WO2024036645A1 - 获取密钥的方法及装置 - Google Patents

获取密钥的方法及装置 Download PDF

Info

Publication number
WO2024036645A1
WO2024036645A1 PCT/CN2022/113779 CN2022113779W WO2024036645A1 WO 2024036645 A1 WO2024036645 A1 WO 2024036645A1 CN 2022113779 W CN2022113779 W CN 2022113779W WO 2024036645 A1 WO2024036645 A1 WO 2024036645A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
transaction
terminal
network
node
Prior art date
Application number
PCT/CN2022/113779
Other languages
English (en)
French (fr)
Inventor
王东晖
刘斐
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2022/113779 priority Critical patent/WO2024036645A1/zh
Publication of WO2024036645A1 publication Critical patent/WO2024036645A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • the present application relates to the field of communications, and in particular to methods and devices for obtaining keys.
  • the terminal can access the network provided by the operator through the subscriber identity module (SIM) card. Specifically, the user selects an operator and purchases the corresponding SIM card.
  • SIM subscriber identity module
  • the root key of the SIM card is preset in the SIM card. Before the SIM card is used, the SIM card vendor can send the root key of the SIM card to the operator through the production network or offline. In this way, both the operator and the terminal have root keys that can be used for authentication.
  • the operator can perform authentication and authentication based on the root key of the SIM card, and provide network services to the terminal after successful authentication and authentication.
  • the SIM card is bound to the operator's network. If the user wants to switch networks, he needs to change the SIM card, which is very inconvenient and leads to poor user experience.
  • the embodiments of this application provide methods and devices for obtaining keys, which can unbind the SIM card from the network. If the user wants to switch networks, there is no need to change the SIM card.
  • the first aspect provides a method for obtaining a key.
  • the communication device that executes the method can be a terminal; it can also be a module applied in the terminal, such as a chip or a chip system.
  • the following description takes the execution subject as the terminal as an example.
  • the method includes: sending a first message to a first node, the first message being used to indicate that the terminal wants to access the network; receiving a second message from the first node, the second message including key information, and the key The information is used to determine a first key used for authentication between the terminal and the target network.
  • the terminal can trigger the first node to configure the first key for the terminal, so that the terminal can authenticate with the target network based on the first key.
  • the terminal does not need to authenticate with the target network through the key in the SIM card, realizing the unbinding of the SIM card and the network. If the user wants to switch networks, there is no need to change the SIM card, which improves the user experience.
  • the second message further includes an identification of the first transaction and at least one of the following: an identification of the target network or a public key of the target network; wherein the first transaction is the first secret key.
  • the blockchain transaction corresponding to the key.
  • the first node can also send the identification of the first transaction, the identification of the target network and/or the public key of the target network to the terminal, so that the terminal authenticates with the target network based on the first key and this information.
  • the method further includes: sending a first request to the target network, the first request being used to request access to the target network, the first request including an identification of the first transaction; receiving from The authentication message of the target network corresponds to the first key.
  • the terminal can trigger authentication between the terminal and the target network.
  • the method further includes: sending the identification of the terminal to the target network.
  • the terminal can indicate to the target network the terminal that authenticates with the target network.
  • the method further includes: sending a second request to the first network, the second request being used to request access to the first network, the second request including the identification of the first transaction and the The identification of the target network; receiving first indication information from the first network, the first indication information being used to instruct the terminal to generate a second key, the second key being used for communication between the terminal and the first network Authentication: generate the second key according to the first key and the identity of the first network.
  • the terminal can trigger the first network to obtain the second key used for authentication with the terminal.
  • the terminal and the second network can be authenticated based on the second key without requiring the target network to participate in the authentication, which simplifies the authentication process.
  • the method further includes: receiving an identifier of a second transaction from the first network, where the second transaction is a blockchain transaction corresponding to the second key.
  • the first network may send the identifier of the second transaction to the terminal, so that the terminal combines the identifier of the second transaction with the first network for authentication.
  • the method further includes: sending a third message to the first node, the third message being used to indicate a third network; receiving second indication information from the first node, the second The instruction information is used to instruct the terminal to generate a third key, which is used for authentication between the terminal and the third network; the third key is generated according to the first key and the identification of the third network. key.
  • the terminal can trigger the first node to configure the third key for authentication for the terminal and the third network, so that the terminal and the third network can perform authentication based on the third key.
  • an identification of a third transaction from the first node is received, and the third transaction is a blockchain transaction corresponding to the third key.
  • the first node may send the identifier of the third transaction to the terminal, so that the terminal combines the identifier of the third transaction with the third network for authentication.
  • the method further includes: sending a first random number to the first network.
  • the terminal can send the first random number to the first network, so that the first network sends the first random number to the target network, so that the target network generates the first random number for the terminal according to the first key and the first random number.
  • a second key for authenticating with the first network can be used
  • the identification of the first transaction includes the address of the first transaction, or the identification of the first transaction includes the address of the first transaction and the serial number of the terminal in the first transaction. .
  • the identifier of the transaction corresponding to the key configured by the first node for each terminal can be unique. For example, if the first transaction includes information about a single terminal, the identification of the first transaction includes the address of the first transaction. If the first transaction includes information about multiple terminals, the identification of the first transaction includes the address of the first transaction and the serial number of the terminal in the first transaction. In this way, the terminal can authenticate with the network based on the identification of its corresponding transaction.
  • the target network is determined according to the selection of the user corresponding to the terminal; or the target network is determined according to a preset policy; or the target network is determined by the first node.
  • the target network can be flexibly selected.
  • the key information includes the first key; or, the key information includes a third key, and the third key is used to determine the first key.
  • the first node can directly indicate to the terminal the first key used for authentication with the target network, or the first node can indicate the third key to the terminal, so that the terminal generates a The first key used to authenticate with the target network.
  • the method further includes: sending a second random number to the first node.
  • the terminal may send a second random number to the first node, so that the first node generates the first key according to the second random number.
  • the third key is used to determine the first key, including: the third key is used to determine the first password together with the identity of the target network and the second random number. key.
  • the first key may be determined based on the third key, the identification of the target network, and the second random number.
  • the first message includes information about the target network.
  • the terminal may indicate to the first node the target network that the terminal wants to access.
  • the second aspect provides a method for obtaining a key.
  • the communication device executing the method may be a first node; it may also be a module applied in the first node, such as a chip or a chip system.
  • the following description takes the execution subject as the first node as an example.
  • the method includes: receiving a first message from a terminal, the first message being used to indicate that the terminal wants to access the network; obtaining a first key, the first key being used for authentication between the terminal and the target network;
  • the blockchain node sends a third message, the third message is used to indicate the first key to the target network; sends a second message to the terminal, the second message includes key information, the key information is based on the first Determined by one key.
  • the first node can obtain the first key and indicate the first key to the terminal and the target network.
  • the terminal and the target network can be authenticated based on the first key without the need to authenticate through the key in the SIM card, thus realizing the unbinding of the SIM card and the network. If the user wants to switch networks, there is no need to change the SIM card, which improves the user experience.
  • the method before sending the second message to the terminal, the method further includes: obtaining an identifier of a first transaction, where the first transaction is a blockchain transaction corresponding to the first key.
  • the first node can also obtain the identifier of the first transaction, so that the first node sends the identifier of the first transaction to the terminal, so that the terminal communicates with the target network based on the identifier of the first transaction and the first key. Certification.
  • the second message further includes an identifier of the first transaction and at least one of the following: an identifier of the target network or a public key of the target network.
  • the first node can also send the identification of the first transaction, the identification of the target network and/or the public key of the target network to the terminal, so that the terminal authenticates with the target network based on the first key and this information.
  • the identification of the first transaction includes the address of the first transaction, or the identification of the first transaction includes the address of the first transaction and the serial number of the terminal in the first transaction. .
  • the identifier of the transaction corresponding to the key configured by the first node for each terminal can be unique. For example, if the first transaction includes information for a single terminal, the identification of the first transaction includes the address of the first transaction. If the first transaction includes information about multiple terminals, the identification of the first transaction includes the address of the first transaction and the serial number of the terminal in the first transaction. In this way, the terminal can authenticate with the network based on the identification of its corresponding transaction.
  • the method further includes: receiving a fourth message from the terminal, the fourth message being used to indicate the second network; sending a fifth message to the blockchain node, the fifth message including a fourth key, which is used for authentication between the terminal and the second network; and sending second instruction information to the terminal, where the second instruction information is used to instruct the terminal to generate the fourth key.
  • the first node can generate a fourth key for authentication for the terminal and the second network, so that the terminal and the second network can perform authentication based on the fourth key.
  • the method further includes: obtaining an address of a third transaction, where the third transaction is a blockchain transaction corresponding to the fourth key.
  • the first node can obtain the address of the third transaction corresponding to the fourth key.
  • the method further includes: sending an identifier of the third transaction to the terminal.
  • the first node may send the identifier of the third transaction to the terminal, so that the terminal and the second network authenticate based on the fourth key and the identifier of the third transaction.
  • the key information includes the first key; or, the key information includes a third key, and the third key is used to determine the first key.
  • the first node can directly indicate to the terminal the first key used for authentication with the target network, or the first node can indicate the third key to the terminal, so that the terminal generates a The first key used to authenticate with the target network.
  • the method further includes: receiving a second random number from the terminal.
  • the first node can generate the first key according to the second random number.
  • the third key is used to determine the first key, including: the third key is used to determine the first password together with the identity of the target network and the second random number. key.
  • the first key may be determined based on the third key, the identification of the target network, and the second random number.
  • the blockchain node is included in the target network, and the third message is obtained by encrypting the first key using the public key of the target network.
  • the blockchain node can decrypt the third message according to the private key of the target network to determine that the third message is related to itself.
  • the first message includes information about the target network.
  • the terminal may indicate to the first node the target network that the terminal wants to access.
  • a method for obtaining a key is provided.
  • the communication device that executes the method can be a node in the target network; it can also be a module applied in the node in the target network, such as a chip or a chip system.
  • the following description takes the execution subject as a node in the target network as an example.
  • the method includes: obtaining a third message; obtaining a first key according to the third message; the first key is used for authentication between the first terminal and the target network; obtaining an identifier of the first transaction, and the first transaction is The blockchain transaction corresponding to the first key; verifying the first terminal according to the first key and the identification of the first transaction; and sending a verification response message to the first terminal according to the verification result.
  • the node in the target network can obtain the first key and the identifier of the first transaction, and verify the first terminal based on the first key and the identifier of the first transaction. In this way, the node in the target network and the first terminal do not need to be authenticated through the key in the SIM card of the first terminal, thereby realizing the unbinding of the SIM card from the network. If the user wants to switch networks, there is no need to change the SIM card, which improves the user experience.
  • verifying the first terminal according to the first key and the identification of the first transaction includes: receiving a first request from the first terminal, the first request being used to request access.
  • the target network the first request includes the identification of the first transaction; sends an authentication message to the first terminal, the authentication message is obtained based on the first key, the first key is queried based on the first request of.
  • the node in the target network and the first terminal can be authenticated based on the first key and the identification of the first transaction.
  • the method before sending the authentication message to the first terminal, the method further includes: sending a query message to the blockchain node, the query message being used to query the key corresponding to the first transaction, and the query The message includes the identification of the first transaction; a response message is received from the blockchain node, and the response message includes the first key.
  • the nodes in the target network can also query the first key on the blockchain, making the verification result of the first terminal more accurate.
  • the method further includes: receiving an identification of the first terminal from the first terminal.
  • the node in the target network may determine to authenticate the first terminal based on the identity of the first terminal.
  • the method further includes: receiving a third request from the second terminal, the third request being used to request access to the target network, the third request including the identification of the fourth transaction and the third request.
  • the identification of the network, the fourth transaction is a blockchain transaction corresponding to the fifth key, and the fifth key is used for authentication between the second terminal and the third network; sending the fourth transaction to the third network identification; obtain the sixth key, which is used for authentication of the second terminal and the target network; send third instruction information to the second terminal, the third instruction information is used to instruct the second terminal Generate the sixth key.
  • the node in the target network can request the third network to configure the key for the target network and the second terminal to authenticate the target network and the second terminal based on the request of the second terminal, so that the target network and the second terminal
  • the second terminal can perform authentication based on the key.
  • the authentication process between the second terminal and the target network does not require the participation of the third network, which simplifies the authentication process.
  • the method further includes: obtaining an identifier of a fifth transaction, which is a blockchain transaction corresponding to the sixth key; and sending the identifier of the fifth transaction to the second terminal. .
  • the node in the target network can send the identifier of the fifth transaction to the second terminal, so that the second terminal and the target network can perform authentication based on the identifier of the fifth transaction and the sixth key.
