can be implemented by software, or can be implemented by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , including several instructions to cause a computing device (which may be a personal computer, a server, a terminal device, a network device, etc.) to execute a method according to an embodiment of the present disclosure.
  • a computing device which may be a personal computer, a server, a terminal device, a network device, etc.
  • a computer-readable storage medium is also provided, on which a program product capable of implementing the method described above in this specification is stored.
  • various aspects of the present invention can also be implemented in the form of a program product, which includes program code.
  • the program product is run on a terminal device, the program code is used to cause the The terminal device performs the steps according to various exemplary embodiments of the present invention described in the "Exemplary Method" section above in this specification.
  • the program product for implementing the above method according to the embodiment of the present invention may adopt a portable compact disk read-only memory (CD-ROM) and include the program code, and may be run on a terminal device, such as a personal computer.
  • a readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus or device.
  • the program product may take the form of any combination of one or more readable media.
  • the readable medium may be a readable signal medium or a readable storage medium.
  • the readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: electrical connection with one or more conductors, portable disk, hard disk, random access memory (RAM), read only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.
  • a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave carrying readable program code therein. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above.
  • a readable signal medium may also be any readable medium other than a readable storage medium that can send, propagate, or transport the program for use by or in connection with an instruction execution system, apparatus, or device.
  • Program code embodied on a readable medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical cable, RF, etc., or any suitable combination of the foregoing.
  • Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, etc., as well as conventional procedural Programming language—such as "C" or a similar programming language.
  • the program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or server execute on.
  • the remote computing device may be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device, such as provided by an Internet service. (business comes via Internet connection).
  • LAN local area network
  • WAN wide area network
  • the remote terminal device by obtaining the identification information of the remote terminal device, generating the terminal application identification according to the identification information of the remote terminal equipment, and then generating the corresponding application key according to the terminal application identification and the application platform key, finally the terminal application identification,
  • the application key and application key identification are fed back to the remote terminal device, and the remote terminal device is configured to send the application key identification and terminal application identification to the relay application management platform through the application session request, so that the relay application management platform can be It is configured to generate the corresponding application key based on the terminal application identification and application platform key.
  • the remote terminal device and the relay application management platform conduct data communication based on the application key. Without the need to upgrade the core network, It meets the secure communication requirements between remote UE and application management platform, and expands the application scenarios of near-domain communication.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephone Function (AREA)

Abstract

本公开提供一种基于共享密钥进行数据通信的方法、装置、设备和介质，其中，方法包括：获取远端终端设备的标识信息；根据远端终端设备的标识信息生成终端应用标识；根据终端应用标识和应用平台密钥生成相应的应用密钥；将终端应用标识、应用密钥和应用密钥标识反馈至远端终端设备，远端终端设备被配置为通过应用会话请求向中继应用管理平台发送应用密钥标识和终端应用标识，以供中继应用管理平台被配置为能够根据终端应用标识和应用平台密钥生成相应的应用密钥，终端与中继应用管理平台基于应用密钥进行数据通信。通过本公开实施例，在不需要对核心网做升级改造的前提下，满足了远端UE与应用管理平台的安全通信需求，扩展了在近域通信的应用场景。

