WO2024031732A1 - 终端设备能力指示方法及装置 - Google Patents

终端设备能力指示方法及装置 Download PDF

Info

Publication number
WO2024031732A1
WO2024031732A1 PCT/CN2022/112334 CN2022112334W WO2024031732A1 WO 2024031732 A1 WO2024031732 A1 WO 2024031732A1 CN 2022112334 W CN2022112334 W CN 2022112334W WO 2024031732 A1 WO2024031732 A1 WO 2024031732A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
terminal device
indication information
upu
check code
Prior art date
Application number
PCT/CN2022/112334
Other languages
English (en)
French (fr)
Inventor
梁浩然
陆伟
Original Assignee
北京小米移动软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京小米移动软件有限公司 filed Critical 北京小米移动软件有限公司
Priority to CN202280002828.3A priority Critical patent/CN117882415A/zh
Priority to PCT/CN2022/112334 priority patent/WO2024031732A1/zh
Publication of WO2024031732A1 publication Critical patent/WO2024031732A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity

Definitions

  • the present application relates to the field of communication technology, and in particular to a terminal equipment capability indication method and device.
  • HPLMN Home Public Land Mobile Network, home public land mobile network
  • UE User Equipment, user equipment
  • VPLMN Vehicle Public Land Mobile Network
  • the UE may need to indicate UPU/SoR to the home network before the home network triggers the UPU (UE Parameters Update, UE parameter update)/SoR (Steering of Roaming, roaming guidance) process. ability.
  • UPU User Parameters Update
  • UE parameter update UE parameter update
  • SoR Step of Roaming, roaming guidance
  • this capability indication information may be tampered with or deleted by the VPLMN.
  • the first embodiment of the present application proposes a terminal device capability indication method.
  • the method is executed by the terminal device.
  • the method includes:
  • the first information includes first indication information and an integrity check code, and the first indication information is used to indicate the capability of the terminal device.
  • the second embodiment of the present application proposes a terminal device capability indication method, which is executed by the first core network device.
  • the method includes:
  • the capability request message is used to request the terminal device to indicate the capabilities of the terminal device; receive the first information and/or the first information sent by the terminal device through the access network
  • the identification of the terminal device; the first information includes first indication information and an integrity check code, and the first indication information is used to indicate the capability of the terminal device.
  • the third embodiment of the present application proposes a terminal device capability indication method.
  • the method is executed by the second core network device.
  • the method includes:
  • the fourth embodiment of the present application provides a terminal equipment capability indication device, the device is applied to the terminal equipment, and the device includes:
  • the transceiver unit is configured to receive a capability request message sent by the first core network device through the access network; the transceiver unit is further configured to send a third capability request message to the first core network device through the access network according to the capability request message.
  • the fifth aspect embodiment of the present application provides a terminal equipment capability indication device, the device is applied to the first core network equipment, and the device includes:
  • the transceiver unit is used to send a capability request message to the terminal device through the access network, and the capability request message is used to request the terminal device to indicate the capability of the terminal device; the transceiver unit is also used to receive the terminal device through The first information sent by the access network and/or the identification of the terminal device; the first information includes first indication information and an integrity check code, and the first indication information is used to indicate the status of the terminal device. ability.
  • the sixth embodiment of the present application provides a terminal equipment capability indication device, the device is applied to the second core network equipment, and the device includes:
  • a transceiver unit configured to receive the first information and the identification of the terminal device sent by the first core network device; the first information includes first indication information and an integrity check code, and the first indication information is used to indicate the Terminal device capabilities.
  • the seventh embodiment of the present application provides a communication device.
  • the device includes a processor and a memory.
  • a computer program is stored in the memory.
  • the processor executes the computer program stored in the memory so that the The device executes the terminal device capability indication method described in the embodiment of the first aspect.
  • the eighth embodiment of the present application provides a communication device.
  • the device includes a processor and a memory.
  • a computer program is stored in the memory.
  • the processor executes the computer program stored in the memory so that the The device executes the terminal device capability indication method described in the above-mentioned embodiment of the second aspect, or executes the terminal device capability indication method described in the above-mentioned embodiment of the third aspect.
  • the ninth aspect of the present application provides a communication device.
  • the device includes a processor and an interface circuit.
  • the interface circuit is used to receive code instructions and transmit them to the processor.
  • the processor is used to run the code instructions to enable the The device executes the terminal device capability indication method described in the embodiment of the first aspect.
  • the tenth embodiment of the present application provides a communication device.
  • the device includes a processor and an interface circuit.
  • the interface circuit is used to receive code instructions and transmit them to the processor.
  • the processor is used to run the code instructions to make the The device executes the terminal device capability indication method described in the above-mentioned embodiment of the second aspect, or executes the terminal device capability indication method described in the above-mentioned embodiment of the third aspect.
  • the eleventh embodiment of the present application provides a computer-readable storage medium for storing instructions. When the instructions are executed, the terminal device capability indication method described in the first embodiment is implemented.
  • the twelfth aspect embodiment of the present application provides a computer-readable storage medium for storing instructions.
  • the terminal device capability indication method described in the second aspect embodiment is implemented.
  • the terminal device capability indication method described in the above embodiment of the third aspect is implemented.
  • the thirteenth aspect embodiment of the present application provides a computer program that, when run on a computer, causes the computer to execute the terminal device capability indication method described in the first aspect embodiment.
  • the fourteenth embodiment of the present application provides a computer program that, when run on a computer, causes the computer to execute the terminal device capability indication method described in the embodiment of the second aspect, or perform the method described in the third embodiment. Terminal equipment capability indication method.
  • Embodiments of the present application provide a terminal equipment capability indication method and device, by receiving a capability request message sent by a first core network device through an access network, and sending a capability request message to the first core network device through the access network according to the capability request message.
  • First information the first information includes first indication information and an integrity check code.
  • the first indication information is used to indicate the capability of the terminal device, so that the terminal device can resist sniffing of information sent by the access network to the terminal device. , delete or tamper, safely indicate one's capability information to the home network, protect the security of information interaction between the terminal device and the home network, and improve the security of the system.
  • Figure 1 is a schematic architectural diagram of a communication system provided by an embodiment of the present application.
  • Figure 2 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application
  • Figure 3 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application.
  • Figure 4 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application.
  • Figure 5 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application.
  • Figure 6 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application.
  • Figure 7 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application.
  • Figure 8 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application.
  • Figure 9 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application.
  • Figure 10 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application.
  • Figure 11 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application.
  • Figure 12 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application.
  • Figure 13 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application.
  • Figure 14 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application.
  • Figure 15 is a schematic structural diagram of a terminal equipment capability indicating device provided by an embodiment of the present application.
  • Figure 16 is a schematic structural diagram of a terminal equipment capability indicating device provided by an embodiment of the present application.
  • Figure 17 is a schematic structural diagram of a terminal equipment capability indicating device provided by an embodiment of the present application.
  • Figure 18 is a schematic diagram of a communication system provided by an embodiment of the present application.
  • Figure 19 is a schematic structural diagram of another terminal equipment capability indicating device provided by an embodiment of the present application.
  • Figure 20 is a schematic structural diagram of a chip provided by an embodiment of the present application.
  • first, second, third, etc. may be used to describe various information in the embodiments of this application, the information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other.
  • first information may also be called second information, and similarly, the second information may also be called first information.
  • the words "if” and “if” as used herein may be interpreted as "when” or "when” or “in response to determining.”
  • Figure 1 is a schematic architectural diagram of a communication system provided by an embodiment of the present application.
  • the communication system may include but is not limited to one terminal device and one core network device.
  • the number and form of devices shown in Figure 1 are only for examples and do not constitute a limitation on the embodiments of the present application. In actual applications, two or more devices may be included.
  • the communication system shown in Figure 1 includes a terminal device 101, a first core network device 102 and a second core network device 103 as an example.
  • LTE Long Term Evolution
  • 5G new air interface system 5G new air interface system
  • other future new mobile communication systems 5G new air interface system
  • the terminal device 101 in the embodiment of this application is an entity on the user side that is used to receive or transmit signals, such as a mobile phone.
  • Terminal equipment can also be called terminal equipment (terminal), user equipment (user equipment, UE), mobile station (Mobile Station, MS), mobile terminal equipment (Mobile Terminal, MT), etc.
  • Terminal devices can be cars with communication functions, smart cars, mobile phones, wearable devices, tablets (Pad), computers with wireless transceiver functions, virtual reality (Virtual Reality, VR) terminal devices, augmented reality ( Augmented Reality (AR) terminal equipment, wireless terminal equipment in industrial control (Industrial Control), wireless terminal equipment in self-driving (Self-Driving), wireless terminal equipment in remote surgery (Remote Medical Surgery), smart grid ( Wireless terminal equipment in Smart Grid, wireless terminal equipment in Transportation Safety, wireless terminal equipment in Smart City, wireless terminal equipment in Smart Home, etc.
  • the embodiments of this application do not limit the specific technology and specific equipment form used by the terminal equipment.
  • the first core network device 102 and the second core network device 103 are both core network devices in the home network HPLMN.
  • the first core network device 102 can be Unified Data Management (UDM)
  • the second core network device can be Authentication Server Function (AUSF). It is understandable that there can be other core network equipment in the home network HPLMN, such as Steering of Roaming Application Function (SoR AF) and so on.
  • SoR AF Steering of Roaming Application Function
  • the terminal device 101 may not be covered by the home network HPLMN, and the terminal device 101 may interact with the home network HPLMN through the access network VPLMN. It is understandable that there can also be at least one core network device in the access network VPLMN, such as AMF, user plane function (User Plane Function, UPF), session management function (Session Management Function, SMF), etc.
  • AMF user plane function
  • UPF User Plane Function
  • SMF Session Management Function
  • HPLMN Home Public Land Mobile Network, home public land mobile network
  • VPLMN Vehicle Public Land Mobile Network, access public land mobile network
  • the UE may need to indicate UPU/SoR to the home network before the home network triggers the UPU (UE Parameters Update, UE parameter update)/SoR (Steering of Roaming, roaming guidance) process. ability.
  • UPU UE Parameters Update, UE parameter update
  • SoR Step of Roaming, roaming guidance
  • this capability indication information may be tampered with or deleted by the VPLMN. Therefore, a security mechanism needs to be designed so that the terminal device can safely indicate its UPU/SoR capabilities to the core network device in the home network.
  • Figure 2 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application. It should be noted that the terminal device capability indication method in the embodiment of the present application is executed by the terminal device. This method can be executed independently or in conjunction with any other embodiment of the present application. As shown in Figure 2, the method may include the following steps:
  • Step 201 Receive a capability request message sent by the first core network device through the access network.
  • the terminal device can receive a capability request message sent by the first core network device through the access network.
  • the capability request message is used to request the terminal device to indicate the capabilities of the terminal device to the first core network device.
  • the first core network device may be a unified data management UDM in the home network HPLMN.
  • the terminal device can receive the capability request message sent by the UDM through the AMF in the access network VPLMN.
  • the capability of the terminal device is the UPU/SoR capability of the terminal device, and the UPU/SoR capability of the terminal device can indicate whether the terminal device supports slice-based SoR information.
  • the capability request message includes UPU counter UPU and/or second indication information, where the second indication information is used to indicate the security protection algorithm used by the terminal device.
  • the security protection algorithm includes the integrity protection algorithm and Confidentiality protection algorithm.
  • the capability request message includes UPU counter Counter UPU ;
  • the capability request message includes a UPU counter Counter UPU and second indication information.
  • the UPU counter UPU and the second indication information are both determined by the authentication service function AUSF.
  • UPU counter Counter UPU please refer to 3GPP technical specification TS 33.501.
  • Step 202 Send the first information and/or the identification of the terminal device to the first core network device through the access network according to the capability request message.
  • the terminal device after receiving the capability request message, can send the first information and/or the identification of the terminal device to the first core network device according to the capability request message.
  • the first information can indicate that the Terminal device capabilities.
  • the first information includes first indication information and an integrity check code, and the first indication information is used to indicate the capability of the terminal device.
  • the first indication information is used to indicate the UPU/SoR capability of the terminal device.
  • the first indication information may include at least one of the following information:
  • the parameters of the terminal device update UPU/roaming guidance SoR capability information
  • the location information of the terminal device is the location information of the terminal device.
  • Requested Network Slice Selection Assistance Information (Requested-NSSAI) of the terminal device.
  • the identification of the terminal device may be the user permanent identifier (Subscription Permanent Identifier, SUPI) of the terminal device or the user hidden identifier (Subscription Concealed Identifier, SUCI) of the terminal device.
  • SUPI Subscriber Permanent Identifier
  • SUCI Subscribed Identifier
  • the terminal device may not send the identification of the terminal device to the first core network device, and the first core network device may obtain the SUPI of the terminal device through session parameters.
  • the capability request message received by the terminal device includes UPU counter Counter UPU , and the terminal device can use the security key K AUSF corresponding to the terminal device, the UPU counter Counter UPU in the capability request message, and the first indication. information, using the preset integrity protection algorithm to generate the integrity check code UC-MAC1-I UE , and send the first indication information and the integrity check code UC-MAC1-I to the first core network device. The first information of UE .
  • the capability request message received by the terminal device includes a UPU counter Counter UPU and second indication information.
  • the second indication information only indicates the integrity protection algorithm.
  • the terminal device can generate an integrity check code based on the security key K AUSF corresponding to the terminal device, the UPU counter Counter UPU in the capability request message, and the first indication information, using the integrity protection algorithm indicated by the second indication information.
  • UC-MAC1-I UE and sends the first information including the first indication information and the integrity check code UC-MAC1-I UE to the first core network device.
  • the capability request message received by the terminal device includes the UPU counter Counter UPU and the second indication information
  • the terminal device can adopt the confidentiality indicated by the second indication information according to the security key K AUSF and the UPU counter Counter UPU
  • the protection algorithm encrypts the first indication information to obtain the encrypted first indication information.
  • the integrity protection algorithm indicated by the second indication information is used to generate the integrity check code UC-MAC1-I UE and send it to the third
  • a core network device sends the first information including the encrypted first indication information and the integrity check code UC-MAC1-I UE .
  • the capability request message received by the terminal device includes the UPU counter Counter UPU and the second indication information.
  • the terminal device can use the second indication information according to the security key K AUSF , the UPU counter Counter UPU and the first indication information.
  • the integrity protection algorithm indicated by the indication information generates the integrity check code UC-MAC1-I UE .
  • the confidentiality protection algorithm indicated by the second indication information is used to encrypt the first indication information and the integrity check code UC-MAC1-I UE to obtain the first information , and sends the first information to the first core network device.
  • the terminal device adopts the security mechanism of integrity protection to protect the process of capability indication. If the capability request message received by the terminal device includes a UPU counter and second indication information indicating a security protection algorithm, the terminal device adopts a security mechanism of integrity and confidentiality protection to protect the capability indication process.
  • the terminal device can first use the confidentiality protection algorithm to encrypt the first indication information, and then generate the integrity check code; it can also first generate the integrity check code. integrity check code, and then use the confidentiality protection algorithm to encrypt the generated integrity check code and the first indication information.
  • the first information sent by the terminal device to the first core network device will be forwarded to the second core network device for verification.
  • the second core network device is the authentication service function AUSF.
  • the security key K AUSF corresponding to the terminal device is a key generated by the AUSF in the home network of the terminal device when the terminal device is initially registered.
  • the terminal device and The security key is stored in AUSF, and the security key corresponds to the terminal device.
  • information interaction between the terminal device and the core network device is completed through transparent transmission of the access network device.
  • the The first information includes first indication information and an integrity check code.
  • the first indication information is used to indicate the capability of the terminal device, so that the terminal device can resist sniffing, deletion or tampering of information sent by the access network to the terminal device, Safely indicate one's capability information to the home network, protect the security of information interaction between the terminal device and the home network, and improve the security of the system.
  • Figure 3 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application. It should be noted that the terminal device capability indication method in the embodiment of the present application is executed by the terminal device. This method can be executed independently or in conjunction with any other embodiment of the present application. As shown in Figure 3, the method may include the following steps:
  • Step 301 Receive a capability request message sent by the first core network device of the home network through the access network, where the capability request message includes a UPU counter.
  • the terminal device can receive a capability request message sent by the first core network device through the access network.
  • the capability request message is used to request the terminal device to indicate the capabilities of the terminal device to the first core network device.
  • the capability request message received by the terminal device only includes the UPU counter Counter UPU .
  • the first core network device may be a unified data management UDM in the home network HPLMN.
  • the terminal device can receive the capability request message sent by the UDM through the AMF in the access network VPLMN.
  • UDM may include the capability request message in the Nudm_SDM_Notify message and send it to the AMF
  • the AMF may include the capability request message in the DL NAS TRANSPORT message and send it to the terminal device.
  • the capability request message may be a UPU transparent container, and the UPU transparent container may include the UPU counter Counter UPU .
  • the capability of the terminal device is the UPU/SoR capability of the terminal device, and the UPU/SoR capability of the terminal device can indicate whether the terminal device supports slice-based SoR information.
  • the UPU counter Counter UPU is determined by the authentication service function AUSF.
  • Step 302 Based on the security key K AUSF corresponding to the terminal device, the UPU counter and the first indication information, a preset integrity protection algorithm is used to generate an integrity check code.
  • the capability request message received by the terminal device only includes the UPU counter Counter UPU , and the terminal device adopts the security mechanism of integrity protection.
  • the terminal device can use the preset integrity protection algorithm to generate the integrity check code UC-MAC1-I UE according to the security key K AUSF corresponding to the terminal device, the UPU counter Counter UPU and the first indication information.
  • the first indication information is used to indicate the capability of the terminal device.
  • the first indication information is used to indicate the UPU/SoR capability of the terminal device.
  • the first indication information may include at least one of the following information:
  • the parameters of the terminal device update UPU/roaming guidance SoR capability information
  • the location information of the terminal device is the location information of the terminal device.
  • the requested network slice selection assistance information Requested-NSSAI of the terminal device is the requested network slice selection assistance information Requested-NSSAI of the terminal device.
  • the first indication information may be a UPU ACK transparent container in the NAS UL TRANSPORT message, and the first indication information may also be capability information of the terminal device, which is included in the UPU ACK in a transparent container.
  • a key derivation function can be used to generate the integrity check code UC-MAC1-I UE .
  • the input parameter KEY of the key derivation function KDF of the UE that generates the integrity check code UC-MAC1-I is the security key K AUSF .
  • the input parameter S of the key derivation function KDF can include:
  • Parameter P0 is the first indication information
  • Parameter L0 is the length of the data included in parameter P0, that is, the length of the data of the first indication information
  • Parameter P1 is UPU counter Counter UPU ;
  • Parameter L1 is the length of the UPU counter Counter UPU .
  • the preset integrity protection algorithm may be specified by the protocol or may be indicated by the network side.
  • Step 303 Send first information and/or the identification of the terminal device to the first core network device through the access network, where the first information includes the first indication information and the integrity check code.
  • the terminal device can send the first information to the first core network device through the access network, where the first information includes the first The indication information and the integrity check code UC-MAC1-I UE generated in step 302.
  • the terminal device may include the first information and the identification of the terminal device in a NAS UL TRANSPORT message and send it to the AMF, and the AMF may then include the first information and the identification of the terminal device in a Nudm_SDM_Info message and send it. to UDM.
  • the identification of the terminal device may be the user permanent identifier SUPI of the terminal device or the hidden user identifier SUCI of the terminal device.
  • the first information sent by the terminal device to the UDM of the first core network device will be forwarded to the second core network device for verification.
  • the second core network device is the authentication service function AUSF.
  • the capability request message includes a UPU counter, and according to the security key K AUSF corresponding to the terminal device, the UPU counter and the first indication information, Generate an integrity check code, and send first information to the first core network device through the access network.
  • the first information includes the first indication information and the integrity check code, so that the terminal device can resist the access network to the terminal device. Sniffing, deletion or tampering of sent information, safely indicating one's capability information to the home network, protecting the security of information interaction between the terminal device and the home network, and improving the security of the system.
  • Figure 4 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application. It should be noted that the terminal device capability indication method in the embodiment of the present application is executed by the terminal device. This method can be executed independently or in conjunction with any other embodiment of the present application. As shown in Figure 4, the method may include the following steps:
  • Step 401 Receive a capability request message sent by the first core network device of the home network through the access network, where the capability request message includes a UPU counter and second indication information.
  • the terminal device can receive a capability request message sent by the first core network device through the access network.
  • the capability request message is used to request the terminal device to indicate the capabilities of the terminal device to the first core network device.
  • the capability request message received by the terminal device includes the UPU counter Counter UPU and the second indication information.
  • the second indication information is used to indicate the security protection algorithm used by the terminal device, and the security protection algorithm includes an integrity protection algorithm and a confidentiality protection algorithm.
  • the first core network device may be a unified data management UDM in the home network HPLMN.
  • the terminal device can receive the capability request message sent by the UDM through the AMF in the access network VPLMN.
  • UDM may include the capability request message in the Nudm_SDM_Notify message and send it to the AMF
  • the AMF may include the capability request message in the DL NAS TRANSPORT message and send it to the terminal device.
  • the capability request message may be a UPU transparent container, and the UPU transparent container may include the UPU counter Counter UPU and the second indication information.
  • the capability of the terminal device is the UPU/SoR capability of the terminal device, and the UPU/SoR capability of the terminal device can indicate whether the terminal device supports slice-based SoR information.
  • the UPU counter UPU and the second indication information are both determined by the authentication service function AUSF.
  • AUSF can select security protection algorithms based on its own security capabilities and the security capabilities of the terminal device.
  • Step 402 According to the security key K AUSF corresponding to the terminal device and the UPU counter, the first instruction information is encrypted using the confidentiality protection algorithm indicated by the second instruction information to obtain encrypted first instruction information.
  • the capability request message received by the terminal device includes the UPU counter Counter UPU and the second indication information.
  • the terminal device adopts a security mechanism for integrity and confidentiality protection according to the instructions of the second instruction information.
  • the terminal device can adopt the method of first performing confidentiality protection and then generating the integrity check code, and can use the confidentiality protection algorithm indicated by the second indication information according to the security key K AUSF corresponding to the terminal device and the UPU counter.
  • the first instruction information is encrypted to obtain encrypted first instruction information.
  • the first indication information is used to indicate the capabilities of the terminal device.
  • the first indication information is used to indicate the UPU/SoR capability of the terminal device.
  • the first indication information may include at least one of the following information:
  • the parameters of the terminal device update UPU/roaming guidance SoR capability information
  • the location information of the terminal device is the location information of the terminal device.
  • the requested network slice selection assistance information Requested-NSSAI of the terminal device is the requested network slice selection assistance information Requested-NSSAI of the terminal device.
  • the first indication information may be a UPU response transparent container in the NAS UL TRANSPORT message, and the first indication information may also be capability information of the terminal device, which is included in the UPU ACK transparent container.
  • the input parameters of the confidentiality protection algorithm may be:
  • the parameter KEY (key) is the security key K AUSF ;
  • the parameter COUNT (counter) is the UPU counter Counter UPU ;
  • the parameter BEARER (bearer) is 0x00;
  • Parameter DIRECTION (direction) is 0x00;
  • LEN first indication information
  • LEN(x) represents the length of x (expressed in digits).
  • the confidentiality protection algorithm may be selected and determined by the AUSF based on its own security capabilities and the security capabilities of the terminal device, and may be indicated to the terminal device through the second instruction information.
  • Step 403 According to the security key K AUSF , the UPU counter and the encrypted first indication information, the integrity protection algorithm indicated by the second indication information is used to generate an integrity check code.
  • the terminal device can use the security key K AUSF , the UPU counter Counter UPU and the encrypted first
  • the indication information uses the integrity protection algorithm indicated by the second indication information to generate the integrity check code UC-MAC1-I UE .
  • the key derivation function KDF can be used to generate the integrity check code UC-MAC1-I UE .
  • the input parameter KEY of the key derivation function KDF of the UE that generates the integrity check code UC-MAC1-I is the security key K AUSF .
  • the input parameter S of the key derivation function KDF can include:
  • Parameter P0 is the encrypted first indication information
  • Parameter L0 is the length of the data included in parameter P0, which is the length of the data of the encrypted first indication information
  • Parameter P1 is UPU counter Counter UPU ;
  • Parameter L1 is the length of the UPU counter Counter UPU .
  • Step 404 Send first information and/or the identification of the terminal device to the first core network device through the access network, where the first information includes the encrypted first indication information and the integrity check code.
  • the terminal device can send the first information to the first core network device through the access network, where the first information includes the information in step 402
  • the terminal device may include the first information and the identification of the terminal device in a NAS UL TRANSPORT message and send it to the AMF, and the AMF may then include the first information and the identification of the terminal device in a Nudm_SDM_Info message and send it. to UDM.
  • the identification of the terminal device may be the SUPI of the terminal device or the SUCI of the terminal device.
  • the first information sent by the terminal device to the UDM of the first core network device will be forwarded to the second core network device for verification.
  • the second core network device is the authentication service function AUSF.
  • the capability request message includes the UPU counter and the second indication information, according to the security key K AUSF corresponding to the terminal device and the UPU counter , using the confidentiality protection algorithm indicated by the second indication information, to encrypt the first indication information to obtain the encrypted first indication information.
  • the security key K AUSF the UPU counter and the encrypted first indication information, Generate an integrity check code, and send first information to the first core network device through the access network.
  • the first information includes the encrypted first indication information and the integrity check code, so that the terminal device can resist access to the network. Sniff, delete or tamper with the information sent by the terminal device, safely indicate its capability information to the home network, protect the security of information interaction between the terminal device and the home network, and improve the security of the system.
  • Figure 5 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application. It should be noted that the terminal device capability indication method in the embodiment of the present application is executed by the terminal device. This method can be executed independently or in conjunction with any other embodiment of the present application. As shown in Figure 5, the method may include the following steps:
  • Step 501 Receive a capability request message sent by the first core network device of the home network through the access network.
  • the capability request message includes a UPU counter and second indication information.
  • the terminal device can receive a capability request message sent by the first core network device through the access network.
  • the capability request message is used to request the terminal device to indicate the capabilities of the terminal device to the first core network device.
  • the capability request message received by the terminal device includes the UPU counter Counter UPU and the second indication information.
  • the second indication information is used to indicate the security protection algorithm used by the terminal device, and the security protection algorithm includes an integrity protection algorithm and a confidentiality protection algorithm.
  • the first core network device may be a unified data management UDM in the home network HPLMN.
  • the terminal device can receive the capability request message sent by the UDM through the AMF in the access network VPLMN.
  • UDM may include the capability request message in the Nudm_SDM_Notify message and send it to the AMF
  • the AMF may include the capability request message in the DL NAS TRANSPORT message and send it to the terminal device.
  • the capability request message may be a UPU transparent container, and the UPU transparent container may include the UPU counter Counter UPU and the second indication information.
  • the capability of the terminal device is the UPU/SoR capability of the terminal device, and the UPU/SoR capability of the terminal device can indicate whether the terminal device supports slice-based SoR information.
  • the UPU counter UPU and the second indication information are both determined by the authentication service function AUSF.
  • AUSF can select security protection algorithms based on its own security capabilities and the security capabilities of the terminal device.
  • Step 502 Based on the security key K AUSF corresponding to the terminal device, the UPU counter and the first indication information, use the integrity protection algorithm indicated by the second indication information to generate an integrity check code.
  • the capability request message received by the terminal device includes the UPU counter Counter UPU and the second indication information.
  • the terminal device adopts a security mechanism for integrity and confidentiality protection according to the instructions of the second instruction information.
  • the terminal device can first generate an integrity check code and then perform confidentiality protection, and can generate an integrity check code UC- based on the security key K AUSF corresponding to the terminal device, the UPU counter, and the first indication information.
  • MAC1- IUE MAC1- IUE .
  • the first indication information is used to indicate the capabilities of the terminal device.
  • the first indication information is used to indicate the UPU/SoR capability of the terminal device.
  • the first indication information may include at least one of the following information:
  • the parameters of the terminal device update UPU/roaming guidance SoR capability information
  • the location information of the terminal device is the location information of the terminal device.
  • the requested network slice selection assistance information Requested-NSSAI of the terminal device is the requested network slice selection assistance information Requested-NSSAI of the terminal device.
  • the first indication information may be a UPU response transparent container in the NAS UL TRANSPORT message, and the first indication information may also be capability information of the terminal device, which is included in the UPU ACK transparent container.
  • the key derivation function KDF can be used to generate the integrity check code UC-MAC1-I UE .
  • the input parameter KEY of the key derivation function KDF of the UE that generates the integrity check code UC-MAC1-I is the security key K AUSF .
  • the input parameter S of the key derivation function KDF can include:
  • Parameter P0 is the first indication information
  • Parameter L0 is the length of the data included in parameter P0, that is, the length of the data of the first indication information
  • Parameter P1 is UPU counter Counter UPU ;
  • Parameter L1 is the length of the UPU counter Counter UPU .
  • Step 503 According to the security key K AUSF and the UPU counter, the confidentiality protection algorithm indicated by the second indication information is used to encrypt the first indication information and the integrity check code to obtain the first information.
  • the terminal device after generating the integrity check code UC-MAC1-I UE , the terminal device can use the confidentiality protection algorithm indicated by the second indication information to compare the first indication information and the integrity check code.
  • the code verification UC-MAC1-I UE performs encryption and obtains the first information.
  • the input parameters of the confidentiality protection algorithm may be:
  • the parameter KEY (key) is the security key K AUSF ;
  • the parameter COUNT (counter) is the UPU counter Counter UPU ;
  • the parameter BEARER (bearer) is 0x00;
  • Parameter DIRECTION (direction) is 0x00;
  • LEN first indication information + integrity check code UC-MAC1-I UE
  • LEN(x) represents the length of x (expressed in digits).
  • the confidentiality protection algorithm may be selected and determined by the AUSF based on its own security capabilities and the security capabilities of the terminal device, and may be indicated to the terminal device through the second instruction information.
  • Step 504 Send the first information and/or the identification of the terminal device to the first core network device through the access network.
  • the terminal device can send the first information and the identification of the terminal device to the first core network device through the access network, where the first information is the first indication information and the generated in step 502.
  • the integrity check code UC-MAC1-I is obtained by encrypting the UE .
  • the terminal device may include the first information and the identification of the terminal device in a NAS UL TRANSPORT message and send it to the AMF, and the AMF may then include the first information and the identification of the terminal device in a Nudm_SDM_Info message and send it. to UDM.
  • the identification of the terminal device may be the SUPI of the terminal device or the SUCI of the terminal device.
  • the first information sent by the terminal device to the UDM of the first core network device will be forwarded to the second core network device for verification.
  • the second core network device is the authentication service function AUSF.
  • the capability request message includes the UPU counter and the second indication information.
  • the security key K AUSF corresponding to the terminal device
  • the UPU counter and the encrypted first indication information generate an integrity check code
  • the check code is encrypted to obtain the first information
  • the first information is sent to the first core network device through the access network, so that the terminal device can resist the sniffing, deletion or tampering of the information sent by the terminal device by the access network, and safely Indicates its own capability information to the home network, protects the security of information interaction between the terminal device and the home network, and improves system security.
  • FIG. 6 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application. It should be noted that the terminal device capability indication method in the embodiment of the present application is executed by the first core network device. This method can be executed independently or in conjunction with any other embodiment of the present application. As shown in Figure 6, the method may include the following steps:
  • Step 601 Send a capability request message to the terminal device through the access network.
  • the capability request message is used to request the terminal device to indicate the capabilities of the terminal device.
  • the first core network device can send a capability request message to the terminal device through the access network VPLMN. After receiving the capability request message, the terminal device can return the capabilities of the terminal device to the first core network device.
  • the first core network device may be a unified data management UDM in the home network HPLMN.
  • the UDM can send a capability request message to the terminal device through the AMF in the access network VPLMN.
  • the capability of the terminal device is the UPU/SoR capability of the terminal device, and the UPU/SoR capability of the terminal device can indicate whether the terminal device supports slice-based SoR information.
  • the first core network device can receive the UPU counter Counter UPU and/or the second indication information sent by the second core network device, and the capability request message sent by the first core network device to the terminal device includes the UPU counter Counter UPU and/or second indication information, where the second indication information is used to indicate the security protection algorithm used by the terminal device.
  • the security protection algorithm includes an integrity protection algorithm and a confidentiality protection algorithm.
  • the first core network device can receive the UPU counter Counter UPU sent by the second core network device, and the capability request message includes the UPU counter Counter UPU ;
  • the first core network device can receive the UPU counter Counter UPU and the second indication information sent by the second core network device, and the capability request message includes the UPU counter Counter UPU and the second indication information.