  • the method further includes: receiving the identification of the first transaction from the second network; sending a second key to the blockchain node, the second key being used for the first terminal For authentication with the second network, the second key is obtained based on the first key, and the first key is queried based on the identifier of the first transaction.
  • the node in the target network can configure the second key for authentication for the second network and the first terminal, so that the second network and the first terminal perform authentication based on the second key.
  • the second network and the first terminal do not need the participation of the target network during the authentication process, which simplifies the authentication process.
  • the identification of the first transaction includes the address of the first transaction, or the identification of the first transaction includes the address of the first transaction and the address of the first terminal in the first transaction. serial number.
  • the identifier of the transaction corresponding to the key configured by the first node for each terminal can be unique. For example, if the first transaction includes information about a single terminal, the identification of the first transaction includes the address of the first transaction. If the first transaction includes information about multiple terminals, the identification of the first transaction includes the address of the first transaction and the serial number of the terminal in the first transaction. In this way, the terminal can authenticate with the network based on the identification of its corresponding transaction.
  • a fourth aspect provides an authentication method.
  • the communication device that executes the method may be a terminal; it may also be a module applied in the terminal, such as a chip or a chip system.
  • the following description takes the execution subject as the terminal as an example.
  • the method includes: obtaining an identifier and a first key of a first transaction, the first transaction being a blockchain transaction corresponding to the first key; and conducting a transaction with a target network based on the identifier of the first transaction and the first key. Authentication; receives an authentication response message from this target network.
  • the terminal can obtain the identifier and the first key of the first transaction, and authenticate with the target network based on the identifier and the first key of the first transaction.
  • the target network does not need to allocate a user permanent identifier (SUPI) to each terminal, and the target network does not need to manage a large number of SUPIs, which not only simplifies the authentication process, but also saves the storage resources of the target network.
  • SUPI user permanent identifier
  • authenticating with the target network based on the identity of the first transaction and the first key includes: sending a first request to the target network, the first request being used to request access to the target network.
  • the target network the first request includes the identification of the first transaction; receives an authentication message from the target network, the authentication message is obtained based on the first key, the first key is queried based on the first request of; verify the authentication message.
  • the terminal can send the identifier of the first transaction to the target network, so that the target network can query the first key based on the identifier of the first transaction, obtain the authentication message based on the first key, and send it to the terminal, so as to Complete authentication between the terminal and the target network.
  • the method further includes: sending the identification of the terminal to the target network.
  • the terminal that wants to access the network can be instructed to the target network.
  • the first request is obtained by encrypting the identification of the first transaction using the public key of the target network.
  • the terminal can encrypt the identification of the first transaction and send it to the target network to improve communication security.
  • a fifth aspect provides a communication device for implementing the method provided in the first aspect.
  • the communication device may be the terminal in the above-mentioned first aspect, or a device including the above-mentioned terminal.
  • the communication device includes corresponding modules, units, or means (means) for implementing the above method.
  • the modules, units, or means can be implemented by hardware, software, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules or units corresponding to the above functions.
  • the communication device may include a transceiver module.
  • the transceiver module which may also be called a transceiver unit, is used to implement the sending and/or receiving functions in the above first aspect and any possible implementation thereof.
  • the transceiver module can be composed of a transceiver circuit, a transceiver, a transceiver or a communication interface.
  • the transceiver module includes a sending module and a receiving module, respectively used to implement the sending and receiving functions in the above first aspect and any possible implementation thereof.
  • the communication device may further include a processing module.
  • the processing module can be used to implement the processing functions in the above first aspect and any possible implementation manner thereof.
  • the processing module may be, for example, a processor.
  • the transceiver module is configured to send a first message to the first node, where the first message is used to instruct the communication device to access the network; the transceiver module is also configured to receive messages from the third node.
  • a second message from a node the second message includes key information, the key information is used to determine a first key, and the first key is used for authentication between the communication device and the target network.
  • the second message also includes an identifier of the first transaction and at least one of the following: an identifier of the target network or a public key of the target network; the first transaction corresponds to the first key blockchain transactions.
  • the transceiver module is also configured to send a first request to the target network, the first request is used to request access to the target network, and the first request includes the identification of the first transaction;
  • the transceiver module is also used to receive an authentication message from the target network, where the authentication message corresponds to the first key.
  • the transceiver module is also used to send the identification of the communication device to the target network.
  • the transceiver module is also configured to send a second request to the first network.
  • the second request is used to request access to the first network.
  • the second request includes the identification of the first transaction. and the identification of the target network;
  • the transceiver module is also used to receive first instruction information from the first network, the first instruction information is used to instruct the communication device to generate a second key, and the second key is used to Authentication between the communication device and the first network;
  • the processing module is used to generate the second key according to the first key and the identification of the first network.
  • the transceiver module is also configured to receive an identifier of a second transaction from the first network, where the second transaction is a blockchain transaction corresponding to the second key.
  • the transceiver module is also used to send a third message to the first node, where the third message is used to indicate a third network; the transceiver module is also used to receive messages from the first node.
  • the second instruction information is used to instruct the communication device to generate a third key, the third key is used for authentication between the communication device and the third network; the processing module is used to generate a third key according to the The first key and the identification of the third network generate the third key.
  • the transceiver module is also configured to receive an identifier of a third transaction from the first node, and the third transaction is a blockchain transaction corresponding to the third key.
  • the transceiver module is also configured to send a first random number to the first network.
  • the identification of the first transaction includes the address of the first transaction, or the identification of the first transaction includes the address of the first transaction and the sequence of the communication device in the first transaction. Number.
  • the target network is determined according to the selection of the user corresponding to the communication device; or the target network is determined according to a preset policy; or the target network is determined by the first node .
  • the key information includes the first key; or, the key information includes a third key, and the third key is used to determine the first key.
  • the transceiver module is also configured to send a second random number to the first node.
  • the third key is used to determine the first key, including: the third key is used to determine the first password together with the identity of the target network and the second random number. key.
  • the first message includes information about the target network.
  • a sixth aspect provides a communication device for implementing the method provided in the second aspect.
  • the communication device may be the first node in the above second aspect, or a device including the above first node.
  • the communication device includes corresponding modules, units, or means (means) for implementing the above method.
  • the modules, units, or means can be implemented by hardware, software, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules or units corresponding to the above functions.
  • the communication device may include a transceiver module and a processing module.
  • the transceiver module which may also be called a transceiver unit, is used to implement the sending and/or receiving functions in the above second aspect and any possible implementation thereof.
  • the transceiver module can be composed of a transceiver circuit, a transceiver, a transceiver or a communication interface.
  • the processing module can be used to implement the processing functions in the above second aspect and any possible implementation manner thereof.
  • the processing module may be, for example, a processor.
  • the transceiver module includes a sending module and a receiving module, respectively configured to implement the sending and receiving functions in the above second aspect and any possible implementation thereof.
  • the transceiver module is used to receive a first message from the terminal, the first message is used to indicate that the terminal wants to access the network; the processing module is used to obtain the first key, the The first key is used for authentication between the terminal and the target network; the transceiver module is also used to send a third message to the blockchain node, the third message is used to indicate the first key to the target network; the The transceiver module is also configured to send a second message to the terminal, where the second message includes key information, and the key information is determined based on the first key.
  • the processing module is also used to obtain an identifier of a first transaction, which is a blockchain transaction corresponding to the first key.
  • the second message further includes an identifier of the first transaction and at least one of the following: an identifier of the target network or a public key of the target network.
  • the identification of the first transaction includes the address of the first transaction, or the identification of the first transaction includes the address of the first transaction and the serial number of the terminal in the first transaction. .
  • the transceiver module is also used to receive a fourth message from the terminal, the fourth message is used to indicate the second network; the transceiver module is also used to send a message to the blockchain node.
  • a fifth message the fifth message includes a fourth key, the fourth key is used for authentication between the terminal and the second network; the transceiver module is also used to send second indication information to the terminal, the The second instruction information is used to instruct the terminal to generate the fourth key.
  • the processing module is also used to obtain the address of a third transaction, and the third transaction is a blockchain transaction corresponding to the fourth key.
  • the transceiver module is also used to send the identifier of the third transaction to the terminal.
  • the key information includes the first key; or, the key information includes a third key, and the third key is used to determine the first key.
  • the transceiver module is also configured to receive a second random number from the terminal.
  • the third key is used to determine the first key, including: the third key is used to determine the first password together with the identity of the target network and the second random number. key.
  • the blockchain node is included in the target network, and the third message is obtained by encrypting the first key using the public key of the target network.
  • the first message includes information about the target network.
  • a seventh aspect provides a communication device for implementing the method provided in the third aspect.
  • the communication device may be a node in the target network in the above third aspect, or a device including a node in the above target network.
  • the communication device includes corresponding modules, units, or means (means) for implementing the above method.
  • the modules, units, or means can be implemented by hardware, software, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules or units corresponding to the above functions.
  • the communication device may include a processing module and a sending module.
  • the processing module can be used to implement the processing functions in the above third aspect and any possible implementation manner thereof.
  • the processing module may be, for example, a processor.
  • the transceiver module which may also be called a transceiver unit, is used to implement the sending and/or receiving functions in the above third aspect and any possible implementation thereof.
  • the transceiver module can be composed of a transceiver circuit, a transceiver, a transceiver or a communication interface.
  • the transceiver module includes a sending module and a receiving module, respectively configured to implement the sending and receiving functions in the above third aspect and any possible implementation thereof.
  • the processing module is used to obtain the third message; the processing module is also used to obtain the first key according to the third message; the first key is used between the first terminal and the target Authentication between networks; the processing module is also used to obtain the identity of the first transaction, which is the blockchain transaction corresponding to the first key; the processing module is also used to obtain the identity of the first transaction according to the first key. Verify the first terminal with the identity of the first transaction; the transceiver module is configured to send a verification response message to the first terminal according to the verification result.
  • the processing module is specifically configured to receive a first request from the first terminal through the transceiver module.
  • the first request is used to request access to the target network, and the first request includes the The identification of the first transaction;
  • the processing module is also specifically configured to send an authentication message to the first terminal through the transceiver module.
  • the authentication message is obtained based on the first key, and the first key is obtained based on the first request. Inquired.
  • the transceiver module is also used to send a query message to the blockchain node.
  • the query message is used to query the key corresponding to the first transaction.
  • the query message includes the identification of the first transaction.
  • the transceiver module is also used to receive a response message from the blockchain node, where the response message includes the first key.
  • the transceiver module is also configured to receive the identification of the first terminal from the first terminal.
  • the transceiver module is also configured to receive a third request from the second terminal.
  • the third request is used to request access to the target network.
  • the third request includes the identification of the fourth transaction and The identifier of the third network.
  • the fourth transaction is a blockchain transaction corresponding to the fifth key.
  • the fifth key is used for authentication between the second terminal and the third network;
  • the transceiver module is also used for Send the identification of the fourth transaction to the third network;
  • the processing module is also used to obtain a sixth key, which is used for authentication between the second terminal and the target network;
  • the transceiver module is also used to Third instruction information is sent to the second terminal, where the third instruction information is used to instruct the second terminal to generate the sixth key.
  • the processing module is also used to obtain an identifier of a fifth transaction, which is a blockchain transaction corresponding to the sixth key; the transceiver module is also used to send a request to the third transaction.
  • the second terminal sends the identification of the fifth transaction.
  • the transceiver module is also used to receive the identification of the first transaction from the second network; the transceiver module is also used to send the second key to the blockchain node, and the third key is sent to the blockchain node.
  • the second key is used for authentication between the first terminal and the second network. The second key is obtained based on the first key, and the first key is queried based on the identifier of the first transaction.
  • the identification of the first transaction includes the address of the first transaction, or the identification of the first transaction includes the address of the first transaction and the address of the first terminal in the first transaction. serial number.
  • An eighth aspect provides a communication device for implementing the method provided in the fourth aspect.
  • the communication device may be the terminal in the above fourth aspect, or a device including the above terminal.
  • the communication device includes corresponding modules, units, or means (means) for implementing the above method.
  • the modules, units, or means can be implemented by hardware, software, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules or units corresponding to the above functions.
  • the communication device may include a processing module and a transceiver module.
  • the processing module can be used to implement the processing functions in the fourth aspect and any possible implementation manner thereof.
  • the processing module may be, for example, a processor.
  • the transceiver module which may also be called a transceiver unit, is used to implement the sending and/or receiving functions in the above fourth aspect and any possible implementation thereof.
  • the transceiver module can be composed of a transceiver circuit, a transceiver, a transceiver or a communication interface.
  • the transceiver module includes a sending module and a receiving module, respectively configured to implement the sending and receiving functions in the above fourth aspect and any possible implementation thereof.