Description

一种基于共享密钥进行数据通信的方法、装置、设备和介质
本公开要求于2022年06月27日提交的申请号为202210745225.4、名称为“基于共享密钥进行数据通信的方法、装置、设备和介质”的中国专利申请的优先权，该中国专利申请的全部内容通过引用全部并入本文。
技术领域
公开涉及通信技术领域，具体而言，涉及一种基于共享密钥进行数据通信的方法、装置、设备和介质。
背景技术
目前，3GPP在5G系统中引入了AKMA(authentication and key management for applications应用层认证和密钥管理)机制。
在相关技术中，可以基于终端在初次网络认证及密钥协商过程中生成的与网络之间的共享密钥(记作K AUSF)，并为应用生成APP端与应用后台之间的共享密钥K AF。
但是，在某些近域通信场景下，当远端UE(User Equipment，终端设备)通过中继UE中转接入移动核心网使用数据业务的情况时，远端UE与应用平台之间无法直接利用AKMA机制生成应用层的共享密钥。
需要说明的是，在上述背景技术部分公开的信息仅用于加强对本公开的背景的理解，因此可以包括不构成对本领域普通技术人员已知的现有技术的信息。
发明内容
本公开的目的在于提供一种基于共享密钥进行数据通信的方法、装置、设备和介质，用于至少在一定程度上克服由于相关技术的限制和缺陷而导致的远端UE与应用平台之间的通信可靠性差的问题。
根据本公开实施例的第一方面，提供一种基于共享密钥进行数据通信的方法，包括：获取远端终端设备的标识信息；根据所述远端终端设备的标识信息生成终端应用标识；根据所述终端应用标识和应用平台密钥生成相应的应用密钥；将所述终端应用标识、所述应用密钥和所述应用密钥标识反馈至远端终端设备，所述远端终端设备被配置为通过应用会话请求向中继应用管理平台发送应用密钥标识和终端应用标识，以供所述中继应用管理平台被配置为能够根据所述终端应用标识和应用平台密钥生成相应的应用密钥，所述远端终端设备与所述中继应用管理平台基于所述应用密钥进行数据通信。
在本公开的一种示例性实施例中，在获取远端终端设备的标识信息前，还包括：通过与应用层进行主认证并生成锚点密钥；基于所述锚点密钥生成应用平台密钥和所述应用密钥标识；请求与所述中继应用管理平台建立应用会话；向所述中继应用管理平台发送所述 应用密钥标识，所述中继应用管理平台被配置为向应用层认证和密钥管理锚点功能发送所述应用密钥标识和应用平台标识，所述应用层认证和密钥管理锚点功能被配置为根据所述锚点密钥确定所述应用平台密钥，并将所述应用平台密钥、所述应用平台密钥的有效期和终端通用公共用户标识反馈至所述中继应用管理平台；通过共享的所述应用平台密钥与所述中继应用管理平台进行数据通信。
在本公开的一种示例性实施例中，根据终端应用标识和应用平台密钥生成相应的应用密钥包括：将所述终端应用标识和所述应用平台密钥代入密钥导出函数进行计算；根据所述密钥导出函数确定相应的应用密钥。
在本公开的一种示例性实施例中，所述密钥导出函数的表达式包括：K-APP＝HMAC-SHA-256(K AF，S)；S＝FC||P0||L0，其中，所述HMAC-SHA-256(K AF，S)表征以所述Kaf和所述S为参数的密钥导出函数，所述Kaf表征所述应用平台密钥，所述K-APP表征所述应用密钥，所述S表征中间参数，所述FC表征3GPP的保留字段，所述P0表征所述终端应用标识，所述L0表征所述终端应用标识的字符长度。
在本公开的一种示例性实施例中，还包括：获取远端终端设备的通信标识符；根据所述通信标识符生成IPv6接口标识，并根据所述IPv6接口标识确定对应的远端终端设备的标识信息；将所述IPv6接口标识分配至对应的远端终端设备。
在本公开的一种示例性实施例中，还包括：获取远端终端设备的通信标识符；根据所述通信标识符生成IPv6接口标识，并根据所述IPv6接口标识确定对应的远端终端设备的标识信息；响应于接收到的所述远端终端设备的数据流，采用生成的IPv6接口标识替换所述数据流中的IPv6接口标识。
在本公开的一种示例性实施例中，所述通信标识符包括MSISDN、GPSI、IMSI、SUPI、MAC地址中的至少一种。
根据本公开实施例的第二方面，提供一种基于共享密钥进行数据通信的装置，包括：获取模块，设置为获取远端终端设备的标识信息；生成模块，设置为根据所述远端终端设备的标识信息生成终端应用标识；所述生成模块，设置为根据所述终端应用标识和应用平台密钥生成相应的应用密钥；交互模块，设置为将所述终端应用标识、所述应用密钥和所述应用密钥标识反馈至远端终端设备，所述远端终端设备被配置为通过应用会话请求向中继应用管理平台发送应用密钥标识和终端应用标识，以供所述中继应用管理平台被配置为能够根据所述终端应用标识和应用平台密钥生成相应的应用密钥，所述远端终端设备与所述中继应用管理平台基于所述应用密钥进行数据通信。
根据本公开的第三方面，提供一种电子设备，包括：存储器；以及耦合到所述存储器的处理器，所述处理器被配置为基于存储在所述存储器中的指令，执行如上述任意一项所述的方法。
根据本公开的第四方面，提供一种计算机可读存储介质，其上存储有程序，该程序被处理器执行时实现如上述任意一项所述的基于共享密钥进行数据通信的方法。
本公开实施例，通过获取远端终端设备的标识信息，并根据远端终端设备的标识信息生成终端应用标识，进而根据终端应用标识和应用平台密钥生成相应的应用密钥，最终将终端应用标识、应用密钥和应用密钥标识反馈至远端终端设备，远端终端设备被配置为通过应用会话请求向中继应用管理平台发送应用密钥标识和终端应用标识，以供中继应用管理平台被配置为能够根据终端应用标识和应用平台密钥生成相应的应用密钥，远端终端设备与中继应用管理平台基于应用密钥进行数据通信，在不需要对核心网做升级改造的前提下，满足了远端UE与应用管理平台的安全通信需求，扩展了在近域通信的应用场景。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本公开。
附图说明
图1示出了可以应用本发明实施例的基于共享密钥进行数据通信的方案的示例性系统架构的示意图；
图2是本公开示例性实施例中应用于外部应用平台AF的3GPP应用层认证及密钥管理架构的示意图；
图3是本公开示例性实施例中认证及密钥协商过程的示意图；
图4是本公开示例性实施例中基于共享密钥进行数据通信的交互示意图；
图5是本公开示例性实施例中应用层密钥推导过程的交互示意图；
图6是本公开示例性实施例中一种基于共享密钥进行数据通信的方法的流程图；
图7是本公开示例性实施例中另一种基于共享密钥进行数据通信的方法的流程图；
图8是本公开示例性实施例中另一种基于共享密钥进行数据通信的方法的流程图；
图9是本公开示例性实施例中另一种基于共享密钥进行数据通信的方法的流程图；
图10是本公开示例性实施例中另一种基于共享密钥进行数据通信的方法的流程图；
图11示出了可以应用本发明实施例的一种应用层密钥推导过程的示意图；
图12示出了可以应用本发明实施例的一种基于共享密钥进行数据通信方案的系统架构的示意图；
图13示出了可以应用本发明实施例的一种基于共享密钥进行数据通信的方案的示意图；
图14示出了可以应用本发明实施例的一种基于共享密钥进行数据通信交互过程的示意图；
图15是本公开示例性实施例中一种基于共享密钥进行数据通信的装置的方框图；
图16是本公开示例性实施例中一种电子设备的方框图。
具体实施方式