  • the second core network device may be the authentication service function AUSF in the home network HPLMN.
  • the UPU counter UPU and the second indication information are both determined by AUSF.
  • UPU counter Counter UPU please refer to 3GPP technical specification TS 33.501.
  • the first core network device UDM that decides to obtain the capability of the terminal device to determine whether the terminal device supports slice-based SoR information.
  • the UDM can determine to trigger the acquisition of the UPU/SoR of the terminal device based on, for example, local configuration, the location of the terminal device in a specific Public Land Mobile Network (PLMN), or the indication information sent by the SoR AF to the UDM. ability.
  • PLMN Public Land Mobile Network
  • Step 602 Receive the first information and/or the identification of the terminal device sent by the terminal device through the access network.
  • the first core network device may receive the first information returned by the terminal device through the access network.
  • the first information includes first indication information and an integrity check code, and the first indication information is used to indicate the capability of the terminal device.
  • the first indication information may include at least one of the following information:
  • the parameters of the terminal device update UPU/roaming guidance SoR capability information
  • the location information of the terminal device is the location information of the terminal device.
  • the requested network slice selection assistance information Requested-NSSAI of the terminal device is the requested network slice selection assistance information Requested-NSSAI of the terminal device.
  • the received identification of the terminal device may be the SUPI or SUCI of the terminal device.
  • the first core network device may receive the SUPI or SUCI sent by the terminal device, or may obtain the SUPI of the terminal device from the session parameters, and then send it to the second core network device.
  • the first information received by the first core network device includes first indication information and an integrity check code; wherein, the integrity check The code is generated using a preset integrity protection algorithm based on the security key K AUSF corresponding to the terminal device, the UPU counter Counter UPU and the first indication information.
  • the terminal device in response to the capability request message including the UPU counter Counter UPU and the second indication information, the second indication information only indicates the integrity protection algorithm, the terminal device can use the security key K AUSF corresponding to the terminal device. , the UPU counter Counter UPU in the capability request message, and the first indication information, use the integrity protection algorithm indicated by the second indication information to generate the integrity check code UC-MAC1-I UE and send it to the first core network The device sends the first information including the first indication information and the integrity check code UC-MAC1-I UE .
  • the first information received by the first core network device includes the encrypted first indication information and the integrity check code.
  • the encrypted first instruction information is based on the security key K AUSF corresponding to the terminal device and the UPU counter Counter UPU
  • the confidentiality protection algorithm indicated by the second instruction information is used to perform the first instruction information.
  • the integrity check code is generated based on the security key K AUSF , the UPU counter Counter UPU and the encrypted first indication information, using the integrity protection algorithm indicated by the second indication information.
  • the first information received by the first core network device is, according to the security key K AUSF , the UPU counter Counter UPU is obtained by encrypting the first indication information and the integrity check code using the confidentiality protection algorithm indicated by the second indication information; the integrity check code is based on the security key K AUSF and the UPU counter
  • the Counter UPU and the first indication information are generated using the integrity protection algorithm indicated by the second indication information.
  • the first core network device can send the first information and the identification of the terminal device to the second core network device, so that the second core network device can check the integrity of the terminal device according to the integrity check code in the first information. Verify whether the first information has been tampered with.
  • the identifier of the terminal device is the SUPI of the terminal device.
  • the first core network device can also receive the first indication information sent by the second core network device after verification, and can determine the capabilities of the terminal device based on the first indication information, and determine whether the terminal device supports based on Slice SoR information.
  • the first core network device after acquiring the capabilities of the terminal device, can request SoR AF for network slice-based SoR information and so on based on the capabilities of the terminal device.
  • the capability request message is used to request the terminal device to indicate the capabilities of the terminal device, and receiving the first information sent by the terminal device through the access network, so that the terminal device can It resists the sniffing, deletion or tampering of information sent by the terminal device by the access network, safely indicates its capability information to the home network, protects the security of information interaction between the terminal device and the home network, and improves the security of the system.
  • Figure 7 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application. It should be noted that the terminal device capability indication method in the embodiment of the present application is executed by the first core network device. This method can be executed independently or in conjunction with any other embodiment of the present application. As shown in Figure 7, the method may include the following steps:
  • Step 701 Receive the UPU counter Counter UPU and/or the second indication information sent by the second core network device.
  • the first core network device can receive the UPU counter Counter UPU and/or the second indication information sent by the second core network device, where the second indication information is used to indicate the security protection algorithm used by the terminal device,
  • the security protection algorithm includes an integrity protection algorithm and a confidentiality protection algorithm.
  • the first core network device may be the unified data management UDM in the home network HPLMN
  • the second core network device may be the authentication service function AUSF in the HPLMN.
  • the first core network device can receive the UPU counter Counter UPU sent by the second core network device;
  • the first core network device can receive the UPU counter Counter UPU and the second indication information sent by the second core network device.
  • the UPU counter UPU and the second indication information are both determined by AUSF.
  • UPU counter Counter UPU please refer to 3GPP technical specification TS 33.501.
  • Step 702 Send a capability request message to the terminal device through the access network, where the capability request message is used to request the terminal device to indicate the capabilities of the terminal device.
  • the first core network device can send a capability request message to the terminal device through the access network VPLMN. After receiving the capability request message, the terminal device can return the capabilities of the terminal device to the first core network device.
  • the UDM sends a capability request message to the terminal device through the AMF in the access network VPLMN.
  • UDM may include the capability request message in the Nudm_SDM_Notify message and send it to the AMF
  • the AMF may include the capability request message in the DL NAS TRANSPORT message and send it to the terminal device.
  • the capability of the terminal device is the UPU/SoR capability of the terminal device, and the UPU/SoR capability of the terminal device can indicate whether the terminal device supports slice-based SoR information.
  • the first core network device can receive the UPU counter Counter UPU sent by the second core network device, and the capability request message sent to the terminal device includes the UPU counter Counter UPU ;
  • the first core network device can receive the UPU counter Counter UPU and the second indication information sent by the second core network device, and the capability request message sent to the terminal device includes the UPU counter Counter UPU and the second indication. information.
  • the capability request message may be a UPU transparent container, and the UPU transparent container may include the UPU counter Counter UPU and/or the second indication information.
  • Step 703 Receive the first information and/or the identification of the terminal device sent by the terminal device through the access network.
  • the first core network device may receive the first information returned by the terminal device through the access network.
  • the first information includes first indication information and an integrity check code, and the first indication information is used to indicate the capability of the terminal device.
  • the first indication information may include at least one of the following information:
  • the parameters of the terminal device update UPU/roaming guidance SoR capability information
  • the location information of the terminal device is the location information of the terminal device.
  • the requested network slice selection assistance information Requested-NSSAI of the terminal device is the requested network slice selection assistance information Requested-NSSAI of the terminal device.
  • the first information received by the first core network device includes first indication information and an integrity check code; wherein, the integrity check The code is generated using a preset integrity protection algorithm based on the security key K AUSF corresponding to the terminal device, the UPU counter Counter UPU and the first indication information.
  • the first information received by the first core network device includes the encrypted first indication information and the integrity check code.
  • the encrypted first instruction information is based on the security key K AUSF corresponding to the terminal device and the UPU counter Counter UPU
  • the confidentiality protection algorithm indicated by the second instruction information is used to perform the first instruction information.
  • the integrity check code is generated based on the security key K AUSF , the UPU counter Counter UPU and the encrypted first indication information, using the integrity protection algorithm indicated by the second indication information.
  • the first information received by the first core network device is, according to the security key K AUSF , the UPU counter Counter UPU is obtained by encrypting the first indication information and the integrity check code using the confidentiality protection algorithm indicated by the second indication information; the integrity check code is based on the security key K AUSF and the UPU counter
  • the Counter UPU and the first indication information are generated using the integrity protection algorithm indicated by the second indication information.
  • the terminal device may include the first information and the identification of the terminal device in a NAS UL TRANSPORT message and send it to the AMF, and the AMF may then include the first information and the identification of the terminal device in a Nudm_SDM_Info message and send it. to UDM.
  • the identification of the terminal device may be the SUPI of the terminal device or the SUCI of the terminal device.
  • Step 704 Send the first information and the identification of the terminal device to the second core network device.
  • the first core network device can send the first information and the identification of the terminal device to the second core network device.
  • the integrity check code in the first information is used by the second core network device to verify whether the first information has been tampered with.
  • the identifier of the terminal device is SUPI.
  • the first core network device directly sends the SUPI of the terminal device to the second core network device. If the first core network device obtains The identification of the received terminal device is SUCI, and the first core network device will decrypt the SUPI of the terminal device according to the SUCI, and send the SUPI to the second core network device.
  • the first core network device can also receive the first indication information sent by the second core network device after verification, and can determine the capabilities of the terminal device based on the first indication information, and determine whether the terminal device supports based on Slice SoR information.
  • the first core network device after acquiring the capabilities of the terminal device, can request SoR AF for network slice-based SoR information and so on based on the capabilities of the terminal device.
  • a capability request message is sent to the terminal device through the access network.
  • the capability request message is used to request the terminal device to indicate the terminal device's Ability to receive the first information sent by the terminal device through the access network, and send the first information to the second core network device, so that the terminal device can resist sniffing, deletion or tampering of the information sent by the terminal device by the access network, Safely indicate one's capability information to the home network, protect the security of information interaction between the terminal device and the home network, and improve the security of the system.
  • FIG. 8 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application. It should be noted that the terminal device capability indication method in the embodiment of the present application is executed by the second core network device. This method can be executed independently or in conjunction with any other embodiment of the present application. As shown in Figure 8, the method may include the following steps:
  • Step 801 Receive the first information and the identification of the terminal device sent by the first core network device.
  • the first information includes first indication information and an integrity check code, and the first indication information is used to indicate the capability of the terminal device.
  • the second core network device can receive the first information and the terminal device identification sent by the first core network device, and can verify whether the first information is based on the integrity check code included in the first information. been tampered with.
  • the first core network device may be the unified data management UDM in the home network HPLMN
  • the second core network device may be the authentication service function AUSF in the HPLMN.
  • the first indication information is used to indicate the UPU/SoR capability of the terminal device.
  • the first indication information may include at least one of the following information:
  • the parameters of the terminal device update UPU/roaming guidance SoR capability information
  • the location information of the terminal device is the location information of the terminal device.
  • the requested network slice selection assistance information Requested-NSSAI of the terminal device is the requested network slice selection assistance information Requested-NSSAI of the terminal device.
  • the second core network device can send the UPU counter and/or second indication information to the first core network device, where the second indication information is used to indicate the security protection algorithm used by the terminal device.
  • the security protection Algorithms include integrity protection algorithms and confidentiality protection algorithms.
  • the second core network device can send the UPU counter Counter UPU to the first core network device
  • the second core network device can send the UPU counter Counter UPU and the second indication information to the first core network device.
  • the security protection algorithm indicated by the second indication information may be selected and determined by the second core network device based on its own security capabilities and the security capabilities of the terminal device, and may be indicated to the terminal device through the second indication information. .
  • the second core network device receives the identification of the terminal device sent by the first core network device, and can determine the security key K AUSF stored in itself corresponding to the terminal device based on the identification of the terminal device. .
  • the identifier of the terminal device is SUPI.
  • the second core network device in response to the received first information including the first indication information and the integrity check code, can determine, based on the identification of the terminal device, that the information stored in the second core network device is the same as that of the terminal device.
  • the security key K AUSF corresponding to the terminal device then based on the security key K AUSF , the UPU counter Counter UPU and the first indication information in the first information, a preset integrity protection algorithm is used to generate a new integrity check Verify the code; determine the consistency of the new integrity check code with the integrity check code in the first information.
  • the capability indication process of the terminal device is terminated.
  • the second core network device in response to the received first information including the encrypted first indication information and the integrity check code, can determine, according to the identification of the terminal device, the second core network device.
  • the protection algorithm generates a new integrity check code; and determines the consistency of the new integrity check code with the integrity check code in the first information.
  • the new integrity check code is consistent with the integrity check code in the first information, send first indication information to the first core network device; wherein the first indication information is, according to the security key K AUSF and the UPU counter Counter UPU , obtained by decrypting the encrypted first indication information in the first information using the confidentiality protection algorithm indicated by the second indication information;
  • the capability indication process of the terminal device is terminated.
  • the second core network device determines, according to the identification of the terminal device, the second core network device.
  • the stored security key K AUSF corresponding to the terminal device and then decrypt the received first information according to the confidentiality protection algorithm indicated by the second instruction information to obtain the first instruction information and the Integrity check code; according to the security key K AUSF , UPU counter Counter UPU and the decrypted first indication information, use the integrity protection algorithm indicated by the second indication information to generate a new integrity check code ; Determine the consistency of the new integrity check code with the integrity check code in the first information.
  • the capability indication process of the terminal device is terminated.
  • the terminal device by receiving the first information sent by the first core network device and the identification of the terminal device, it is possible to verify whether the first information has been tampered through the integrity check code in the first information, so that the terminal device can resist access to the network Sniff, delete or tamper with the information sent by the terminal device, safely indicate its capability information to the home network, protect the security of information interaction between the terminal device and the home network, and improve the security of the system.
  • Figure 9 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application. It should be noted that the terminal device capability indication method in the embodiment of the present application is executed by the second core network device. This method can be executed independently or in conjunction with any other embodiment of the present application. As shown in Figure 9, the method may include the following steps:
  • Step 901 Receive first information and the identification of the terminal device sent by the first core network device.
  • the first information includes first indication information and an integrity check code.
  • the second core network device can receive the first information and the identification of the terminal device sent by the first core network device, where the first information includes the first indication information and the integrity check code, and the third An indication information is used to indicate the capabilities of the terminal device.
  • the first core network device may be the unified data management UDM in the home network HPLMN
  • the second core network device may be the authentication service function AUSF in the HPLMN.
  • the first indication information is used to indicate the UPU/SoR capability of the terminal device.
  • the first indication information may include at least one of the following information:
  • the parameters of the terminal device update UPU/roaming guidance SoR capability information
  • the location information of the terminal device is the location information of the terminal device.
  • the requested network slice selection assistance information Requested-NSSAI of the terminal device is the requested network slice selection assistance information Requested-NSSAI of the terminal device.
  • the first indication information may be a UPU ACK transparent container, and the first indication information may also be capability information of the terminal device, which is included in the UPU ACK transparent container.
  • the identifier of the terminal device is SUPI.
  • the second core network device after receiving the first information, can determine whether the first information is encrypted. If the first information is unencrypted, and the first information in the first information is If the indication information is not encrypted, it is determined that the terminal device adopts an integrity protection security mechanism.
  • Step 902 Determine the security key K AUSF stored in the second core network device corresponding to the terminal device based on the identification of the terminal device.
  • the second core network device AUSF can determine the security key K AUSF stored in itself and corresponding to the terminal device according to the identification of the terminal device.
  • the identifier of the terminal device is SUPI.
  • Step 903 Use a preset integrity protection algorithm to generate a new integrity check code based on the security key K AUSF , the UPU counter Counter UPU and the first indication information in the first information.
  • the UPU counter is determined by the second core network device and sent to the terminal device for security protection.
  • the key derivation function KDF may be used to generate the new integrity check code.
  • the input parameter KEY of the key derivation function KDF that generates the new integrity check code is the security key K AUSF .
  • the input parameter S of the key derivation function KDF can include:
  • Parameter P0 is the first indication information
  • Parameter L0 is the length of the data included in parameter P0, that is, the length of the data of the first indication information
  • Parameter P1 is UPU counter Counter UPU ;
  • Parameter L1 is the length of the UPU counter Counter UPU .
  • UPU counter Counter UPU please refer to 3GPP technical specification TS 33.501.
  • the preset integrity protection algorithm may be specified by the protocol or may be indicated by the network side.
  • Step 904 Determine the consistency between the new integrity check code and the integrity check code in the first information.
  • the second core network device after the second core network device generates the new integrity check code, it can determine whether the new integrity check code generated by itself is consistent with the integrity check code in the received first information. Whether the codes are consistent. If they are consistent, step 905 is executed; if they are inconsistent, step 906 is executed.
  • Step 905 In response to the new integrity check code being consistent with the integrity check code in the first information, send the first indication information to the first core network device.
  • the new integrity check code generated by the second core network device is consistent with the integrity check code in the received first information, it means that the first information has not been tampered with. is safe.
  • the second core network device can send the first indication information in the first information to the first core network device.
  • the first core network device can obtain the capabilities of the terminal device according to the first indication information.
  • Step 906 In response to the new integrity check code being inconsistent with the integrity check code in the first information, terminate the capability indication process of the terminal device.
  • the second core network device can terminate the capability indication process of the terminal device.
  • the first information includes the first indication information and the integrity check code
  • the second core network device is determined according to the identification of the terminal device.
  • the security key K AUSF corresponding to the terminal device stored in The consistency of the new integrity check code and the integrity check code in the first information, in response to the consistency of the new integrity check code and the integrity check code in the first information, reporting to the first core network
  • the device sends the first indication information, and in response to the new integrity check code being inconsistent with the integrity check code in the first information, terminates the indication process of the terminal device's capabilities, so that the terminal device can resist access to the network to the terminal. Sniff, delete or tamper with the information sent by the device, safely indicate its capability information to the home network, protect the security of information interaction between the terminal device and the home network, and improve the security of the system.
  • Figure 10 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application. It should be noted that the terminal device capability indication method in the embodiment of the present application is executed by the second core network device. This method can be executed independently or in conjunction with any other embodiment of the present application. As shown in Figure 9, the method may include the following steps:
  • Step 1001 Receive first information and the identification of the terminal device sent by the first core network device.
  • the first information includes encrypted first indication information and an integrity check code.
  • the second core network device can receive the first information and the identification of the terminal device sent by the first core network device, where the first information includes the encrypted first indication information and the integrity check code,
  • the first indication information is used to indicate the capabilities of the terminal device.
  • the encrypted first indication information is obtained by the terminal device encrypting the first indication information using the confidentiality protection algorithm indicated by the second indication information according to the security key and the UPU counter.
  • the first core network device may be the unified data management UDM in the home network HPLMN
  • the second core network device may be the authentication service function AUSF in the HPLMN.
  • the first indication information is used to indicate the UPU/SoR capability of the terminal device.
  • the first indication information may include at least one of the following information:
  • the parameters of the terminal device update UPU/roaming guidance SoR capability information
  • the location information of the terminal device is the location information of the terminal device.
  • the requested network slice selection assistance information Requested-NSSAI of the terminal device is the requested network slice selection assistance information Requested-NSSAI of the terminal device.
  • the first indication information may be a UPU ACK transparent container, and the first indication information may also be capability information of the terminal device, which is included in the UPU ACK transparent container.
  • the identifier of the terminal device is SUPI.
  • the second core network device after receiving the first information, can determine whether the first information is encrypted. If the first information is unencrypted, and the first information in the first information is If the indication information is encrypted, it is determined that the terminal device adopts a security mechanism for integrity and confidentiality protection.
  • Step 1002 Determine the security key K AUSF stored in the second core network device corresponding to the terminal device based on the identification of the terminal device.
  • the second core network device AUSF can determine the security key K AUSF stored in itself and corresponding to the terminal device according to the identification of the terminal device.
  • the identifier of the terminal device is SUPI.
  • Step 1003 Based on the security key K AUSF , UPU counter Counter UPU and the encrypted first indication information in the first information, use the integrity protection algorithm indicated by the second indication information to generate a new integrity check code.
  • the UPU counter is determined by the second core network device and sent to the terminal device for security protection.
  • the key derivation function KDF may be used to generate the new integrity check code.
  • the input parameter KEY of the key derivation function KDF that generates the new integrity check code is the security key K AUSF .
  • the input parameter S of the key derivation function KDF can include:
  • Parameter P0 is the encrypted first indication information
  • Parameter L0 is the length of the data included in parameter P0, which is the length of the data of the encrypted first indication information
  • Parameter P1 is UPU counter Counter UPU ;
  • Parameter L1 is the length of the UPU counter Counter UPU .
  • UPU counter Counter UPU please refer to 3GPP technical specification TS 33.501.
  • Step 1004 Determine the consistency between the new integrity check code and the integrity check code in the first information.
  • the second core network device after the second core network device generates the new integrity check code, it can determine whether the new integrity check code generated by itself is consistent with the integrity check code in the received first information. Whether the codes are consistent. If they are consistent, step 1005 is executed; if they are inconsistent, step 1006 is executed.
  • Step 1005 In response to the new integrity check code being consistent with the integrity check code in the first information, send the first indication information to the first core network device.
  • the first instruction information is to use the confidentiality protection algorithm indicated by the second instruction information to decrypt the encrypted first instruction information in the first information according to the security key K AUSF and the UPU counter Counter UPU owned.
  • the confidentiality protection algorithm may be selected and determined by the AUSF based on its own security capabilities and the security capabilities of the terminal device, and may be indicated to the terminal device through the second instruction information.
  • the confidentiality protection algorithm can refer to the algorithm described in Annex D.1 of 3GPP Technical Specification TS 33.501; for the use and operation mode of the confidentiality protection algorithm, please refer to Annex D.2 of 3GPP Technical Specification TS 33.501. Provisions.
  • the new integrity check code generated by the second core network device is consistent with the integrity check code in the received first information, it means that the first information has not been tampered with. is safe.
  • the second core network device can send the first indication information in the first information to the first core network device.
  • the first core network device can obtain the capabilities of the terminal device according to the first indication information.
  • Step 1006 In response to the new integrity check code being inconsistent with the integrity check code in the first information, terminate the capability indication process of the terminal device.
  • the second core network device can terminate the capability indication process of the terminal device.
  • the first information includes the encrypted first indication information and the integrity check code
  • the second core is determined based on the identification of the terminal device.
  • a new integrity check is generated based on the security key K AUSF stored in the network device and corresponding to the terminal device, the UPU counter Counter UPU and the encrypted first indication information in the first information.
  • the first core network device sends the first indication information, and in response to the new integrity check code being inconsistent with the integrity check code in the first information, terminates the capability indication process of the terminal device, so that the terminal device can resist
  • the access network can sniff, delete or tamper with the information sent by the terminal device, safely indicate its capability information to the home network, protect the security of information interaction between the terminal device and the home network, and improve the security of the system.
  • Figure 11 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application. It should be noted that the terminal device capability indication method in the embodiment of the present application is executed by the second core network device. This method can be executed independently or in conjunction with any other embodiment of the present application. As shown in Figure 9, the method may include the following steps:
  • Step 1101 Receive first information and the identification of the terminal device sent by the first core network device.
  • the first information is obtained by encrypting the first indication information and the integrity check code.
  • the second core network device can receive the first information and the identification of the terminal device sent by the first core network device, where the first information encrypts the first indication information and the integrity check code to obtain , the first indication information is used to indicate the capability of the terminal device.
  • the first indication information is obtained by the terminal device encrypting the first indication information and the integrity check code using the confidentiality protection algorithm indicated by the second indication information according to the security key and the UPU counter.
  • the confidentiality protection algorithm may be selected and determined by the AUSF based on its own security capabilities and the security capabilities of the terminal device, and may be indicated to the terminal device through the second instruction information.
  • the confidentiality protection algorithm can refer to the algorithm described in Annex D.1 of 3GPP Technical Specification TS 33.501; for the use and operation mode of the confidentiality protection algorithm, please refer to Annex D.2 of 3GPP Technical Specification TS 33.501. Provisions.
  • the first core network device may be the unified data management UDM in the home network HPLMN
  • the second core network device may be the authentication service function AUSF in the HPLMN.
  • the first indication information is used to indicate the UPU/SoR capability of the terminal device.
  • the first indication information may include at least one of the following information:
  • the parameters of the terminal device update UPU/roaming guidance SoR capability information
  • the location information of the terminal device is the location information of the terminal device.
  • the requested network slice selection assistance information Requested-NSSAI of the terminal device is the requested network slice selection assistance information Requested-NSSAI of the terminal device.
  • the first indication information may be a UPU ACK transparent container, and the first indication information may also be capability information of the terminal device, which is included in the UPU ACK transparent container.
  • the identifier of the terminal device is SUPI.
  • the second core network device after receiving the first information, the second core network device can determine whether the first information is encrypted. If the first information is encrypted, it is determined that the terminal device adopts integrity and Security mechanism for confidentiality protection.
  • Step 1102 Determine the security key K AUSF stored in the second core network device corresponding to the terminal device based on the identification of the terminal device.
  • the second core network device AUSF can determine the security key K AUSF stored in itself and corresponding to the terminal device according to the identification of the terminal device.
  • the identifier of the terminal device is SUPI.
  • Step 1103 Decrypt the received first information according to the confidentiality protection algorithm indicated by the second instruction information to obtain the first instruction information and the integrity check code in the first information.
  • the first information received by the second core network device is encrypted, and the second core network device can adopt a confidentiality protection algorithm determined by itself and indicated to the terminal device through the second instruction information.
  • the security key K AUSF and the UPU counter Counter UPU decrypt the first information and obtain the first indication information and the integrity check code in the first information.
  • Step 1104 Based on the security key K AUSF , UPU counter Counter UPU and the first indication information in the first information, use the integrity protection algorithm indicated by the second indication information to generate a new integrity check code.
  • the UPU counter is determined by the second core network device and sent to the terminal device for security protection.
  • the second core network device decrypts the received first information to obtain the first indication information and the integrity check code in the first information, it can based on the decrypted first information.
  • the first indication information, the security key K AUSF and the UPU counter Counter UPU use the integrity protection algorithm indicated by the second indication information to generate a new integrity check code.
  • the key derivation function KDF may be used to generate the new integrity check code.
  • the input parameter KEY of the key derivation function KDF that generates the new integrity check code is the security key K AUSF .
  • the input parameter S of the key derivation function KDF can include:
  • Parameter P0 is the first indication information
  • Parameter L0 is the length of the data included in parameter P0, that is, the length of the data of the first indication information
  • Parameter P1 is UPU counter Counter UPU ;
  • Parameter L1 is the length of the UPU counter Counter UPU .
  • UPU counter Counter UPU please refer to 3GPP technical specification TS 33.501.
  • Step 1105 Determine the consistency between the new integrity check code and the integrity check code in the first information.
  • the second core network device after the second core network device generates the new integrity check code, it can determine whether the new integrity check code generated by itself is consistent with the integrity check code in the received first information. Whether the codes are consistent. If they are consistent, step 1106 is executed; if they are inconsistent, step 1107 is executed.
  • Step 1106 In response to the new integrity check code being consistent with the integrity check code in the first information, send the first indication information to the first core network device.
  • the new integrity check code generated by the second core network device is consistent with the integrity check code in the decrypted first information, it means that the first information has not been tampered with. is safe.
  • the second core network device can send the first indication information in the first information to the first core network device.
  • the first core network device can obtain the capabilities of the terminal device according to the first indication information.
  • Step 1107 In response to the new integrity check code being inconsistent with the integrity check code in the first information, terminate the capability indication process of the terminal device.
  • the second core network device can terminate the capability indication process of the terminal device.
  • the first information is obtained by encrypting the first indication information and the integrity check code.
  • the security key K AUSF stored in the second core network device corresponding to the terminal device decrypts the received first information according to the confidentiality protection algorithm indicated by the second instruction information, and obtains the first information in the first information.
  • the first indication information and the integrity check code according to the security key K AUSF , the UPU counter Counter UPU and the first indication information in the first information, a new integrity check code is generated to determine the new integrity
  • the check code is consistent with the integrity check code in the first information, and in response to the new integrity check code being consistent with the integrity check code in the first information, sending the third core network device to the first core network device
  • An indication message in response to the inconsistency between the new integrity check code and the integrity check code in the first information, terminating the indication process of the terminal device's capabilities, so that the terminal device can resist accessing the information sent by the network to the terminal device sniffing, deletion or tampering, safely indicating its capability information to the home network, protecting the security of information interaction between the terminal device and the home network, and improving the security of the system.
  • Figure 12 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application. This method can be executed independently or in conjunction with any other embodiment of the present application. As shown in Figure 12, the method may include the following steps:
  • the terminal device performs regular registration.
  • the UDM can interact with the SoR AF to provide SoR information to the end device during initial registration (e.g., provide SoR information to the end device based on local configuration).
  • UDM decides to obtain the capabilities of the terminal device to determine whether the terminal device supports slice-based SoR information.
  • the UDM may determine to trigger acquisition of the end device's capabilities based on, for example, the local configuration, the location of the end device in a specific PLMN, or a new indication provided by the SoR AF to the UDM in step 1201.
  • UDM can trigger the extended UPU process and request the terminal device to send its UPU/SoR capabilities in the response. Therefore, the UDM can send the Nudm_SDM_Notify message including the UPU transparent container (capability request message) to the AMF to trigger the end device to return its UPU/SoR capabilities.
  • the UPU transparent container includes UPU counter Counter UPU , which is used to protect the integrity of terminal device parameter update data.
  • Counter UPU is generated by AUSF.
  • MF sends a DL NAS TRANSPORT message to the terminal device, where the DL NAS TRANSPORT message includes the UPU transparent container.
  • the UPU transparent container is used by UDM to request the UPU/SoR capability of the terminal device (the terminal device capability to process enhanced SoR information , e.g., VPLMN list and optional supported network slices and/or suitability/validity information).
  • the terminal device returns its capabilities to the AMF in the UPU ACK transparent container (first indication information) in the NAS UL TRANSPORT message. Among them, the terminal device provides integrity protection for the UPUACK transparent container.
  • the terminal device uses the preset integrity protection algorithm to generate an integrity check code UC-MAC1-I UE based on the security key K AUSF , UPU counter Counter UPU and the UPUACK transparent container.
  • the UPUACK transparent container and the integrity check code UC-MAC1-I are regarded by the UE as a protected container (first information).
  • the terminal device can perform integrity protection on the entire UPUACK transparent container, or can also perform integrity protection on part of the information in it.
  • the manner in which the terminal device generates the integrity check code can be implemented in any manner in the embodiments of the present application, and the embodiments of the present application will not be described in detail here.
  • AMF sends Nudm_SDM_Info including the protected container (first information) to UDM, indicating the UPU/SoR capability of the terminal device.
  • UDM sends the protected container (first information) and the SUPI of the terminal device to AUSF.
  • AUSF uses the SUPI of the terminal device to identify the security key K AUSF corresponding to the terminal device.
  • the first information is not encrypted, and the AUSF uses the security key K AUSF and the local Counter UPU to verify the first information.
  • AUSF uses the preset integrity protection algorithm to generate a new integrity check code based on the UPUACK transparent container (first indication information) in the first information, the security key K AUSF and the local Counter UPU .
  • UC-MAC1-I' UE and then the AUSF checks whether the newly generated integrity check code UC-MAC1-I' UE is the same as the integrity check code UC-MAC1-I UE generated by the terminal device in the first information. If they are the same, the AUSF sends the UPUACK transparent container (first indication information) to the UDM; if they are not the same, the AUSF terminates the capability indication process.
  • UDM After receiving the UPUACK transparent container (first instruction information), UDM can send Nsoraf_SoR_Get request (VPLMN ID), SUPI of the terminal device, and access type to SoR AF (refer to 3GPP technical specification TS 29.571, which can include subscription S-NSSAI, the location of the terminal device, the ability of the terminal device to receive enhanced information). UDM can also transparently pass other information contained in the container and relevant to SoR AF for consideration by SoR AF.