  • the processing module is used to obtain the identifier and the first key of the first transaction, and the first transaction is the blockchain transaction corresponding to the first key; the processing module is also used
  • the transceiver module is configured to receive a verification response message from the target network.
  • the processing module is specifically configured to send a first request to the target network through the transceiver module.
  • the first request is used to request access to the target network, and the first request includes the first request.
  • the identification of the transaction; the processing module is also specifically configured to receive an authentication message from the target network through the transceiver module.
  • the authentication message is obtained based on the first key, and the first key is queried based on the first request.
  • the processing module is also specifically used to verify the authentication message.
  • the transceiver module is also used to send the identification of the communication device to the target network.
  • the first request is obtained by encrypting the identification of the first transaction using the public key of the target network.
  • a ninth aspect provides a communication device, including: a processor; the processor is configured to be coupled to a memory, and after reading instructions in the memory, execute the method as described in any of the above aspects according to the instructions.
  • the communication device may be the terminal in the first aspect, or a device including the terminal; or the communication device may be the first node in the second aspect, or a device including the first node; or the communication device
  • the device may be a node in the target network in the third aspect, or a device including a node in the target network; or the communication device may be a terminal in the fourth aspect, or a device including the terminal.
  • the communication device further includes a memory, which is used to store necessary program instructions and data.
  • the communication device is a chip or a chip system.
  • the communication device when it is a chip system, it may be composed of a chip, or may include a chip and other discrete devices.
  • a communication device including: a processor and an interface circuit; the interface circuit is used to receive a computer program or instructions and transmit them to the processor; the processor is used to execute the computer program or instructions to enable the communication
  • the device performs the method described in any of the above aspects.
  • the communication device is a chip or a chip system.
  • the communication device when it is a chip system, it may be composed of a chip, or may include a chip and other discrete devices.
  • a computer-readable storage medium is provided. Instructions are stored in the computer-readable storage medium, and when run on a computer, the computer can perform the method described in any of the above aspects.
  • a computer program product containing instructions which when run on a computer enables the computer to execute the method described in any of the above aspects.
  • a thirteenth aspect provides a communication system, which includes a terminal for performing the method described in the first aspect, a first node for performing the method described in the second aspect, and a terminal for performing the method described in the second aspect.
  • Figure 1A is a schematic diagram of the communication system architecture provided by an embodiment of the present application.
  • Figure 1B is a schematic diagram 1 of the network architecture provided by an embodiment of the present application.
  • Figure 1C is a schematic diagram 2 of the network architecture provided by an embodiment of the present application.
  • Figure 1D is a schematic diagram 2 of the communication system architecture provided by the embodiment of the present application.
  • Figure 2 is a schematic diagram of the hardware structure of a communication device provided by an embodiment of the present application.
  • Figure 3 is a schematic flowchart 1 of a method for obtaining a key provided by an embodiment of the present application
  • Figure 4 is a schematic flow chart of the authentication method provided by the embodiment of the present application.
  • Figure 5 is a schematic flow chart 2 of a method for obtaining a key provided by an embodiment of the present application
  • Figure 6 is a schematic flowchart of a method for updating a key provided by an embodiment of the present application.
  • Figure 7 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • Figure 8 is a schematic second structural diagram of a communication device provided by an embodiment of the present application.
  • the blockchain is a tamper-proof technology guaranteed by a cryptographic mechanism.
  • blockchain nodes can run on physical nodes, or they can also run in a virtual environment in physical nodes without restrictions.
  • blockchain is a ledger technology.
  • the ledger is distributed and can be maintained simultaneously through multiple nodes.
  • the multiple nodes can use cryptography mechanisms to prevent the ledger from being tampered with.
  • a blockchain is a chained data structure that combines data blocks in a chronological manner and is cryptographically guaranteed to be an untamperable and unforgeable distributed ledger.
  • a blockchain system has multiple blockchain nodes, and since there is no centralized management organization in the blockchain, the blockchain nodes must reach a consensus on each block of information, that is, Each blockchain node stores the same blockchain information.
  • blockchain can serve as a unified trusted platform to realize the tracing of historical events and/or automated network management.
  • Blockchain can realize at least one of the following functions: log auditing, automated settlement, or secure access and verification, etc.
  • the blockchain can also have other naming methods, such as distributed ledger or ledger, etc., which are not limited.
  • the terminal is a device with wireless transceiver function.
  • Terminals can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; they can also be deployed on water (such as ships, etc.); they can also be deployed in the air (such as aircraft, balloons, satellites, etc.).
  • the terminal may also be called a terminal device, and the terminal device may be a user equipment (UE), where the UE includes a handheld device, a vehicle-mounted device, a wearable device or a computing device with wireless communication functions.
  • the UE may be a mobile phone, a tablet computer, or a computer with wireless transceiver functions.
  • the terminal device can also be a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in driverless driving, a wireless terminal in telemedicine, or a smart terminal.
  • VR virtual reality
  • AR augmented reality
  • the terminal may be a wearable device.
  • Wearable devices can also be called wearable smart devices. It is a general term for applying wearable technology to intelligently design daily wear and develop wearable devices, such as glasses, gloves, watches, clothing and shoes, etc.
  • a wearable device is a portable device that is worn directly on the body or integrated into the user's clothing or accessories.
  • a wearable device is not only a hardware device, but also a device that achieves powerful functions through software support, data interaction, and cloud interaction.
  • wearable smart devices include devices that are full-featured, large in size, and can achieve complete or partial functions without relying on smartphones, such as smart watches or smart glasses, as well as devices that only focus on a certain type of application function and need to be integrated with other devices such as Devices used with smartphones, such as various smart bracelets, smart jewelry, etc. for monitoring physical signs.
  • the terminal can be a terminal in the Internet of things (IoT) system.
  • IoT Internet of things
  • Its main technical feature is to connect objects to the network through communication technology, thereby realizing the realization of human An intelligent network that interconnects machines and things.
  • the terminal in this application may be a terminal in machine type communication (MTC).
  • MTC machine type communication
  • the terminal of this application may be a vehicle-mounted module, vehicle-mounted module, vehicle-mounted component, vehicle-mounted chip or vehicle-mounted unit built into the vehicle as one or more components or units.
  • the vehicle uses the built-in vehicle-mounted module, vehicle-mounted module, vehicle-mounted component , vehicle-mounted chip or vehicle-mounted unit can implement the method of this application.
  • the key providing device can be any device with computing functions and can provide keys for other devices or devices.
  • the key providing device may provide the terminal with a key for authentication (or authentication) with the network.
  • the key providing device may be maintained by the manufacturer of the terminal, or may be maintained by a third party other than the manufacturer of the terminal, without limitation.
  • the method provided by the embodiment of the present application can be used in various communication systems that can obtain keys.
  • the following describes the method provided by the embodiment of the present application, taking the communication system shown in FIG. 1A and FIG. 1D as an example.
  • FIG. 1A and FIG. 1D are only schematic diagrams and do not limit the applicable scenarios of the technical solution provided by this application.
  • FIG. 1A it is a schematic architectural diagram of a communication system 10 provided by an embodiment of the present application.
  • the communication system 10 may include a node 101, a terminal 102 and a network 103 capable of communicating with the node 101.
  • the network 103 may include at least one node.
  • Node 101 and terminal 102 may communicate with network 103 through nodes in network 103.
  • the node 101 can communicate with the network 103 through the node 1031 in the network 103
  • the terminal 102 can communicate with the network 103 through the node 1032 in the network 103.
  • network 103 may provide services to terminal 102.
  • the network 103 is an operator's network and can provide wireless access services for the terminal 102 .
  • the network 103 can also be other types of networks, such as wireless local area networks, etc., without limitation.
  • Node 101 may provide terminal 102 and network 103 with keys for communicating with each other.
  • the node 101 can be a key providing device.
  • the terminal and the key providing device please refer to the previous explanation of the technical terms involved in the embodiments of the present application, and will not be described again here.
  • node 101 is a blockchain node
  • node 1031 is a blockchain node. That is, the communication system 10 may include any of the following scenarios: Scenario 1, node 101 is a blockchain node, and node 1031 is a blockchain node; Scenario 2, node 101 is not a blockchain node, and node 1031 is a blockchain node. ;Scenario 3, node 101 is a blockchain node, node 1031 is not a blockchain node. The above scenarios are described below.
  • Node 101 is a blockchain node
  • node 1031 is a blockchain node.
  • the architecture of network 103 may be as shown in Figure 1B.
  • the network includes access and mobility management function (AMF) network elements, session management function (SMF) network elements, and user plane function (UPF) network elements. elements, access network equipment and blockchain (BC) network elements.
  • the network also includes unified data management (UDM)-unified data repository (UDR) extension network elements, and/or network exposure function (NEF) Network elements, etc.
  • UDM unified data management
  • UDR network exposure function
  • FIG. 1B is only a schematic diagram of a network.
  • the network may include more or fewer network elements than shown in FIG. 1B without limitation.
  • the network does not include UDM-UDR extended network elements, but includes UDM network elements and/or UDR network elements.
  • the network element corresponding to the node 1031 in Figure 1B is the BC network element, that is, the node 101 can communicate with the network 103 through the BC network element. If the terminal 102 communicates with the network 103 through the node 1032, the network element corresponding to the node 1032 in Figure 1B is the access network device.
  • Scenario 2 Node 101 is not a blockchain node, and node 1031 is a blockchain node.
  • the network architecture of network 103 may be as shown in Figure 1B.
  • the network element corresponding to the node 1031 in Figure 1B is the BC network element, that is, the node 101 can communicate with the network 103 through the BC network element. If the terminal 102 communicates with the network 103 through the node 1032, the network element corresponding to the node 1032 in Figure 1B is the access network device.
  • Node 101 is a blockchain node, and node 1031 is not a blockchain node.
  • the network architecture of network 103 may be as shown in Figure 1C.
  • the network includes AMF network elements, SMF network elements, UPF network elements, access network equipment and ledger anchor function.
  • the network also includes UDM-UDR extended network elements, and/or NEF network elements, etc.
  • FIG. 1C is only a schematic diagram of a network. In specific applications, the network may include more or fewer network elements than shown in FIG. 1C without limitation.
  • the network does not include UDM-UDR extended network elements, but includes UDM network elements and/or UDR network elements.
  • the network element corresponding to the node 1031 in Figure 1C is the LAF network element, that is, the node 101 can communicate with the network 103 through the LAF network element. If the terminal 102 communicates with the network 103 through the node 1032, the network element corresponding to the node 1032 in Figure 1C is the access network device.
  • the communication system 10 also includes a network 104 capable of communicating with the node 101.
  • Network 104 may provide services to terminal 102.
  • the network 104 is an operator's network, and when the terminal 102 moves from the coverage area of the network 103 to the coverage area of the network 104, the network 104 can provide wireless access services for the terminal 102.
  • the operator corresponding to the network 104 and the operator corresponding to the network 103 may be the same or different, and are not limited.
  • network 104 may include at least one node.
  • Node 101 may communicate with network 104 through nodes in network 104, such as node 1041. If the terminal 102 moves from the coverage area of the network 103 to the coverage area of the network 104, the terminal 102 can also communicate with the network 104 through a node in the network 104, such as node 1042.
  • the network 104 may or may not include blockchain nodes, without limitation. If the network 104 includes blockchain nodes, the architecture of the network 104 may be as shown in Figure 1B. If the network 104 does not include blockchain nodes, the architecture of the network 104 may be as shown in Figure 1C.
  • the communication system 10 shown in FIG. 1A is only used as an example and is not used to limit the technical solution of the present application. Those skilled in the art should understand that during specific implementation, the communication system 10 may also include other devices, and the number of terminals, networks, and nodes shown in FIG. 1A may also be determined according to specific needs without limitation.
  • the communication system 11 may include a node 111, a terminal 112 capable of communicating with the node 111 and a blockchain node 114, and a network 113 capable of communicating with the blockchain node 114.
  • the network 113 may include at least one node.
  • Blockchain node 114 and terminal 112 may communicate with network 113 through nodes in network 113 .
  • the blockchain node 114 can communicate with the network 113 through the node 1131 in the network 113
  • the terminal 112 can communicate with the network 113 through the node 1132 in the network 113.
  • network 113 may provide services to terminal 112 .
  • the network 113 is an operator's network and can provide wireless access services for the terminal 112 .
  • the network 113 can also be other types of networks, such as wireless local area networks, etc., without limitation.
  • Node 111 may provide terminal 112 and network 113 with keys for communicating with each other. Among them, the node 111 can be a key providing device.
  • the terminal and the key providing device please refer to the previous explanation of the technical terms involved in the embodiments of the present application, and will not be described again here.