现在将参考附图更全面地描述示例实施方式。然而，示例实施方式能够以多种形式实 施，且不应被理解为限于在此阐述的范例；相反，提供这些实施方式使得本公开将更加全面和完整，并将示例实施方式的构思全面地传达给本领域的技术人员。所描述的特征、结构或特性可以以任何合适的方式结合在一个或更多实施方式中。在下面的描述中，提供许多具体细节从而给出对本公开的实施方式的充分理解。然而，本领域技术人员将意识到，可以实践本公开的技术方案而省略所述特定细节中的一个或更多，或者可以采用其它的方法、组元、装置、步骤等。在其它情况下，不详细示出或描述公知技术方案以避免喧宾夺主而使得本公开的各方面变得模糊。
此外，附图仅为本公开的示意性图解，图中相同的附图标记表示相同或类似的部分，因而将省略对它们的重复描述。附图中所示的一些方框图是功能实体，不一定必须与物理或逻辑上独立的实体相对应。可以采用软件形式来实现这些功能实体，或在一个或多个硬件模块或集成电路中实现这些功能实体，或在不同网络和/或处理器装置和/或微控制器装置中实现这些功能实体。
图1示出了可以应用本发明实施例的基于共享密钥进行数据通信的方案的示例性系统架构的示意图。
如图1所示，系统架构100可以包括终端设备101、102、103中的一种或多种，网络104和服务器105。网络104用以在终端设备101、102、103和服务器105之间提供通信链路的介质。网络104可以包括各种连接类型，例如有线、无线通信链路或者光纤电缆等等。
应该理解，图1中的终端设备、网络和服务器的数目仅仅是示意性的。根据实现需要，可以具有任意数目的终端设备、网络和服务器。比如无线网络除了现有功能之外还可以有其它网络功能、服务器105可以是多个服务器组成的服务器集群等。
用户可以使用终端设备101、102、103通过网络104与服务器105交互，以接收或发送消息等。终端设备101、102、103可以是具有显示屏的各种电子设备，包括但不限于智能手机、平板电脑、便携式计算机和台式计算机等等。此处所述的终端设备，除了终端自身的软硬件功能，也可以包含为实现上述功能的应用APP软件。
在一些实施例中，本发明实施例所提供的基于共享密钥进行数据通信的方法一般由通信网络中的网元执行，相应地，基于共享密钥进行数据通信的装置一般设置于网元中。
下面对本公开的实施例涉及的名词和概念进行说明。
UDM：Unified Data Management，统一数据管理功能，3GPP AKA认证、用户识别、访问授权、注册、移动、订阅、短信管理等。
AUSF：AuthenticationServer Function，认证服务器功能，实现3GPP和非3GPP的接入认证。
AMF：Access and Mobility Management Function，接入和移动性管理功能，执行注册、连接、可达性、移动性管理。
NEF：Network Exposure Function，网络开放功能，开放各NF的能力，转换内外部信 息，也可用于边缘计算场景。
AF：Application Function，应用功能，各种应用平台。
UE：User Equipment，用户设备，指各种用户终端设备。
RAN：Radio Access Network，无线接入网。
HPLMN：Home Public Land Mobile Network，本地公用陆地移动网络。
ME：Mobile Equipment，移动设备。
IPv6：Internet Protocol Version 6，互联网协议第6版的缩写，是互联网工程任务组设计的用于替代IPv4的下一代IP协议。
AAnf：应用层认证和密钥管理锚点功能。
图2是本公开示例性实施例中应用于外部应用平台AF的3GPP应用层认证及密钥管理架构的示意图。
参考图2，应用于外部应用平台AF的3GPP应用层认证及密钥管理架构200包括UDM、AUSF、AMF、RAN、NEF、UE、AF和AAnf，并按照如图所示的方式进行应用层认证及密钥管理。
图3是本公开示例性实施例中认证及密钥协商过程的示意图。
参考图3，应用于内部应用平台AF的3GPP应用层认证及密钥管理架构300包括UDM、AUSF、AMF、RAN、UE、AF和AAnf，并按照如图3所示的方式进行应用层认证及密钥管理。
图4是本公开示例性实施例中基于共享密钥进行数据通信的交互示意图。
参考图4，基于共享密钥进行数据通信的交互过程400包括HPLMN和Serving Network两部分，在HPLMN中确定K AUSF，在Serving Network中根据K SEAF确定K AMF，并基于K AMF确定K N3IWF、K gNB，NH、K NASint和K NASenc，进而由K gNB，NH确定K RRCint、K RRCenc、K UPint、K UPenc。
图5是本公开示例性实施例中应用层密钥推导过程的交互示意图。
参考图5，应用层密钥推导过程500包括由K AUSF确定K AKMA，继而由K AKMA确定K AF这两个过程。
下面结合附图对本公开示例实施方式进行详细说明。
图6是本公开示例性实施例中基于共享密钥进行数据通信的方法的流程图。
参考图6，基于共享密钥进行数据通信的方法可以包括：
步骤S602，获取远端终端设备的标识信息。
步骤S604，根据所述远端终端设备的标识信息生成终端应用标识。
步骤S606，根据所述终端应用标识和应用平台密钥生成相应的应用密钥。
步骤S608，将所述终端应用标识、所述应用密钥和所述应用密钥标识反馈至远端终端设备，所述远端终端设备被配置为通过应用会话请求向中继应用管理平台发送应用密钥标识和终端应用标识，以供所述中继应用管理平台被配置为能够根据所述终端应用标识和 应用平台密钥生成相应的应用密钥，所述远端终端设备与所述中继应用管理平台基于所述应用密钥进行数据通信。
本公开实施例，通过获取远端终端设备的标识信息，并根据远端终端设备的标识信息生成终端应用标识，进而根据终端应用标识和应用平台密钥生成相应的应用密钥，最终将终端应用标识、应用密钥和应用密钥标识反馈至远端终端设备，远端终端设备被配置为通过应用会话请求向中继应用管理平台发送应用密钥标识和终端应用标识，以供中继应用管理平台被配置为能够根据终端应用标识和应用平台密钥生成相应的应用密钥，远端终端设备与中继应用管理平台基于应用密钥进行数据通信，在不需要对核心网做升级改造的前提下，满足了远端UE与应用管理平台的安全通信需求，扩展了在近域通信的应用场景。
下面，对基于共享密钥进行数据通信的方法的各步骤进行详细说明。
在本公开的一种示例性实施例中，如图7所示，在获取远端终端设备的标识信息前，还包括：
步骤S702，通过与应用层进行主认证并生成锚点密钥。
步骤S704，基于所述锚点密钥生成应用平台密钥和所述应用密钥标识。
步骤S706，请求与所述中继应用管理平台建立应用会话。
步骤S708，向所述中继应用管理平台发送所述应用密钥标识，所述中继应用管理平台被配置为向应用层认证和密钥管理锚点功能发送所述应用密钥标识和应用平台标识，所述应用层认证和密钥管理锚点功能被配置为根据所述锚点密钥确定所述应用平台密钥，并将所述应用平台密钥、所述应用平台密钥的有效期和终端通用公共用户标识反馈至所述中继应用管理平台。
步骤S710，通过共享的所述应用平台密钥与所述中继应用管理平台进行数据通信。
在本公开的一种示例性实施例中，如图8所示，根据终端应用标识和应用平台密钥生成相应的应用密钥包括：
步骤S802，将所述终端应用标识和所述应用平台密钥代入密钥导出函数进行计算。