  • SoR AF creates slice-based SoR information, taking into account the information provided by UDM and possibly the availability of S-NSSAI (Single-NSSAI, single network slice selection auxiliary information) subscribed in VPLMN. To enable SoR AF to create slice-based SoR information, SoR AF scans the list of possible VPLMNs and determines for each list the degree of support of the subscribed NSSAI. SoR AF can then sort the information as shown in the following example:
  • VPLMN supports all subscribed NSSAIs in any order preferred by HPLMN;
  • VPLMN supports subscribing to a subset of NSSAI in any order preferred by HPLMN;
  • SoR AF sends slice-based SoR information to UDM in Nsoraf_SoR_Get Response.
  • UDM sends Nudm_Notif to AMF and contains enhanced SoR information.
  • AMF sends a DL NAS TRANSPORT message containing enhanced SoR information to the terminal device.
  • the ID of the enhanced SoR information can be included in the message.
  • the terminal device stores enhanced SoR information.
  • the terminal device returns UPU ACK to AMF in the NAS UL TRANSPORT message.
  • the terminal device scans the received roaming guidance SoR information and makes corresponding adjustments.
  • AMF sends Nudm_SDM_InfoUPU to UDM, which includes SoRACK to confirm that the terminal device has received the enhanced SoR information (including VPLMN list, etc.).
  • the terminal device capability indication method can provide a protection mechanism (integrity protection) for the terminal capability indication process, so that the terminal device can resist sniffing and sniffing of information sent by the terminal device by the access network.
  • Delete or tamper with safely indicate one's capability information to the home network, protect the security of information interaction between the terminal device and the home network, and improve the security of the system.
  • Figure 13 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application. This method can be executed independently or in conjunction with any other embodiment of the present application. As shown in Figure 13, the method may include the following steps:
  • the terminal device performs regular registration.
  • the UDM can interact with the SoR AF to provide SoR information to the end device during initial registration (e.g., provide SoR information to the end device based on local configuration).
  • UDM decides to obtain the capabilities of the terminal device to determine whether the terminal device supports slice-based SoR information.
  • the UDM may determine to trigger acquisition of the end device's capabilities based on, for example, the local configuration, the location of the end device in a specific PLMN, or a new indication provided by the SoR AF to the UDM in step 1201.
  • UDM can trigger the extended UPU process and request the terminal device to send its UPU/SoR capabilities in the response. Therefore, the UDM can send the Nudm_SDM_Notify message including the UPU transparent container (capability request message) to the AMF to trigger the end device to return its UPU/SoR capabilities.
  • the UPU transparent container includes the UPU counter Counter UPU , which is used to protect the integrity of the terminal device parameter update data. Counter UPU is generated by AUSF.
  • the AUSF also indicates the security protection algorithm (second indication information) that the terminal device needs to use (for example, the algorithm described in Annex D.1 of the 3GPP technical specification TS 33.501). Specifically, AUSF can select a security protection algorithm based on its own security capabilities and the security capabilities of the terminal device.
  • MF sends a DL NAS TRANSPORT message to the terminal device, where the DL NAS TRANSPORT message includes the UPU transparent container.
  • the UPU transparent container is used by UDM to request the UPU/SoR capability of the terminal device (the terminal device capability to process enhanced SoR information , e.g., VPLMN list and optionally supported network slices and/or suitability/validity information).
  • the terminal device returns its capabilities to the AMF in the UPU ACK transparent container (first indication information) in the NAS UL TRANSPORT message. Among them, the terminal device provides integrity and confidentiality protection for the UPUACK transparent container.
  • the terminal device encrypts the UPUACK transparent container using the confidentiality protection algorithm indicated by AUSF according to the security key K AUSF and the UPU counter Counter UPU .
  • the terminal device uses the integrity protection algorithm indicated by AUSF to generate an integrity check code UC-MAC1-I UE based on the security key K AUSF , UPU counter Counter UPU and the encrypted UPUACK transparent container.
  • the encrypted UPUACK transparent container and the integrity check code UC-MAC1-I are regarded by the UE as a protected container (first information).
  • the terminal device can protect the integrity and confidentiality of the entire UPUACK transparent container, and can also protect part of the information therein.
  • the method in which the terminal device performs encryption and generates the integrity check code can be implemented in any of the embodiments of the present application, and the embodiments of the present application will not be repeated here.
  • AMF sends Nudm_SDM_Info including the protected container (first information) to UDM, indicating the UPU/SoR capability of the terminal device.
  • UDM sends the protected container (first information) and the SUPI of the terminal device to AUSF.
  • AUSF uses the SUPI of the terminal device to identify the security key K AUSF corresponding to the terminal device.
  • the first information is not encrypted
  • the UPUACK transparent container (first indication information) in the first information is encrypted
  • the AUSF uses the security key K AUSF and the local Counter UPU to verify the first information.
  • AUSF uses the integrity protection algorithm indicated by AUSF to generate a new integrity check based on the encrypted UPUACK transparent container (first indication information), security key K AUSF and local Counter UPU in the first information.
  • the AUSF checks whether the newly generated integrity check code UC-MAC1-I' UE is the same as the integrity check code UC-MAC1-I UE generated by the terminal device in the first information . If they are the same, the AUSF decrypts the encrypted UPUACK transparent container and sends the decrypted UPUACK transparent container (first indication information) to the UDM; if they are not the same, the AUSF terminates the capability indication process.
  • UDM After receiving the UPUACK transparent container (first instruction information), UDM can send Nsoraf_SoR_Get request (VPLMN ID), SUPI of the terminal device, and access type to SoR AF (refer to 3GPP technical specification TS 29.571, which can include subscription S-NSSAI, the location of the terminal device, the ability of the terminal device to receive enhanced information). UDM can also transparently pass other information contained in the container and relevant to SoR AF for consideration by SoR AF.
  • SoR AF creates slice-based SoR information, taking into account the information provided by UDM and possibly the availability of S-NSSAI (Single-NSSAI, single network slice selection auxiliary information) subscribed in VPLMN. To enable SoR AF to create slice-based SoR information, SoR AF scans the list of possible VPLMNs and determines for each list the degree of support of the subscribed NSSAI. SoR AF can then sort the information as shown in the following example:
  • VPLMN supports all subscribed NSSAIs in any order preferred by HPLMN;
  • VPLMN supports subscribing to a subset of NSSAI in any order preferred by HPLMN;
  • SoR AF sends slice-based SoR information to UDM in Nsoraf_SoR_Get Response.
  • UDM sends Nudm_Notif to AMF and contains enhanced SoR information.
  • AMF sends a DL NAS TRANSPORT message containing enhanced SoR information to the terminal device.
  • the ID of the enhanced SoR information can be included in the message.
  • the terminal device stores enhanced SoR information.
  • the terminal device returns UPU ACK to AMF in the NAS UL TRANSPORT message.
  • the terminal device scans the received roaming guidance SoR information and makes corresponding adjustments.
  • AMF sends Nudm_SDM_InfoUPU to UDM, which includes SoRryACK to confirm that the terminal device has received the enhanced SoR information (including VPLMN list, etc.).
  • the terminal device capability indication method can provide a protection mechanism (integrity and confidentiality protection) for the terminal capability indication process, so that the terminal device can resist the access network to the information sent by the terminal device. Sniff, delete or tamper, safely indicate one's capability information to the home network, protect the security of information interaction between the terminal device and the home network, and improve the security of the system.
  • a protection mechanism integrated and confidentiality protection
  • Figure 14 is a schematic flowchart of a terminal device capability indication method provided by an embodiment of the present application. This method can be executed independently or in conjunction with any other embodiment of the present application. As shown in Figure 14, the method may include the following steps:
  • the terminal device performs regular registration.
  • the UDM can interact with the SoR AF to provide SoR information to the end device during initial registration (e.g., provide SoR information to the end device based on local configuration).
  • UDM decides to obtain the capabilities of the terminal device to determine whether the terminal device supports slice-based SoR information.
  • the UDM may determine to trigger acquisition of the end device's capabilities based on, for example, the local configuration, the location of the end device in a specific PLMN, or a new indication provided by the SoR AF to the UDM in step 1201.
  • UDM can trigger the extended UPU process and request the terminal device to send its UPU/SoR capabilities in the response. Therefore, the UDM can send the Nudm_SDM_Notify message including the UPU transparent container (capability request message) to the AMF to trigger the end device to return its UPU/SoR capabilities.
  • the UPU transparent container includes the UPU counter Counter UPU , which is used to protect the integrity of the terminal device parameter update data. Counter UPU is generated by AUSF.
  • the AUSF also indicates the security protection algorithm (second indication information) that the terminal device needs to use (for example, the algorithm described in Annex D.1 of the 3GPP technical specification TS 33.501). Specifically, AUSF can select a security protection algorithm based on its own security capabilities and the security capabilities of the terminal device.
  • MF sends a DL NAS TRANSPORT message to the terminal device, where the DL NAS TRANSPORT message includes the UPU transparent container.
  • the UPU transparent container is used by UDM to request the UPU/SoR capability of the terminal device (the terminal device capability to process enhanced SoR information , e.g., VPLMN list and optional supported network slices and/or suitability/validity information).
  • the terminal device returns its capabilities to the AMF in the UPU ACK transparent container (first indication information) in the NAS UL TRANSPORT message. Among them, the terminal device provides integrity and confidentiality protection for the UPUACK transparent container.
  • the terminal device first uses the integrity protection algorithm indicated by AUSF to generate an integrity check code UC-MAC1-I UE based on the security key K AUSF , the UPU counter Counter UPU and the UPUACK transparent container. Then, according to the security key K AUSF and the UPU counter Counter UPU , the UPUACK transparent container and the integrity check code UC-MAC1-I UE are encrypted using the confidentiality protection algorithm indicated by the AUSF.
  • the entire encrypted information of the UPUACK transparent container and the integrity check code UC-MAC1-I UE is regarded as a protected container (first information).
  • the terminal device can protect the integrity and confidentiality of the entire UPUACK transparent container, and can also protect part of the information therein.
  • the method in which the terminal device performs encryption and generates the integrity check code can be implemented in any of the embodiments of the present application, and the embodiments of the present application will not be repeated here.
  • AMF sends Nudm_SDM_Info including the protected container (first information) to UDM, indicating the UPU/SoR capability of the terminal device.
  • UDM sends the protected container (first information) and the SUPI of the terminal device to AUSF.
  • AUSF uses the SUPI of the terminal device to identify the security key K AUSF corresponding to the terminal device.
  • the first information is encrypted and the AUSF uses the security key K AUSF and the local Counter UPU to verify the first information.
  • the AUSF decrypts the protected container (first information) according to the security key K AUSF and the local Counter UPU using the indicated confidentiality protection algorithm to obtain the UPUACK transparent container (first indication information) and the integrity check Verification code UC-MAC1-I UE .
  • the integrity protection algorithm indicated by AUSF is used to generate a new integrity check code UC-MAC1- I' UE , and then the AUSF checks whether the newly generated integrity check code UC-MAC1-I' UE is the same as the integrity check code UC-MAC1-I UE generated by the terminal device in the first information. If they are the same, the decrypted UPUACK transparent container (first indication information) is sent to the UDM; if they are not the same, the AUSF terminates the capability indication process.
  • UDM After receiving the UPUACK transparent container (first instruction information), UDM can send Nsoraf_SoR_Get request (VPLMN ID), SUPI of the terminal device, and access type to SoR AF (refer to 3GPP technical specification TS 29.571, which can include subscription S-NSSAI, the location of the terminal device, the ability of the terminal device to receive enhanced information). UDM can also transparently pass other information contained in the container and relevant to SoR AF for consideration by SoR AF.
  • SoR AF creates slice-based SoR information, taking into account the information provided by UDM and possibly the availability of S-NSSAI (Single-NSSAI, single network slice selection auxiliary information) subscribed in VPLMN. To enable SoR AF to create slice-based SoR information, SoR AF scans the list of possible VPLMNs and determines for each list the degree of support of the subscribed NSSAI. SoR AF can then sort the information as shown in the following example:
  • VPLMN supports all subscribed NSSAIs in any order preferred by HPLMN;
  • VPLMN supports subscribing to a subset of NSSAI in any order preferred by HPLMN;
  • SoR AF sends slice-based SoR information to UDM in Nsoraf_SoR_Get Response.
  • UDM sends Nudm_Notif to AMF and contains enhanced SoR information.
  • AMF sends a DL NAS TRANSPORT message containing enhanced SoR information to the terminal device.
  • the ID of the enhanced SoR information can be included in the message.
  • the terminal device stores enhanced SoR information.
  • the terminal device returns UPU ACK to AMF in the NAS UL TRANSPORT message.
  • the terminal device scans the received roaming guidance SoR information and makes corresponding adjustments.
  • AMF sends Nudm_SDM_InfoUPU to UDM, which includes SoRryACK to confirm that the terminal device has received the enhanced SoR information (including VPLMN list, etc.).
  • the terminal device capability indication method can provide a protection mechanism (integrity and confidentiality protection) for the terminal capability indication process, so that the terminal device can resist the access network to the information sent by the terminal device. Sniff, delete or tamper, safely indicate one's capability information to the home network, protect the security of information interaction between the terminal device and the home network, and improve the security of the system.
  • a protection mechanism integrated and confidentiality protection
  • the present application also provides a terminal equipment capability indication device, because the terminal equipment capability indication device provided by the embodiments of the present application is consistent with the methods provided by the above embodiments.
  • the implementation of the terminal device capability indication method is also applicable to the terminal device capability indication device provided in the following embodiments, which will not be described in detail in the following embodiments.
  • Figure 15 is a schematic structural diagram of a terminal equipment capability indicating device provided by an embodiment of the present application.
  • the terminal equipment capability indication device 1500 includes: a transceiver unit 1510, wherein:
  • Transceiver unit 1510 configured to receive a capability request message sent by the first core network device through the access network
  • the transceiver unit 1510 is also configured to send the first information and/or the identification of the terminal device to the first core network device through the access network according to the capability request message;
  • the first information includes first indication information and an integrity check code, and the first indication information is used to indicate the capability of the terminal device.
  • the capability request message includes: user equipment parameter update UPU counter, and/or second indication information; the second indication information is used to indicate the security protection algorithm used by the terminal equipment, and the security protection algorithm includes integrity Protection algorithm and confidentiality protection algorithm.
  • the transceiver unit 1510 is specifically configured to: use an integrity protection algorithm according to the security key K AUSF corresponding to the terminal device, the UPU counter and the first indication information. , generate the integrity check code; send the first information to the first core network device through the access network, where the first information includes the first indication information and the integrity check code.
  • the transceiver unit 1510 is specifically configured to: according to the security key K AUSF corresponding to the terminal device, the UPU The counter and the first indication information use the integrity protection algorithm indicated by the second indication information to generate the integrity check code; send the first information to the first core network device through the access network, and the first information including the first indication information and the integrity check code.
  • the transceiver unit 1510 is specifically configured to: use the second indication according to the security key K AUSF corresponding to the terminal device and the UPU counter.
  • the confidentiality protection algorithm of the information indication encrypts the first indication information to obtain the encrypted first indication information; according to the security key K AUSF , the UPU counter and the encrypted first indication information, the second indication information is used.
  • the integrity protection algorithm indicated by the indication information generates the integrity check code; and sends the first information to the first core network device through the access network, where the first information includes the encrypted first indication information and the complete Check code.
  • the transceiver unit 1510 is specifically configured to: according to the security key K AUSF corresponding to the terminal device, the UPU counter and the first indication information, using the integrity protection algorithm indicated by the second indication information to generate the integrity check code; according to the security key K AUSF and the UPU counter, using the confidentiality protection algorithm indicated by the second indication information, Encrypt the first indication information and the integrity check code to obtain the first information;
  • the first core network device is a unified data management UDM.
  • the first indication information includes at least one of the following: parameter update UPU/roaming guidance SoR capability information of the terminal device; location information of the terminal device; requested network slice selection assistance information Requested-NSSAI of the terminal device.
  • the terminal equipment capability indication device in this embodiment can receive a capability request message sent by the first core network device of the home network through the access network, and according to the capability request message, send the first core network device to the first core network device through the access network.
  • the first information includes first indication information and an integrity check code.
  • the first indication information is used to indicate the capability of the terminal device, so that the terminal device can resist the access network to the terminal device. Sniff, delete or tamper with information, safely indicate one's capability information to the home network, protect the security of information interaction between the terminal device and the home network, and improve the security of the system.
  • FIG. 16 is a schematic structural diagram of a terminal equipment capability indicating device provided by an embodiment of the present application.
  • the terminal equipment capability indication device 1600 includes: a transceiver unit 1610, wherein:
  • the transceiver unit 1610 is configured to send a capability request message to the terminal device through the access network, where the capability request message is used to request the terminal device to indicate the capabilities of the terminal device;
  • the transceiver unit 1610 is also used to receive the first information sent by the terminal device through the access network and/or the identification of the terminal device;
  • the first information includes first indication information and an integrity check code, and the first indication information is used to indicate the capability of the terminal device.
  • the transceiver unit 1610 is also configured to: receive the user equipment parameter update UPU counter sent by the second core network device, and/or second indication information; the second indication information is used to indicate the security of use of the terminal device. Protection algorithm, the security protection algorithm includes an integrity protection algorithm and a confidentiality protection algorithm;
  • the capability request message includes the user equipment parameter update UPU counter and/or the second indication information.
  • the transceiver unit 1610 is specifically configured to: receive the first information sent by the terminal equipment through the access network, the first information including first indication information and an integrity check code; wherein the integrity check code is generated using an integrity protection algorithm based on the security key KAUSF corresponding to the terminal device, the UPU counter and the first indication information.
  • the transceiver unit 1610 is specifically configured to: receive the first information sent by the terminal device through the access network, the first The information includes first indication information and integrity check code; wherein, the integrity check code is based on the security key K AUSF corresponding to the terminal device, the UPU counter and the first indication information, using the second indication information Indicates the integrity protection algorithm generated.
  • the transceiver unit 1610 is specifically configured to: receive the first information sent by the terminal device through the access network, the first The information includes encrypted first indication information and integrity check code; wherein, the encrypted first indication information is indicated by the second indication information according to the security key K AUSF corresponding to the terminal device and the UPU counter.
  • the confidentiality protection algorithm is obtained by encrypting the first indication information; the integrity check code is based on the security key K AUSF , the UPU counter and the encrypted first indication information, using the second indication information Generated by the integrity protection algorithm indicated.
  • the transceiver unit 1610 is specifically configured to: receive the first information sent by the terminal device through the access network, the first The information is obtained by encrypting the first indication information and the integrity check code according to the security key K AUSF corresponding to the terminal device and the UPU counter, using the confidentiality protection algorithm indicated by the second indication information; wherein , the integrity check code is generated based on the security key K AUSF , the UPU counter and the first indication information, using the integrity protection algorithm indicated by the second indication information.
  • the transceiver unit 1610 is also configured to: send the first information and/or the identification of the terminal device to the second core network device; the integrity check code is used by the second core network device to verify the third An indication of whether the information has been tampered with.
  • the transceiver unit 1610 is also configured to receive the verified first indication information sent by the second core network device.
  • the first core network device is a unified data management UDM
  • the second core network device is an authentication service function AUSF.
  • the first indication information includes at least one of the following: parameter update UPU/roaming guidance SoR capability information of the terminal device; location information of the terminal device; requested network slice selection assistance information Requested-NSSAI of the terminal device.
  • the terminal equipment capability indicating device of this embodiment can send a capability request message to the terminal device through the access network.
  • the capability request message is used to request the terminal device to indicate the capability of the terminal device, and receives the capability request message sent by the terminal device through the access network.
  • the first information enables the terminal device to resist sniffing, deletion or tampering of the information sent by the access network to the terminal device, safely indicates its capability information to the home network, protects the security of information interaction between the terminal device and the home network, and improves the security of information interaction between the terminal device and the home network. System security.
  • Figure 17 is a schematic structural diagram of a terminal equipment capability indicating device provided by an embodiment of the present application.
  • the terminal equipment capability indication device 1700 includes: a transceiver unit 1710, wherein:
  • Transceiver unit 1710 configured to receive the first information sent by the first core network device and the identification of the terminal device
  • the first information includes first indication information and an integrity check code, and the first indication information is used to indicate the capability of the terminal device.
  • the transceiver unit 1710 is also configured to: send the user equipment parameter update UPU counter to the first core network device, and/or second indication information; the second indication information is used to indicate the security protection used by the terminal device.
  • the security protection algorithm includes integrity protection algorithm and confidentiality protection algorithm.
  • the device in response to the first information including the first indication information and the integrity check code, the device further includes a processing unit (not shown in the figure), the processing unit being configured to: determine according to the identification of the terminal device The security key K AUSF corresponding to the terminal device stored in the second core network device; according to the security key K AUSF , the UPU counter and the first indication information in the first information, an integrity protection algorithm is used, Generate a new integrity check code; determine the consistency of the new integrity check code with the integrity check code in the first information.
  • the transceiver unit 1710 is also configured to: in response to the new integrity check code being consistent with the integrity check code in the first information, send the first indication information to the first core network device; In response to the new integrity check code being inconsistent with the integrity check code in the first information, the process of indicating the capability of the terminal device is terminated.
  • the device in response to the first information including the first indication information and the integrity check code, the device further includes a processing unit (not shown in the figure), the processing unit being configured to: determine according to the identification of the terminal device The security key K AUSF corresponding to the terminal device stored in the second core network device; according to the security key K AUSF , the UPU counter and the first indication information in the first information, the second indication information is used
  • the indicated integrity protection algorithm generates a new integrity check code; and determines the consistency between the new integrity check code and the integrity check code in the first information.
  • the transceiver unit 1710 is also configured to: in response to the new integrity check code being consistent with the integrity check code in the first information, send the first indication information to the first core network device; In response to the new integrity check code being inconsistent with the integrity check code in the first information, the process of indicating the capability of the terminal device is terminated.
  • the device in response to the first information including the encrypted first indication information and the integrity check code, the device further includes a processing unit (not shown in the figure), the processing unit being configured to: according to the identification of the terminal device , determine the security key K AUSF stored in the second core network device corresponding to the terminal device; according to the security key K AUSF , the UPU counter and the encrypted first indication information in the first information, use the The integrity protection algorithm indicated by the second instruction information generates a new integrity check code; and the consistency of the new integrity check code and the integrity check code in the first information is determined.
  • a processing unit being configured to: according to the identification of the terminal device , determine the security key K AUSF stored in the second core network device corresponding to the terminal device; according to the security key K AUSF , the UPU counter and the encrypted first indication information in the first information, use the The integrity protection algorithm indicated by the second instruction information generates a new integrity check code; and the consistency of the new integrity check code and the integrity check code in the first information is determined.
  • the transceiver unit 1710 is also configured to: in response to the new integrity check code being consistent with the integrity check code in the first information, send the first indication information to the first core network device;
  • the first indication information is obtained by decrypting the encrypted first indication information using the confidentiality protection algorithm indicated by the second indication information according to the security key K AUSF and the UPU counter; in response to the new The integrity check code is inconsistent with the integrity check code in the first information, and the capability indication process of the terminal device is terminated.
  • the device further includes a processing unit (not shown in the figure), the processing unit being configured to: according to the terminal The identification of the device determines the security key K AUSF stored in the second core network device corresponding to the terminal device; according to the security key K AUSF and the UPU counter, the confidentiality protection indicated by the second indication information is adopted algorithm, decrypt the first information to obtain the first indication information and integrity check code in the first information; according to the security key K AUSF , the UPU counter and the first indication information in the first information , use the integrity protection algorithm indicated by the second indication information to generate a new integrity check code; determine the consistency of the new integrity check code with the integrity check code in the first information.
  • the transceiver unit 1710 is also configured to: in response to the new integrity check code being consistent with the integrity check code in the first information, send the first indication information to the first core network device; In response to the new integrity check code being inconsistent with the integrity check code in the first information, the process of indicating the capability of the terminal device is terminated.
  • the first core network device is a unified data management UDM
  • the second core network device is an authentication service function AUSF.
  • the first indication information includes at least one of the following: parameter update UPU/roaming guidance SoR capability information of the terminal device; location information of the terminal device; requested network slice selection assistance information Requested-NSSAI of the terminal device.
  • the terminal equipment capability indication device of this embodiment can receive the first information sent by the first core network equipment and the identification of the terminal equipment, and can verify whether the first information has been tampered with through the integrity check code in the first information. , so that the terminal device can resist the sniffing, deletion or tampering of the information sent by the access network to the terminal device, safely indicate its own capability information to the home network, protect the security of information interaction between the terminal device and the home network, and improve the security of the system sex.
  • Figure 18 is a schematic diagram of a communication system provided by an embodiment of the present application.
  • the communication system includes: a first core network device and a second core network device, where:
  • the second core network device is configured to send the user equipment parameter update UPU counter and/or second indication information to the first core network device;
  • the first core network device is configured to receive the UPU counter and/or the second indication information; and send a capability request message to the terminal device through the access network.
  • the capability request message is used to request the terminal device to indicate the capability of the terminal device.
  • the capability The request message includes the UPU counter and/or second indication information;
  • the first core network device is also configured to receive the first information and the identification of the terminal device sent by the terminal device through the access network; and send the first information to the second core network device;
  • the second core network device is also configured to receive the first information and the identification of the terminal device, and verify the first information; and send the first instruction information in the verified first information to the first core network device. .
  • the first indication information includes at least one of the following:
  • the requested network slice selection auxiliary information of the terminal device Requested-NSSAI is the requested network slice selection auxiliary information of the terminal device Requested-NSSAI.
  • the second indication information is used to indicate the security protection algorithm used by the terminal device.
  • the security protection algorithm includes an integrity protection algorithm and a confidentiality protection algorithm.
  • embodiments of the present application also provide a communication device, including: a processor and a memory.
  • a computer program is stored in the memory.
  • the processor executes the computer program stored in the memory, so that the device executes the steps shown in Figure 2 to The method shown in the embodiment of Figure 5.
  • embodiments of the present application also provide a communication device, including: a processor and a memory.
  • a computer program is stored in the memory.
  • the processor executes the computer program stored in the memory, so that the device executes the steps shown in Figure 6 to The method shown in the embodiment of FIG. 7, or the method shown in the embodiment of FIGS. 8 to 11 is performed.
  • embodiments of the present application also provide a communication device, including: a processor and an interface circuit.
  • the interface circuit is used to receive code instructions and transmit them to the processor.
  • the processor is used to run the code instructions to The methods shown in the embodiments of Figures 2 to 5 are executed.
  • embodiments of the present application also provide a communication device, including: a processor and an interface circuit.
  • the interface circuit is used to receive code instructions and transmit them to the processor.
  • the processor is used to run the code instructions to Perform the method shown in the embodiment of FIGS. 6 to 7 , or perform the method shown in the embodiment of FIGS. 8 to 11 .
  • the terminal device capability indication device 1900 may be a network device, a terminal device, a chip, a chip system, or a processor that supports network devices to implement the above methods, or a chip or a chip that supports terminal devices to implement the above methods. system, or processor, etc.
  • the device can be used to implement the method described in the above method embodiment. For details, please refer to the description in the above method embodiment.
  • the terminal device capability indication device 1900 may include one or more processors 1901.
  • the processor 1901 may be a general-purpose processor or a special-purpose processor, or the like.
  • it can be a baseband processor or a central processing unit.
  • the baseband processor can be used to process communication protocols and communication data
  • the central processor can be used to control terminal equipment capability indicating devices (such as base stations, baseband chips, terminal equipment, terminal equipment chips, DU or CU, etc.), Execute computer programs and process data from computer programs.
  • the terminal device capability indicating device 1900 may also include one or more memories 1902, on which a computer program 1903 may be stored.
  • the processor 1901 executes the computer program 1903, so that the terminal device capability indicating device 1900 executes the above method implementation.
  • the computer program 1903 may be solidified in the processor 1901, in which case the processor 1901 may be implemented by hardware.
  • the memory 1902 may also store data.
  • the terminal equipment capability indicating device 1900 and the memory 1902 can be provided separately or integrated together.
  • the terminal equipment capability indicating device 1900 may also include a transceiver 1905 and an antenna 1906.
  • the transceiver 1905 may be called a transceiver unit, a transceiver, a transceiver circuit, etc., and is used to implement transceiver functions.
  • the transceiver 1905 may include a receiver and a transmitter.
  • the receiver may be called a receiver or a receiving circuit, etc., used to implement the receiving function;
  • the transmitter may be called a transmitter, a transmitting circuit, etc., used to implement the transmitting function.
  • the terminal device capability indicating device 1900 may also include one or more interface circuits 1907.
  • the interface circuit 1907 is used to receive code instructions and transmit them to the processor 1901 .
  • the processor 1901 executes code instructions to cause the terminal device capability indicating device 1900 to perform the method described in the above method embodiment.
  • the processor 1901 may include a transceiver for implementing receiving and transmitting functions.
  • the transceiver may be a transceiver circuit, an interface, or an interface circuit.
  • the transceiver circuits, interfaces or interface circuits used to implement the receiving and transmitting functions can be separate or integrated together.
  • the above-mentioned transceiver circuit, interface or interface circuit can be used for reading and writing codes/data, or the above-mentioned transceiver circuit, interface or interface circuit can be used for signal transmission or transfer.
  • the terminal device capability indicating apparatus 1900 may include a circuit, and the circuit may implement the sending or receiving or communication functions in the foregoing method embodiments.
  • the processor and transceiver described in this application can be implemented in integrated circuits (ICs), analog ICs, radio frequency integrated circuits RFICs, mixed signal ICs, application specific integrated circuits (ASICs), printed circuit boards ( printed circuit board (PCB), electronic equipment, etc.
  • the processor and transceiver can also be manufactured using various IC process technologies, such as complementary metal oxide semiconductor (CMOS), n-type metal oxide-semiconductor (NMOS), P-type Metal oxide semiconductor (positive channel metal oxide semiconductor, PMOS), bipolar junction transistor (BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.
  • CMOS complementary metal oxide semiconductor
  • NMOS n-type metal oxide-semiconductor
  • PMOS P-type Metal oxide semiconductor
  • BJT bipolar junction transistor
  • BiCMOS bipolar CMOS
  • SiGe silicon germanium
  • GaAs gallium arsenide
  • the terminal equipment capability indication device described in the above embodiments may be a network device or a terminal device, but the scope of the terminal equipment capability indication device described in this application is not limited thereto, and the structure of the terminal equipment capability indication device may not be limited to that shown in Figure 15 -Limitations of Figure 17.
  • the terminal device capability indicating device may be a stand-alone device or may be part of a larger device.
  • the terminal equipment capability indicating device may be:
  • the IC collection may also include storage components for storing data and computer programs;
  • the terminal equipment capability indicating device may be a chip or a chip system
  • the terminal equipment capability indicating device may be a chip or a chip system
  • the chip shown in Figure 20 includes a processor 2001 and an interface 2002.
  • the number of processors 2001 may be one or more, and the number of interfaces 2002 may be multiple.
  • Interface 2002 for code instructions and transmission to the processor
  • the processor 2001 is configured to run code instructions to perform the methods shown in Figures 6 to 7, or to perform the methods shown in Figures 8 to 11.
  • Interface 2002 for code instructions and transmission to the processor
  • the processor 2001 is configured to run code instructions to perform the methods shown in Figures 2 to 5.
  • the chip also includes a memory 2003, which is used to store necessary computer programs and data.
  • Embodiments of the present application also provide a communication system, which system includes the terminal equipment capability indicating device as the terminal equipment in the aforementioned embodiment of FIG. 15-FIG. 17, or the system includes the terminal equipment as the terminal equipment in the aforementioned embodiment of FIG. 19.
  • Ability indicating device is included in the communication system, which system includes the terminal equipment capability indicating device as the terminal equipment in the aforementioned embodiment of FIG. 15-FIG. 17, or the system includes the terminal equipment as the terminal equipment in the aforementioned embodiment of FIG. 19.
  • This application also provides a readable storage medium on which instructions are stored. When the instructions are executed by a computer, the functions of any of the above method embodiments are implemented.
  • This application also provides a computer program product, which, when executed by a computer, implements the functions of any of the above method embodiments.
  • a computer program product includes one or more computer programs.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer program may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program may be transmitted from a website, computer, server or data center via a wireline (e.g.
  • Coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless means to transmit to another website, computer, server or data center.
  • Computer-readable storage media can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or other integrated media that contains one or more available media. Available media may be magnetic media (e.g., floppy disks, hard disks, tapes), optical media (e.g., high-density digital video discs (DVD)), or semiconductor media (e.g., solid state disks (SSD)) )wait.
  • magnetic media e.g., floppy disks, hard disks, tapes
  • optical media e.g., high-density digital video discs (DVD)
  • semiconductor media e.g., solid state disks (SSD)
  • At least one in this application can also be described as one or more, and the plurality can be two, three, four or more, which is not limited by this application.
  • the technical feature is distinguished by “first”, “second”, “third”, “A”, “B”, “C” and “D”, etc.
  • the technical features described in “first”, “second”, “third”, “A”, “B”, “C” and “D” are in no particular order or order.
  • the corresponding relationships shown in each table in this application can be configured or predefined.
  • the values of the information in each table are only examples and can be configured as other values, which are not limited by this application.
  • the corresponding relationships shown in some rows may not be configured.
  • appropriate deformation adjustments can be made based on the above table, such as splitting, merging, etc.
  • the names of the parameters shown in the titles of the above tables may also be other names understandable by the communication device, and the values or expressions of the parameters may also be other values or expressions understandable by the communication device.
  • other data structures can also be used, such as arrays, queues, containers, stacks, linear lists, pointers, linked lists, trees, graphs, structures, classes, heaps, hash tables or hash tables. wait.
  • Predefinition in this application can be understood as definition, pre-definition, storage, pre-storage, pre-negotiation, pre-configuration, solidification, or pre-burning.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例公开了一种终端设备能力指示方法及装置，通过接收第一核心网设备通过访问网络发送的能力请求消息，根据该能力请求消息，通过该访问网络向该第一核心网设备发送第一信息，该第一信息包括第一指示信息和完整性校验码，该第一指示信息用于指示该终端设备的能力，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。