  • the communication system 11 may include any of the following scenarios: Scenario 4, node 111 is not a blockchain node, and node 1131 is not a blockchain node; Scenario 5, node 111 is a blockchain node, and node 1131 is not a blockchain node. ; Scenario 6, node 111 is not a blockchain node, node 1131 is a blockchain node. The above scenarios are described below.
  • Scenario 4 Node 111 is not a blockchain node, and node 1131 is not a blockchain node.
  • the network architecture of network 113 may be as shown in Figure 1C.
  • the network element corresponding to the node 1131 in Figure 1C is the LAF network element, that is, the blockchain node 114 can communicate with the network 113 through the LAF network element. If the terminal 112 communicates with the network 113 through the node 1132, the network element corresponding to the node 1132 in Figure 1C is the access network device.
  • Node 111 is a blockchain node, and node 1131 is not a blockchain node.
  • the network architecture of network 113 may be as shown in Figure 1C.
  • the network element corresponding to the node 1131 in Figure 1C is the LAF network element, that is, the blockchain node 114 can communicate with the network 113 through the LAF network element. If the terminal 112 communicates with the network 113 through the node 1132, the network element corresponding to the node 1132 in Figure 1C is the access network device.
  • Node 111 is not a blockchain node
  • node 1131 is a blockchain node.
  • the network architecture of network 113 may be as shown in Figure 1B.
  • the network element corresponding to the node 1131 in Figure 1B is the BC network element, that is, the blockchain node 114 can communicate with the network 113 through the BC network element. If the terminal 112 communicates with the network 113 through the node 1132, the network element corresponding to the node 1132 in Figure 1B is the access network device.
  • the communication system 11 also includes a network 115 capable of communicating with the blockchain node 114.
  • Network 115 may provide services to terminal 112.
  • the network 115 is an operator's network, and when the terminal 112 moves from the coverage area of the network 113 to the coverage area of the network 115, the network 115 can provide wireless access services for the terminal 112.
  • the operator corresponding to the network 115 and the operator corresponding to the network 113 may be the same or different, and are not limited.
  • the network 115 may include at least one node.
  • Node 111 may communicate with network 115 through nodes in network 115, such as node 1151. If the terminal 112 moves from the coverage area of the network 113 to the coverage area of the network 115, the terminal 112 can also communicate with the network 115 through nodes in the network 115, such as node 1152.
  • the network 115 may or may not include blockchain nodes, without limitation. If the network 115 includes blockchain nodes, the architecture of the network 115 may be as shown in Figure 1B. If the network 115 does not include blockchain nodes, the architecture of the network 115 may be as shown in Figure 1C.
  • the communication system 11 shown in FIG. 1D is only used as an example and is not used to limit the technical solution of the present application. Those skilled in the art should understand that during specific implementation, the communication system 11 may also include other devices, and the number of terminals, networks, and nodes shown in Figure 1D may also be determined according to specific needs without limitation.
  • each node or device in Figure 1A or Figure 1D in the embodiment of this application can also be called a communication device. It may be a general-purpose device or a special-purpose device, which is not specifically limited in the embodiments of this application.
  • each node or device in Figure 1A or Figure 1D in the embodiment of this application can be implemented by one device, or can be implemented by multiple devices together, or can be implemented by one or more functions within one device.
  • Module implementation is not specifically limited in the embodiments of this application. It can be understood that the above functions can be either network elements in hardware devices, software functions running on dedicated hardware, or a combination of hardware and software, or virtualization instantiated on a platform (for example, a cloud platform) Function.
  • FIG. 2 shows a schematic diagram of the hardware structure of a communication device applicable to embodiments of the present application.
  • the communication device 20 includes at least one processor 201 and at least one communication interface 204, which are used to implement the method provided by the embodiment of the present application.
  • the communication device 20 may also include a communication line 202 and a memory 203 .
  • the processor 201 can be a general central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more processors used to control the execution of the program of the present application. integrated circuit.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • Communication line 202 may include a path, such as a bus, that carries information between the above-mentioned components.
  • Communication interface 204 is used to communicate with other devices or communication networks.
  • the communication interface 204 can be any device such as a transceiver, such as an Ethernet interface, a radio access network (RAN) interface, a wireless local area networks (WLAN) interface, a transceiver, and pins , bus, or transceiver circuit, etc.
  • RAN radio access network
  • WLAN wireless local area networks
  • the memory 203 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (random access memory (RAM)) or other type that can store information and instructions.
  • a dynamic storage device can also be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be used by a computer Any other medium for access, but not limited to this.
  • the memory may exist independently and be coupled to the processor 201 through the communication line 202 .
  • the memory 203 may also be integrated with the processor 201.
  • the memory provided by the embodiment of the present application may generally be non-volatile.
  • the memory 203 is used to store computer execution instructions involved in executing the solutions provided by the embodiments of the present application, and the processor 201 controls the execution.
  • the processor 201 is used to execute computer execution instructions stored in the memory 203, thereby implementing the method provided by the embodiment of the present application.
  • the processor 201 may also perform processing-related functions in the methods provided in the following embodiments of the present application, and the communication interface 204 is responsible for communicating with other devices or communication networks. This application implements The example does not specifically limit this.
  • the computer-executed instructions in the embodiments of the present application may also be called application codes, which are not specifically limited in the embodiments of the present application.
  • the coupling in the embodiment of this application is an indirect coupling or communication connection between devices, units or modules, which may be in electrical, mechanical or other forms, and is used for information interaction between devices, units or modules.
  • the processor 201 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 2 .
  • the communication device 20 may include multiple processors, such as the processor 201 and the processor 207 in FIG. 2 .
  • processors may be a single-CPU processor or a multi-CPU processor.
  • a processor here may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the communication device 20 may also include an output device 205 and/or an input device 206.
  • Output device 205 is coupled to processor 201 and can display information in a variety of ways.
  • the output device 205 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector (projector), etc.
  • the input device 206 is coupled to the processor 201 and can receive user input in a variety of ways.
  • the input device 206 may be a mouse, a keyboard, a touch screen device, a sensing device, or the like.
  • composition structure shown in Figure 2 does not constitute a limitation on the communication device.
  • the communication device may include more or fewer components than shown in the figure, or a combination of certain components. components, or different component arrangements.
  • A/B may indicate A or B; "and/or” may be used to describe There are three relationships between associated objects.
  • a and/or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.
  • a and B can be singular or plural.
  • expressions similar to "at least one of A, B and C" or "at least one of A, B or C” are often used to mean any of the following: A alone; B alone; alone C exists; A and B exist simultaneously; A and C exist simultaneously; B and C exist simultaneously; A, B, and C exist simultaneously.
  • the above is an example of three elements A, B and C to illustrate the optional items of this project. When there are more elements in the expression, the meaning of the expression can be obtained according to the aforementioned rules.
  • words such as “first” and “second” may be used to distinguish technical features with the same or similar functions.
  • the words “first”, “second” and other words do not limit the quantity and execution order, and the words “first” and “second” do not limit the number and execution order.
  • words such as “exemplary” or “for example” are used to express examples, illustrations or illustrations, and any embodiment or design solution described as “exemplary” or “for example” shall not be interpreted. To be more preferred or advantageous than other embodiments or designs.
  • the use of words such as “exemplary” or “such as” is intended to present related concepts in a concrete manner that is easier to understand.
  • an embodiment means that a particular feature, structure, or characteristic associated with the embodiment is included in at least one embodiment of the present application. Therefore, various embodiments are not necessarily referred to the same embodiment throughout this specification. Furthermore, the particular features, structures or characteristics may be combined in any suitable manner in one or more embodiments. It can be understood that in the various embodiments of the present application, the size of the sequence numbers of each process does not mean the order of execution. The execution order of each process should be determined by its functions and internal logic, and should not be determined by the execution order of the embodiments of the present application. The implementation process constitutes no limitation.
  • At the same time in this application can be understood as at the same point in time, within a period of time, or within the same cycle.
  • any node and/or terminal can perform some or all of the steps in the embodiment of the present application. These steps are only examples. The embodiment of the present application can also perform other steps or various steps. Deformation. In addition, various steps may be performed in a different order than those presented in the embodiments of the present application, and it may not be necessary to perform all the steps in the embodiments of the present application.
  • a method for obtaining a key is provided in an embodiment of the present application.
  • the method may include the following steps:
  • S301 The terminal sends the first message to the first node.
  • the first node receives the first message from the terminal.
  • the terminal may be the terminal 102 in FIG. 1A , and the first node may be the node 101 in FIG. 1A ; or the terminal may be the terminal 112 in FIG. 1D , and the first node may be the node 111 in FIG. 1D .
  • the first message may be used to instruct the terminal to access the network.
  • the first node can determine the network for the terminal to access, that is, determine the target network for the terminal.
  • the first node may also generate a key for the terminal and the target network so that the terminal communicates with the target network. For example, the terminal authenticates with the target network through the generated key.
  • the first message includes information about the target network.
  • the terminal can indicate to the first node the network to which the terminal wants to access, so that the first node generates a key for the terminal and the target network, so that the terminal and the target network communicate.
  • the target network is the network 103 in Figure 1A.
  • the target network is the network 113 in Figure 1D.
  • the information of the target network is used to indicate the target network.
  • the information of the target network includes the identification of the target network.
  • the target network is determined based on the selection of the user corresponding to the terminal; or, the target network is determined based on a preset policy.
  • the user selects the target network through software on the terminal, and in response to the user's operation, the terminal determines the target network.
  • the terminal determines the target network based on the network access demand information submitted by the user, such as traffic demand information and/or call time demand information.
  • the terminal determines the target network based on environmental information, such as location information of the terminal and/or signal quality of surrounding networks measured by the terminal.
  • the terminal also sends a second random number to the first node, so that the first node generates a key based on the second random number.
  • the first node receives the second random number from the terminal.
  • the second random number may be included in the first message and sent to the first node, or sent to the first node through another message, without limitation.
  • the first key may be used for authentication between the terminal and the target network.
  • the first key is a symmetric key.
  • the first node generates the first key through a key generation algorithm.
  • the first node obtains the first key from other devices capable of generating keys.
  • the first node if the first node also receives the second random number, the first node generates the first key according to the key generation algorithm and the second random number.
  • S303 The first node sends the third message to the blockchain node.
  • the blockchain node receives the third message from the first node.
  • the third message may be used to indicate the first key to the target network.
  • the third message is obtained by encrypting the first key using the public key of the target network (eg, the public key of the node in the target network).
  • the target network After the target network receives the third message, it decrypts it with its own private key to obtain the first key.
  • the third message is obtained by encrypting the first key and the fourth indication information using the public key of the blockchain node.
  • the fourth instruction information is used to instruct the blockchain node to send the first key to the target network.
  • the fourth indication information includes an identification of the target network.
  • the blockchain node after receiving the third message, the blockchain node sends a response message of the third message to the first node to indicate to the first node that the third message has been received.
  • the first node can trigger the generation of a blockchain transaction corresponding to the first key (hereinafter referred to as the first transaction) on the blockchain.
  • the first transaction a blockchain transaction corresponding to the first key
  • the first node itself triggers the generation of the first transaction
  • the first node if the first node is not a node in the blockchain, the first node triggers the blockchain node to generate the first transaction. trade.
  • the target network can obtain the third message.
  • the target network can obtain the third message through the blockchain.
  • the blockchain node in S303 is node 1031 in Figure 1A.
  • Node 101 generates the first transaction, uses the first key as the content of the first transaction, encrypts the first transaction with the public key of node 1031 on the chain, and signs the first key with the private key of node 101 on the chain, Obtain the third message and publish the third message to the blockchain.
  • the first transaction is completed and uploaded to the chain.
  • each node on the blockchain verifies the signature with the public key of node 101 on the chain, and decrypts it with its own private key on the chain. If the verification and decryption are successful, it means that the first transaction is related to itself and can be Get the first key.
  • node 1031 can verify and decrypt successfully, and obtains the first key.
  • the target network network 103 in this example
  • obtains the first key obtains the first key.
  • the target network also obtains the identity of the first transaction on the chain.
  • the format of the third message may be as follows: ⁇ EncapPK_Node 1031(TX(Initial: Node 101, Receiver: Node 1031, Content: First Key)), Sigsk-Node 101 ⁇ , which can be represented
  • the sender of the third message is node 101
  • the receiver of the third message is node 1031
  • the content of the third message includes the first key.
  • EncapPK_Node 1031 (TX (Initial: Node 101, Receiver: Node 1031, Content: First Key)) represents information encrypted with the first key using the public key of Node 1031 on the chain.
  • Sigsk-node 101 represents the information signed with the first key using the private key of node 101 on the chain.
  • the blockchain node in S303 is node 1031 in Figure 1A.
  • Node 101 encrypts the first key with the public key of node 1031, obtains the third message, and sends the third message to node 1031.