步骤S804，根据所述密钥导出函数确定相应的应用密钥。
在本公开的一种示例性实施例中，所述密钥导出函数的表达式包括：K-APP＝HMAC-SHA-256(K AF，S)，S＝FC||P0||L0，其中，所述HMAC-SHA-256(K AF，S)表征以所述Kaf和所述S为参数的密钥导出函数，所述K AF表征所述应用平台密钥，所述K-APP表征所述应用密钥，所述S表征中间参数，所述FC表征3GPP的保留字段，所述P0表征所述终端应用标识(UE-APP-ID)，所述L0表征所述终端应用标识的字符长度。
在上述实施例中，密钥导出函数的定义在3GPP TS33.220中有具体描述，3GPP引用了IETF RFC 2104中的"HMAC:Keyed-Hashing for Message Authentication"和ISO/IEC 10118-3:2004中的"Information Technology–Security techniques–Hash-functions–Part 3:Dedicated hash-functions"。
在上述实施例中，上述参数表达式还可以采用以下方式：
FC：可在3GPP保留的字段0xF0-0xFE(0xF0和0xFE均为十六进制)中选取其一；
P0＝UE-APP-ID；
L0＝length of UE_APP_ID；
其中，UE-APP-ID＝UE-ID||AF FQDN||Ua*安全协议ID。
在上述实施例中，HMAC是一种使用单向散列函数来构造消息认证码的方法，其中HMAC中的H就是Hash的意思。
HMAC中所使用的单向散列函数并不仅限于一种，任何高强度的单向散列函数都可以被用于HMAC，如果将来设计出的新的单向散列函数，也同样可以使用。
使用SHA-1、SHA-224、SHA-256、SHA-384、SHA-512所构造的HMAC，分别称为HMAC-SHA1、HMAC-SHA-224、HMAC-SHA-384、HMAC-SHA-512。
HMAC的计算步骤包括：
1、密钥填充：如果密钥比单向散列函数分组长度要短，就需要在末尾填充0，直到其长度达到单向散列函数的分组长度为止。如果密钥比分组长度要长，则要用单向散列函数求出密钥的散列值，然后将这个散列值用作HMAC的密钥。
2、填充后的密钥与ipad的XOR：将填充后的密钥与被称为ipad的比特序列进行XOR运算。ipad是将00110110这一比特序列不断循环反复直到达到分组长度所形成的比特序列，其中ipad的i是inner的意思。XOR运算所得到的值，就是一个和单向散列函数的分组长度相同，且和密钥相关的比特序列。这里将这个比特序列称为ipadkey。
3、与消息组合：将ipadkey与消息组合，也就是将和密钥相关的比特序列(ipadkey)附加在消息的开头。
4、计算散列值：将3的结果输入单向散列函数，并计算出散列值。
5、填充后的密钥与opad的XOR：将填充后的密钥与被称为opad的比特序列进行XOR运算，opad是将01011100这一比特序列不断循环反复直到达到分组长度所形成的比特序列，其中opad的o是outer的意思。XOR运算所得到的结果也是一个和单向散列函数的分组长度相同，且和密钥相关的比特序列。这里将这个比特序列称为opadkey。
6、与散列值组合：将4的散列值拼在opadkey后面。
7、计算散列值：将6的结果输入单向散列函数，并计算出散列值，这个散列值就是最终的MAC值。通过上述流程可以看出，最后得到的MAC值，一定是一个和输入的消息以及密钥都相关的长度固定的比特序列。
在本公开的一种示例性实施例中，如图9所示，基于共享密钥进行数据通信的方法还包括：
步骤S902，获取远端终端设备的通信标识符。
步骤S904，根据所述通信标识符生成IPv6接口标识，并根据所述IPv6接口标识确定对应的远端终端设备的标识信息。
步骤S906，将所述IPv6接口标识分配至对应的远端终端设备。
在上述实施例中，远端UE与中继UE完成认证后，中继UE需获取远端UE的ID，此处远端UE的ID可以是MSISDN/GPSI、IMSI/SUPI、MAC地址等，中继UE可以在利用远端UE ID生成IPv6接口ID后，向远端UE分配该IPv6接口ID。
在本公开的一种示例性实施例中，如图10所示，基于共享密钥进行数据通信的方法还包括：
步骤S1002，获取远端终端设备的通信标识符。
步骤S1004，根据所述通信标识符生成IPv6接口标识，并根据所述IPv6接口标识确定对应的远端终端设备的标识信息。
步骤S1006，响应于接收到的所述远端终端设备的数据流，采用生成的IPv6接口标识替换所述数据流中的IPv6接口标识。
在上述实施例中，如果中继UE未向远端UE分配接口ID，则需要在远端UE的数据流中，将源IPv6接口ID替换为利用远端UE ID生成的IPv6接口ID。
在上述实施例中，在实现了所述远端终端设备与所述中继应用管理平台基于所述应用密钥进行数据通信的同时，核心网需要将不同源IPv6接口ID的流量分别统计，分别生成流量记录，并发送给IT系统进行计费。
在本公开的一种示例性实施例中，所述通信标识符包括MSISDN、GPSI、IMSI、SUPI、MAC地址中的至少一种。
其中，IMSI是国际移动用户识别码(International MobileSubscriber Identification Number)是区别移动用户的标志，储存在SIM卡的EF-IMSI文件中，可用于区别移动用户的有效信息。IMSI是SIM卡的id号码，可以区分每一张SIM卡。IMSI由一串十进制数字组成，最大长度为15位，实际使用的IMSI的长度绝大部分都是15位。
其中，MSISDN(MobileSubscriber International ISDN number)移动台国际用户识别码，即移动用户的ISDN号码，是在公共交换电话网交换网络编号计划中，唯一能识别移动用户的号码，俗称为手机号，MSISDN号码其组成包含如下三个部分：
(1)CC：Country Code，国家码，中国的国家码为86。
(2)NDC：National Destination Code，国内目的地码，也称网络接入码，由各个国家的通信主管部门分配给各个网络运营商。中国移动网络接入码为134～139、150～152、188等，中国联通为130～132、185～186等，中国电信为133、153、180、189等。
(3)SN：Subscriber Number，客户号码，由网络运营商分配。
SUPI：Subscription Permanent Identifier，用户永久标识，类似于4G的IMSI。手机的真实身份在5G里称为SUPI(SUbscription Permanent Identifier，用户永久标识符)，类似IMSI，通过公钥加密后的密文称为SUCI(Subscription Concealed Identifier，用户隐藏标识符)，SUCI传送给基站后，基站直接上传至核心网。
GPSI：Generic PublicSubscription Identifier，通用公共用户标识，等同于4G的MSISDN，SUPI和GPSI之间不一定一一对应，用户如果访问不同的数据网络，就会存 在多个GPSI标识，网络需要将外部网络GPSI与SUPI建立关系。NEF可以实现External GPSI与Inter GPSI有映射关系，UDR上保存有Internal GPSI与SUPI的映射关系。