Description

终端设备能力指示方法及装置 技术领域
本申请涉及通信技术领域，特别涉及一种终端设备能力指示方法及装置。
背景技术
在3GPP技术规范TS 22.261中规定了，HPLMN(Home Public Land Mobile Network，归属公用陆地移动网络)应能够向UE(User Equipment，用户设备)提供UE注册网络切片可以使用的VPLMN(Visited Public Land Mobile Network，访问公用陆地移动网络)的优先级信息，以支持漫游UE的激活网络切片服务。
具体而言，在3GPP技术报告TR 23.700-41中，UE可能需要在归属网络触发UPU(UE Parameters Update，UE参数更新)/SoR(Steering of Roaming，漫游引导)过程之前向归属网络指示UPU/SoR能力。然而，该能力指示信息可能被VPLMN篡改或删除。
发明内容
本申请第一方面实施例提出了一种终端设备能力指示方法，所述方法由终端设备执行，所述方法包括：
接收第一核心网设备通过访问网络发送的能力请求消息；根据所述能力请求消息，通过所述访问网络向所述第一核心网设备发送第一信息和/或所述终端设备的标识；所述第一信息包括第一指示信息和完整性校验码，所述第一指示信息用于指示所述终端设备的能力。
本申请第二方面实施例提出了一种终端设备能力指示方法，所述方法由第一核心网设备执行，所述方法包括：
通过访问网络向终端设备发送能力请求消息，所述能力请求消息用于请求所述终端设备指示所述终端设备的能力；接收所述终端设备通过所述访问网络发送的第一信息和/或所述终端设备的标识；所述第一信息包括第一指示信息和完整性校验码，所述第一指示信息用于指示所述终端设备的能力。
本申请第三方面实施例提出了一种终端设备能力指示方法，所述方法由第二核心网设备执行，所述方法包括：
接收第一核心网设备发送的第一信息和终端设备的标识；所述第一信息包括第一指示信息和完整性校验码，所述第一指示信息用于指示所述终端设备的能力。
本申请第四方面实施例提出了一种终端设备能力指示装置，所述装置应用于终端设备，所述装置包括：
收发单元，用于接收第一核心网设备通过访问网络发送的能力请求消息；所述收发单元，还用于根据所述能力请求消息，通过所述访问网络向所述第一核心网设备发送第一信息和/或所述终端设备的标识；所述第一信息包括第一指示信息和完整性校验码，所述第一指示信息用于指示所述终端设备的能力。
本申请第五方面实施例提出了一种终端设备能力指示装置，所述装置应用于第一核心网设备，所述装置包括：
收发单元，用于通过访问网络向终端设备发送能力请求消息，所述能力请求消息用于请求所述终端设备指示所述终端设备的能力；所述收发单元，还用于接收所述终端设备通过所述访问网络发送的第一信息和/或所述终端设备的标识；所述第一信息包括第一指示信息和完整性校验码，所述第一指示信息用于指示所述终端设备的能力。
本申请第六方面实施例提出了一种终端设备能力指示装置，所述装置应用于第二核心网设备，所述装置包括：
收发单元，用于接收第一核心网设备发送的第一信息和终端设备的标识；所述第一信息包括第一指示信息和完整性校验码，所述第一指示信息用于指示所述终端设备的能力。
本申请第七方面实施例提出了一种通信装置，所述装置包括处理器和存储器，所述存储器中存储有计算机程序，所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行上述第一方面实施例所述的终端设备能力指示方法。
本申请第八方面实施例提出了一种通信装置，所述装置包括处理器和存储器，所述存储器中存储有计算机程序，所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行上述第二方面实施例所述的终端设备能力指示方法，或者执行上述第三方面实施例所述的终端设备能力指示方法。
本申请第九方面实施例提出了一种通信装置，该装置包括处理器和接口电路，该接口电路用于接收代码指令并传输至该处理器，该处理器用于运行所述代码指令以使该装置执行上述第一方面实施例所述的终端设备能力指示方法。
本申请第十方面实施例提出了一种通信装置，该装置包括处理器和接口电路，该接口电路用于接收代码指令并传输至该处理器，该处理器用于运行所述代码指令以使该装置执行上述第二方面实施例所述的终端设备能力指示方法，或者执行上述第三方面实施例所述的终端设备能力指示方法。
本申请第十一方面实施例提出了一种计算机可读存储介质，用于存储有指令，当所述指令被执行时，使上述第一方面实施例所述的终端设备能力指示方法被实现。
本申请第十二方面实施例提出了一种计算机可读存储介质，用于存储有指令，当所述指令被执行时，使上述第二方面实施例所述的终端设备能力指示方法被实现，或者使上述第三方面实施例所述的终端设备能力指示方法被实现。
本申请第十三方面实施例提出了一种计算机程序，当其在计算机上运行时，使得计算机执行第一方面实施例所述的终端设备能力指示方法。
本申请第十四方面实施例提出了一种计算机程序，当其在计算机上运行时，使得计算机执行第二方面实施例所述的终端设备能力指示方法，或者执行上述第三方面实施例所述的终端设备能力指示方法。
本申请实施例提供的一种终端设备能力指示方法及装置，通过接收第一核心网设备通过访问网络发送的能力请求消息，根据该能力请求消息，通过该访问网络向该第一核心网设备发送第一信息，该第一信息包括第一指示信息和完整性校验码，该第一指示信息用于指示该终端设备的能力，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。
本申请附加的方面和优点将在下面的描述中部分给出，部分将从下面的描述中变得明显，或通过本申请的实践了解到。
附图说明
为了更清楚地说明本申请实施例或背景技术中的技术方案，下面将对本申请实施例或背景技术中所需要使用的附图进行说明。
图1为本申请实施例提供的一种通信系统的架构示意图；
图2是本申请实施例提供的一种终端设备能力指示方法的流程示意图；
图3是本申请实施例提供的一种终端设备能力指示方法的流程示意图；
图4是本申请实施例提供的一种终端设备能力指示方法的流程示意图；
图5是本申请实施例提供的一种终端设备能力指示方法的流程示意图；
图6是本申请实施例提供的一种终端设备能力指示方法的流程示意图；
图7是本申请实施例提供的一种终端设备能力指示方法的流程示意图；
图8是本申请实施例提供的一种终端设备能力指示方法的流程示意图；
图9是本申请实施例提供的一种终端设备能力指示方法的流程示意图；
图10是本申请实施例提供的一种终端设备能力指示方法的流程示意图；
图11是本申请实施例提供的一种终端设备能力指示方法的流程示意图；
图12是本申请实施例提供的一种终端设备能力指示方法的流程示意图；
图13是本申请实施例提供的一种终端设备能力指示方法的流程示意图；
图14是本申请实施例提供的一种终端设备能力指示方法的流程示意图；
图15是本申请实施例提供的一种终端设备能力指示装置的结构示意图；
图16是本申请实施例提供的一种终端设备能力指示装置的结构示意图；
图17是本申请实施例提供的一种终端设备能力指示装置的结构示意图；
图18为本申请实施例提供的一种通信系统示意图；
图19是本申请实施例提供的另一种终端设备能力指示装置的结构示意图；
图20是本申请实施例提供的一种芯片的结构示意图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本申请实施例相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本申请实施例的一些方面相一致的装置和方法的例子。
在本申请实施例使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本申请实施例。在本申请实施例和所附权利要求书中所使用的单数形式的“一种”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本申请实施例可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本申请实施例范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”及“若”可以被解释成为“在……时”或“当……时”或“响应于确定”。
下面详细描述本申请的实施例，所述实施例的示例在附图中示出，其中自始至终相同或类似的标号表示相同或类似的要素。下面通过参考附图描述的实施例是示例性的，旨在用于解释本申请，而不能理解为对本申请的限制。
为了更好的理解本申请实施例公开的一种终端设备能力指示方法，下面首先对本申请实施例适用的通信系统进行描述。
请参见图1，图1为本申请实施例提供的一种通信系统的架构示意图。该通信系统可包括但不限于一个终端设备和一个核心网设备，图1所示的设备数量和形态仅用于举例并不构成对本申请实施例的限定，实际应用中可以包括两个或两个以上的网络设备和两个或两个以上的终端设备。图1所示的通信系统以包括一个终端设备101，一个第一核心网设备102和一个第二核心网设备103为例。
需要说明的是，本申请实施例的技术方案可以应用于各种通信系统。例如：长期演进(Long Term  Evolution，LTE)系统、第五代移动通信系统、5G新空口系统，或者其他未来的新型移动通信系统等。
本申请实施例中的终端设备101是用户侧的一种用于接收或发射信号的实体，如手机。终端设备也可以称为终端设备(terminal)、用户设备(user equipment，UE)、移动台(Mobile Station，MS)、移动终端设备(Mobile Terminal，MT)等。终端设备可以是具备通信功能的汽车、智能汽车、手机(Mobile Phone)、穿戴式设备、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(Virtual Reality，VR)终端设备、增强现实(Augmented Reality，AR)终端设备、工业控制(Industrial Control)中的无线终端设备、无人驾驶(Self-Driving)中的无线终端设备、远程手术(Remote Medical Surgery)中的无线终端设备、智能电网(Smart Grid)中的无线终端设备、运输安全(Transportation Safety)中的无线终端设备、智慧城市(Smart City)中的无线终端设备、智慧家庭(Smart Home)中的无线终端设备等等。本申请的实施例对终端设备所采用的具体技术和具体设备形态不做限定。
在本申请实施例中，第一核心网设备102和第二核心网设备103均为归属网络HPLMN中的核心网设备。其中，第一核心网设备102可以为统一数据管理(Unified Data Management，UDM)，第二核心网设备可以为鉴权服务功能(Authentication Server Function，AUSF)。可以理解的是，归属网络HPLMN中还可以有其他核心网设备，比如漫游引导应用功能(Steering of Roaming Application Function，SoR AF)等等。
在本申请实施例中，终端设备101可能不处于归属网络HPLMN的覆盖下，终端设备101可以通过访问网络VPLMN与归属网络HPLMN进行交互。可以理解的是，访问网络VPLMN中也可以存在至少一个核心网设备，比如AMF，用户平面功能(User Plane Function，UPF)，会话管理功能(Session Management Function，SMF)等等。
在3GPP技术规范TS 22.261中规定了，HPLMN(Home Public Land Mobile Network，归属公用陆地移动网络)应能够向UE提供UE注册网络切片可以使用的VPLMN(Visited Public Land Mobile Network，访问公用陆地移动网络)的优先级信息，以支持漫游UE的激活网络切片服务。
具体而言，在3GPP技术报告TR 23.700-41中，UE可能需要在归属网络触发UPU(UE Parameters Update，UE参数更新)/SoR(Steering of Roaming，漫游引导)过程之前向归属网络指示UPU/SoR能力。然而，该能力指示信息可能被VPLMN篡改或删除。因此，需要设计一个安全机制，使得终端设备能够安全地向归属网络中的核心网设备指示自己的UPU/SoR能力。
可以理解的是，在本申请各实施例中，终端设备和各核心网设备之间的信息交互是通过接入网设备的透传完成的。
可以理解的是，本申请实施例描述的通信系统是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着系统架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
下面结合附图对本申请所提供的终端设备能力指示方法及其装置进行详细地介绍。
请参见图2，图2是本申请实施例提供的一种终端设备能力指示方法的流程示意图。需要说明的是，本申请实施例的终端设备能力指示方法由终端设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图2所示，该方法可以包括如下步骤：
步骤201，接收第一核心网设备通过访问网络发送的能力请求消息。
在本申请实施例中，终端设备能够接收第一核心网设备通过访问网络发送的能力请求消息，该能力请求消息用于请求终端设备向第一核心网设备指示该终端设备的能力。
在本申请实施例中，第一核心网设备可以为归属网络HPLMN中的统一数据管理UDM。终端设备可以接收UDM通过访问网络VPLMN中的AMF发送的能力请求消息。
可选地，终端设备的能力为终端设备的UPU/SoR能力，该终端设备的UPU/SoR能力能够指示该终端设备是否支持基于切片的SoR信息。
在本申请实施例中，该能力请求消息包括UPU计数器Counter UPU和/或第二指示信息，其中，第二指示信息用于指示终端设备使用的安全保护算法，安全保护算法包括完整性保护算法和机密性保护算法。
作为一种可能的实现，该能力请求消息包括UPU计数器Counter UPU；
作为另一种可能的实现，该能力请求消息包括UPU计数器Counter UPU和第二指示信息。
在本申请实施例中，该UPU计数器Counter UPU和第二指示信息，均为鉴权服务功能AUSF确定的。
需要说明的是，关于该UPU计数器Counter UPU的定义，可以参考3GPP技术规范TS 33.501。
步骤202，根据该能力请求消息，通过访问网络向该第一核心网设备发送第一信息和/或该终端设备的标识。
在本申请实施例中，终端设备在接收到该能力请求消息之后，能够根据该能力请求消息向第一核心网设备发送第一信息和/或该终端设备的标识，该第一信息能够指示该终端设备的能力。
其中，该第一信息包括第一指示信息和完整性校验码，该第一指示信息用于指示该终端设备的能力。
可选地，该第一指示信息用于指示该终端设备的UPU/SoR能力。
在本申请实施例中，该第一指示信息可以包括以下至少一种信息：
该终端设备的参数更新UPU/漫游引导SoR能力信息；
该终端设备的位置信息；
该终端设备的请求网络切片选择辅助信息(Requested Network Slice Selection Assistance Information，Requested-NSSAI)。
可选地，该终端设备的标识可以为该终端设备的用户永久标识符(Subscription Permanent Identifier，SUPI)或者该终端设备的用户隐藏标识符(Subscription Concealed Identifier，SUCI)。
该终端设备可以不向第一核心网设备发送该终端设备的标识，第一核心网设备可以通过会话参数获取该终端设备的SUPI。
在一些实施方式中，终端设备接收到的该能力请求消息包括UPU计数器Counter UPU，终端设备能够根据终端设备对应的安全密钥K AUSF，该能力请求消息中的UPU计数器Counter UPU，以及第一指示信息，采用预设的完整性保护算法，生成完整性校验码UC-MAC1-I UE，并向第一核心网设备发送包括该第一指示信息和该完整性校验码UC-MAC1-I UE的第一信息。
在一些实施方式中，终端设备接收到的该能力请求消息包括UPU计数器Counter UPU和第二指示信息，该第二指示信息仅指示了完整性保护的算法。终端设备能够根据终端设备对应的安全密钥K AUSF，该能力请求消息中的UPU计数器Counter UPU，以及第一指示信息，采用该第二指示信息指示的完整性保护算法，生成完整性校验码UC-MAC1-I UE，并向第一核心网设备发送包括该第一指示信息和该完整性校验码UC-MAC1-I UE的第一信息。
在一些实施方式中，终端设备接收到的该能力请求消息包括UPU计数器Counter UPU和第二指示信息，终端设备能够根据安全密钥K AUSF和UPU计数器Counter UPU，采用第二指示信息指示的机密性保护算法，对第一指示信息进行加密，得到加密的第一指示信息。然后再根据安全密钥K AUSF，UPU计数器Counter UPU以及该加密的第一指示信息，采用第二指示信息指示的完整性保护算法，生成完整性校验码UC-MAC1-I UE，并向第一核心网设备发送包括该加密的第一指示信息和该完整性校验码UC-MAC1-I UE的第一信息。
在一些实施方式中，终端设备接收到的该能力请求消息包括UPU计数器Counter UPU和第二指示信 息，终端设备能够根据安全密钥K AUSF，UPU计数器Counter UPU，以及第一指示信息，采用第二指示信息指示的完整性保护算法，生成完整性校验码UC-MAC1-I UE。再根据安全密钥K AUSF和UPU计数器Counter UPU，采用第二指示信息指示的机密性保护算法，对第一指示信息和该完整性校验码UC-MAC1-I UE进行加密，得到第一信息，并向第一核心网设备发送该第一信息。
也就是，如果终端设备接收到的能力请求消息中包括UPU计数器而不包括指示安全保护算法的第二指示信息，终端设备采用完整性保护的安全机制，保护该能力指示的过程。如果终端设备接收到的能力请求消息中包括UPU计数器以及指示安全保护算法的第二指示信息，终端设备采用完整性和机密性保护的安全机制，保护该能力指示的过程。
对于采用完整性和机密性保护的安全机制的情况，可选地，终端设备可以先使用该机密性保护算法对第一指示信息进行加密，然后再生成完整性校验码；也可以先生成完整性校验码，再使用该机密性保护算法对生成的完整性校验码和第一指示信息进行加密。
在本申请实施例中，终端设备发送给第一核心网设备的第一信息，会被转发至第二核心网设备进行验证。其中，第二核心网设备为鉴权服务功能AUSF。
需要说明的是，在本申请各实施例中，与终端设备对应的安全密钥K AUSF，是在该终端设备初始注册时，该终端设备的归属网络中的AUSF生成的密钥，终端设备与AUSF都存储有该安全密钥，且该安全密钥与终端设备是对应的。
可以理解的是，在本申请各实施例中，终端设备与核心网设备之间的信息交互是通过接入网设备的透传完成的。
综上，通过接收第一核心网设备通过访问网络发送的能力请求消息，根据该能力请求消息，通过该访问网络向该第一核心网设备发送第一信息和/或该终端设备的标识，该第一信息包括第一指示信息和完整性校验码，该第一指示信息用于指示该终端设备的能力，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。
请参见图3，图3是本申请实施例提供的一种终端设备能力指示方法的流程示意图。需要说明的是，本申请实施例的终端设备能力指示方法由终端设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图3所示，该方法可以包括如下步骤：
步骤301，接收归属网络的第一核心网设备通过访问网络发送的能力请求消息，该能力请求消息包括UPU计数器。
在本申请实施例中，终端设备能够接收第一核心网设备通过访问网络发送的能力请求消息，该能力请求消息用于请求终端设备向第一核心网设备指示该终端设备的能力。
在本申请实施例中，终端设备接收到的能力请求消息中仅包括UPU计数器Counter UPU。
在本申请实施例中，第一核心网设备可以为归属网络HPLMN中的统一数据管理UDM。终端设备可以接收UDM通过访问网络VPLMN中的AMF发送的能力请求消息。
在一些实施方式中，UDM可以将该能力请求消息包括在Nudm_SDM_Notify消息中，发送给AMF，AMF再将该能力请求消息包括在DL NAS TRANSPORT消息中，发送给终端设备。
在一些实施方式中，该能力请求消息可以是一个UPU透明容器(UPU transparent container)，该UPU透明容器中可以包括该UPU计数器Counter UPU。
可选地，终端设备的能力为终端设备的UPU/SoR能力，该终端设备的UPU/SoR能力能够指示该终端设备是否支持基于切片的SoR信息。
在本申请实施例中，该UPU计数器Counter UPU，为鉴权服务功能AUSF确定的。
需要说明的是，关于UPU透明容器以及该UPU计数器Counter UPU的定义，可以参考3GPP技术规范TS 33.501。
步骤302，根据终端设备对应的安全密钥K AUSF，该UPU计数器以及第一指示信息，采用预设的完整性保护算法，生成完整性校验码。
在本申请实施例中，终端设备接收到的能力请求消息中仅包括UPU计数器Counter UPU，终端设备采用完整性保护的安全机制。终端设备能够根据终端设备对应的安全密钥K AUSF，该UPU计数器Counter UPU以及第一指示信息，采用预设的完整性保护算法，生成完整性校验码UC-MAC1-I UE。
其中，第一指示信息用于指示该终端设备的能力。
可选地，该第一指示信息用于指示该终端设备的UPU/SoR能力。
在本申请实施例中，该第一指示信息可以包括以下至少一种信息：
该终端设备的参数更新UPU/漫游引导SoR能力信息；
该终端设备的位置信息；
该终端设备的请求网络切片选择辅助信息Requested-NSSAI。
在一些实施方式中，该第一指示信息可以为NAS UL TRANSPORT消息中的UPU应答透明容器(UPU ACK transparent container)，该第一指示信息也可以为该终端设备的能力信息，被包括在该UPU ACK透明容器中。
在一些实施方式中，可以采用密钥导出函数(Key Derivation Function，KDF)来生成该完整性校验码UC-MAC1-I UE。
可选地，生成该完整性校验码UC-MAC1-I UE的密钥导出函数KDF的输入参数KEY为该安全密钥K AUSF。该密钥导出函数KDF的输入参数S可以包括：
该密钥导出函数的编码号FC；
参数P0为第一指示信息；
参数L0为参数P0中包括的数据的长度，也就是该第一指示信息的数据的长度；
参数P1为UPU计数器Counter UPU；
参数L1为该UPU计数器Counter UPU的长度。
在本申请实施例中，该预设的完整性保护算法可以是协议规定的，也可以是网络侧指示的。
步骤303，通过访问网络向该第一核心网设备发送第一信息和/或该终端设备的标识，该第一信息包括该第一指示信息和该完整性校验码。
在本申请实施例中，终端设备在生成该完整性校验码UC-MAC1-I UE之后，能够通过访问网络向第一核心网设备发送第一信息，其中，该第一信息包括该第一指示信息以及步骤302中生成的该完整性校验码UC-MAC1-I UE。
在一些实施方式中，终端设备可以将该第一信息和该终端设备的标识包括在NAS UL TRANSPORT消息中发送给AMF，AMF再将该第一信息和该终端设备的标识包括在Nudm_SDM_Info消息中发送给UDM。
可选地，该终端设备的标识可以为该终端设备的用户永久标识符SUPI或者该终端设备的用户隐藏标识符SUCI。
在本申请实施例中，终端设备发送给第一核心网设备UDM的第一信息，会被转发至第二核心网设备进行验证。其中，第二核心网设备为鉴权服务功能AUSF。
综上，通过接收归属网络的第一核心网设备通过访问网络发送的能力请求消息，该能力请求消息包括UPU计数器，根据终端设备对应的安全密钥K AUSF，该UPU计数器以及第一指示信息，生成完整性校验码，通过访问网络向该第一核心网设备发送第一信息，该第一信息包括该第一指示信息和该 完整性校验码，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。
请参见图4，图4是本申请实施例提供的一种终端设备能力指示方法的流程示意图。需要说明的是，本申请实施例的终端设备能力指示方法由终端设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图4所示，该方法可以包括如下步骤：
步骤401，接收归属网络的第一核心网设备通过访问网络发送的能力请求消息，该能力请求消息包括UPU计数器和第二指示信息。
在本申请实施例中，终端设备能够接收第一核心网设备通过访问网络发送的能力请求消息，该能力请求消息用于请求终端设备向第一核心网设备指示该终端设备的能力。
在本申请实施例中，终端设备接收到的能力请求消息中包括UPU计数器Counter UPU和第二指示信息。其中，第二指示信息用于指示终端设备使用的安全保护算法，该安全保护算法包括完整性保护算法和机密性保护算法。
在本申请实施例中，第一核心网设备可以为归属网络HPLMN中的统一数据管理UDM。终端设备可以接收UDM通过访问网络VPLMN中的AMF发送的能力请求消息。
在一些实施方式中，UDM可以将该能力请求消息包括在Nudm_SDM_Notify消息中，发送给AMF，AMF再将该能力请求消息包括在DL NAS TRANSPORT消息中，发送给终端设备。
在一些实施方式中，该能力请求消息可以是一个UPU透明容器，该UPU透明容器中可以包括该UPU计数器Counter UPU和第二指示信息。
可选地，终端设备的能力为终端设备的UPU/SoR能力，该终端设备的UPU/SoR能力能够指示该终端设备是否支持基于切片的SoR信息。
在本申请实施例中，该UPU计数器Counter UPU和该第二指示信息，均为鉴权服务功能AUSF确定的。AUSF可以根据自身的安全能力和终端设备的安全能力来选择安全保护算法。
需要说明的是，关于UPU透明容器以及该UPU计数器Counter UPU的定义，可以参考3GPP技术规范TS 33.501。
步骤402，根据该终端设备对应的安全密钥K AUSF和该UPU计数器，采用该第二指示信息指示的该机密性保护算法，对第一指示信息进行加密，得到加密的第一指示信息。
在本申请实施例中，终端设备接收到的能力请求消息中包括UPU计数器Counter UPU和第二指示信息。终端设备根据第二指示信息的指示，采用完整性和机密性保护的安全机制。终端设备可以采用先进行机密性保护再生成完整性校验码的方式，能够根据该终端设备对应的安全密钥K AUSF和该UPU计数器，采用该第二指示信息指示的机密性保护算法，对第一指示信息进行加密，得到加密的第一指示信息。
其中，该第一指示信息用于指示终端设备的能力。
可选地，该第一指示信息用于指示该终端设备的UPU/SoR能力。
在本申请实施例中，该第一指示信息可以包括以下至少一种信息：
该终端设备的参数更新UPU/漫游引导SoR能力信息；
该终端设备的位置信息；
该终端设备的请求网络切片选择辅助信息Requested-NSSAI。
在一些实施方式中，该第一指示信息可以为NAS UL TRANSPORT消息中的UPU应答透明容器，该第一指示信息也可以为该终端设备的能力信息，被包括在该UPU ACK透明容器中。