  • node 1031 decrypts the third message with its own private key to obtain the first key.
  • the target network network 103 in this example
  • node 1031 generates a first transaction, uses the first key as the content of the first transaction, encrypts the first transaction, and publishes the encrypted message to the blockchain.
  • the first transaction is completed and uploaded to the chain. It is understandable that after the first transaction is uploaded to the chain, the target network can obtain the identification of the first transaction on the chain.
  • the blockchain node in S303 is a node in the blockchain other than node 101, such as the blockchain node corresponding to the target network (network 103 in this example).
  • the blockchain node corresponding to the target network can be understood as the node on the blockchain that can communicate with the target network.
  • Node 101 generates the first transaction, uses the first key and the fourth instruction information as the content of the first transaction, encrypts the first transaction with the public key of the blockchain node corresponding to network 103 on the chain, and uses the public key of node 101 on the chain to The private key on the server signs the first key, obtains the third message, and publishes the third message to the blockchain. After the nodes on the blockchain reach consensus, the first transaction is completed and uploaded to the chain.
  • each node on the blockchain verifies the signature with the public key of node 101 on the chain, and decrypts it with its own private key on the chain. If the verification and decryption are successful, it means that the first transaction is related to itself and can be The first key and fourth indication information are obtained.
  • the blockchain node corresponding to the network 103 can successfully verify and decrypt, obtain the first key and the fourth instruction information, and use the public key of the node 1031 to encrypt the first key.
  • the fourth instruction information Send the encrypted information to node 1031.
  • Node 1031 receives the encrypted information and decrypts it with its own private key to obtain the first key. In this way, the target network obtains the first key.
  • the blockchain node corresponding to the network 103 also obtains the identifier of the first transaction on the chain, and sends the identifier of the first transaction to the node 1031. In this way, the target network can obtain the identification of the first transaction.
  • the format of the third message is as follows: ⁇ EncapPK_The blockchain node corresponding to network 103 (TX(Initial: node 101, Receiver: the blockchain node corresponding to network 103, Content: the first key and the Four indication information)), Sigsk-node 101 ⁇ , can indicate that the sender of the third message is the node 101, the receiver of the third message is the blockchain node corresponding to the network 103, and the content of the third message includes the first key and fourth instruction information.
  • EncapPK_The blockchain node corresponding to the network 103 (TX (Initial: node 101, Receiver: the blockchain node corresponding to the network 103, Content: the first key and the fourth indication information)) represents the block corresponding to the network 103
  • the public key of the chain node on the chain encrypts the first key and the fourth indication information.
  • Sigsk-node 101 represents the information signed with the first key using the private key of node 101 on the chain.
  • the blockchain node in S303 is the blockchain node 114 in Figure 1D.
  • the blockchain node 114 is the blockchain node corresponding to the node 111, that is, the node on the blockchain that can communicate with the node 111.
  • the node 111 encrypts the first key and the fourth instruction information with the public key of the blockchain node 114, obtains the third message, and sends the third message to the blockchain node 114.
  • the blockchain node 114 decrypts the third message with its own private key to obtain the first key and the fourth indication information.
  • the blockchain node 114 generates the first transaction, uses the first key and the fourth instruction information as the content of the first transaction, and encrypts the first transaction with the public key of the blockchain node corresponding to the network 113 on the chain, Sign the first key with the private key of the blockchain node 114 on the chain, obtain message 1, and publish message 1 to the blockchain.
  • the first transaction is completed and uploaded to the chain.
  • each node on the blockchain verifies the signature with the public key of blockchain node 114 on the chain, and decrypts it with its own private key on the chain. If the verification and decryption are successful, it means that the first transaction is related to itself.
  • the blockchain node corresponding to network 113 can successfully verify and decrypt, obtain the first key and the fourth instruction information, encrypt the first key with the public key of node 1131, and send the message to node 1131 according to the fourth instruction information. Send encrypted messages.
  • Node 1131 receives the encrypted information and decrypts it with its own private key to obtain the first key.
  • the target network (network 113 in this example) obtains the first key.
  • the blockchain node corresponding to the network 113 obtains the identifier of the first transaction on the chain and sends the identifier of the first transaction to the node 1131. In this way, the target network can obtain the identification of the first transaction.
  • the blockchain node in S303 is the blockchain node 114 in Figure 1D.
  • the blockchain node 114 is the blockchain node corresponding to the target network (network 113 in this example), that is, the node on the blockchain that can communicate with the target network.
  • Node 111 generates the first transaction, uses the first key and the fourth instruction information as the content of the first transaction, encrypts the first transaction with the public key of the blockchain node corresponding to network 113 on the chain, and uses node 111 on the chain to encrypt the first transaction. Sign the first key with the private key, obtain the third message, and publish the third message to the blockchain. After the nodes on the blockchain reach consensus, the first transaction is completed and uploaded to the chain.
  • each node on the blockchain verifies the signature with the public key of node 111 on the chain, and decrypts it with its own private key on the chain. If the verification and decryption are successful, it means that the first transaction is related to itself and can be The first key and fourth indication information are obtained. It should be understood that the blockchain node corresponding to the network 113 can successfully verify and decrypt, obtain the first key and the fourth instruction information, encrypt the first key with the public key of the node 1131, and send it to the node 1131 according to the fourth instruction information. Encrypted information. Node 1131 receives the encrypted information and decrypts it with its own private key to obtain the first key. In this way, the target network obtains the first key.
  • the blockchain node corresponding to the network 113 obtains the identifier of the first transaction on the chain and sends the identifier of the first transaction to the node 1131. In this way, the target network can obtain the identification of the first transaction.
  • the format of the third message is as follows: ⁇ EncapPK_The blockchain node corresponding to network 113 (TX(Initial: node 111, Receiver: the blockchain node corresponding to network 113, Content: the first key and the Four indication information)), Sigsk-node 111 ⁇ , can indicate that the sender of the third message is the node 111, the receiver of the third message is the blockchain node corresponding to the network 113, and the content of the third message includes the first key and fourth instruction information.
  • EncapPK_The blockchain node corresponding to the network 113 (TX (Initial: node 111, Receiver: the blockchain node corresponding to the network 113, Content: the first key and the fourth instruction information)) represents the block corresponding to the network 113
  • the public key of the chain node on the chain encrypts the first key and the fourth indication information.
  • Sigsk-node 111 represents the information signed with the first key using the private key of node 111 on the chain.
  • the blockchain node in S303 is the blockchain node 114 in Figure 1D.
  • the blockchain node 114 is the blockchain node corresponding to the node 111, that is, the node on the blockchain that can communicate with the node 111.
  • the node 111 encrypts the first key and the fourth instruction information with the public key of the blockchain node 114, obtains the third message, and sends the third message to the blockchain node 114.
  • the blockchain node 114 decrypts the third message with its own private key to obtain the first key and the fourth indication information.
  • the blockchain node 114 generates the first transaction, uses the first key as the content of the first transaction, encrypts the first transaction with the public key of the node 1131 on the chain, and uses the private key of the blockchain node 114 on the chain.
  • the key signs the first key, gets message 2, and publishes message 2 to the blockchain.
  • the first transaction is completed and uploaded to the chain.
  • each node on the blockchain verifies the signature with the public key of blockchain node 114 on the chain, and decrypts it with its own private key on the chain. If the verification and decryption are successful, it means that the first transaction is related to itself. , and can obtain the first key.
  • node 1131 can successfully verify and decrypt and obtain the first key.
  • the target network network 113 in this example
  • the target network also obtains the identification of the first transaction on the blockchain.
  • the format of the above-mentioned third message is only exemplary.
  • the above-mentioned message may include more or less information than the above-mentioned example, without limitation.
  • the third message may not include the fourth instruction information, but may instruct the corresponding blockchain node of the network 103 to send the first key to the node 1031 in an implicit manner.
  • the first node also obtains the identifier of the first transaction. For example, if the first node is a node in the blockchain, the first node directly obtains the identifier of the first transaction on the blockchain; if the first node is not a node in the blockchain, the first node receives the identifier from the blockchain. The identifier of the first transaction of the blockchain node.
  • the identifier of the first transaction includes the address of the first transaction, or the identifier of the first transaction includes the address of the first transaction and the serial number of the terminal in the first transaction.
  • the first transaction address is the address of the first transaction on the blockchain.
  • the identifier of the first transaction includes the address of the first transaction. If the first transaction includes information about multiple terminals, the identification of the first transaction includes the address of the first transaction and the serial number of the terminal in the first transaction. In this way, the identifier of the transaction corresponding to the key configured by the first node for each terminal can be unique.
  • the address of the first transaction can be used as the identifier of the first transaction. If the first transaction includes: ⁇ serial number 1: key corresponding to terminal 1, sequence number 2: key corresponding to terminal 2 ⁇ , then for terminal 1, sequence number 1 can be added to the end of the address of the first transaction as the third As an identification of a transaction, for terminal 2, the serial number 2 can be added to the end of the address of the first transaction as the identification of the first transaction.
  • S304 The first node sends the second message to the terminal.
  • the terminal receives the second message from the first node.
  • the second message may include key information.
  • the key information is determined based on the first key.
  • the terminal can determine the first key based on the key information.
  • the second message also includes the identification of the first transaction and at least one of the following: the identification of the target network or the public key of the target network.
  • the key information includes the first key, or the key information is the first key. That is to say, the first node can include the first key in the second message and send it to the terminal. After receiving the second message, the terminal can obtain the first key. The first node also sends the first key through the blockchain. The key is sent to the target network. In this way, authentication can be performed between the terminal and the target network based on the first key.
  • the key information includes the third key, or the key information is the third key.
  • the third key is determined based on the first key. That is to say, the first node first obtains the third key, generates the first key based on the third key, sends the first key to the target network through the blockchain, and sends the third key to the terminal. After receiving the third key, the terminal can generate the first key based on the third key. In this way, on the one hand, the terminal and the target network can be authenticated through the first key; on the other hand, the target network can obtain the first key, but cannot obtain the third key, so the third key is derived as The root key of the first key can be hidden and protected.
  • the first node can also update the authentication key between the terminal and the target network based on the third key, or configure the authentication key between the terminal and other networks based on the third key, which not only facilitates operation but also improves the communication between the terminal and the network. communication security.
  • the first key is obtained based on the third key and the identification of the target network; or the first key is obtained based on the third key, the identification of the target network and the second random number. That is to say, the first node and the terminal can use a key generation algorithm to calculate the third key and the identification of the target network to obtain the first key, or use the key generation algorithm to calculate the third key, the identification of the target network and The second random number is calculated to obtain the first key.
  • One possible implementation method is that the first node writes the card over the air to the terminal through the security interface, and writes the content included in the second message into the terminal.
  • the second message includes: HTTPS: UE-Root_Key, Target-OP-profile (ID OP , PK OP ), TX-addr.
  • UE-Root_Key is the third key
  • Target-OP-profile is the information of the target network
  • ID OP is the identification of the target network
  • PK OP is the public key of the target network
  • TX-addr is the identification of the first transaction.
  • the terminal may update the key according to the method shown in Figure 6 below.
  • the actions of the terminal or the first node or the target network (which may be a node in the target network) in the above-mentioned S301-S304 can be performed by the processor 201 in the communication device 20 shown in FIG. 2 to call the application program stored in the memory 203. Code is executed, and the embodiments of this application do not impose any restrictions on this.
  • the terminal can trigger the first node to configure the first key for the terminal and the target network. Subsequently, the terminal and the target network can be authenticated or authenticated based on the first key so that the terminal can access the target network. In this way, there is no need to use the key in the SIM card for authentication or authentication between the terminal and the target network, which realizes the unbinding of the SIM card and the network. If the user wants to switch networks, there is no need to change the SIM card, allowing the terminal to flexibly access the network. Improved user experience.
  • the authentication method may include the following steps:
  • S401 The terminal obtains the first transaction identifier and the first key.
  • the terminal may be the terminal 102 in FIG. 1A; or the terminal may be the terminal 112 in FIG. 1D.
  • the first transaction is the blockchain transaction corresponding to the first key.
  • the first key can be used for authentication between the terminal and the target network.
  • the target network may be the network 103 in Figure 1A; if the terminal is the terminal 112 in Figure 1D, the target network may be the network 113 in Figure 1D.
  • the terminal obtains the identity of the first transaction and the first key through the method shown in Figure 3. For example, the terminal receives a second message from the first node, and the second message includes the key information and the first key. The identifier of the transaction. The key information and the identification of the first transaction may also be included in different messages respectively, without limitation. Alternatively, the terminal obtains the first transaction identifier and the first key through other methods, which is not limited.
  • the target network obtains the first transaction identifier and the first key.