MAC：Medium/Media Access Control地址，用来表示互联网上每一个站点的标识符，采用十六进制数表示，共六个字节(48位)。其中，前三个字节是由IEEE的注册管理机构RA负责给不同厂家分配的代码(高位24位)，也称为"编制上唯一的标识符"(Organizationally Unique Identifier)，后三个字节(低位24位)由各厂家自行指派给生产的适配器接口，称为扩展标识符(唯一性)。一个地址块可以生成2个不同的地址。MAC地址实际上就是适配器地址或适配器标识符。
图11示出了可以应用本发明实施例的一种应用层密钥推导过程的示意图。
如图11所示，应用层密钥推导过程1100包括：新增由K AF推导出KAPP(根据远端UE的数量确定所需的个数)，该KAPPn由中继ME自组网生成并发送给远端UEn，用于应用平台AF与MEn之间的安全通信。
图12示出了可以应用本发明实施例的一种基于共享密钥进行数据通信方案的系统架构的示意图。
如图12所示，系统架构可以包括远端终端设备1202、中继终端设备1204、无线网络和互联网1210。无线网络用以在终端设备和服务器之间提供通信链路的介质。无线网络可以包括基站1206、用户面功能1208、接入与移动性管理功能1212和会话管理功能1214。无线网络的连接类型包括有线、无线通信链路或者光纤电缆，但不限于此。
图13示出了可以应用本发明实施例的一种基于共享密钥进行数据通信的方案的示意图。
如图13所示，基于共享密钥进行数据通信的方案包括以下流程：
步骤S1302，中继UE完成主认证，生成共享密钥K AUSF，基于K AUSF生成锚点密钥K AKMA、应用密钥标识A-KID，并与平台AF完成K AF的协商及生成。
步骤S1304，远程UE与中继UE建立连接，中继UE获得远端UE ID。
步骤S1306，中继UE为远端UE生成UE-APP-ID，利用UE-APP-ID和K AF生成K-app。
步骤S1308，中继UE将UE-APP-ID、应用密钥K-app和A-KID发送给远端UE。
步骤S1310，应用平台AF利用UE-APP-ID和应用平台密钥K AF生成应用密钥K-app。
步骤S1312，远端UE和平台AF之间利用K-app进行安全通信。
图14示出了可以应用本发明实施例的一种基于共享密钥进行数据通信交互过程的示意图。
如图14所示，基于共享密钥进行数据通信交互过程主要涉及远端UE1402、中继UE1404、认证服务器功能1406、应用层认证和密钥管理锚点功能(AAnf)1408、网络开放功能(NEF)1410和中继应用管理平台(AF)1412，中继UE1404与应用层认证和密钥管理锚点功能(AAnf)1408之间进行主认证及K AKMA密钥建立，中继UE1404生成 A-KID和K AF，中继UE1404与中继应用管理平台(AF)1412之间进行，中继应用管理平台AF1412发送A-KID和AF_ID，并经由NEF从AAnF获取K AF、K AF有效期、手机号GPSI等，中继UE1404与中继应用管理平台(AF)1412之间的应用会话建立响应，中继UE1404利用共享密钥K AF进行安全通信，接下来远端UE与中继应用管理平台(AF)1412之间的安全通信主要通过以下步骤实现：
1.远端UE1402与中继UE1404建立安全连接，中继UE1404获取远端UE1402的ID。
2.中继UE1404利用远端UE1402的ID生成UE_APP_ID。
3.中继UE1404利用UE_APP_ID和K AF生成K_app。
4.中继UE1404将UE_APP_ID、K_app、A-KID发送至远端UE1402。
5.远端UE1402与中继应用管理平台(AF)1412之间的应用会话建立请求(A-KID、UE_APP_ID)。
6.中继应用管理平台(AF)1412利用UE_APP_ID和K AF生成K_app。
7.远端UE1402与中继应用管理平台(AF)1412之间的应用会话建立响应。
8.远端UE1402与中继应用管理平台(AF)1412之间利用共享密钥K_app进行安全通信。
对应于上述方法实施例，本公开还提供一种基于共享密钥进行数据通信的装置，可以用于执行上述方法实施例。
图15是本公开示例性实施例中一种基于共享密钥进行数据通信的装置的方框图。
参考图15，基于共享密钥进行数据通信的装置1500可以包括：
获取模块1502，设置为获取远端终端设备的标识信息。
生成模块1504，设置为根据所述远端终端设备的标识信息生成终端应用标识。
所述生成模块1504，设置为根据所述终端应用标识和应用平台密钥生成相应的应用密钥。
交互模块1506，设置为将所述终端应用标识、所述应用密钥和所述应用密钥标识反馈至远端终端设备，所述远端终端设备被配置为通过应用会话请求向中继应用管理平台发送应用密钥标识和终端应用标识，以供所述中继应用管理平台被配置为能够根据所述终端应用标识和应用平台密钥生成相应的应用密钥，所述远端终端设备与所述中继应用管理平台基于所述应用密钥进行数据通信。
在本公开的一种示例性实施例中，交互模块1506还设置为：通过与应用层进行主认证并生成锚点密钥；基于所述锚点密钥生成应用平台密钥和所述应用密钥标识；请求与所述中继应用管理平台建立应用会话；向所述中继应用管理平台发送所述应用密钥标识，所述中继应用管理平台被配置为向应用层认证和密钥管理锚点功能发送所述应用密钥标识和应用平台标识，所述应用层认证和密钥管理锚点功能被配置为根据所述锚点密钥确定所述应用平台密钥，并将所述应用平台密钥、所述应用平台密钥的有效期和终端通用公共用户标识反馈至所述中继应用管理平台；通过共享的所述应用平台密钥与所述中继应用管理 平台进行数据通信。
在本公开的一种示例性实施例中，生成模块1504还设置为：将所述终端应用标识和所述应用平台密钥代入密钥导出函数进行计算；根据所述密钥导出函数确定相应的应用密钥。
在本公开的一种示例性实施例中，所述密钥导出函数的表达式包括：K-APP＝HMAC-SHA-256(K AF，S)；S＝FC||P0||L0，其中，所述HMAC-SHA-256(K AF，S)表征以所述K AF和所述S为参数的密钥导出函数，所述K AF表征所述应用平台密钥，所述K-APP表征所述应用密钥，所述S表征中间参数，所述FC表征3GPP的保留字段，所述P0表征所述终端应用标识，所述L0表征所述终端应用标识的字符长度。
在本公开的一种示例性实施例中，交互模块1506还设置为：获取远端终端设备的通信标识符；根据所述通信标识符生成IPv6接口标识，并根据所述IPv6接口标识确定对应的远端终端设备的标识信息；将所述IPv6接口标识分配至对应的远端终端设备。
在本公开的一种示例性实施例中，交互模块1506还设置为：获取远端终端设备的通信标识符；根据所述通信标识符生成IPv6接口标识，并根据所述IPv6接口标识确定对应的远端终端设备的标识信息；响应于接收到的所述远端终端设备的数据流，采用生成的IPv6接口标识替换所述数据流中的IPv6接口标识。
在本公开的一种示例性实施例中，所述通信标识符包括MSISDN、GPSI、IMSI、SUPI、MAC地址中的至少一种。
由于基于共享密钥进行数据通信的装置1500的各功能已在其对应的方法实施例中予以详细说明，本公开于此不再赘述。