在一些实施方式中，该机密性保护算法的输入参数可以为：
参数KEY(密钥)为该安全密钥K AUSF；
参数COUNT(计数器)为该UPU计数器Counter UPU；
参数BEARER(承载)为0x00；
参数DIRECTION(方向)为0x00；
参数LENGTH(长度)：LEN(第一指示信息)，其中LEN(x)表示x的长度(以位数表示)。
该机密性保护算法可以是AUSF根据自身的安全能力和终端设备的安全能力来选择确定的，并通过第二指示信息指示给终端设备。
需要说明的是，关于机密性保护算法的使用和操作模式可以参考3GPP技术规范TS 33.501的附件D.2中的规定。
步骤403，根据该安全密钥K AUSF，该UPU计数器以及该加密的第一指示信息，采用该第二指示信息指示的完整性保护算法，生成完整性校验码。
在本申请实施例中，在采用第二指示信息指示的机密性保护算法对第一指示信息进行加密之后，终端设备能够根据该安全密钥K AUSF，该UPU计数器Counter UPU以及该加密的第一指示信息，采用该第二指示信息指示的完整性保护算法，生成完整性校验码UC-MAC1-I UE。
在一些实施方式中，可以采用密钥导出函数KDF来生成该完整性校验码UC-MAC1-I UE。
可选地，生成该完整性校验码UC-MAC1-I UE的密钥导出函数KDF的输入参数KEY为该安全密钥K AUSF。该密钥导出函数KDF的输入参数S可以包括：
该密钥导出函数的编码号FC；
参数P0为该加密的第一指示信息；
参数L0为参数P0中包括的数据的长度，也就是该加密的第一指示信息的数据的长度；
参数P1为UPU计数器Counter UPU；
参数L1为该UPU计数器Counter UPU的长度。
步骤404，通过访问网络向该第一核心网设备发送第一信息和/或该终端设备的标识，该第一信息包括该加密的第一指示信息和该完整性校验码。
在本申请实施例中，终端设备在生成该完整性校验码UC-MAC1-I UE之后，能够通过访问网络向第一核心网设备发送第一信息，其中，该第一信息包括步骤402中生成的该加密的第一指示信息以及步骤403中生成的该完整性校验码UC-MAC1-I UE。
在一些实施方式中，终端设备可以将该第一信息和该终端设备的标识包括在NAS UL TRANSPORT消息中发送给AMF，AMF再将该第一信息和该终端设备的标识包括在Nudm_SDM_Info消息中发送给UDM。
可选地，该终端设备的标识可以为该终端设备的SUPI或者该终端设备的SUCI。
在本申请实施例中，终端设备发送给第一核心网设备UDM的第一信息，会被转发至第二核心网设备进行验证。其中，第二核心网设备为鉴权服务功能AUSF。
综上，通过接收归属网络的第一核心网设备通过访问网络发送的能力请求消息，该能力请求消息包括UPU计数器和第二指示信息，根据该终端设备对应的安全密钥K AUSF和该UPU计数器，采用该第二指示信息指示的机密性保护算法，对第一指示信息进行加密，得到加密的第一指示信息，根据该安全密钥K AUSF，该UPU计数器以及该加密的第一指示信息，生成完整性校验码，通过访问网络向该第一核心网设备发送第一信息，该第一信息包括该加密的第一指示信息和该完整性校验码，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。
请参见图5，图5是本申请实施例提供的一种终端设备能力指示方法的流程示意图。需要说明的是，本申请实施例的终端设备能力指示方法由终端设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图5所示，该方法可以包括如下步骤：
步骤501，接收归属网络的第一核心网设备通过访问网络发送的能力请求消息，该能力请求消息包括UPU计数器和第二指示信息。
在本申请实施例中，终端设备能够接收第一核心网设备通过访问网络发送的能力请求消息，该能力请求消息用于请求终端设备向第一核心网设备指示该终端设备的能力。
在本申请实施例中，终端设备接收到的能力请求消息中包括UPU计数器Counter UPU和第二指示信息。其中，第二指示信息用于指示终端设备使用的安全保护算法，该安全保护算法包括完整性保护算法和机密性保护算法。
在本申请实施例中，第一核心网设备可以为归属网络HPLMN中的统一数据管理UDM。终端设备可以接收UDM通过访问网络VPLMN中的AMF发送的能力请求消息。
在一些实施方式中，UDM可以将该能力请求消息包括在Nudm_SDM_Notify消息中，发送给AMF，AMF再将该能力请求消息包括在DL NAS TRANSPORT消息中，发送给终端设备。
在一些实施方式中，该能力请求消息可以是一个UPU透明容器，该UPU透明容器中可以包括该UPU计数器Counter UPU和第二指示信息。
可选地，终端设备的能力为终端设备的UPU/SoR能力，该终端设备的UPU/SoR能力能够指示该终端设备是否支持基于切片的SoR信息。
在本申请实施例中，该UPU计数器Counter UPU和该第二指示信息，均为鉴权服务功能AUSF确定的。AUSF可以根据自身的安全能力和终端设备的安全能力来选择安全保护算法。
需要说明的是，关于UPU透明容器以及该UPU计数器Counter UPU的定义，可以参考3GPP技术规范TS 33.501。
步骤502，根据该终端设备对应的安全密钥K AUSF，该UPU计数器以及该第一指示信息，采用该第二指示信息指示的完整性保护算法，生成完整性校验码。
在本申请实施例中，终端设备接收到的能力请求消息中包括UPU计数器Counter UPU和第二指示信息。终端设备根据第二指示信息的指示，采用完整性和机密性保护的安全机制。终端设备可以采用先生成完整性校验码再进行机密性保护的方式，能够根据该终端设备对应的安全密钥K AUSF，该UPU计数器，以及第一指示信息，生成完整性校验码UC-MAC1-I UE。
其中，该第一指示信息用于指示终端设备的能力。
可选地，该第一指示信息用于指示该终端设备的UPU/SoR能力。
在本申请实施例中，该第一指示信息可以包括以下至少一种信息：
该终端设备的参数更新UPU/漫游引导SoR能力信息；
该终端设备的位置信息；
该终端设备的请求网络切片选择辅助信息Requested-NSSAI。
在一些实施方式中，该第一指示信息可以为NAS UL TRANSPORT消息中的UPU应答透明容器，该第一指示信息也可以为该终端设备的能力信息，被包括在该UPU ACK透明容器中。
在一些实施方式中，可以采用密钥导出函数KDF来生成该完整性校验码UC-MAC1-I UE。
可选地，生成该完整性校验码UC-MAC1-I UE的密钥导出函数KDF的输入参数KEY为该安全密钥K AUSF。该密钥导出函数KDF的输入参数S可以包括：
该密钥导出函数的编码号FC；
参数P0为该第一指示信息；
参数L0为参数P0中包括的数据的长度，也就是该第一指示信息的数据的长度；
参数P1为UPU计数器Counter UPU；
参数L1为该UPU计数器Counter UPU的长度。
步骤503，根据该安全密钥K AUSF和该UPU计数器，采用该第二指示信息指示的机密性保护算法，对第一指示信息和该完整性校验码进行加密，得到第一信息。
在本申请实施例中，在生成了该完整性校验码UC-MAC1-I UE之后，终端设备能够采用该第二指示信息指示的机密性保护算法，对第一指示信息和该完整性校验码UC-MAC1-I UE进行加密，得到第一信息。
在一些实施方式中，该机密性保护算法的输入参数可以为：
参数KEY(密钥)为该安全密钥K AUSF；
参数COUNT(计数器)为该UPU计数器Counter UPU；
参数BEARER(承载)为0x00；
参数DIRECTION(方向)为0x00；
参数LENGTH(长度)：LEN(第一指示信息+完整性校验码UC-MAC1-I UE)，其中LEN(x)表示x的长度(以位数表示)。
该机密性保护算法可以是AUSF根据自身的安全能力和终端设备的安全能力来选择确定的，并通过第二指示信息指示给终端设备。
需要说明的是，关于机密性保护算法的使用和操作模式可以参考3GPP技术规范TS 33.501的附件D.2中的规定。
步骤504，通过访问网络向该第一核心网设备发送该第一信息和/或该终端设备的标识。
在本申请实施例中，终端设备能够通过访问网络向第一核心网设备发送第一信息和该终端设备的标识，其中，该第一信息是对该第一指示信息和步骤502中生成的该完整性校验码UC-MAC1-I UE进行加密得到的。
在一些实施方式中，终端设备可以将该第一信息和该终端设备的标识包括在NAS UL TRANSPORT消息中发送给AMF，AMF再将该第一信息和该终端设备的标识包括在Nudm_SDM_Info消息中发送给UDM。
可选地，该终端设备的标识可以为该终端设备的SUPI或者该终端设备的SUCI。
在本申请实施例中，终端设备发送给第一核心网设备UDM的第一信息，会被转发至第二核心网设备进行验证。其中，第二核心网设备为鉴权服务功能AUSF。
综上，通过接收归属网络的第一核心网设备通过访问网络发送的能力请求消息，该能力请求消息包括UPU计数器和第二指示信息，根据该终端设备对应的安全密钥K AUSF，该UPU计数器以及该加密的第一指示信息，生成完整性校验码，根据该安全密钥K AUSF和该UPU计数器，采用该第二指示信息指示的机密性保护算法，对第一指示信息和该完整性校验码进行加密，得到第一信息，通过访问网络向该第一核心网设备发送该第一信息，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。
请参见图6，图6是本申请实施例提供的一种终端设备能力指示方法的流程示意图。需要说明的是，本申请实施例的终端设备能力指示方法由第一核心网设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图6所示，该方法可以包括如下步骤：
步骤601，通过访问网络向终端设备发送能力请求消息，该能力请求消息用于请求该终端设备指 示该终端设备的能力。
在本申请实施例中，第一核心网设备能够通过访问网络VPLMN向终端设备发送能力请求消息，终端设备在接收到该能力请求消息之后，能够向第一核心网设备返回该终端设备的能力。
在本申请实施例中，第一核心网设备可以为归属网络HPLMN中的统一数据管理UDM。UDM可以通过访问网络VPLMN中的AMF向终端设备发送能力请求消息。
可选地，终端设备的能力为终端设备的UPU/SoR能力，该终端设备的UPU/SoR能力能够指示该终端设备是否支持基于切片的SoR信息。
在一些实施方式中，第一核心网设备能够接收第二核心网设备发送的UPU计数器Counter UPU和/或第二指示信息，第一核心网设备向终端设备发送的该能力请求消息包括UPU计数器Counter UPU和/或第二指示信息，其中，第二指示信息用于指示终端设备使用的安全保护算法，该安全保护算法包括完整性保护算法和机密性保护算法。
作为一种可能的实现，第一核心网设备能够接收第二核心网设备发送的UPU计数器Counter UPU，该能力请求消息包括该UPU计数器Counter UPU；
作为另一种可能的实现，第一核心网设备能够接收第二核心网设备发送的UPU计数器Counter UPU和第二指示信息，该能力请求消息包括该UPU计数器Counter UPU和该第二指示信息。
在本申请实施例中，第二核心网设备可以为归属网络HPLMN中的鉴权服务功能AUSF。该UPU计数器Counter UPU和第二指示信息，均为AUSF确定的。
需要说明的是，关于该UPU计数器Counter UPU的定义，可以参考3GPP技术规范TS 33.501。
在本申请各实施例中，是由第一核心网设备UDM决定获取终端设备的能力，以确定该终端设备是否支持基于切片的SoR信息。
可选地，UDM可以基于例如本地配置、特定公用陆地移动网络(Public Land Mobile Network，PLMN)中的终端设备的位置，或者SoR AF发送给UDM的指示信息，确定触发获取终端设备的UPU/SoR能力。
步骤602，接收该终端设备通过该访问网络发送的第一信息和/或该终端设备的标识。
在本申请实施例中，第一核心网设备在向终端设备发送能力请求消息之后，可以接收该终端设备通过该访问网络返回的该第一信息。其中，该第一信息包括第一指示信息和完整性校验码，该第一指示信息用于指示该终端设备的能力。
在本申请实施例中，该第一指示信息可以包括以下至少一种信息：
该终端设备的参数更新UPU/漫游引导SoR能力信息；
该终端设备的位置信息；
该终端设备的请求网络切片选择辅助信息Requested-NSSAI。
可选地，接收的该终端设备的标识可以为该终端设备的SUPI或SUCI。
可选地，第一核心网设备可以接收终端设备发送的SUPI或SUCI，也可以从会话参数中获取该终端设备的SUPI，进而发送给第二核心网设备。
在一些实施方式中，响应于该能力请求消息包括该UPU计数器Counter UPU，第一核心网设备接收到的该第一信息包括第一指示信息和完整性校验码；其中，该完整性校验码是根据该终端设备对应的安全密钥K AUSF，该UPU计数器Counter UPU以及该第一指示信息，采用预设的完整性保护算法生成的。
在一些实施方式中，响应于该能力请求消息包括该UPU计数器Counter UPU和该第二指示信息，该第二指示信息仅指示完整性保护算法，终端设备能够根据终端设备对应的安全密钥K AUSF，该能力请求消息中的UPU计数器Counter UPU，以及第一指示信息，采用该第二指示信息指示的完整性保护算法，生成完整性校验码UC-MAC1-I UE，并向第一核心网设备发送包括该第一指示信息和该完整性校验码 UC-MAC1-I UE的第一信息。
在一些实施方式中，响应于该能力请求消息包括该UPU计数器Counter UPU和该第二指示信息，第一核心网设备接收到的该第一信息包括加密的第一指示信息和完整性校验码；其中，该加密的第一指示信息是，根据该终端设备对应的安全密钥K AUSF和该UPU计数器Counter UPU，采用该第二指示信息指示的机密性保护算法，对该第一指示信息进行加密得到的；该完整性校验码是，根据该安全密钥K AUSF，该UPU计数器Counter UPU以及该加密的第一指示信息，采用该第二指示信息指示的完整性保护算法生成的。
在一些实施方式中，响应于该能力请求消息包括该UPU计数器Counter UPU和该第二指示信息，第一核心网设备接收到的该第一信息是，根据该安全密钥K AUSF，该UPU计数器Counter UPU，采用该第二指示信息指示的机密性保护算法，对第一指示信息和完整性校验码进行加密得到的；该完整性校验码是根据该安全密钥K AUSF，该UPU计数器Counter UPU以及该第一指示信息，采用该第二指示信息指示的完整性保护算法生成的。
在本申请实施例中，第一核心网设备能够将该第一信息和该终端设备的标识发送给第二核心网设备，以使第二核心网设备根据第一信息中的完整性校验码验证该第一信息是否被篡改。其中，该终端设备的标识为该终端设备的SUPI。
在本申请实施例中，第一核心网设备还能够接收第二核心网设备在验证之后发送的第一指示信息，并能根据该第一指示信息确定终端设备的能力，确定终端设备是否支持基于切片的SoR信息。
可以理解的是，在本申请实施例中，第一核心网设备在获取到终端设备的能力之后，可以根据终端设备的能力，向SoR AF请求基于网络切片的SoR信息等等。
综上，通过通过访问网络向终端设备发送能力请求消息，该能力请求消息用于请求该终端设备指示该终端设备的能力，接收该终端设备通过该访问网络发送的第一信息，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。
请参见图7，图7是本申请实施例提供的一种终端设备能力指示方法的流程示意图。需要说明的是，本申请实施例的终端设备能力指示方法由第一核心网设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图7所示，该方法可以包括如下步骤：
步骤701，接收第二核心网设备发送的UPU计数器Counter UPU和/或第二指示信息。
在本申请实施例中，第一核心网设备能够接收第二核心网设备发送的UPU计数器Counter UPU和/或第二指示信息，其中，第二指示信息用于指示终端设备使用的安全保护算法，该安全保护算法包括完整性保护算法和机密性保护算法。
在本申请实施例中，第一核心网设备可以为归属网络HPLMN中的统一数据管理UDM，第二核心网设备可以为HPLMN中的鉴权服务功能AUSF。
作为一种可能的实现，第一核心网设备能够接收第二核心网设备发送的UPU计数器Counter UPU；
作为另一种可能的实现，第一核心网设备能够接收第二核心网设备发送的UPU计数器Counter UPU和第二指示信息。
在本申请实施例中，该UPU计数器Counter UPU和第二指示信息，均为AUSF确定的。
需要说明的是，关于该UPU计数器Counter UPU的定义，可以参考3GPP技术规范TS 33.501。
步骤702，通过访问网络向终端设备发送能力请求消息，该能力请求消息用于请求该终端设备指示该终端设备的能力。
在本申请实施例中，第一核心网设备能够通过访问网络VPLMN向终端设备发送能力请求消息， 终端设备在接收到该能力请求消息之后，能够向第一核心网设备返回该终端设备的能力。
在本申请实施例中，UDM通过访问网络VPLMN中的AMF向终端设备发送能力请求消息。
在一些实施方式中，UDM可以将该能力请求消息包括在Nudm_SDM_Notify消息中，发送给AMF，AMF再将该能力请求消息包括在DL NAS TRANSPORT消息中，发送给终端设备。
可选地，终端设备的能力为终端设备的UPU/SoR能力，该终端设备的UPU/SoR能力能够指示该终端设备是否支持基于切片的SoR信息。
在一些实施方式中，第一核心网设备能够接收第二核心网设备发送的UPU计数器Counter UPU，向终端设备发送的该能力请求消息包括该UPU计数器Counter UPU；
在一些实施方式中，第一核心网设备能够接收第二核心网设备发送的UPU计数器Counter UPU和第二指示信息，向终端设备发送的该能力请求消息包括该UPU计数器Counter UPU和该第二指示信息。
在一些实施方式中，该能力请求消息可以是一个UPU透明容器，该UPU透明容器中可以包括该UPU计数器Counter UPU和/或第二指示信息。
步骤703，接收该终端设备通过该访问网络发送的第一信息和/或该终端设备的标识。
在本申请实施例中，第一核心网设备在向终端设备发送能力请求消息之后，可以接收该终端设备通过该访问网络返回的该第一信息。其中，该第一信息包括第一指示信息和完整性校验码，该第一指示信息用于指示该终端设备的能力。
在本申请实施例中，该第一指示信息可以包括以下至少一种信息：
该终端设备的参数更新UPU/漫游引导SoR能力信息；
该终端设备的位置信息；
该终端设备的请求网络切片选择辅助信息Requested-NSSAI。
在一些实施方式中，响应于该能力请求消息包括该UPU计数器Counter UPU，第一核心网设备接收到的该第一信息包括第一指示信息和完整性校验码；其中，该完整性校验码是根据该终端设备对应的安全密钥K AUSF，该UPU计数器Counter UPU以及该第一指示信息，采用预设的完整性保护算法生成的。
在一些实施方式中，响应于该能力请求消息包括该UPU计数器Counter UPU和该第二指示信息，第一核心网设备接收到的该第一信息包括加密的第一指示信息和完整性校验码；其中，该加密的第一指示信息是，根据该终端设备对应的安全密钥K AUSF和该UPU计数器Counter UPU，采用该第二指示信息指示的机密性保护算法，对该第一指示信息进行加密得到的；该完整性校验码是，根据该安全密钥K AUSF，该UPU计数器Counter UPU以及该加密的第一指示信息，采用该第二指示信息指示的完整性保护算法生成的。
在一些实施方式中，响应于该能力请求消息包括该UPU计数器Counter UPU和该第二指示信息，第一核心网设备接收到的该第一信息是，根据该安全密钥K AUSF，该UPU计数器Counter UPU，采用该第二指示信息指示的机密性保护算法，对第一指示信息和完整性校验码进行加密得到的；该完整性校验码是根据该安全密钥K AUSF，该UPU计数器Counter UPU以及该第一指示信息，采用该第二指示信息指示的完整性保护算法生成的。
在一些实施方式中，终端设备可以将该第一信息和该终端设备的标识包括在NAS UL TRANSPORT消息中发送给AMF，AMF再将该第一信息和该终端设备的标识包括在Nudm_SDM_Info消息中发送给UDM。
可选地，该终端设备的标识可以为该终端设备的SUPI或者该终端设备的SUCI。
步骤704，向该第二核心网设备发送该第一信息和该终端设备的标识。
在本申请实施例中，第一核心网设备能够将该第一信息和该终端设备的标识发送给第二核心网设备。
其中，该第一信息中的完整性校验码用于第二核心网设备验证该第一信息是否被篡改。
可选地，该终端设备的标识为SUPI。
可以理解的是，如果第一核心网设备获取到的终端设备的标识为SUPI，则该第一核心网设备直接向第二核心网设备发送该终端设备的SUPI，如果该第一核心网设备获取到的终端设备的标识为SUCI，则第一核心网设备会根据该SUCI解密得到该终端设备的SUPI，并将该SUPI发送给第二核心网设备。
在本申请实施例中，第一核心网设备还能够接收第二核心网设备在验证之后发送的第一指示信息，并能根据该第一指示信息确定终端设备的能力，确定终端设备是否支持基于切片的SoR信息。
可以理解的是，在本申请实施例中，第一核心网设备在获取到终端设备的能力之后，可以根据终端设备的能力，向SoR AF请求基于网络切片的SoR信息等等。
综上，通过接收第二核心网设备发送的UPU计数器Counter UPU和/或第二指示信息，通过访问网络向终端设备发送能力请求消息，该能力请求消息用于请求该终端设备指示该终端设备的能力，接收该终端设备通过该访问网络发送的第一信息，向该第二核心网设备发送该第一信息，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。
请参见图8，图8是本申请实施例提供的一种终端设备能力指示方法的流程示意图。需要说明的是，本申请实施例的终端设备能力指示方法由第二核心网设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图8所示，该方法可以包括如下步骤：
步骤801，接收第一核心网设备发送的第一信息和终端设备的标识。
其中，该第一信息包括第一指示信息和完整性校验码，该第一指示信息用于指示该终端设备的能力。
在本申请实施例中，第二核心网设备能够接收第一核心网设备发送的第一信息和终端设备标识，并能够根据该第一信息中包括的完整性校验码验证该第一信息是否被篡改。
在本申请实施例中，第一核心网设备可以为归属网络HPLMN中的统一数据管理UDM，第二核心网设备可以为HPLMN中的鉴权服务功能AUSF。
可选地，该第一指示信息用于指示该终端设备的UPU/SoR能力。
在本申请实施例中，该第一指示信息可以包括以下至少一种信息：
该终端设备的参数更新UPU/漫游引导SoR能力信息；
该终端设备的位置信息；
该终端设备的请求网络切片选择辅助信息Requested-NSSAI。
在一些实施方式中，第二核心网设备能够向第一核心网设备发送UPU计数器和/或第二指示信息，其中，该第二指示信息用于指示终端设备使用的安全保护算法，该安全保护算法包括完整性保护算法和机密性保护算法。
作为一种可能的实现，第二核心网设备能够向第一核心网设备发送UPU计数器Counter UPU；
作为另一种可能的实现，第二核心网设备能够向第一核心网设备发送UPU计数器Counter UPU和第二指示信息。
可选地，该第二指示信息指示的安全保护算法，可以是第二核心网设备根据自身的安全能力以及终端设设备的安全能力选择确定的，并通过该第二指示信息指示给该终端设备。
在本申请实施例中，第二核心网设备接收到第一核心网设备发送的终端设备的标识，并能根据该终端设备的标识，确定自身存储的与该终端设备对应的安全密钥K AUSF。
可选地，该终端设备的标识为SUPI。
在一些实施方式中，响应于接收到的第一信息包括第一指示信息和完整性校验码，第二核心网设备能够根据该终端设备的标识，确定第二核心网设备中存储的与该终端设备对应的安全密钥K AUSF；然后根据该安全密钥K AUSF，UPU计数器Counter UPU以及第一信息中的第一指示信息，采用预设的完整性保护算法，生成一个新的完整性校验码；判断该新的完整性校验码与第一信息中的完整性校验码的一致性。
如果该新的完整性校验码与第一信息中的完整性校验码一致，向第一核心网设备发送该第一指示信息；
如果该新的完整性校验码与第一信息中的完整性校验码不一致，终止该终端设备的能力的指示过程。
在一些实施方式中，响应于接收到的第一信息包括加密的第一指示信息和完整性校验码，第二核心网设备能够根据该终端设备的标识，确定所述第二核心网设备中存储的与该终端设备对应的安全密钥K AUSF；然后根据该安全密钥K AUSF，UPU计数器Counter UPU以及第一信息中的加密的第一指示信息，采用该第二指示信息指示的完整性保护算法，生成一个新的完整性校验码；判断该新的完整性校验码与第一信息中的完整性校验码的一致性。
如果该新的完整性校验码与第一信息中的完整性校验码一致，向第一核心网设备发送第一指示信息；其中，该第一指示信息是，根据该安全密钥K AUSF和该UPU计数器Counter UPU，采用第二指示信息指示的机密性保护算法对该第一信息中的该加密的第一指示信息进行解密得到的；
如果该新的完整性校验码与第一信息中的完整性校验码不一致，终止该终端设备的能力的指示过程。
在一些实施方式中，响应于接收到的第一信息是对第一指示信息和完整性校验码进行加密得到的，第二核心网设备根据该终端设备的标识，确定第二核心网设备中存储的与该终端设备对应的安全密钥K AUSF；然后根据该第二指示信息指示的机密性保护算法，对接收到的第一信息进行解密，得到该第一信息中的第一指示信息和完整性校验码；根据该安全密钥K AUSF，UPU计数器Counter UPU以及解密得到的该第一指示信息，采用该第二指示信息指示的完整性保护算法，生成一个新的完整性校验码；判断该新的完整性校验码与第一信息中的完整性校验码的一致性。
如果该新的完整性校验码与第一信息中的完整性校验码一致，向第一核心网设备发送该解密得到的第一指示信息；
如果该新的完整性校验码与第一信息中的完整性校验码不一致，终止该终端设备的能力的指示过程。
综上，通过接收第一核心网设备发送的第一信息和终端设备的标识，能够通过该第一信息中的完整性校验码验证该第一信息是否被篡改，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。
请参见图9，图9是本申请实施例提供的一种终端设备能力指示方法的流程示意图。需要说明的是，本申请实施例的终端设备能力指示方法由第二核心网设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图9所示，该方法可以包括如下步骤：
步骤901，接收第一核心网设备发送的第一信息和终端设备的标识，该第一信息包括第一指示信息和完整性校验码。
在本申请实施例中，第二核心网设备能够接收第一核心网设备发送的第一信息和终端设备的标识，其中，该第一信息包括第一指示信息和完整性校验码，该第一指示信息用于指示该终端设备的能力。
在本申请实施例中，第一核心网设备可以为归属网络HPLMN中的统一数据管理UDM，第二核心网设备可以为HPLMN中的鉴权服务功能AUSF。