  • the execution subject of S402 may be the second node in the target network.
  • the target network is the network 103 in Figure 1A
  • the node 1031 obtains the identity of the first transaction and the first key, that is, the second node is the node 1031
  • the target network is the network 113 in Figure 1D
  • the node 1131 Obtain the identification and first key of the first transaction, that is, the second node is node 1131.
  • the target network obtains the identifier and the first key of the first transaction through the method shown in Figure 3.
  • the target network obtains the identifier and the first key of the first transaction on the chain, or the target network Obtain the identification of the first transaction and the first key from the blockchain node or the first node.
  • the target network obtains the first transaction identifier and the first key through other methods, which is not restricted.
  • S401 may be executed first and then S402, or S402 may be executed first and then S401, or S401 and S402 may be executed simultaneously.
  • S403 Authentication is performed between the terminal and the target network based on the identifier of the first transaction and the first key.
  • the execution subject of S403 may be the third node in the target network.
  • the target network is the network 103 in Figure 1A
  • authentication is performed between the terminal and the node 1032 based on the identity of the first transaction and the first key, that is, the third node is the node 1032
  • the target network is the network 103 in Figure 1D Network 113
  • authentication is performed between the terminal and node 1132 based on the identity of the first transaction and the first key, that is, the third node is node 1132.
  • the second node is different from the third node.
  • the second node and the third node can also be the same, without limitation.
  • the terminal sends a first request to the target network.
  • the first request may be used to request access to the target network.
  • the target network After receiving the first request, the target network sends an authentication message to the terminal.
  • the authentication message is obtained based on the first key, which can also be described as the authentication message corresponding to the first key. In this way, after receiving the authentication message, the terminal can verify the authentication message.
  • the first request may include the identification of the first transaction.
  • the target network can obtain the first key according to the identifier of the first transaction, for example, query the first key using the identifier of the first transaction as an index.
  • the terminal also sends the terminal identification to the target network to indicate the terminal to be authenticated to the target network.
  • the identification of the terminal may be included in the first request and sent to the target network, or the identification of the terminal may be included in other messages and sent to the target network, without limitation.
  • the terminal uses the public key of the target network to encrypt the identity of the first transaction to obtain the first request, and sends the first request to the target network.
  • the target network decrypts it with the private key of the target network to obtain the identity of the first transaction, obtains the first key based on the identity of the first transaction, and obtains the authentication message based on the first key and the identity of the target network. , and sends an authentication message to the terminal.
  • the terminal verifies the authentication message according to the first key and the identification of the target network.
  • the terminal encrypts the identity of the first transaction and the identity of the terminal using the public key of the target network to obtain the first request, and sends the first request to the target network.
  • the target network decrypts it with the private key of the target network to obtain the identity of the first transaction and the identity of the terminal. It obtains the first key according to the identity of the first transaction and obtains the first key according to the first key and the identity of the target network.
  • the identification (which can be replaced by the sequence number of the target network) and the third random number generated by the target network are used to obtain the authentication message, and the authentication message and the third random number are sent to the terminal.
  • the terminal verifies the authentication message according to the first key, the identification of the target network and the third random number.
  • the target network after the target network obtains the identifier of the first transaction according to the first request, it can query the first key in the target network based on the identifier of the first transaction.
  • the third node obtains the identification of the first transaction and the first key from the second node. After the third node obtains the identifier of the first transaction according to the first request, it can locally query the first key according to the identifier of the first transaction. Alternatively, after obtaining the identifier of the first transaction according to the first request, the third node sends the identifier of the first transaction to the second node. After receiving the identification of the first transaction, the second node queries the first key locally based on the identification of the first transaction and sends the first key to the third node.
  • the target network verifies the identity of the first transaction via the blockchain.
  • the target network sends a query message to the blockchain node.
  • the query message may be used to query the key corresponding to the first transaction.
  • the query message may include the identifier of the first transaction.
  • the blockchain node can query the first key according to the identifier of the first transaction and send a response message to the target network.
  • the response message includes the first key.
  • the target network verifies whether the first key it has queried is the same as the first key sent by the blockchain node. If they are the same, it sends an authentication message to the terminal. If they are not the same, it sends an authentication failure message to the terminal. .
  • the terminal After the terminal verifies the authentication message, it sends the verification result to the target network. Accordingly, the target network receives the verification result from the terminal.
  • the verification results include verification failure or verification success.
  • the target network after receiving the verification result, sends a verification response message to the terminal according to the verification result.
  • the terminal receives the verification response message from the target network.
  • the verification response message may indicate that the authentication passed or the authentication failed, or the verification response message may indicate that access to the target network is allowed or access to the target network is not allowed.
  • the actions of the terminal or the target network (which may be a node in the target network) in the above-mentioned S401-S403 can be executed by the processor 201 in the communication device 20 shown in Figure 2 by calling the application code stored in the memory 203,
  • the embodiments of this application do not impose any limitations on this.
  • authentication can be performed between the terminal and the target network through the identification of the first transaction and the first key.
  • the target network does not need to allocate a user permanent identifier (SUPI) to each terminal, and the target network does not need to manage a large number of SUPIs, which not only simplifies the authentication process, but also saves the storage resources of the target network.
  • SUPI user permanent identifier
  • the method may include the following steps:
  • S501 The terminal obtains the first transaction identifier and the first key.
  • the target network obtains the first transaction identifier and the first key.
  • S501-S502 are the same as S401-S402 in the method shown in Figure 4.
  • S503 The terminal sends the second request to the first network.
  • the first network receives the second request from the terminal.
  • the target network is the network where the terminal is located, and the first network is the network where the terminal is roaming.
  • Example 1 taking the communication system 10 shown in FIG. 1A as an example, the first network is the network 104.
  • the terminal 102 moves from the coverage area of the network 103 to the coverage area of the network 104, it sends a second request to the network 104, for example, to a node. 1042 Send the second request.
  • Example 2 taking the communication system 11 shown in FIG. 1D as an example, the first network is the network 115.
  • the terminal 112 moves from the coverage area of the network 113 to the coverage area of the network 115, it sends a second request to the network 115, for example, to a node. 1152 Send the second request.
  • the second request may be used to request access to the first network.
  • the second request may include the identification of the first transaction and the identification of the target network.
  • the terminal also sends the first random number to the first network.
  • the first network receives the first random number from the terminal. It can be understood that the first random number may be included in the second request and sent to the first network, or may be included in other messages and sent to the first network, without limitation.
  • S504 The first network sends the identification of the first transaction to the target network.
  • the target network receives the identification of the first transaction from the first network.
  • the first network determines to send the identifier of the first transaction to the target network based on the identifier of the target network. After receiving the identification of the first transaction, the target network obtains the first key according to the identification of the first transaction.
  • the node 1042 after receiving the second request, sends the identifier of the first transaction to the node 1032 according to the identifier of the network 103. After receiving the identifier of the first transaction, the node 1032 performs a query based on the identifier of the first transaction to obtain the first key.
  • node 1152 after receiving the second request, sends the identifier of the first transaction to node 1132 according to the identifier of network 113. After receiving the identifier of the first transaction, the node 1132 performs a query based on the identifier of the first transaction to obtain the first key.
  • the first network sends the first random number to the target network.
  • the target network receives the first random number from the first network.
  • the first network sends the identification of the first network to the target network.
  • the target network receives the identification of the first network from the first network.
  • the first network sends the target network's identifier to the target network.
  • the target network receives the identification of the target network from the first network.
  • the above-mentioned identification of the first transaction, the first random number, the identification of the first network and the identification of the target network may be included in one message and sent to the target network, or may be included in different messages and sent to the target network. , not restricted.
  • S505 The target network sends the second key to the blockchain node. Accordingly, the blockchain node receives the second key from the target network.
  • the second key can be used for authentication between the terminal and the first network.
  • the second key is obtained based on the first key.
  • node 1032 obtains the second key based on the first key. For example, the node 1032 calculates the first key according to the key generation algorithm to obtain the second key, or calculates the first key and the identity of the network 104 according to the key generation algorithm to obtain the second key, or calculates the second key according to the key
  • the generation algorithm calculates the first key, the identification of the network 104 and the first random number to obtain the second key, and sends the second key to the blockchain node. For example, after node 1032 obtains the second key, it sends the second key to node 1031. After receiving the second key, node 1031 sends the second key to the blockchain node.
  • node 1132 obtains the second key based on the first key. For example, the node 1132 calculates the first key according to the key generation algorithm to obtain the second key, or calculates the first key and the identity of the network 115 according to the key generation algorithm to obtain the second key, or calculates the second key according to the key
  • the generation algorithm calculates the first key, the identification of the network 115 and the first random number to obtain the second key, and sends the second key to the blockchain node. For example, after node 1132 obtains the second key, it sends the second key to node 1131. After receiving the second key, node 1131 sends the second key to the blockchain node.
  • the target network can trigger the generation of a blockchain transaction corresponding to the second key (hereinafter referred to as the second transaction) on the blockchain.
  • the second transaction a blockchain transaction corresponding to the second key
  • node 1031 or node 1131 itself triggers the generation of the second transaction
  • node 1031 or node 1131 is not a node in the blockchain
  • node 1031 or node 1131 Trigger the blockchain node to generate the second transaction.
  • the first network can obtain the second key through the blockchain.
  • the first network also obtains the identifier of the second transaction.
  • the above process is similar to the process in which the first node sends the third message to the blockchain node in S303. Please refer to the corresponding description in S303 and will not be described again here.
  • the identifier of the second transaction includes the address of the second transaction, or the identifier of the second transaction includes the address of the second transaction and the serial number of the terminal in the second transaction.
  • the second transaction address is the address of the second transaction on the blockchain.
  • the first network sends the first indication information to the terminal.
  • the terminal receives the first indication information from the first network.
  • the first instruction information may be used to instruct the terminal to generate a second key or to instruct the terminal to generate a new key.
  • the node 1032 sends the first indication information to the terminal 102.
  • the node 1132 sends the first indication information to the terminal 112.
  • the first network also sends the identifier of the second transaction to the terminal.
  • the terminal receives the identification of the second transaction from the first network.
  • identification of the second transaction and the first instruction information may be included in one message and sent to the terminal, or they may be included in different messages and sent to the terminal, without limitation.
  • S507 The terminal generates a second key based on the first key.
  • the terminal 102 obtains the second key based on the first key. For example, the terminal 102 calculates the first key according to the key generation algorithm to obtain the second key, or calculates the first key and the identity of the network 104 according to the key generation algorithm to obtain the second key, or calculates the second key according to the key
  • the generation algorithm calculates the first key, the identification of the network 104 and the first random number to obtain the second key.
  • the terminal 112 obtains the second key based on the first key. For example, the terminal 112 calculates the first key according to the key generation algorithm to obtain the second key, or calculates the first key and the identity of the network 115 according to the key generation algorithm to obtain the second key, or calculates the second key according to the key
  • the generation algorithm calculates the first key, the identification of the network 115 and the first random number to obtain the second key.
  • the terminal and the first network can obtain the second key and the identification of the second transaction.
  • the terminal and the first network may authenticate based on the second key and the identifier of the second transaction.
  • the terminal and the first network may authenticate based on the second key and the identifier of the second transaction.
  • the terminal can update the key according to the method shown in Figure 6 below.
  • the actions of the terminal or the target network (which may be a node in the target network) or the first network (may be a node in the first network) in the above-mentioned S501-S507 may be processed by the communication device 20 shown in FIG. 2
  • the processor 201 calls the application program code stored in the memory 203 for execution, and the embodiment of the present application does not impose any restrictions on this.
  • the target network may configure the second key for the first network and the terminal. Subsequently, the terminal and the first network can perform authentication or authentication based on the second key without requiring the target network to participate in the authentication, thus simplifying the authentication process.
  • an embodiment of the present application provides a method for updating a key.
  • the method may include the following steps:
  • S601 The terminal obtains the first transaction identifier and the first key.
  • the target network obtains the first transaction identifier and the first key.
  • S601-S602 are the same as S401-S402 in the method shown in Figure 4.
  • S401-S402 in the method shown in Figure 4.
  • S603 The terminal sends the fourth message to the first node.
  • the first node receives the fourth message from the terminal.
  • the first node is the node 101 in Figure 1A; or, if the terminal is the terminal 112 in Figure 1D, the first node is the node 111 in Figure 1D.
  • the fourth message may be used to indicate the second network.
  • the fourth message includes the identification of the second network.
  • the second network and the target network may be the same or different.
  • the second network is the network 103 or the network 104 in FIG. 1A; or the second network is the network 113 or the network 115 in FIG. 1D.