应当注意，尽管在上文详细描述中提及了用于动作执行的设备的若干模块或者单元，但是这种划分并非强制性的。实际上，根据本公开的实施方式，上文描述的两个或更多模块或者单元的特征和功能可以在一个模块或者单元中具体化。反之，上文描述的一个模块或者单元的特征和功能可以进一步划分为由多个模块或者单元来具体化。
在本公开的示例性实施例中，还提供了一种能够实现上述方法的电子设备。
所属技术领域的技术人员能够理解，本发明的各个方面可以实现为系统、方法或程序产品。因此，本发明的各个方面可以具体实现为以下形式，即：完全的硬件实施方式、完全的软件实施方式(包括固件、微代码等)，或硬件和软件方面结合的实施方式，这里可以统称为“电路”、“模块”或“系统”。
下面参照图16来描述根据本发明的这种实施方式的电子设备1600。图16显示的电子设备1600仅仅是一个示例，不应对本发明实施例的功能和使用范围带来任何限制。
如图16所示，电子设备1600以通用计算设备的形式表现。电子设备1600的组件可以包括但不限于：上述至少一个处理单元1610、上述至少一个存储单元1620、连接不同系统组件(包括存储单元1620和处理单元1610)的总线1630。
其中，所述存储单元存储有程序代码，所述程序代码可以被所述处理单元1610执行， 使得所述处理单元1610执行本说明书上述“示例性方法”部分中描述的根据本发明各种示例性实施方式的步骤。例如，所述处理单元1610可以执行如本公开实施例所示的方法。
存储单元1620可以包括易失性存储单元形式的可读介质，例如随机存取存储单元(RAM)16201和/或高速缓存存储单元16202，还可以进一步包括只读存储单元(ROM)16203。
存储单元1620还可以包括具有一组(至少一个)程序模块16205的程序/实用工具16204，这样的程序模块16205包括但不限于：操作系统、一个或者多个应用程序、其它程序模块以及程序数据，这些示例中的每一个或某种组合中可能包括网络环境的实现。
总线1630可以为表示几类总线结构中的一种或多种，包括存储单元总线或者存储单元控制器、外围总线、图形加速端口、处理单元或者使用多种总线结构中的任意总线结构的局域总线。
电子设备1600也可以与一个或多个外部设备1640(例如键盘、指向设备、蓝牙设备等)通信，还可与一个或者多个使得用户能与该电子设备1600交互的设备通信，和/或与使得该电子设备1600能与一个或多个其它计算设备进行通信的任何设备(例如路由器、调制解调器等等)通信。这种通信可以通过输入/输出(I/O)接口1650进行。并且，电子设备1600还可以通过网络适配器1660与一个或者多个网络(例如局域网(LAN)，广域网(WAN)和/或公共网络，例如因特网)通信。如图所示，网络适配器1660通过总线1630与电子设备1600的其它模块通信。应当明白，尽管图中未示出，可以结合电子设备1600使用其它硬件和/或软件模块，包括但不限于：微代码、设备驱动器、冗余处理单元、外部磁盘驱动阵列、RAID系统、磁带驱动器以及数据备份存储系统等。
通过以上的实施方式的描述，本领域的技术人员易于理解，这里描述的示例实施方式可以通过软件实现，也可以通过软件结合必要的硬件的方式来实现。因此，根据本公开实施方式的技术方案可以以软件产品的形式体现出来，该软件产品可以存储在一个非易失性存储介质(可以是CD-ROM，U盘，移动硬盘等)中或网络上，包括若干指令以使得一台计算设备(可以是个人计算机、服务器、终端装置、或者网络设备等)执行根据本公开实施方式的方法。
在本公开的示例性实施例中，还提供了一种计算机可读存储介质，其上存储有能够实现本说明书上述方法的程序产品。在一些可能的实施方式中，本发明的各个方面还可以实现为一种程序产品的形式，其包括程序代码，当所述程序产品在终端设备上运行时，所述程序代码用于使所述终端设备执行本说明书上述“示例性方法”部分中描述的根据本发明各种示例性实施方式的步骤。
根据本发明的实施方式的用于实现上述方法的程序产品可以采用便携式紧凑盘只读存储器(CD-ROM)并包括程序代码，并可以在终端设备，例如个人电脑上运行。然而，本发明的程序产品不限于此，在本文件中，可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行系统、装置或者器件使用或者与其结合使用。
所述程序产品可以采用一个或多个可读介质的任意组合。可读介质可以是可读信号介质或者可读存储介质。可读存储介质例如可以为但不限于电、磁、光、电磁、红外线、或半导体的系统、装置或器件，或者任意以上的组合。可读存储介质的更具体的例子(非穷举的列表)包括：具有一个或多个导线的电连接、便携式盘、硬盘、随机存取存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(EPROM或闪存)、光纤、便携式紧凑盘只读存储器(CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。
计算机可读信号介质可以包括在基带中或者作为载波一部分传播的数据信号，其中承载了可读程序代码。这种传播的数据信号可以采用多种形式，包括但不限于电磁信号、光信号或上述的任意合适的组合。可读信号介质还可以是可读存储介质以外的任何可读介质，该可读介质可以发送、传播或者传输用于由指令执行系统、装置或者器件使用或者与其结合使用的程序。
可读介质上包含的程序代码可以用任何适当的介质传输，包括但不限于无线、有线、光缆、RF等等，或者上述的任意合适的组合。
可以以一种或多种程序设计语言的任意组合来编写用于执行本发明操作的程序代码，所述程序设计语言包括面向对象的程序设计语言—诸如Java、C++等，还包括常规的过程式程序设计语言—诸如“C”语言或类似的程序设计语言。程序代码可以完全地在用户计算设备上执行、部分地在用户设备上执行、作为一个独立的软件包执行、部分在用户计算设备上部分在远程计算设备上执行、或者完全在远程计算设备或服务器上执行。在涉及远程计算设备的情形中，远程计算设备可以通过任意种类的网络，包括局域网(LAN)或广域网(WAN)，连接到用户计算设备，或者，可以连接到外部计算设备(例如利用因特网服务提供商来通过因特网连接)。
此外，上述附图仅是根据本发明示例性实施例的方法所包括的处理的示意性说明，而不是限制目的。易于理解，上述附图所示的处理并不表明或限制这些处理的时间顺序。另外，也易于理解，这些处理可以是例如在多个模块中同步或异步执行的。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本公开的其它实施方案。本申请旨在涵盖本公开的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本公开的一般性原理并包括本公开未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本公开的真正范围和构思由权利要求指出。
工业实用性
实施例，通过获取远端终端设备的标识信息，并根据远端终端设备的标识信息生成终端应用标识，进而根据终端应用标识和应用平台密钥生成相应的应用密钥，最终将终端应用标识、应用密钥和应用密钥标识反馈至远端终端设备，远端终端设备被配置为通过应用会话请求向中继应用管理平台发送应用密钥标识和终端应用标识，以供中继应用管理平台 被配置为能够根据终端应用标识和应用平台密钥生成相应的应用密钥，远端终端设备与中继应用管理平台基于应用密钥进行数据通信，在不需要对核心网做升级改造的前提下，满足了远端UE与应用管理平台的安全通信需求，扩展了在近域通信的应用场景。