可选地，该第一指示信息用于指示该终端设备的UPU/SoR能力。
在本申请实施例中，该第一指示信息可以包括以下至少一种信息：
该终端设备的参数更新UPU/漫游引导SoR能力信息；
该终端设备的位置信息；
该终端设备的请求网络切片选择辅助信息Requested-NSSAI。
可选地，该第一指示信息可以为UPU ACK透明容器，该第一指示信息也可以为该终端设备的能力信息，被包括在该UPU ACK透明容器中。
可选地，该终端设备的标识为SUPI。
在本申请实施例中，第二核心网设备在接收到第一信息之后，能够确定该第一信息是否被加密，如果该第一信息是未被加密的，且该第一信息中的第一指示信息也未被加密，则确定该终端设备采用了完整性保护的安全机制。
步骤902，根据该终端设备的标识，确定第二核心网设备中存储的与该终端设备对应的安全密钥K AUSF。
在本申请实施例中，第二核心网设备AUSF能够根据终端设备的标识，确定自身中存储的与该终端设备对应的安全密钥K AUSF。
可选地，该终端设备的标识为SUPI。
步骤903，根据该安全密钥K AUSF，UPU计数器Counter UPU以及第一信息中的第一指示信息，采用预设的完整保护算法，生成一个新的完整性校验码。
在本申请实施例中，该UPU计数器是第二核心网设备确定的，并发送给终端设备用于进行安全保护的。
在一些实施方式中，可以采用密钥导出函数KDF来生成该新的完整性校验码。
可选地，生成该新的完整性校验码的密钥导出函数KDF的输入参数KEY为该安全密钥K AUSF。该密钥导出函数KDF的输入参数S可以包括：
该密钥导出函数的编码号FC；
参数P0为第一指示信息；
参数L0为参数P0中包括的数据的长度，也就是该第一指示信息的数据的长度；
参数P1为UPU计数器Counter UPU；
参数L1为该UPU计数器Counter UPU的长度。
需要说明的是，关于该UPU计数器Counter UPU的定义，可以参考3GPP技术规范TS 33.501。
可以理解的是，在本申请各实施例中，该预设的完整性保护算法可以是协议规定的，也可以是网络侧指示的。
步骤904，判断该新的完整性校验码与第一信息中的完整性校验码的一致性。
在本申请实施例中，第二核心网设备生成该新的完整性校验码之后，能够判断自己生成的该新的完整性校验码，与接收到的第一信息中的完整性校验码是否一致。如果一致，则执行步骤905，如果不一致，则执行步骤906。
步骤905，响应于该新的完整性校验码与第一信息中的完整性校验码一致，向第一核心网设备发送该第一指示信息。
在本申请实施例中，如果第二核心网设备生成的该新的完整性校验码，与接收到的第一信息中的完整性校验码一致，则说明该第一信息没有被篡改，是安全的。第二核心网设备能够向第一核心网设 备发送该第一信息中的第一指示信息。第一核心网设备能够根据该第一指示信息获取该终端设备的能力。
步骤906，响应于该新的完整性校验码与第一信息中的完整性校验码不一致，终止该终端设备的能力的指示过程。
在本申请实施例中，如果第二核心网设备生成的该新的完整性校验码，与接收到的第一信息中的完整性校验码不一致，则说明该第一信息可能被篡改，是不安全的。则第二核心网设备能够终止该终端设备的能力指示的过程。
综上，通过接收第一核心网设备发送的第一信息和终端设备的标识，该第一信息包括第一指示信息和完整性校验码，根据该终端设备的标识，确定第二核心网设备中存储的与该终端设备对应的安全密钥K AUSF，根据该安全密钥K AUSF，UPU计数器Counter UPU以及第一信息中的第一指示信息，生成一个新的完整性校验码，判断该新的完整性校验码与第一信息中的完整性校验码的一致性，响应于该新的完整性校验码与第一信息中的完整性校验码一致，向第一核心网设备发送该第一指示信息，响应于该新的完整性校验码与第一信息中的完整性校验码不一致，终止该终端设备的能力的指示过程，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。
请参见图10，图10是本申请实施例提供的一种终端设备能力指示方法的流程示意图。需要说明的是，本申请实施例的终端设备能力指示方法由第二核心网设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图9所示，该方法可以包括如下步骤：
步骤1001，接收第一核心网设备发送的第一信息和终端设备的标识，该第一信息包括加密的第一指示信息和完整性校验码。
在本申请实施例中，第二核心网设备能够接收第一核心网设备发送的第一信息和终端设备的标识，其中，该第一信息包括加密的第一指示信息和完整性校验码，该第一指示信息用于指示该终端设备的能力。
可以理解的是，该加密的第一指示信息是终端设备根据安全密钥和UPU计数器，采用第二指示信息指示的机密性保护算法对第一指示信息进行加密得到的。
在本申请实施例中，第一核心网设备可以为归属网络HPLMN中的统一数据管理UDM，第二核心网设备可以为HPLMN中的鉴权服务功能AUSF。
可选地，该第一指示信息用于指示该终端设备的UPU/SoR能力。
在本申请实施例中，该第一指示信息可以包括以下至少一种信息：
该终端设备的参数更新UPU/漫游引导SoR能力信息；
该终端设备的位置信息；
该终端设备的请求网络切片选择辅助信息Requested-NSSAI。
可选地，该第一指示信息可以为UPU ACK透明容器，该第一指示信息也可以为该终端设备的能力信息，被包括在该UPU ACK透明容器中。
可选地，该终端设备的标识为SUPI。
在本申请实施例中，第二核心网设备在接收到第一信息之后，能够确定该第一信息是否被加密，如果该第一信息是未被加密的，而该第一信息中的第一指示信息是被加密的，则确定该终端设备采用了完整性和机密性保护的安全机制。
步骤1002，根据该终端设备的标识，确定第二核心网设备中存储的与该终端设备对应的安全密钥K AUSF。
在本申请实施例中，第二核心网设备AUSF能够根据终端设备的标识，确定自身中存储的与该终端设备对应的安全密钥K AUSF。
可选地，该终端设备的标识为SUPI。
步骤1003，根据该安全密钥K AUSF，UPU计数器Counter UPU以及第一信息中的加密的第一指示信息，采用第二指示信息指示的完整性保护算法，生成一个新的完整性校验码。
在本申请实施例中，该UPU计数器是第二核心网设备确定的，并发送给终端设备用于进行安全保护的。
在一些实施方式中，可以采用密钥导出函数KDF来生成该新的完整性校验码。
可选地，生成该新的完整性校验码的密钥导出函数KDF的输入参数KEY为该安全密钥K AUSF。该密钥导出函数KDF的输入参数S可以包括：
该密钥导出函数的编码号FC；
参数P0为该加密的第一指示信息；
参数L0为参数P0中包括的数据的长度，也就是该加密的第一指示信息的数据的长度；
参数P1为UPU计数器Counter UPU；
参数L1为该UPU计数器Counter UPU的长度。
需要说明的是，关于该UPU计数器Counter UPU的定义，可以参考3GPP技术规范TS 33.501。
步骤1004，判断该新的完整性校验码与第一信息中的完整性校验码的一致性。
在本申请实施例中，第二核心网设备生成该新的完整性校验码之后，能够判断自己生成的该新的完整性校验码，与接收到的第一信息中的完整性校验码是否一致。如果一致，则执行步骤1005，如果不一致，则执行步骤1006。
步骤1005，响应于该新的完整性校验码与第一信息中的完整性校验码一致，向第一核心网设备发送该第一指示信息。
其中，该第一指示信息是，根据该安全密钥K AUSF和该UPU计数器Counter UPU，采用第二指示信息指示的机密性保护算法对该第一信息中的该加密的第一指示信息进行解密得到的。
该机密性保护算法可以是AUSF根据自身的安全能力和终端设备的安全能力来选择确定的，并通过第二指示信息指示给终端设备。
需要说明的是，该机密性保护算法可以参考3GPP技术规范TS 33.501的附件D.1中描述的算法；关于机密性保护算法的使用和操作模式可以参考3GPP技术规范TS 33.501的附件D.2中的规定。
在本申请实施例中，如果第二核心网设备生成的该新的完整性校验码，与接收到的第一信息中的完整性校验码一致，则说明该第一信息没有被篡改，是安全的。第二核心网设备能够向第一核心网设备发送该第一信息中的第一指示信息。第一核心网设备能够根据该第一指示信息获取该终端设备的能力。
步骤1006，响应于该新的完整性校验码与第一信息中的完整性校验码不一致，终止该终端设备的能力的指示过程。
在本申请实施例中，如果第二核心网设备生成的该新的完整性校验码，与接收到的第一信息中的完整性校验码不一致，则说明该第一信息可能被篡改，是不安全的。则第二核心网设备能够终止该终端设备的能力指示的过程。
综上，通过接收第一核心网设备发送的第一信息和终端设备的标识，该第一信息包括加密的第一指示信息和完整性校验码，根据该终端设备的标识，确定第二核心网设备中存储的与该终端设备对应的安全密钥K AUSF，根据该安全密钥K AUSF，UPU计数器Counter UPU以及第一信息中的加密的第一指示信息，生成一个新的完整性校验码，判断该新的完整性校验码与第一信息中的完整性校验码的一致性， 响应于该新的完整性校验码与第一信息中的完整性校验码一致，向第一核心网设备发送该第一指示信息，响应于该新的完整性校验码与第一信息中的完整性校验码不一致，终止该终端设备的能力的指示过程，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。
请参见图11，图11是本申请实施例提供的一种终端设备能力指示方法的流程示意图。需要说明的是，本申请实施例的终端设备能力指示方法由第二核心网设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图9所示，该方法可以包括如下步骤：
步骤1101，接收第一核心网设备发送的第一信息和终端设备的标识，该第一信息是对第一指示信息和完整性校验码进行加密得到的。
在本申请实施例中，第二核心网设备能够接收第一核心网设备发送的第一信息和终端设备的标识，其中，该第一信息对第一指示信息和完整性校验码进行加密得到的，该第一指示信息用于指示该终端设备的能力。
可以理解的是，该第一指示信息是终端设备根据安全密钥和UPU计数器，采用第二指示信息指示的机密性保护算法对第一指示信息和完整性校验码进行加密得到的。
该机密性保护算法可以是AUSF根据自身的安全能力和终端设备的安全能力来选择确定的，并通过第二指示信息指示给终端设备。
需要说明的是，该机密性保护算法可以参考3GPP技术规范TS 33.501的附件D.1中描述的算法；关于机密性保护算法的使用和操作模式可以参考3GPP技术规范TS 33.501的附件D.2中的规定。
在本申请实施例中，第一核心网设备可以为归属网络HPLMN中的统一数据管理UDM，第二核心网设备可以为HPLMN中的鉴权服务功能AUSF。
可选地，该第一指示信息用于指示该终端设备的UPU/SoR能力。
在本申请实施例中，该第一指示信息可以包括以下至少一种信息：
该终端设备的参数更新UPU/漫游引导SoR能力信息；
该终端设备的位置信息；
该终端设备的请求网络切片选择辅助信息Requested-NSSAI。
可选地，该第一指示信息可以为UPU ACK透明容器，该第一指示信息也可以为该终端设备的能力信息，被包括在该UPU ACK透明容器中。
可选地，该终端设备的标识为SUPI。
在本申请实施例中，第二核心网设备在接收到第一信息之后，能够确定该第一信息是否被加密，如果该第一信息是被加密的，则确定该终端设备采用了完整性和机密性保护的安全机制。
步骤1102，根据该终端设备的标识，确定第二核心网设备中存储的与该终端设备对应的安全密钥K AUSF。
在本申请实施例中，第二核心网设备AUSF能够根据终端设备的标识，确定自身中存储的与该终端设备对应的安全密钥K AUSF。
可选地，该终端设备的标识为SUPI。
步骤1103，根据该第二指示信息指示的机密性保护算法，对接收到的第一信息进行解密，得到该第一信息中的第一指示信息和完整性校验码。
在本申请实施例中，第二核心网设备接收到的第一信息是被加密的，第二核心网设备能够采用自己确定并通过第二指示信息指示给终端设备的机密性保护算法，根据该安全密钥K AUSF和该UPU计数器Counter UPU对该第一信息进行解密，得到该第一信息中的第一指示信息和完整性校验码。
步骤1104，根据该安全密钥K AUSF，UPU计数器Counter UPU以及第一信息中的第一指示信息，采用该第二指示信息指示的完整性保护算法，生成一个新的完整性校验码。
在本申请实施例中，该UPU计数器是第二核心网设备确定的，并发送给终端设备用于进行安全保护的。
在本申请实施例中，第二核心网设备在对接收到的第一信息进行解密得到第一信息中的第一指示信息和完整性校验码之后，能够基于该解密得到的第一信息中的第一指示信息，该安全密钥K AUSF以及UPU计数器Counter UPU，采用该第二指示信息指示的完整性保护算法，生成一个新的完整性校验码。
在一些实施方式中，可以采用密钥导出函数KDF来生成该新的完整性校验码。
可选地，生成该新的完整性校验码的密钥导出函数KDF的输入参数KEY为该安全密钥K AUSF。该密钥导出函数KDF的输入参数S可以包括：
该密钥导出函数的编码号FC；
参数P0为第一指示信息；
参数L0为参数P0中包括的数据的长度，也就是该第一指示信息的数据的长度；
参数P1为UPU计数器Counter UPU；
参数L1为该UPU计数器Counter UPU的长度。
需要说明的是，关于该UPU计数器Counter UPU的定义，可以参考3GPP技术规范TS 33.501。
步骤1105，判断该新的完整性校验码与第一信息中的完整性校验码的一致性。
在本申请实施例中，第二核心网设备生成该新的完整性校验码之后，能够判断自己生成的该新的完整性校验码，与接收到的第一信息中的完整性校验码是否一致。如果一致，则执行步骤1106，如果不一致，则执行步骤1107。
步骤1106，响应于该新的完整性校验码与第一信息中的完整性校验码一致，向第一核心网设备发送该第一指示信息。
在本申请实施例中，如果第二核心网设备生成的该新的完整性校验码，与解密得到的第一信息中的完整性校验码一致，则说明该第一信息没有被篡改，是安全的。第二核心网设备能够向第一核心网设备发送该第一信息中的第一指示信息。第一核心网设备能够根据该第一指示信息获取该终端设备的能力。
步骤1107，响应于该新的完整性校验码与第一信息中的完整性校验码不一致，终止该终端设备的能力的指示过程。
在本申请实施例中，如果第二核心网设备生成的该新的完整性校验码，与解密得到的第一信息中的完整性校验码不一致，则说明该第一信息可能被篡改，是不安全的。则第二核心网设备能够终止该终端设备的能力指示的过程。
综上，通过接收第一核心网设备发送的第一信息和终端设备的标识，该第一信息是对第一指示信息和完整性校验码进行加密得到的，根据该终端设备的标识，确定第二核心网设备中存储的与该终端设备对应的安全密钥K AUSF，根据该第二指示信息指示的机密性保护算法，对接收到的第一信息进行解密，得到该第一信息中的第一指示信息和完整性校验码，根据该安全密钥K AUSF，UPU计数器Counter UPU以及第一信息中的第一指示信息，生成一个新的完整性校验码，判断该新的完整性校验码与第一信息中的完整性校验码的一致性，响应于该新的完整性校验码与第一信息中的完整性校验码一致，向第一核心网设备发送该第一指示信息，响应于该新的完整性校验码与第一信息中的完整性校验码不一致，终止该终端设备的能力的指示过程，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。
请参见图12，图12是本申请实施例提供的一种终端设备能力指示方法的流程示意图。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图12所示，该方法可以包括如下步骤：
1、终端设备执行常规注册。在该过程中，UDM可以与SoR AF交互以在初始注册期间向终端设备提供SoR信息(例如，基于本地配置像终端设备提供SoR信息)。
2、UDM决定获取终端设备的能力，以确定终端设备是否支持基于切片的SoR信息。UDM可以基于例如本地配置、特定PLMN中的终端设备的位置，或者SoR AF在步骤1201中向UDM提供的新指示，确定触发获取终端设备的能力。
3、UDM能够触发扩展的UPU过程，请求终端设备在响应中发送其UPU/SoR能力。因此，UDM能够向AMF发送包括UPU透明容器(能力请求消息)的Nudm_SDM_Notify消息，以触发终端设备返回其UPU/SoR能力。
在3GPP技术规范TS 33.501中，UPU透明容器包括UPU计数器Counter UPU，用于保护终端设备参数更新数据的完整性。Counter UPU由AUSF生成。
4、MF向终端设备发送DL NAS TRANSPORT消息，其中该DL NAS TRANSPORT消息中包括该UPU透明容器，该UPU透明容器用于UDM请求终端设备的UPU/SoR能力(处理增强的SoR信息的终端设备能力，例如，VPLMN列表和可选的支持的网络切片和/或适用性/有效性信息)。
5、终端设备在NAS UL TRANSPORT消息中的UPU ACK透明容器(第一指示信息)内将其能力返回给AMF。其中，终端设备为该UPUACK透明容器提供完整性保护。终端设备根据安全密钥K AUSF，UPU计数器Counter UPU以及该UPUACK透明容器，采用预设的完整性保护算法，生成一个完整性校验码UC-MAC1-I UE。将该UPUACK透明容器和该完整性校验码UC-MAC1-I UE视为一个受保护的容器(第一信息)。
可以理解，终端设备可以对整个UPUACK透明容器进行完整性保护，也可以对其中的部分信息进行完整性保护。
需要说明的是，终端设备生成该完整性校验码的方式可以采用本申请各实施例中的任一种方式实现，本申请实施例在此不再赘述。
6、AMF向UDM发送包括受保护的容器(第一信息)的Nudm_SDM_Info，指示终端设备的UPU/SoR能力。
7、UDM将该受保护的容器(第一信息)和终端设备的SUPI发送给AUSF。
8、AUSF利用终端设备的SUPI来识别该终端设备对应的安全密钥K AUSF。该第一信息未被加密，AUSF利用安全密钥K AUSF和本地Counter UPU来验证该第一信息。具体来说，AUSF根据第一信息中的UPUACK透明容器(第一指示信息)，安全密钥K AUSF和本地Counter UPU来，采用预设的完整性保护算法，生成一个新的完整性校验码UC-MAC1-I’ UE，然后AUSF检查该新生成的完整性校验码UC-MAC1-I’ UE是否与第一信息中终端设备生成的完整性校验码UC-MAC1-I UE相同。如果相同，则AUSF将该UPUACK透明容器(第一指示信息)发送给UDM；如果不相同，则AUSF终止该能力指示的过程。
9、UDM在收到UPUACK透明容器(第一指示信息)之后，可以向SoR AF发送Nsoraf_SoR_Get请求(VPLMN ID)、终端设备的SUPI、接入类型(可以参考3GPP技术规范TS 29.571、其中可以包括订阅的S-NSSAI、终端设备的位置、终端设备接收增强信息的能力)。UDM还可以透明地传递包含在容器中且与SoR AF相关的其他信息以供SoR AF考虑。
10、SoR AF创建基于切片的SoR信息，同时考虑到UDM提供的信息以及可能的VPLMN中订阅 的S-NSSAI(Single-NSSAI，单个网络切片选择辅助信息)的可用性。为了使SoR AF能够创建基于切片的SoR信息，SoR AF扫描可能的VPLMN列表，并为每个列表确定订阅的NSSAI的支持程度。然后，SoR AF可以将信息排序为如下所示示例：
VPLMN以HPLMN首选的任何顺序支持所有订阅的NSSAI；
VPLMN以HPLMN首选的任何顺序支持订阅NSSAI的子集；
其他网络列表支持的订阅NSSAI或HPLMN不首选的请求NSSAI。
11、SoR AF在Nsoraf_SoR_Get Response中将基于切片的SoR信息发送到UDM。
12、UDM向AMF发送Nudm_Notif并在其中包含增强的SoR信息。
13、AMF向终端设备发送包含增强型SoR信息的DL NAS TRANSPORT消息。
可选地，增强的SoR信息的ID可以包含在消息中。终端设备存储增强的SoR信息。
14、终端设备在NAS UL TRANSPORT消息中向AMF返回UPU ACK。
15、终端设备扫描接收到的漫游引导SoR信息，并进行相应的调整。
16、AMF向UDM发送Nudm_SDM_InfoUPU，其中包括SoRACK以确认终端设备接收到增强的SoR信息(包括VPLMN列表等)。
综上，本申请实施例提供的终端设备能力指示方法，能够提供一种对终端能力指示过程的保护机制(完整性保护)，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。
请参见图13，图13是本申请实施例提供的一种终端设备能力指示方法的流程示意图。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图13所示，该方法可以包括如下步骤：
1、终端设备执行常规注册。在该过程中，UDM可以与SoR AF交互以在初始注册期间向终端设备提供SoR信息(例如，基于本地配置像终端设备提供SoR信息)。
2、UDM决定获取终端设备的能力，以确定终端设备是否支持基于切片的SoR信息。UDM可以基于例如本地配置、特定PLMN中的终端设备的位置，或者SoR AF在步骤1201中向UDM提供的新指示，确定触发获取终端设备的能力。
3、UDM能够触发扩展的UPU过程，请求终端设备在响应中发送其UPU/SoR能力。因此，UDM能够向AMF发送包括UPU透明容器(能力请求消息)的Nudm_SDM_Notify消息，以触发终端设备返回其UPU/SoR能力。
在3GPP技术规范TS 33.501中，UPU透明容器(能力请求消息)包括UPU计数器Counter UPU，用于保护终端设备参数更新数据的完整性。Counter UPU由AUSF生成。在UPU透明容器(能力请求消息)中，AUSF还指示了终端设备所需使用的安全保护算法(第二指示信息)(例如，3GPP技术规范TS 33.501的附件D.1中描述的算法)。具体来说，AUSF可以根据自身的安全能力和终端设备的安全能力来选择安全保护算法。
4、MF向终端设备发送DL NAS TRANSPORT消息，其中该DL NAS TRANSPORT消息中包括该UPU透明容器，该UPU透明容器用于UDM请求终端设备的UPU/SoR能力(处理增强的SoR信息的终端设备能力，例如，VPLMN列表和可选的支持的网络切片和/或适用性/有效性信息)。
5、终端设备在NAS UL TRANSPORT消息中的UPU ACK透明容器(第一指示信息)内将其能力返回给AMF。其中，终端设备为该UPUACK透明容器提供完整性和机密性保护。终端设备根据安全密钥K AUSF，UPU计数器Counter UPU，采用AUSF指示的机密性保护算法对该UPUACK透明容器进行 加密。终端设备根据安全密钥K AUSF，UPU计数器Counter UPU以及该加密的UPUACK透明容器，采用AUSF指示的完整性保护算法生成一个完整性校验码UC-MAC1-I UE。将该加密的UPUACK透明容器和该完整性校验码UC-MAC1-I UE视为一个受保护的容器(第一信息)。
可以理解，终端设备可以对整个UPUACK透明容器进行完整性和机密性保护，也可以对其中的部分信息进行完整性和机密性保护。
需要说明的是，终端设备进行加密以及生成该完整性校验码的方式可以采用本申请各实施例中的任一种方式实现，本申请实施例在此不再赘述。
6、AMF向UDM发送包括受保护的容器(第一信息)的Nudm_SDM_Info，指示终端设备的UPU/SoR能力。
7、UDM将该受保护的容器(第一信息)和终端设备的SUPI发送给AUSF。
8、AUSF利用终端设备的SUPI来识别该终端设备对应的安全密钥K AUSF。该第一信息未被加密，该第一信息中的UPUACK透明容器(第一指示信息)被加密，AUSF利用安全密钥K AUSF和本地Counter UPU来验证该第一信息。具体来说，AUSF根据第一信息中的加密的UPUACK透明容器(第一指示信息)，安全密钥K AUSF和本地Counter UPU，采用AUSF指示的完整性保护算法来生成一个新的完整性校验码UC-MAC1-I’ UE，然后AUSF检查该新生成的完整性校验码UC-MAC1-I’ UE是否与第一信息中终端设备生成的完整性校验码UC-MAC1-I UE相同。如果相同，则AUSF对加密的UPUACK透明容器进行解密，并将解密得到的该UPUACK透明容器(第一指示信息)发送给UDM；如果不相同，则AUSF终止该能力指示的过程。
9、UDM在收到UPUACK透明容器(第一指示信息)之后，可以向SoR AF发送Nsoraf_SoR_Get请求(VPLMN ID)、终端设备的SUPI、接入类型(可以参考3GPP技术规范TS 29.571、其中可以包括订阅的S-NSSAI、终端设备的位置、终端设备接收增强信息的能力)。UDM还可以透明地传递包含在容器中且与SoR AF相关的其他信息以供SoR AF考虑。
10、SoR AF创建基于切片的SoR信息，同时考虑到UDM提供的信息以及可能的VPLMN中订阅的S-NSSAI(Single-NSSAI，单个网络切片选择辅助信息)的可用性。为了使SoR AF能够创建基于切片的SoR信息，SoR AF扫描可能的VPLMN列表，并为每个列表确定订阅的NSSAI的支持程度。然后，SoR AF可以将信息排序为如下所示示例：
VPLMN以HPLMN首选的任何顺序支持所有订阅的NSSAI；
VPLMN以HPLMN首选的任何顺序支持订阅NSSAI的子集；
其他网络列表支持的订阅NSSAI或HPLMN不首选的请求NSSAI。
11、SoR AF在Nsoraf_SoR_Get Response中将基于切片的SoR信息发送到UDM。
12、UDM向AMF发送Nudm_Notif并在其中包含增强的SoR信息。
13、AMF向终端设备发送包含增强型SoR信息的DL NAS TRANSPORT消息。
可选地，增强的SoR信息的ID可以包含在消息中。终端设备存储增强的SoR信息。
14、终端设备在NAS UL TRANSPORT消息中向AMF返回UPU ACK。
15、终端设备扫描接收到的漫游引导SoR信息，并进行相应的调整。
16、AMF向UDM发送Nudm_SDM_InfoUPU，其中包括SoRryACK以确认终端设备接收到增强的SoR信息(包括VPLMN列表等)。
综上，本申请实施例提供的终端设备能力指示方法，能够提供一种对终端能力指示过程的保护机制(完整性和机密性保护)，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。
请参见图14，图14是本申请实施例提供的一种终端设备能力指示方法的流程示意图。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图14所示，该方法可以包括如下步骤：
1、终端设备执行常规注册。在该过程中，UDM可以与SoR AF交互以在初始注册期间向终端设备提供SoR信息(例如，基于本地配置像终端设备提供SoR信息)。
2、UDM决定获取终端设备的能力，以确定终端设备是否支持基于切片的SoR信息。UDM可以基于例如本地配置、特定PLMN中的终端设备的位置，或者SoR AF在步骤1201中向UDM提供的新指示，确定触发获取终端设备的能力。