  • the second network is the same as the target network, it means that the terminal triggers an update of the key used for authentication between the terminal and the target network. If the second network is different from the target network, it means that the terminal wants to switch to the second network, and the terminal triggers the first node to configure a key for authentication for the terminal and the second network.
  • S603 may not be included in the method shown in FIG. 6 .
  • the first node can trigger the update of the key.
  • the terminal sends a fourth random number to the first node.
  • the first node receives the fourth random number from the terminal.
  • the fourth random number is included in the fourth message and sent to the first node, or the fourth random number is included in a message different from the fourth message and sent to the first node.
  • S604 The first node sends the fifth message to the blockchain node.
  • the blockchain node receives the fifth message from the first node.
  • the fifth message includes the fourth key.
  • the fourth key may be used for authentication between the terminal and the second network.
  • the first node after receiving the fourth message, the first node generates the fourth key according to the first key. For example, the first node calculates the first key according to the key generation algorithm to obtain the fourth key, or calculates the first key and the identity of the second network according to the key generation algorithm to obtain the fourth key, Or the first key, the identifier of the second network and the fourth random number are calculated according to the key generation algorithm to obtain the fourth key. Subsequently, the first node can send the fifth message to the blockchain node.
  • the first node can trigger the generation of a blockchain transaction corresponding to the fourth key (hereinafter referred to as the third transaction) on the blockchain.
  • the third transaction a blockchain transaction corresponding to the fourth key
  • the first node is a node in the blockchain
  • the first node itself triggers the generation of the third transaction
  • the first node if the first node is not a node in the blockchain, the first node triggers the blockchain node to generate the third transaction. trade.
  • the second network can obtain the fourth key through the blockchain.
  • the second network also obtains the identifier of the third transaction.
  • the above process is similar to the process in which the first node sends the third message to the blockchain node in S303. Please refer to the corresponding description in S303 and will not be described again here.
  • the identifier of the third transaction includes the address of the third transaction, or the identifier of the third transaction includes the address of the third transaction and the serial number of the terminal in the third transaction.
  • the third transaction address is the address of the third transaction on the blockchain.
  • the blockchain node after receiving the fifth message, the blockchain node sends a response message of the fifth message to the first node to indicate to the first node that the fifth message has been received.
  • S605 The first node sends the second indication information to the terminal.
  • the terminal receives the second indication information from the first node.
  • the second instruction information may be used to instruct the terminal to generate a fourth key, or to instruct the terminal to generate a new key.
  • the first node sends the identifier of the third transaction to the terminal.
  • the terminal receives the identification of the third transaction from the first node.
  • identification of the third transaction and the second instruction information may be included in one message and sent to the terminal, or they may be included in different messages and sent to the terminal, without limitation.
  • S606 The terminal generates a fourth key based on the first key.
  • the terminal calculates the first key according to the key generation algorithm to obtain the fourth key, or calculates the first key and the identity of the second network according to the key generation algorithm to obtain the fourth key, or calculates the fourth key according to the key generation algorithm.
  • the key generation algorithm calculates the first key, the identification of the second network and the fourth random number to obtain the fourth key.
  • the terminal and the second network can obtain the fourth key and the identification of the third transaction.
  • the terminal and the second network may authenticate based on the fourth key and the identifier of the third transaction.
  • the terminal and the second network may authenticate based on the fourth key and the identifier of the third transaction.
  • the actions of the terminal or the first node or the target network (which may be a node in the target network) in the above-mentioned S601-S606 can be performed by the processor 201 in the communication device 20 shown in FIG. 2 to call the application program stored in the memory 203. Code is executed, and the embodiments of this application do not impose any restrictions on this.
  • the terminal can trigger the first node to configure keys for the terminal and the second network. If the second network is the same as the target network, the terminal can trigger the update of the key used for authentication between the terminal and the target network to improve communication security. If the second network is different from the target network, the terminal can access the second network according to the key configured on the first node without changing the SIM card, which is very convenient.
  • the methods and/or steps implemented by the terminal can also be implemented by components (such as chips or circuits) that can be used in the terminal; the methods and/or steps implemented by the first node can also be implemented by the terminal.
  • Implemented by components (such as chips or circuits) that can be used in the first node; methods and/or steps implemented by nodes in the target network can also be implemented by components (such as chips or circuits) that can be used in nodes in the target network;
  • embodiments of the present application also provide a communication device.
  • the communication device can be the terminal in the above method embodiment, or a device including the above terminal, or a component that can be used for the terminal; or, the communication device can be the above method.
  • the first node in the embodiment may be a device that includes the above-mentioned first node, or may be a component that can be used for the first node; or the communication device may be a node in the target network in the above-mentioned method embodiment, or include the above-mentioned target.
  • the above-mentioned terminal or the first node or the node in the target network or the node in the first network or the node in the second network includes the corresponding hardware structure and/or to perform each function.
  • Software modules Persons skilled in the art should easily realize that, with the units and algorithm operations of each example described in conjunction with the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is performed by hardware or computer software driving the hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each specific application, but such implementations should not be considered beyond the scope of this application.
  • Embodiments of the present application can divide the terminal or the first node or the node in the target network or the node in the first network or the node in the second network into functional modules according to the above method examples.
  • the terminal or the first node or the node in the second network can be divided into functional modules corresponding to each function.
  • Function modules can also integrate two or more functions into one processing module.
  • the above integrated modules can be implemented in the form of hardware or software function modules. It can be understood that the division of modules in the embodiment of the present application is schematic and is only a logical function division. In actual implementation, there may be other division methods.
  • FIG. 7 shows a schematic structural diagram of a communication device 70 .
  • the communication device 70 includes a transceiver module 701.
  • the communication device 70 also includes a processing module 702.
  • the transceiver module 701 which may also be called a transceiver unit, is used to perform transceiver operations.
  • it may be a transceiver circuit, a transceiver, a transceiver or a communication interface.
  • the processing module 702 which may also be called a processing unit, is used to perform operations other than sending and receiving operations, and may be, for example, a processing circuit or a processor.
  • the communication device 70 may also include a storage module (not shown in Figure 7) for storing program instructions and data.
  • the communication device 70 is used to implement the functions of the terminal.
  • the communication device 70 is, for example, the embodiment shown in FIG. 3 , the embodiment shown in FIG. 4 , the embodiment shown in FIG. 5 or the terminal described in the embodiment shown in FIG. 6 .
  • the transceiver module 701 is used to send a first message to the first node, where the first message is used to instruct the communication device 70 to access the network.
  • the transceiver module 701 may be used to perform S301.
  • the transceiver module 701 is also used to receive a second message from the first node.
  • the second message includes key information.
  • the key information is used to determine the first key.
  • the first key is used for the communication device 70 Authentication with the target network.
  • the transceiver module 701 is also used to perform S304.
  • the second message also includes an identifier of the first transaction and at least one of the following: an identifier of the target network or a public key of the target network; the first transaction corresponds to the first key blockchain transactions.
  • the transceiver module 701 is also used to send a first request to the target network.
  • the first request is used to request access to the target network, and the first request includes the identification of the first transaction; the transceiver module 701 , and is also used to receive an authentication message from the target network, where the authentication message corresponds to the first key.
  • the transceiver module 701 is also used to send the identification of the communication device 70 to the target network.
  • the transceiver module 701 is also configured to send a second request to the first network.
  • the second request is used to request access to the first network.
  • the second request includes the identification of the first transaction. and the identification of the target network;
  • the transceiver module 701 is also used to receive first instruction information from the first network.
  • the first instruction information is used to instruct the communication device 70 to generate a second key.
  • the second key is For authentication between the communication device 70 and the first network; the processing module 702 is configured to generate a second key according to the first key and the identity of the first network.
  • the transceiver module 701 is also configured to receive an identifier of a second transaction from the first network, where the second transaction is a blockchain transaction corresponding to the second key.
  • the transceiver module 701 is also configured to send a third message to the first node, where the third message is used to indicate the third network; the transceiver module 701 is also configured to receive the second message from the first node. Instruction information, the second instruction information is used to instruct the communication device 70 to generate a third key, which is used for authentication between the communication device 70 and the third network; the processing module 702 is used to generate a third key according to the first key and the third network. The identification of the third network generates a third key.
  • the transceiver module 701 is also configured to receive an identifier of a third transaction from the first node, where the third transaction is a blockchain transaction corresponding to the third key.
  • the transceiving module 701 is also configured to send the first random number to the first network.
  • the identification of the first transaction includes the address of the first transaction, or the identification of the first transaction includes the address of the first transaction and the serial number of the communication device 70 in the first transaction.
  • the target network is determined according to the selection of the user corresponding to the communication device 70; or the target network is determined according to a preset policy; or the target network is determined by the first node.
  • the key information includes a first key; alternatively, the key information includes a third key, and the third key is used to determine the first key.
  • the transceiving module 701 is also used to send a second random number to the first node.
  • the third key is used to determine the first key, including: the third key is used to determine the first key together with an identifier of the target network and a second random number.
  • the first message includes information about the target network.
  • the communication device 70 may take the form shown in FIG. 2 .
  • the processor 201 in Figure 2 can cause the communication device 70 to execute the method described in the above method embodiment by calling the computer execution instructions stored in the memory 203.
  • the functions/implementation processes of the transceiver module 701 and the processing module 702 in Figure 7 can be implemented by the processor 201 in Figure 2 calling computer execution instructions stored in the memory 203.
  • the function/implementation process of the processing module 702 in Figure 7 can be implemented by the processor 201 in Figure 2 calling the computer execution instructions stored in the memory 203.
  • the function/implementation process of the transceiver module 701 in Figure 7 can be implemented by Figure 7 It is implemented by the communication interface 204 in 2.
  • FIG. 8 shows a schematic structural diagram of a communication device 80.
  • the communication device 80 includes a transceiver module 801 and a processing module 802.
  • the transceiver module 801 which may also be called a transceiver unit, is used to perform transceiver operations.
  • it may be a transceiver circuit, a transceiver, a transceiver, or a communication interface.
  • the communication device 80 may also include a storage module (not shown in Figure 8) for storing program instructions and data.
  • the communication device 80 is used to implement the function of the first node.
  • the communication device 80 is, for example, the first node described in the embodiment shown in FIG. 3 or the embodiment shown in FIG. 6 .
  • the transceiver module 801 is used to receive a first message from the terminal, where the first message is used to indicate that the terminal wants to access the network.
  • the transceiver module 801 may be used to perform S301.
  • the processing module 802 is used to obtain a first key, which is used for authentication between the terminal and the target network.
  • the processing module 802 may be used to perform S302.
  • the transceiver module 801 is also used to send a third message to the blockchain node, where the third message is used to indicate the first key to the target network.
  • the transceiver module 801 can also be used to perform S303.
  • the transceiver module 801 is also configured to send a second message to the terminal.
  • the second message includes key information, and the key information is determined based on the first key.
  • the transceiver module 801 can also be used to perform S304.
  • the processing module 802 is also used to obtain the identifier of the first transaction, which is the blockchain transaction corresponding to the first key.
  • the second message further includes an identification of the first transaction and at least one of the following: an identification of the target network or a public key of the target network.
  • the identification of the first transaction includes the address of the first transaction, or the identification of the first transaction includes the address of the first transaction and the serial number of the terminal in the first transaction.
  • the transceiver module 801 is also used to receive a fourth message from the terminal, the fourth message is used to indicate the second network; the transceiver module 801 is also used to send a fifth message to the blockchain node. message, the fifth message includes a fourth key, the fourth key is used for authentication between the terminal and the second network; the transceiver module 801 is also used to send second indication information to the terminal, the second indication information is Generate a fourth key at the instruction terminal.
  • the processing module 802 is also used to obtain the address of a third transaction, which is a blockchain transaction corresponding to the fourth key.
  • the transceiving module 801 is also used to send the identifier of the third transaction to the terminal.
  • the key information includes the first key; alternatively, the key information includes a third key, and the third key is used to determine the first key.
  • the transceiving module 801 is also used to receive a second random number from the terminal.
  • the third key is used to determine the first key, including: the third key is used to determine the first key together with an identifier of the target network and a second random number.
  • the blockchain node is included in the target network, and the third message is obtained by encrypting the first key using the public key of the target network.
  • the first message includes information about the target network.
  • the communication device 80 is used to implement the function of a node in the target network.
  • the communication device 80 is, for example, a node in the target network described in the embodiment shown in FIG. 4 , the embodiment shown in FIG. 5 or the embodiment shown in FIG. 6 .
  • the processing module 802 is used to obtain the third message.
  • the processing module 802 is also configured to obtain a first key according to the third message; the first key is used for authentication between the first terminal and the target network.
  • the processing module 802 is also used to obtain the identification of the first transaction, which is the blockchain transaction corresponding to the first key.
  • the processing module 802 is also configured to verify the first terminal according to the first key and the identification of the first transaction.