Claims (10)

  1. 一种基于共享密钥进行数据通信的方法，其特征在于，适用于中继终端设备，所述基于共享密钥进行数据通信的方法包括：
    获取远端终端设备的标识信息；
    根据所述远端终端设备的标识信息生成终端应用标识；
    根据所述终端应用标识和应用平台密钥生成相应的应用密钥；
    将所述终端应用标识、所述应用密钥和所述应用密钥标识反馈至远端终端设备，所述远端终端设备被配置为通过应用会话请求向中继应用管理平台发送应用密钥标识和终端应用标识，以供所述中继应用管理平台被配置为能够根据所述终端应用标识和应用平台密钥生成相应的应用密钥，所述远端终端设备与所述中继应用管理平台基于所述应用密钥进行数据通信。
  2. 如权利要求1所述的基于共享密钥进行数据通信的方法，其特征在于，在获取远端终端设备的标识信息前，还包括：
    通过与应用层进行主认证并生成锚点密钥；
    基于所述锚点密钥生成应用平台密钥和所述应用密钥标识；
    请求与所述中继应用管理平台建立应用会话；
    向所述中继应用管理平台发送所述应用密钥标识，所述中继应用管理平台被配置为向应用层认证和密钥管理锚点功能发送所述应用密钥标识和应用平台标识，所述应用层认证和密钥管理锚点功能被配置为根据所述锚点密钥确定所述应用平台密钥，并将所述应用平台密钥、所述应用平台密钥的有效期和终端通用公共用户标识反馈至所述中继应用管理平台；通过共享的所述应用平台密钥与所述中继应用管理平台进行数据通信。
  3. 如权利要求1所述的基于共享密钥进行数据通信的方法，其特征在于，根据终端应用标识和应用平台密钥生成相应的应用密钥包括：
    将所述终端应用标识和所述应用平台密钥代入密钥导出函数进行计算；
    根据所述密钥导出函数确定相应的应用密钥。
  4. 如权利要求3所述的基于共享密钥进行数据通信的方法，其特征在于，所述密钥导出函数的表达式包括：
    K-APP＝HMAC-SHA-256(K AF，S)；
    S＝FC||P0||L0，
    其中，所述HMAC-SHA-256(K AF，S)表征以所述K AF和所述S为参数的密钥导出函数，所述K AF表征所述应用平台密钥，所述K-APP表征所述应用密钥，所述S表征中间参数，所述FC表征3GPP的保留字段，所述P0表征所述终端应用标识，所述L0表征所述终端应用标识的字符长度。
  5. 如权利要求1-4中任一项所述的基于共享密钥进行数据通信的方法，其特征在于，还包括：
    获取远端终端设备的通信标识符；
    根据所述通信标识符生成IPv6接口标识，并根据所述IPv6接口标识确定对应的远端终端设备的标识信息；
    将所述IPv6接口标识分配至对应的远端终端设备。
  6. 如权利要求1-4中任一项所述的基于共享密钥进行数据通信的方法，其特征在于，还包括：
    获取远端终端设备的通信标识符；
    根据所述通信标识符生成IPv6接口标识，并根据所述IPv6接口标识确定对应的远端终端设备的标识信息；
    响应于接收到的所述远端终端设备的数据流，采用生成的IPv6接口标识替换所述数据流中的IPv6接口标识。
  7. 如权利要求6所述的基于共享密钥进行数据通信的方法，其特征在于，
    所述通信标识符包括MSISDN、GPSI、IMSI、SUPI、MAC地址中的至少一种。
  8. 一种基于共享密钥进行数据通信的装置，其特征在于，包括：
    获取模块，设置为获取远端终端设备的标识信息；
    生成模块，设置为根据所述远端终端设备的标识信息生成终端应用标识；
    所述生成模块，设置为根据所述终端应用标识和应用平台密钥生成相应的应用密钥；
    交互模块，设置为将所述终端应用标识、所述应用密钥和所述应用密钥标识反馈至远端终端设备，所述远端终端设备被配置为通过应用会话请求向中继应用管理平台发送应用密钥标识和终端应用标识，以供所述中继应用管理平台被配置为能够根据所述终端应用标识和应用平台密钥生成相应的应用密钥，所述远端终端设备与所述中继应用管理平台基于所述应用密钥进行数据通信。
  9. 一种电子设备，其特征在于，包括：
    存储器；以及
    耦合到所述存储器的处理器，所述处理器被配置为基于存储在所述存储器中的指令，执行如权利要求1-7任一项所述的基于共享密钥进行数据通信的方法。
  10. 一种计算机可读存储介质，其上存储有程序，该程序被处理器执行时实现如权利要求1-7任一项所述的基于共享密钥进行数据通信的方法。
PCT/CN2022/140617 2022-06-27 2022-12-21 一种基于共享密钥进行数据通信的方法、装置、设备和介质 Ceased WO2024001086A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210745225.4A CN115150075B (zh) 2022-06-27 2022-06-27 基于共享密钥进行数据通信的方法、装置、设备和介质
CN202210745225.4 2022-06-27