3、UDM能够触发扩展的UPU过程，请求终端设备在响应中发送其UPU/SoR能力。因此，UDM能够向AMF发送包括UPU透明容器(能力请求消息)的Nudm_SDM_Notify消息，以触发终端设备返回其UPU/SoR能力。
在3GPP技术规范TS 33.501中，UPU透明容器(能力请求消息)包括UPU计数器Counter UPU，用于保护终端设备参数更新数据的完整性。Counter UPU由AUSF生成。在UPU透明容器(能力请求消息)中，AUSF还指示了终端设备所需使用的安全保护算法(第二指示信息)(例如，3GPP技术规范TS 33.501的附件D.1中描述的算法)。具体来说，AUSF可以根据自身的安全能力和终端设备的安全能力来选择安全保护算法。
4、MF向终端设备发送DL NAS TRANSPORT消息，其中该DL NAS TRANSPORT消息中包括该UPU透明容器，该UPU透明容器用于UDM请求终端设备的UPU/SoR能力(处理增强的SoR信息的终端设备能力，例如，VPLMN列表和可选的支持的网络切片和/或适用性/有效性信息)。
5、终端设备在NAS UL TRANSPORT消息中的UPU ACK透明容器(第一指示信息)内将其能力返回给AMF。其中，终端设备为该UPUACK透明容器提供完整性和机密性保护。终端设备先根据安全密钥K AUSF，UPU计数器Counter UPU以及该UPUACK透明容器，采用AUSF指示的完整性保护算法生成一个完整性校验码UC-MAC1-I UE。然后再根据安全密钥K AUSF，UPU计数器Counter UPU，采用AUSF指示的机密性保护算法对该UPUACK透明容器和完整性校验码UC-MAC1-I UE进行加密。将对该UPUACK透明容器和该完整性校验码UC-MAC1-I UE整体加密后的信息视为一个受保护的容器(第一信息)。
可以理解，终端设备可以对整个UPUACK透明容器进行完整性和机密性保护，也可以对其中的部分信息进行完整性和机密性保护。
需要说明的是，终端设备进行加密以及生成该完整性校验码的方式可以采用本申请各实施例中的任一种方式实现，本申请实施例在此不再赘述。
6、AMF向UDM发送包括受保护的容器(第一信息)的Nudm_SDM_Info，指示终端设备的UPU/SoR能力。
7、UDM将该受保护的容器(第一信息)和终端设备的SUPI发送给AUSF。
8、AUSF利用终端设备的SUPI来识别该终端设备对应的安全密钥K AUSF。该第一信息被加密，AUSF利用安全密钥K AUSF和本地Counter UPU来验证该第一信息。具体来说，AUSF根据安全密钥K AUSF和本地Counter UPU采用指示的该机密性保护算法对该受保护的容器(第一信息)进行解密得到UPUACK透明容器(第一指示信息)以及完整性校验码UC-MAC1-I UE。然后再根据第一信息中的UPUACK透明容器(第一指示信息)，安全密钥K AUSF和本地Counter UPU，采用AUSF指示的完整性保护算法来生成一个新的完整性校验码UC-MAC1-I’ UE，然后AUSF检查该新生成的完整性校验码UC-MAC1-I’ UE是否与第一信息中终端设备生成的完整性校验码UC-MAC1-I UE相同。如果相同，则将解密 得到的该UPUACK透明容器(第一指示信息)发送给UDM；如果不相同，则AUSF终止该能力指示的过程。
9、UDM在收到UPUACK透明容器(第一指示信息)之后，可以向SoR AF发送Nsoraf_SoR_Get请求(VPLMN ID)、终端设备的SUPI、接入类型(可以参考3GPP技术规范TS 29.571、其中可以包括订阅的S-NSSAI、终端设备的位置、终端设备接收增强信息的能力)。UDM还可以透明地传递包含在容器中且与SoR AF相关的其他信息以供SoR AF考虑。
10、SoR AF创建基于切片的SoR信息，同时考虑到UDM提供的信息以及可能的VPLMN中订阅的S-NSSAI(Single-NSSAI，单个网络切片选择辅助信息)的可用性。为了使SoR AF能够创建基于切片的SoR信息，SoR AF扫描可能的VPLMN列表，并为每个列表确定订阅的NSSAI的支持程度。然后，SoR AF可以将信息排序为如下所示示例：
VPLMN以HPLMN首选的任何顺序支持所有订阅的NSSAI；
VPLMN以HPLMN首选的任何顺序支持订阅NSSAI的子集；
其他网络列表支持的订阅NSSAI或HPLMN不首选的请求NSSAI。
11、SoR AF在Nsoraf_SoR_Get Response中将基于切片的SoR信息发送到UDM。
12、UDM向AMF发送Nudm_Notif并在其中包含增强的SoR信息。
13、AMF向终端设备发送包含增强型SoR信息的DL NAS TRANSPORT消息。
可选地，增强的SoR信息的ID可以包含在消息中。终端设备存储增强的SoR信息。
14、终端设备在NAS UL TRANSPORT消息中向AMF返回UPU ACK。
15、终端设备扫描接收到的漫游引导SoR信息，并进行相应的调整。
16、AMF向UDM发送Nudm_SDM_InfoUPU，其中包括SoRryACK以确认终端设备接收到增强的SoR信息(包括VPLMN列表等)。
综上，本申请实施例提供的终端设备能力指示方法，能够提供一种对终端能力指示过程的保护机制(完整性和机密性保护)，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。
与上述几种实施例提供的终端设备能力指示方法相对应，本申请还提供一种终端设备能力指示装置，由于本申请实施例提供的终端设备能力指示装置与上述几种实施例提供的方法相对应，因此在终端设备能力指示方法的实施方式也适用于下述实施例提供的终端设备能力指示装置，在下述实施例中不再详细描述。
请参见图15，图15为本申请实施例提供的一种终端设备能力指示装置的结构示意图。
如图15所示，该终端设备能力指示装置1500包括：收发单元1510，其中：
收发单元1510，用于接收第一核心网设备通过访问网络发送的能力请求消息；
该收发单元1510，还用于根据该能力请求消息，通过该访问网络向该第一核心网设备发送第一信息和/或该终端设备的标识；
该第一信息包括第一指示信息和完整性校验码，该第一指示信息用于指示该终端设备的能力。
可选地，该能力请求消息包括：用户设备参数更新UPU计数器，和/或，第二指示信息；该第二指示信息用于指示该终端设备使用的安全保护算法，该安全保护算法包括完整性保护算法和机密性保护算法。
可选地，响应于该能力请求消息包括该UPU计数器，该收发单元1510具体用于：根据该终端设备对应的安全密钥K AUSF，该UPU计数器以及该第一指示信息，采用完整性保护算法，生成该完整性 校验码；通过该访问网络向该第一核心网设备发送该第一信息，该第一信息包括该第一指示信息和该完整性校验码。
可选地，响应于该能力请求消息包括该UPU计数器和该第二指示信息，该根据该能力请求消息，该收发单元1510具体用于：根据该终端设备对应的安全密钥K AUSF，该UPU计数器以及该第一指示信息，采用该第二指示信息指示的完整性保护算法，生成该完整性校验码；通过该访问网络向该第一核心网设备发送该第一信息，该第一信息包括该第一指示信息和该完整性校验码。
可选地，响应于该能力请求消息包括该UPU计数器和该第二指示信息，该收发单元1510具体用于：根据该终端设备对应的安全密钥K AUSF和该UPU计数器，采用该第二指示信息指示的该机密性保护算法，对该第一指示信息进行加密，得到加密的第一指示信息；根据该安全密钥K AUSF，该UPU计数器以及该加密的第一指示信息，采用该第二指示信息指示的该完整性保护算法，生成该完整性校验码；通过该访问网络向该第一核心网设备发送该第一信息，该第一信息包括该加密的第一指示信息和该完整性校验码。
可选地，响应于该第一指示信息采用完整性和机密性保护的安全机制，该收发单元1510具体用于：根据该终端设备对应的安全密钥K AUSF，该UPU计数器以及该第一指示信息，采用该第二指示信息指示的该完整性保护算法，生成该完整性校验码；根据该安全密钥K AUSF和该UPU计数器，采用该第二指示信息指示的该机密性保护算法，对该第一指示信息和该完整性校验码进行加密，得到第一信息；
通过该访问网络向该第一核心网设备发送该第一信息。
可选地，该第一核心网设备为统一数据管理UDM。
可选地，该第一指示信息包括以下至少一种：终端设备的参数更新UPU/漫游引导SoR能力信息；终端设备的位置信息；终端设备的请求网络切片选择辅助信息Requested-NSSAI。
本实施例的终端设备能力指示装置，可以通过接收归属网络的第一核心网设备通过访问网络发送的能力请求消息，根据该能力请求消息，通过该访问网络向该第一核心网设备发送第一信息和该终端设备的标识，该第一信息包括第一指示信息和完整性校验码，该第一指示信息用于指示该终端设备的能力，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。
请参见图16，图16为本申请实施例提供的一种终端设备能力指示装置的结构示意图。
如图16所示，该终端设备能力指示装置1600包括：收发单元1610，其中：
收发单元1610，用于通过访问网络向终端设备发送能力请求消息，该能力请求消息用于请求该终端设备指示该终端设备的能力；
该收发单元1610，还用于接收该终端设备通过该访问网络发送的第一信息和/或该终端设备的标识；
该第一信息包括第一指示信息和完整性校验码，该第一指示信息用于指示该终端设备的能力。
可选地，该收发单元1610还用于：接收第二核心网设备发送的用户设备参数更新UPU计数器，和/或，第二指示信息；该第二指示信息用于指示该终端设备使用的安全保护算法，该安全保护算法包括完整性保护算法和机密性保护算法；
该能力请求消息包括该用户设备参数更新UPU计数器和/或该第二指示信息。
可选地，响应于该能力请求消息包括该用户设备参数更新UPU计数器，该收发单元1610具体用于：接收该终端设备通过该访问网络发送的第一信息，该第一信息包括第一指示信息和完整性校验码；其中，该完整性校验码是根据该终端设备对应的安全密钥KAUSF，该UPU计数器以及该第一指示信息，采用完整性保护算法生成的。
可选地，响应于该能力请求消息包括该用户设备参数更新UPU计数器和该第二指示信息，该收发 单元1610具体用于：接收该终端设备通过该访问网络发送的第一信息，该第一信息包括第一指示信息和完整性校验码；其中，该完整性校验码是根据该终端设备对应的安全密钥K AUSF，该UPU计数器以及该第一指示信息，采用该第二指示信息指示的完整性保护算法生成的。
可选地，响应于该能力请求消息包括该用户设备参数更新UPU计数器和该第二指示信息，该收发单元1610具体用于：接收该终端设备通过该访问网络发送的第一信息，该第一信息包括加密的第一指示信息和完整性校验码；其中，该加密的第一指示信息是，根据该终端设备对应的安全密钥K AUSF和该UPU计数器，采用该第二指示信息指示的该机密性保护算法对该第一指示信息进行加密得到的；该完整性校验码是，根据该安全密钥K AUSF，该UPU计数器以及该加密的第一指示信息，采用该第二指示信息指示的该完整性保护算法生成的。
可选地，响应于该能力请求消息包括该用户设备参数更新UPU计数器和该第二指示信息，该收发单元1610具体用于：接收该终端设备通过该访问网络发送的第一信息，该第一信息是，根据该终端设备对应的安全密钥K AUSF和该UPU计数器，采用该第二指示信息指示的该机密性保护算法，对第一指示信息和完整性校验码进行加密得到的；其中，该完整性校验码是，根据该安全密钥K AUSF，该UPU计数器以及该第一指示信息，采用该第二指示信息指示的该完整性保护算法生成的。
可选地，该收发单元1610还用于：向该第二核心网设备发送该第一信息和/或该终端设备的标识；该完整性校验码用于该第二核心网设备验证该第一指示信息是否被篡改。
可选地，该收发单元1610还用于：接收该第二核心网设备发送的验证后的该第一指示信息。
可选地，该第一核心网设备为统一数据管理UDM，该第二核心网设备为鉴权服务功能AUSF。
可选地，该第一指示信息包括以下至少一种：终端设备的参数更新UPU/漫游引导SoR能力信息；终端设备的位置信息；终端设备的请求网络切片选择辅助信息Requested-NSSAI。
本实施例的终端设备能力指示装置，可以通过通过访问网络向终端设备发送能力请求消息，该能力请求消息用于请求该终端设备指示该终端设备的能力，接收该终端设备通过该访问网络发送的第一信息，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。
请参见图17，图17为本申请实施例提供的一种终端设备能力指示装置的结构示意图。
如图17所示，该终端设备能力指示装置1700包括：收发单元1710，其中：
收发单元1710，用于接收第一核心网设备发送的第一信息和终端设备的标识；
该第一信息包括第一指示信息和完整性校验码，该第一指示信息用于指示该终端设备的能力。
可选地，该收发单元1710还用于：向第一核心网设备发送用户设备参数更新UPU计数器，和/或，第二指示信息；该第二指示信息用于指示该终端设备使用的安全保护算法，该安全保护算法包括完整性保护算法和机密性保护算法。
可选地，响应于该第一信息包括第一指示信息和完整性校验码，该装置还包括处理单元(图中未示出)，该处理单元用于：根据该终端设备的标识，确定该第二核心网设备中存储的与该终端设备对应的安全密钥K AUSF；根据该安全密钥K AUSF，该UPU计数器以及该第一信息中的第一指示信息，采用完整性保护算法，生成一个新的完整性校验码；判断该新的完整性校验码与该第一信息中的完整性校验码的一致性。
可选地，该收发单元1710还用于：响应于该新的完整性校验码与该第一信息中的完整性校验码一致，向该第一核心网设备发送该第一指示信息；响应于该新的完整性校验码与该第一信息中的完整性校验码不一致，终止该终端设备的能力的指示过程。
可选地，响应于该第一信息包括第一指示信息和完整性校验码，该装置还包括处理单元(图中未 示出)，该处理单元用于：根据该终端设备的标识，确定该第二核心网设备中存储的与该终端设备对应的安全密钥K AUSF；根据该安全密钥K AUSF，该UPU计数器以及该第一信息中的第一指示信息，采用该第二指示信息指示的完整性保护算法，生成一个新的完整性校验码；判断该新的完整性校验码与该第一信息中的完整性校验码的一致性。
可选地，该收发单元1710还用于：响应于该新的完整性校验码与该第一信息中的完整性校验码一致，向该第一核心网设备发送该第一指示信息；响应于该新的完整性校验码与该第一信息中的完整性校验码不一致，终止该终端设备的能力的指示过程。
可选地，响应于该第一信息包括加密的第一指示信息和完整性校验码，该装置还包括处理单元(图中未示出)，该处理单元用于：根据该终端设备的标识，确定该第二核心网设备中存储的与该终端设备对应的安全密钥K AUSF；根据该安全密钥K AUSF，该UPU计数器以及该第一信息中的加密的第一指示信息，采用该第二指示信息指示的该完整性保护算法，生成一个新的完整性校验码；判断该新的完整性校验码与该第一信息中的完整性校验码的一致性。
可选地，该收发单元1710还用于：响应于该新的完整性校验码与该第一信息中的完整性校验码一致，向该第一核心网设备发送该第一指示信息；该第一指示信息是，根据该安全密钥K AUSF和该UPU计数器，采用该第二指示信息指示的该机密性保护算法，对该加密的第一指示信息进行解密得到的；响应于该新的完整性校验码与该第一信息中的完整性校验码不一致，终止该终端设备的能力的指示过程。
可选地，响应于该第一信息是对第一指示信息和完整性校验码进行加密得到的，该装置还包括处理单元(图中未示出)，该处理单元用于：根据该终端设备的标识，确定该第二核心网设备中存储的与该终端设备对应的安全密钥K AUSF；根据该安全密钥K AUSF和该UPU计数器，采用该第二指示信息指示的该机密性保护算法，对该第一信息进行解密，得到该第一信息中的第一指示信息和完整性校验码；根据该安全密钥K AUSF，该UPU计数器以及该第一信息中的第一指示信息，采用该第二指示信息指示的该完整性保护算法，生成一个新的完整性校验码；判断该新的完整性校验码与该第一信息中的完整性校验码的一致性。
可选地，该收发单元1710还用于：响应于该新的完整性校验码与该第一信息中的完整性校验码一致，向该第一核心网设备发送该第一指示信息；响应于该新的完整性校验码与该第一信息中的完整性校验码不一致，终止该终端设备的能力的指示过程。
可选地，该第一核心网设备为统一数据管理UDM，该第二核心网设备为鉴权服务功能AUSF。
可选地，该第一指示信息包括以下至少一种：终端设备的参数更新UPU/漫游引导SoR能力信息；终端设备的位置信息；终端设备的请求网络切片选择辅助信息Requested-NSSAI。
本实施例的终端设备能力指示装置，可以通过接收第一核心网设备发送的第一信息和终端设备的标识，能够通过该第一信息中的完整性校验码验证该第一信息是否被篡改，使得终端设备能够抵抗访问网络对终端设备发送的信息的嗅探、删除或篡改，安全地向归属网络指示自己的能力信息，保护终端设备与归属网络之间的信息交互安全，提高系统的安全性。
请参见图18，图18为本申请实施例提供的一种通信系统示意图。
如图18所示，该通信系统包括：第一核心网设备和第二核心网设备，其中：
第二核心网设备，用于向第一核心网设备发送用户设备参数更新UPU计数器和/或第二指示信息；
第一核心网设备，用于接收该UPU计数器和/或第二指示信息；通过访问网络向终端设备发送能力请求消息，该能力请求消息用于请求该终端设备指示该终端设备的能力，该能力请求消息包括该UPU计数器和/或第二指示信息；
该第一核心网设备，还用于接收该终端设备通过该访问网络发送的第一信息和终端设备的标识；向第二核心网设备发送该第一信息；
该第二核心网设备，还用于接收该第一信息和终端设备的标识，并对该第一信息进行验证；向该第一核心网设备发送验证后的第一信息中的第一指示信息。
可选地，该第一指示信息包括以下至少一种：
终端设备的参数更新UPU/漫游引导SoR能力信息；
终端设备的位置信息；
终端设备的请求网络切片选择辅助信息Requested-NSSAI。
可选地，该第二指示信息用于指示该终端设备使用的安全保护算法，该安全保护算法包括完整性保护算法和机密性保护算法。
为了实现上述实施例，本申请实施例还提出一种通信装置，包括：处理器和存储器，存储器中存储有计算机程序，处理器执行所述存储器中存储的计算机程序，以使装置执行图2至图5实施例所示的方法。
为了实现上述实施例，本申请实施例还提出一种通信装置，包括：处理器和存储器，存储器中存储有计算机程序，处理器执行所述存储器中存储的计算机程序，以使装置执行图6至图7实施例所示的方法，或者执行图8至图11实施例所示的方法。
为了实现上述实施例，本申请实施例还提出一种通信装置，包括：处理器和接口电路，接口电路，用于接收代码指令并传输至处理器，处理器，用于运行所述代码指令以执行图2至图5实施例所示的方法。
为了实现上述实施例，本申请实施例还提出一种通信装置，包括：处理器和接口电路，接口电路，用于接收代码指令并传输至处理器，处理器，用于运行所述代码指令以执行图6至图7实施例所示的方法，或者执行图8至图11实施例所示的方法。
请参见图19，图19是本申请实施例提供的另一种终端设备能力指示装置的结构示意图。终端设备能力指示装置1900可以是网络设备，也可以是终端设备，也可以是支持网络设备实现上述方法的芯片、芯片系统、或处理器等，还可以是支持终端设备实现上述方法的芯片、芯片系统、或处理器等。该装置可用于实现上述方法实施例中描述的方法，具体可以参见上述方法实施例中的说明。
终端设备能力指示装置1900可以包括一个或多个处理器1901。处理器1901可以是通用处理器或者专用处理器等。例如可以是基带处理器或中央处理器。基带处理器可以用于对通信协议以及通信数据进行处理，中央处理器可以用于对终端设备能力指示装置(如，基站、基带芯片，终端设备、终端设备芯片，DU或CU等)进行控制，执行计算机程序，处理计算机程序的数据。
可选的，终端设备能力指示装置1900中还可以包括一个或多个存储器1902，其上可以存有计算机程序1903，处理器1901执行计算机程序1903，以使得终端设备能力指示装置1900执行上述方法实施例中描述的方法。计算机程序1903可能固化在处理器1901中，该种情况下，处理器1901可能由硬件实现。
可选的，存储器1902中还可以存储有数据。终端设备能力指示装置1900和存储器1902可以单独设置，也可以集成在一起。
可选的，终端设备能力指示装置1900还可以包括收发器1905、天线1906。收发器1905可以称为收发单元、收发机、或收发电路等，用于实现收发功能。收发器1905可以包括接收器和发送器，接收器可以称为接收机或接收电路等，用于实现接收功能；发送器可以称为发送机或发送电路等，用于实 现发送功能。
可选的，终端设备能力指示装置1900中还可以包括一个或多个接口电路1907。接口电路1907用于接收代码指令并传输至处理器1901。处理器1901运行代码指令以使终端设备能力指示装置1900执行上述方法实施例中描述的方法。
在一种实现方式中，处理器1901中可以包括用于实现接收和发送功能的收发器。例如该收发器可以是收发电路，或者是接口，或者是接口电路。用于实现接收和发送功能的收发电路、接口或接口电路可以是分开的，也可以集成在一起。上述收发电路、接口或接口电路可以用于代码/数据的读写，或者，上述收发电路、接口或接口电路可以用于信号的传输或传递。
在一种实现方式中，终端设备能力指示装置1900可以包括电路，电路可以实现前述方法实施例中发送或接收或者通信的功能。本申请中描述的处理器和收发器可实现在集成电路(integrated circuit，IC)、模拟IC、射频集成电路RFIC、混合信号IC、专用集成电路(application specific integrated circuit，ASIC)、印刷电路板(printed circuit board，PCB)、电子设备等上。该处理器和收发器也可以用各种IC工艺技术来制造，例如互补金属氧化物半导体(complementary metal oxide semiconductor，CMOS)、N型金属氧化物半导体(nMetal-oxide-semiconductor，NMOS)、P型金属氧化物半导体(positive channel metal oxide semiconductor，PMOS)、双极结型晶体管(bipolar junction transistor，BJT)、双极CMOS(BiCMOS)、硅锗(SiGe)、砷化镓(GaAs)等。
以上实施例描述中的终端设备能力指示装置可以是网络设备或者终端设备，但本申请中描述的终端设备能力指示装置的范围并不限于此，而且终端设备能力指示装置的结构可以不受图15-图17的限制。终端设备能力指示装置可以是独立的设备或者可以是较大设备的一部分。例如终端设备能力指示装置可以是：
(1)独立的集成电路IC，或芯片，或，芯片系统或子系统；
(2)具有一个或多个IC的集合，可选的，该IC集合也可以包括用于存储数据，计算机程序的存储部件；
(3)ASIC，例如调制解调器(Modem)；
(4)可嵌入在其他设备内的模块；
(5)接收机、终端设备、智能终端设备、蜂窝电话、无线设备、手持机、移动单元、车载设备、网络设备、云设备、人工智能设备等等；
(6)其他等等。
对于终端设备能力指示装置可以是芯片或芯片系统的情况，可参见图20所示的芯片的结构示意图。图20所示的芯片包括处理器2001和接口2002。其中，处理器2001的数量可以是一个或多个，接口2002的数量可以是多个。
对于芯片用于实现本申请实施例中网络设备的功能的情况：
接口2002，用于代码指令并传输至处理器；
处理器2001，用于运行代码指令以执行如图6至图7的方法，或者执行如图8至图11的方法。
对于芯片用于实现本申请实施例中终端设备的功能的情况：
接口2002，用于代码指令并传输至处理器；
处理器2001，用于运行代码指令以执行如图2至图5的方法。
可选的，芯片还包括存储器2003，存储器2003用于存储必要的计算机程序和数据。
本领域技术人员还可以了解到本申请实施例列出的各种说明性逻辑块(illustrative logical block)和步骤(step)可以通过电子硬件、电脑软件，或两者的结合进行实现。这样的功能是通过硬件还是软件来实现取决于特定的应用和整个系统的设计要求。本领域技术人员可以对于每种特定的应用，可 以使用各种方法实现的功能，但这种实现不应被理解为超出本申请实施例保护的范围。
本申请实施例还提供一种通信系统，该系统包括前述图15-图17实施例中作为终端设备的终端设备能力指示装置，或者，该系统包括前述图19实施例中作为终端设备的终端设备能力指示装置。
本申请还提供一种可读存储介质，其上存储有指令，该指令被计算机执行时实现上述任一方法实施例的功能。
本申请还提供一种计算机程序产品，该计算机程序产品被计算机执行时实现上述任一方法实施例的功能。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。计算机程序产品包括一个或多个计算机程序。在计算机上加载和执行计算机程序时，全部或部分地产生按照本申请实施例的流程或功能。计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。计算机程序可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，计算机程序可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disk，SSD))等。
本领域普通技术人员可以理解：本申请中涉及的第一、第二等各种数字编号仅为描述方便进行的区分，并不用来限制本申请实施例的范围，也表示先后顺序。
本申请中的至少一个还可以描述为一个或多个，多个可以是两个、三个、四个或者更多个，本申请不做限制。在本申请实施例中，对于一种技术特征，通过“第一”、“第二”、“第三”、“A”、“B”、“C”和“D”等区分该种技术特征中的技术特征，该“第一”、“第二”、“第三”、“A”、“B”、“C”和“D”描述的技术特征间无先后顺序或者大小顺序。
本申请中各表所示的对应关系可以被配置，也可以是预定义的。各表中的信息的取值仅仅是举例，可以配置为其他值，本申请并不限定。在配置信息与各参数的对应关系时，并不一定要求必须配置各表中示意出的所有对应关系。例如，本申请中的表格中，某些行示出的对应关系也可以不配置。又例如，可以基于上述表格做适当的变形调整，例如，拆分，合并等等。上述各表中标题示出参数的名称也可以采用通信装置可理解的其他名称，其参数的取值或表示方式也可以通信装置可理解的其他取值或表示方式。上述各表在实现时，也可以采用其他的数据结构，例如可以采用数组、队列、容器、栈、线性表、指针、链表、树、图、结构体、类、堆、散列表或哈希表等。
本申请中的预定义可以理解为定义、预先定义、存储、预存储、预协商、预配置、固化、或预烧制。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
应当理解，可以使用上面所示的各种形式的流程，重新排序、增加或删除步骤。例如，本申请实施例中记载的各步骤可以并行地执行也可以顺序地执行也可以不同的次序执行，只要能够实现本发明 公开的技术方案所期望的结果，本文在此不进行限制。
上述具体实施方式，并不构成对本发明保护范围的限制。本领域技术人员应该明白的是，根据设计要求和其他因素，可以进行各种修改、组合、子组合和替代。任何在本发明的精神和原则之内所作的修改、等同替换和改进等，均应包含在本发明保护范围之内。