Publications (1)

Publication Number Publication Date
WO2024001086A1 true WO2024001086A1 (zh) 2024-01-04

Family

ID=83410628

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/140617 Ceased WO2024001086A1 (zh) 2022-06-27 2022-12-21 一种基于共享密钥进行数据通信的方法、装置、设备和介质

Country Status (2)

Country Link
CN (1) CN115150075B (zh)
WO (1) WO2024001086A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115150075B (zh) * 2022-06-27 2024-12-24 中国电信股份有限公司 基于共享密钥进行数据通信的方法、装置、设备和介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210360742A1 (en) * 2018-10-03 2021-11-18 Apple Inc. Systems, methods, and apparatuses for enabling relay services for user equipment to access 5gc via a residential gateway
WO2022019627A1 (en) * 2020-07-20 2022-01-27 Samsung Electronics Co., Ltd. Methods and systems for establishing secure communication in wireless communication system
WO2022088029A1 (zh) * 2020-10-30 2022-05-05 华为技术有限公司 密钥获取方法和通信装置
CN115150075A (zh) * 2022-06-27 2022-10-04 中国电信股份有限公司 基于共享密钥进行数据通信的方法、装置、设备和介质

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113348690B (zh) * 2019-01-14 2024-01-30 瑞典爱立信有限公司 用于安全的方法和装置
CN113162758B (zh) * 2020-01-23 2023-09-19 中国移动通信有限公司研究院 一种密钥生成方法及设备
MX2022010227A (es) * 2020-02-21 2022-09-19 Ericsson Telefon Ab L M Seleccion de funcion de servidor de autenticacion en autenticacion y administracion de claves.
CN113543126B (zh) * 2020-03-31 2023-02-28 华为技术有限公司 密钥获取方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210360742A1 (en) * 2018-10-03 2021-11-18 Apple Inc. Systems, methods, and apparatuses for enabling relay services for user equipment to access 5gc via a residential gateway
WO2022019627A1 (en) * 2020-07-20 2022-01-27 Samsung Electronics Co., Ltd. Methods and systems for establishing secure communication in wireless communication system
WO2022088029A1 (zh) * 2020-10-30 2022-05-05 华为技术有限公司 密钥获取方法和通信装置
CN115150075A (zh) * 2022-06-27 2022-10-04 中国电信股份有限公司 基于共享密钥进行数据通信的方法、装置、设备和介质

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
HUAWEI, HISILICON: "Solution on key management in UE-to-network relay based on primary authentication", 3GPP DRAFT; S3-203432, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. E-meeting; 20201109 - 20201120, 16 November 2020 (2020-11-16), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051955237 *
QUALCOMM INCORPORATED: "Sending UE identifier to the AKMA AF", 3GPP DRAFT; S3-203191, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. e-meeting; 20201109 - 20201120, 30 October 2020 (2020-10-30), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051949767 *

Also Published As

Publication number Publication date
CN115150075A (zh) 2022-10-04
CN115150075B (zh) 2024-12-24

Similar Documents

Publication Publication Date Title
US12348959B2 (en) Session request method and apparatus, terminal, and storage medium
US20230033598A1 (en) Network key processing method and system and related device
CN101406021B (zh) 基于sim的认证
EP4271015B1 (en) Registration method and apparatus, authentication method and apparatus, routing indicator determining method and apparatus, entity, and terminal
US8091116B2 (en) Communication system and method
CN111327583B (zh) 一种身份认证方法、智能设备及认证服务器
CN112512045B (zh) 一种通信系统、方法及装置
US20220225095A1 (en) External Authentication Method, Communication Apparatus, and Communication System
US8582542B2 (en) Communication system and method
CN105682253A (zh) 建立通信的方法、设备、终端和计算机可读存储介质
KR20050027015A (ko) 셀룰러 시스템과 연관된 보안값(들)에 기초하여 무선근거리 네트워크에 대한 액세스를 인증하는 방법
US12207350B2 (en) System and methods for subscriber identifier authentication and privacy
JP2015503303A (ja) セキュリティで保護された通信システムおよび通信方法
CN102685856A (zh) 无线通信方法与无线直接连接通信系统
WO2019149006A1 (zh) 获取、提供无线接入点接入信息的方法、设备以及介质
US9807819B1 (en) Cross-technology session continuity
WO2020147602A1 (zh) 一种认证方法、装置和系统
WO2021081900A1 (zh) 通信方法及相关装置
WO2024001086A1 (zh) 一种基于共享密钥进行数据通信的方法、装置、设备和介质
US12477343B2 (en) Mobile virtual network operator network access control
JP2022076669A (ja) 情報処理装置、情報処理プログラム、及び通信システム
KR100684965B1 (ko) 인터넷 프로토콜 버젼 6 식별자를 이용하여 인터넷프로토콜 버젼 6 주소를 자동으로 생성하는 방법
CN118614099A (zh) 基于tls-psk的用于接入边缘数据网络的认证机制
CN110933670A (zh) 一种实现主认证增强的安全usim卡及终端的主认证方法
CN109155913B (zh) 网络连接方法、安全节点的确定方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22949162

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22949162

Country of ref document: EP

Kind code of ref document: A1

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 03.04.2025)

122 Ep: pct application non-entry in european phase

Ref document number: 22949162

Country of ref document: EP

Kind code of ref document: A1