Claims (37)

  1. 一种终端设备能力指示方法，其特征在于，所述方法由终端设备执行，所述方法包括：
    接收第一核心网设备通过访问网络发送的能力请求消息；
    根据所述能力请求消息，通过所述访问网络向所述第一核心网设备发送第一信息和/或所述终端设备的标识；
    所述第一信息包括第一指示信息和完整性校验码，所述第一指示信息用于指示所述终端设备的能力。
  2. 根据权利要求1所述的方法，其特征在于，所述能力请求消息包括：用户设备参数更新UPU计数器，和/或，第二指示信息；
    所述第二指示信息用于指示所述终端设备使用的安全保护算法，所述安全保护算法包括完整性保护算法和机密性保护算法。
  3. 根据权利要求2所述的方法，其特征在于，响应于所述能力请求消息包括所述UPU计数器，所述根据所述能力请求消息，通过所述访问网络向所述第一核心网设备发送第一信息，包括：
    根据所述终端设备对应的安全密钥K AUSF，所述UPU计数器以及所述第一指示信息，采用完整性保护算法，生成所述完整性校验码；
    通过所述访问网络向所述第一核心网设备发送所述第一信息，所述第一信息包括所述第一指示信息和所述完整性校验码。
  4. 根据权利要求2所述的方法，其特征在于，响应于所述能力请求消息包括所述UPU计数器和所述第二指示信息，所述根据所述能力请求消息，通过所述访问网络向所述第一核心网设备发送第一信息，包括：
    根据所述终端设备对应的安全密钥K AUSF，所述UPU计数器以及所述第一指示信息，采用所述第二指示信息指示的完整性保护算法，生成所述完整性校验码；
    通过所述访问网络向所述第一核心网设备发送所述第一信息，所述第一信息包括所述第一指示信息和所述完整性校验码。
  5. 根据权利要求2所述的方法，其特征在于，响应于所述能力请求消息包括所述UPU计数器和所述第二指示信息，所述根据所述能力请求消息，通过所述访问网络向所述第一核心网设备发送第一信息，包括：
    根据所述终端设备对应的安全密钥K AUSF和所述UPU计数器，采用所述第二指示信息指示的所述机密性保护算法，对所述第一指示信息进行加密，得到加密的第一指示信息；
    根据所述安全密钥K AUSF，所述UPU计数器以及所述加密的第一指示信息，采用所述第二指示信息指示的所述完整性保护算法，生成所述完整性校验码；
    通过所述访问网络向所述第一核心网设备发送所述第一信息，所述第一信息包括所述加密的第一指示信息和所述完整性校验码。
  6. 根据权利要求2所述的方法，其特征在于，响应于所述第一指示信息采用完整性和机密性保护的安全机制，所述根据所述能力请求消息，通过所述访问网络向所述第一核心网设备发送第一信息，包括：
    根据所述终端设备对应的安全密钥K AUSF，所述UPU计数器以及所述第一指示信息，采用所述第二指示信息指示的所述完整性保护算法，生成所述完整性校验码；
    根据所述安全密钥K AUSF和所述UPU计数器，采用所述第二指示信息指示的所述机密性保护算法，对所述第一指示信息和所述完整性校验码进行加密，得到第一信息；
    通过所述访问网络向所述第一核心网设备发送所述第一信息。
  7. 根据权利要求1-6任一项所述的方法，其特征在于，所述第一核心网设备为统一数据管理UDM。
  8. 根据权利要求1-6任一项所述的方法，其特征在于，所述第一指示信息包括以下至少一种：
    终端设备的参数更新UPU/漫游引导SoR能力信息；
    终端设备的位置信息；
    终端设备的请求网络切片选择辅助信息Requested-NSSAI。
  9. 一种终端设备能力指示方法，其特征在于，所述方法由第一核心网设备执行，所述方法包括：
    通过访问网络向终端设备发送能力请求消息，所述能力请求消息用于请求所述终端设备指示所述终端设备的能力；
    接收所述终端设备通过所述访问网络发送的第一信息和/或所述终端设备的标识；
    所述第一信息包括第一指示信息和完整性校验码，所述第一指示信息用于指示所述终端设备的能力。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    接收第二核心网设备发送的用户设备参数更新UPU计数器，和/或，第二指示信息；所述第二指示信息用于指示所述终端设备使用的安全保护算法，所述安全保护算法包括完整性保护算法和机密性保护算法；
    所述能力请求消息包括所述用户设备参数更新UPU计数器和/或所述第二指示信息。
  11. 根据权利要求10所述的方法，其特征在于，响应于所述能力请求消息包括所述用户设备参数更新UPU计数器，所述接收所述终端设备通过所述访问网络发送的第一信息，包括：
    接收所述终端设备通过所述访问网络发送的第一信息，所述第一信息包括第一指示信息和完整性校验码；
    其中，所述完整性校验码是根据所述终端设备对应的安全密钥K AUSF，所述UPU计数器以及所述第一指示信息，采用完整性保护算法生成的。
  12. 根据权利要求10所述的方法，其特征在于，响应于所述能力请求消息包括所述用户设备参数更新UPU计数器和所述第二指示信息，所述接收所述终端设备通过所述访问网络发送的第一信息，包括：
    接收所述终端设备通过所述访问网络发送的第一信息，所述第一信息包括第一指示信息和完整性校验码；
    其中，所述完整性校验码是根据所述终端设备对应的安全密钥K AUSF，所述UPU计数器以及所述第一指示信息，采用所述第二指示信息指示的完整性保护算法生成的。
  13. 根据权利要求10所述的方法，其特征在于，响应于所述能力请求消息包括所述用户设备参数更新UPU计数器和所述第二指示信息，所述接收所述终端设备通过所述访问网络发送的第一信息，包括：
    接收所述终端设备通过所述访问网络发送的第一信息，所述第一信息包括加密的第一指示信息和完整性校验码；
    其中，所述加密的第一指示信息是，根据所述终端设备对应的安全密钥K AUSF和所述UPU计数器，采用所述第二指示信息指示的所述机密性保护算法对所述第一指示信息进行加密得到的；
    所述完整性校验码是，根据所述安全密钥K AUSF，所述UPU计数器以及所述加密的第一指示信息，采用所述第二指示信息指示的所述完整性保护算法生成的。
  14. 根据权利要求10所述的方法，其特征在于，响应于所述能力请求消息包括所述用户设备参数 更新UPU计数器和所述第二指示信息，所述接收所述终端设备通过所述访问网络发送的第一信息，包括：
    接收所述终端设备通过所述访问网络发送的第一信息，所述第一信息是，根据所述终端设备对应的安全密钥K AUSF和所述UPU计数器，采用所述第二指示信息指示的所述机密性保护算法，对第一指示信息和完整性校验码进行加密得到的；
    其中，所述完整性校验码是，根据所述安全密钥K AUSF，所述UPU计数器以及所述第一指示信息，采用所述第二指示信息指示的所述完整性保护算法生成的。
  15. 根据权利要求11-14任一项所述的方法，其特征在于，所述方法还包括：
    向所述第二核心网设备发送所述第一信息和所述终端设备的标识；
    所述完整性校验码用于所述第二核心网设备验证所述第一指示信息是否被篡改。
  16. 根据权利要求15所述的方法，其特征在于，所述方法还包括：
    接收所述第二核心网设备发送的验证后的所述第一指示信息。
  17. 根据权利要求9-16任一项所述的方法，其特征在于，所述第一核心网设备为统一数据管理UDM，所述第二核心网设备为鉴权服务功能AUSF。
  18. 根据权利要求9-16任一项所述的方法，其特征在于，所述第一指示信息包括以下至少一种：
    终端设备的参数更新UPU/漫游引导SoR能力信息；
    终端设备的位置信息；
    终端设备的请求网络切片选择辅助信息Requested-NSSAI。
  19. 一种终端设备能力指示方法，其特征在于，所述方法由第二核心网设备执行，所述方法包括：
    接收第一核心网设备发送的第一信息和/或终端设备的标识；
    所述第一信息包括第一指示信息和完整性校验码，所述第一指示信息用于指示所述终端设备的能力。
  20. 根据权利要求18所述的方法，其特征在于，所述方法还包括：
    向第一核心网设备发送用户设备参数更新UPU计数器，和/或，第二指示信息；所述第二指示信息用于指示所述终端设备使用的安全保护算法，所述安全保护算法包括完整性保护算法和机密性保护算法。
  21. 根据权利要求20所述的方法，其特征在于，响应于所述第一信息包括第一指示信息和完整性校验码，所述方法还包括：
    根据所述终端设备的标识，确定所述第二核心网设备中存储的与所述终端设备对应的安全密钥K AUSF；
    根据所述安全密钥K AUSF，所述UPU计数器以及所述第一信息中的第一指示信息，采用完整性保护算法，生成一个新的完整性校验码；
    判断所述新的完整性校验码与所述第一信息中的完整性校验码的一致性。
  22. 根据权利要求21所述的方法，其特征在于，所述方法还包括：
    响应于所述新的完整性校验码与所述第一信息中的完整性校验码一致，向所述第一核心网设备发送所述第一指示信息；
    响应于所述新的完整性校验码与所述第一信息中的完整性校验码不一致，终止所述终端设备的能力的指示过程。
  23. 根据权利要求20所述的方法，其特征在于，响应于所述第一信息包括第一指示信息和完整性校验码，所述方法还包括：
    根据所述终端设备的标识，确定所述第二核心网设备中存储的与所述终端设备对应的安全密钥K AUSF；
    根据所述安全密钥K AUSF，所述UPU计数器以及所述第一信息中的第一指示信息，采用所述第二指示信息指示的完整性保护算法，生成一个新的完整性校验码；
    判断所述新的完整性校验码与所述第一信息中的完整性校验码的一致性。
  24. 根据权利要求23所述的方法，其特征在于，所述方法还包括：
    响应于所述新的完整性校验码与所述第一信息中的完整性校验码一致，向所述第一核心网设备发送所述第一指示信息；
    响应于所述新的完整性校验码与所述第一信息中的完整性校验码不一致，终止所述终端设备的能力的指示过程。
  25. 根据权利要求20所述的方法，其特征在于，响应于所述第一信息包括加密的第一指示信息和完整性校验码，所述方法还包括：
    根据所述终端设备的标识，确定所述第二核心网设备中存储的与所述终端设备对应的安全密钥K AUSF；
    根据所述安全密钥K AUSF，所述UPU计数器以及所述第一信息中的加密的第一指示信息，采用所述第二指示信息指示的所述完整性保护算法，生成一个新的完整性校验码；
    判断所述新的完整性校验码与所述第一信息中的完整性校验码的一致性。
  26. 根据权利要求25所述的方法，其特征在于，所述方法还包括：
    响应于所述新的完整性校验码与所述第一信息中的完整性校验码一致，向所述第一核心网设备发送所述第一指示信息；所述第一指示信息是，根据所述安全密钥K AUSF和所述UPU计数器，采用所述第二指示信息指示的所述机密性保护算法，对所述加密的第一指示信息进行解密得到的；
    响应于所述新的完整性校验码与所述第一信息中的完整性校验码不一致，终止所述终端设备的能力的指示过程。
  27. 根据权利要求20所述的方法，其特征在于，响应于所述第一信息是对第一指示信息和完整性校验码进行加密得到的，所述方法还包括：
    根据所述终端设备的标识，确定所述第二核心网设备中存储的与所述终端设备对应的安全密钥K AUSF；
    根据所述安全密钥K AUSF和所述UPU计数器，采用所述第二指示信息指示的所述机密性保护算法，对所述第一信息进行解密，得到所述第一信息中的第一指示信息和完整性校验码；
    根据所述安全密钥K AUSF，所述UPU计数器以及所述第一信息中的第一指示信息，采用所述第二指示信息指示的所述完整性保护算法，生成一个新的完整性校验码；
    判断所述新的完整性校验码与所述第一信息中的完整性校验码的一致性。
  28. 根据权利要求27所述的方法，其特征在于，所述方法还包括：
    响应于所述新的完整性校验码与所述第一信息中的完整性校验码一致，向所述第一核心网设备发送所述第一指示信息；
    响应于所述新的完整性校验码与所述第一信息中的完整性校验码不一致，终止所述终端设备的能力的指示过程。
  29. 根据权利要求19-28任一项所述的方法，其特征在于，所述第一核心网设备为统一数据管理UDM，所述第二核心网设备为鉴权服务功能AUSF。
  30. 根据权利要求19-28任一项所述的方法，其特征在于，所述第一指示信息包括以下至少一种：
    终端设备的参数更新UPU/漫游引导SoR能力信息；
    终端设备的位置信息；
    终端设备的请求网络切片选择辅助信息Requested-NSSAI。
  31. 一种终端设备能力指示装置，其特征在于，所述装置应用于终端设备，所述装置包括：
    收发单元，用于接收第一核心网设备通过访问网络发送的能力请求消息；
    所述收发单元，还用于根据所述能力请求消息，通过所述访问网络向所述第一核心网设备发送第一信息和/或所述终端设备的标识；
    所述第一信息包括第一指示信息和完整性校验码，所述第一指示信息用于指示所述终端设备的能力。
  32. 一种终端设备能力指示装置，其特征在于，所述装置应用于第一核心网设备，所述装置包括：
    收发单元，用于通过访问网络向终端设备发送能力请求消息，所述能力请求消息用于请求所述终端设备指示所述终端设备的能力；
    所述收发单元，还用于接收所述终端设备通过所述访问网络发送的第一信息和/或所述终端设备的标识；
    所述第一信息包括第一指示信息和完整性校验码，所述第一指示信息用于指示所述终端设备的能力。
  33. 一种终端设备能力指示装置，其特征在于，所述装置应用于第二核心网设备，所述装置包括：
    收发单元，用于接收第一核心网设备发送的第一信息和终端设备的标识；
    所述第一信息包括第一指示信息和完整性校验码，所述第一指示信息用于指示所述终端设备的能力。
  34. 一种通信装置，其特征在于，所述装置包括处理器和存储器，所述存储器中存储有计算机程序，所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行如权利要求1至8中任一项所述的方法，或者执行如权利要求9至18中任一项所述的方法，或者执行如权利要求19至30中任一项所述的方。
  35. 一种通信装置，其特征在于，包括：处理器和接口电路；
    所述接口电路，用于接收代码指令并传输至所述处理器；
    所述处理器，用于运行所述代码指令以执行如权利要求1至8中任一项所述的方法，或者执行如权利要求9至18中任一项所述的方法，或者执行如权利要求19至30中任一项所述的方法。
  36. 一种通信系统，其特征在于，所述系统包括：
    第二核心网设备，用于向第一核心网设备发送用户设备参数更新UPU计数器和/或第二指示信息；
    第一核心网设备，用于接收所述UPU计数器和/或第二指示信息；通过访问网络向终端设备发送能力请求消息，所述能力请求消息用于请求所述终端设备指示所述终端设备的能力，所述能力请求消息包括所述UPU计数器和/或第二指示信息；
    所述第一核心网设备，还用于接收所述终端设备通过所述访问网络发送的第一信息；向第二核心网设备发送所述第一信息；
    所述第二核心网设备，还用于接收所述第一信息，并对所述第一信息进行验证；向所述第一核心网设备发送验证后的第一信息中的第一指示信息。
  37. 一种计算机可读存储介质，用于存储有指令，当所述指令被执行时，使如权利要求1至8中任一项所述的方法被实现，或者使如权利要求9至18中任一项所述的方法被实现，或者使如权利要求19至30中任一项所述的方法被实现。
PCT/CN2022/112334 2022-08-12 2022-08-12 终端设备能力指示方法及装置 WO2024031732A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202280002828.3A CN117882415A (zh) 2022-08-12 2022-08-12 终端设备能力指示方法及装置
PCT/CN2022/112334 WO2024031732A1 (zh) 2022-08-12 2022-08-12 终端设备能力指示方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/112334 WO2024031732A1 (zh) 2022-08-12 2022-08-12 终端设备能力指示方法及装置

Publications (1)

Publication Number Publication Date
WO2024031732A1 true WO2024031732A1 (zh) 2024-02-15

Family

ID=89850427

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/112334 WO2024031732A1 (zh) 2022-08-12 2022-08-12 终端设备能力指示方法及装置

Country Status (2)

Country Link
CN (1) CN117882415A (zh)
WO (1) WO2024031732A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109076079A (zh) * 2016-04-27 2018-12-21 高通股份有限公司 增强的非接入层安全
WO2021051974A1 (zh) * 2019-09-16 2021-03-25 华为技术有限公司 一种空口信息的安全保护方法及装置
US20210409952A1 (en) * 2018-11-12 2021-12-30 Telefonaktiebolaget Lm Ericsson (Publ) Security Parameter Negotiation in a Wireless Communication System

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109076079A (zh) * 2016-04-27 2018-12-21 高通股份有限公司 增强的非接入层安全
US20210409952A1 (en) * 2018-11-12 2021-12-30 Telefonaktiebolaget Lm Ericsson (Publ) Security Parameter Negotiation in a Wireless Communication System
WO2021051974A1 (zh) * 2019-09-16 2021-03-25 华为技术有限公司 一种空口信息的安全保护方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
"3 Generation Partnership Project; Technical Specification Group Services and System Aspects; Security architecture and procedures for 5G system (Release 15)", 3GPP STANDARD; TECHNICAL SPECIFICATION; 3GPP TS 33.501, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. V15.4.0, 28 March 2019 (2019-03-28), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , pages 1 - 187, XP051723120 *

Also Published As

Publication number Publication date
CN117882415A (zh) 2024-04-12

Similar Documents

Publication Publication Date Title
AU2018340618B2 (en) Parameter protection method and device, and system
JP7164602B2 (ja) 端末情報の配信方法及び関連製品
US20220272511A1 (en) Subscription data management method and apparatus
WO2024026890A1 (zh) 一种定位方法/装置/设备及存储介质
WO2024031732A1 (zh) 终端设备能力指示方法及装置
WO2024031724A1 (zh) 终端设备能力指示方法及装置
WO2023245520A1 (zh) 一种定位服务的直接通信方法及装置
WO2024092826A1 (zh) 身份验证方法及装置
WO2023087191A1 (zh) 无线资源控制rrc拒绝消息的传输方法及装置
WO2023225878A1 (zh) 一种ai网络功能的重新认证授权方法/装置/设备及存储介质
WO2023184191A1 (zh) 一种扩展现实多媒体xrm业务的处理方法及其装置
WO2024207524A1 (zh) 基于网络切片的通信方法及装置
WO2024168935A1 (zh) 一种消息验证方法及其装置
WO2024138581A1 (zh) 一种网络切片的授权方法、装置、设备及存储介质
WO2024197472A1 (zh) 一种算力登记与注销方法、装置及存储介质
WO2024065339A1 (zh) 一种网络卫星覆盖数据的授权方法、设备及存储介质
WO2024082143A1 (zh) 一种设备业务角色的验证方法/装置/设备及存储介质
WO2024065335A1 (zh) 一种侧行链路定位方法及装置
WO2024065336A1 (zh) 一种侧行链路定位方法及装置
WO2024092827A1 (zh) 一种测距方法及其装置
WO2024197474A1 (zh) 一种密钥协商方法、装置、设备及存储介质
WO2024065469A1 (zh) 一种直连链路建立方法、设备及存储介质
WO2023231038A1 (zh) 测距方法及装置
WO2024065131A1 (zh) 一种多路径传输方法/装置/设备及存储介质
WO2023221000A1 (zh) 一种核心网中ai功能的认证授权方法及其装置

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 202280002828.3

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22954680

Country of ref document: EP

Kind code of ref document: A1