  • the transceiver module 801 is also configured to send a verification response message to the first terminal according to the verification result.
  • the processing module 802 is specifically configured to receive a first request from the first terminal through the transceiver module 801.
  • the first request is used to request access to the target network, and the first request includes a first request.
  • the identification of the transaction; the processing module 802 is also specifically configured to send an authentication message to the first terminal through the transceiver module 801.
  • the authentication message is obtained based on the first key, and the first key is queried based on the first request. .
  • the sending and receiving module 801 is also used to send a query message to the blockchain node.
  • the query message is used to query the key corresponding to the first transaction.
  • the query message includes the identification of the first transaction; sending and receiving Module 801 is also used to receive a response message from the blockchain node, where the response message includes the first key.
  • the transceiver module 801 is also configured to receive the identification of the first terminal from the first terminal.
  • the transceiver module 801 is also configured to receive a third request from the second terminal.
  • the third request is used to request access to the target network.
  • the third request includes the identification of the fourth transaction and the third request.
  • the identification of the third network, the fourth transaction is a blockchain transaction corresponding to the fifth key, and the fifth key is used for authentication between the second terminal and the third network;
  • the transceiver module 801 is also used to send a message to the third network.
  • the network sends the identification of the fourth transaction;
  • the processing module 802 is also used to obtain the sixth key, which is used for authentication between the second terminal and the target network;
  • the transceiver module 801 is also used to send a message to the second terminal.
  • Third indication information the third indication information is used to instruct the second terminal to generate the sixth key.
  • the processing module 802 is also used to obtain the identity of the fifth transaction, which is the blockchain transaction corresponding to the sixth key; the transceiver module 801 is also used to send the message to the second terminal. Send the identification of this fifth transaction.
  • the transceiver module 801 is also used to receive the identification of the first transaction from the second network; the transceiver module 801 is also used to send a second key to the blockchain node.
  • the key is used for authentication between the first terminal and the second network.
  • the second key is obtained based on the first key.
  • the first key is queried based on the identifier of the first transaction.
  • the identification of the first transaction includes the address of the first transaction, or the identification of the first transaction includes the address of the first transaction and the serial number of the first terminal in the first transaction.
  • the communication device 80 is used to implement the functions of the terminal.
  • the communication device 80 is, for example, the terminal described in the embodiment shown in Figure 4.
  • the processing module 802 is used to obtain the identification and the first key of the first transaction, and the first transaction is the blockchain transaction corresponding to the first key.
  • the processing module 802 may be used to perform S401.
  • the processing module 802 is also configured to perform authentication with the target network based on the identity of the first transaction and the first key.
  • the processing module 802 can also be used to perform S403.
  • the transceiver module 801 is used to receive the verification response message from the target network.
  • the processing module 802 is specifically configured to send a first request to the target network through the transceiver module 801.
  • the first request is used to request access to the target network, and the first request includes an identification of the first transaction.
  • the processing module 802 is also specifically configured to receive an authentication message from the target network through the transceiver module 801. The authentication message is obtained according to the first key, and the first key is queried according to the first request; the processing module 802 , is also specifically used to verify the authentication message.
  • the transceiver module 801 is also used to send the 80 identification of the communication device 80 to the target network.
  • the first request is obtained by encrypting the identity of the first transaction using the public key of the target network.
  • the communication device 80 may take the form shown in FIG. 2 .
  • the processor 201 in Figure 2 can cause the communication device 80 to execute the method described in the above method embodiment by calling the computer execution instructions stored in the memory 203.
  • the functions/implementation processes of the transceiver module 801 and the processing module 802 in Figure 8 can be implemented by the processor 201 in Figure 2 calling computer execution instructions stored in the memory 203.
  • the function/implementation process of the processing module 802 in Figure 8 can be implemented by the processor 201 in Figure 2 calling the computer execution instructions stored in the memory 203.
  • the function/implementation process of the transceiver module 801 in Figure 8 can be implemented by Figure 8 It is implemented by the communication interface 204 in 2.
  • the above modules or units can be implemented in software, hardware, or a combination of both.
  • the software exists in the form of computer program instructions and is stored in the memory.
  • the processor can be used to execute the program instructions and implement the above method flow.
  • the processor can be built into an SoC (System on a Chip) or ASIC, or it can be an independent semiconductor chip.
  • the processor can further include necessary hardware accelerators, such as field programmable gate array (FPGA), PLD (programmable logic device) , or a logic circuit that implements dedicated logic operations.
  • FPGA field programmable gate array
  • PLD programmable logic device
  • the hardware can be a CPU, a microprocessor, a digital signal processing (DSP) chip, a microcontroller unit (MCU), an artificial intelligence processor, an ASIC, Any one or any combination of SoC, FPGA, PLD, dedicated digital circuits, hardware accelerators or non-integrated discrete devices, which can run the necessary software or not rely on software to perform the above method flow.
  • DSP digital signal processing
  • MCU microcontroller unit
  • embodiments of the present application also provide a chip system, including: at least one processor and an interface.
  • the at least one processor is coupled to the memory through the interface.
  • the at least one processor executes the computer program or instructions in the memory
  • the chip system further includes a memory.
  • the chip system may be composed of chips, or may include chips and other discrete devices, which is not specifically limited in the embodiments of the present application.
  • embodiments of the present application also provide a computer-readable storage medium. All or part of the processes in the above method embodiments can be completed by instructing relevant hardware through a computer program.
  • the program can be stored in the above computer-readable storage medium. When executed, the program can include the processes of the above method embodiments. .
  • the computer-readable storage medium may be an internal storage unit of the communication device of any of the aforementioned embodiments, such as a hard disk or memory of the communication device.
  • the above-mentioned computer-readable storage medium may also be an external storage device of the above-mentioned communication device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card equipped on the above-mentioned communication device, Flash card, etc.
  • SMC smart media card
  • SD secure digital
  • the computer-readable storage medium may also include both an internal storage unit of the communication device and an external storage device.
  • the above computer-readable storage medium is used to store the above computer program and other programs and data required by the above communication device.
  • the above-mentioned computer-readable storage media can also be used to temporarily store data that has been output or is to be output.
  • the embodiment of the present application also provides a computer program product. All or part of the processes in the above method embodiments can be completed by instructing relevant hardware through a computer program.
  • the program can be stored in the above computer program product. When executed, the program can include the processes of the above method embodiments.
  • the embodiment of the present application also provides a computer instruction. All or part of the processes in the above method embodiments can be completed by computer instructions to instruct related hardware (such as computers, processors, access network equipment, mobility management network elements or session management network elements, etc.).
  • the program may be stored in the above-mentioned computer-readable storage medium or in the above-mentioned computer program product.
  • this embodiment of the present application also provides a communication system, including: the terminal in the above embodiment and a first node.
  • this embodiment of the present application also provides a communication system, including: the terminal in the above embodiment and a node in the target network.
  • this embodiment of the present application also provides a communication system, including: the terminal in the above embodiment, a first node and a node in the target network.
  • the disclosed devices and methods can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of modules or units is only a logical function division.
  • there may be other division methods for example, multiple units or components may be The combination can either be integrated into another device, or some features can be omitted, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated.
  • the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place, or they may be distributed to multiple different places. . Some or all of the units can be selected according to actual needs to achieve the purpose of this embodiment.
  • each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit.
  • the above integrated units can be implemented in the form of hardware or software functional units.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请公开了获取密钥的方法及装置，涉及通信领域。在该方法中，终端可以向第一节点发送用于指示终端要接入网络的第一消息，使得第一节点为终端和终端要接入的网络配置密钥。这样，终端和该网络之间可通过配置的密钥进行认证或鉴权，而不是通过SIM卡中的密钥进行认证或鉴权，实现了SIM卡与网络解绑。如此，用户若想切换网络，不需要更换SIM卡，提高了用户体验。

Description

获取密钥的方法及装置 技术领域
本申请涉及通信领域，尤其涉及获取密钥的方法及装置。
背景技术
在通信系统中，终端可通过用户身份识别模块(subscriber identity module，SIM)卡接入运营商提供的网络。具体来说，用户选择运营商并购买对应的SIM卡。SIM卡中预置了该SIM卡的根密钥。SIM卡商在SIM卡被使用前，可通过生产网或者离线的方式将SIM卡的根密钥发送给运营商。如此，运营商和终端都有了可用于认证的根密钥。终端入网时，运营商可基于SIM卡的根密钥进行认证鉴权，并在认证鉴权成功后为终端提供网络服务。
通过以上描述可知，SIM卡是与运营商的网络绑定的，若用户想切换网络，需要更换SIM卡，十分不便，用户体验差。
发明内容
本申请实施例提供获取密钥的方法及装置，可以实现SIM卡与网络解绑，用户若想切换网络，不需要更换SIM卡。
为达到上述目的，本申请的实施例采用如下技术方案：
第一方面，提供了一种获取密钥的方法，执行该方法的通信装置可以为终端；也可以为应用于终端中的模块，例如芯片或芯片系统。下面以执行主体为终端为例进行描述。该方法包括：向第一节点发送第一消息，该第一消息用于指示该终端要接入网络；接收来自该第一节点的第二消息，该第二消息包括密钥信息，该密钥信息用于确定第一密钥，该第一密钥用于该终端与目标网络之间的认证。
基于上述第一方面提供的方法，终端可以触发第一节点为终端配置第一密钥，使得终端能够根据第一密钥与目标网络进行认证。这样，终端不需要通过SIM卡中的密钥与目标网络进行认证，实现了SIM卡与网络解绑。若用户想切换网络，也不需要更换SIM卡，提高了用户体验。
在一种可能的实现方式中，该第二消息还包括第一交易的标识和以下至少一项：该目标网络的标识或该目标网络的公钥；其中，该第一交易为该第一密钥对应的区块链交易。
基于上述可能的实现方式，第一节点还可以向终端发送第一交易的标识，以及目标网络的标识和/或目标网络的公钥，以便终端根据第一密钥以及这些信息与目标网络进行认证。
在一种可能的实现方式中，该方法还包括：向该目标网络发送第一请求，该第一请求用于请求接入该目标网络，该第一请求包括该第一交易的标识；接收来自该目标网络的认证消息，该认证消息与该第一密钥对应。
基于上述可能的实现方式，终端可以触发终端与目标网络之间的认证。
在一种可能的实现方式中，该方法还包括：向该目标网络发送该终端的标识。
基于上述可能的实现方式，终端可以向目标网络指示与目标网络进行认证的终端。
在一种可能的实现方式中，该方法还包括：向第一网络发送第二请求，该第二请求用于请求接入该第一网络，该第二请求包括该第一交易的标识和该目标网络的标识；接收来自该第一网络的第一指示信息，该第一指示信息用于指示该终端生成第二密钥，该第二密钥用于该终端与该第一网络之间的认证；根据该第一密钥和该第一网络的标识生成该第二密钥。
基于上述可能的实现方式，终端可以触发第一网络获取用于与终端进行认证的第二密钥。这样，终端和第二网络之间可基于第二密钥进行认证，而不需要目标网络参与认证，简化了认证流程。
在一种可能的实现方式中，该方法还包括：接收来自该第一网络的第二交易的标识，该第二交易为该第二密钥对应的区块链交易。
基于上述可能的实现方式，第一网络可向终端发送第二交易的标识，以便终端结合第二交易的标识与第一网络进行认证。
在一种可能的实现方式中，该方法还包括：向该第一节点发送第三消息，该第三消息用于指示第三网络；接收来自该第一节点的第二指示信息，该第二指示信息用于指示该终端生成第三密钥，该第三密钥用于该终端与该第三网络之间的认证；根据该第一密钥和该第三网络的标识生成所述第三密钥。
基于上述可能的实现方式，终端可触发第一节点为终端和第三网络配置用于认证的第三密钥，使得终端和第三网络之间可基于第三密钥进行认证。
在一种可能的实现方式中，接收来自该第一节点的第三交易的标识，该第三交易为该第三密钥对应的区块链交易。
基于上述可能的实现方式，第一节点可向终端发送第三交易的标识，以便终端结合第三交易的标识与第三网络进行认证。
在一种可能的实现方式中，该方法还包括：向该第一网络发送第一随机数。
基于上述可能的实现方式，终端可向第一网络发送第一随机数，以便第一网络将第一随机数发送给目标网络，使得目标网络根据第一密钥和第一随机数生成用于终端与第一网络进行认证的第二密钥。
在一种可能的实现方式中，该第一交易的标识包括该第一交易的地址，或者，该第一交易的标识包括该第一交易的地址和该终端在该第一交易中的序列号。
基于上述可能的实现方式，可使得第一节点为每个终端配置的密钥所对应的交易的标识是唯一的。例如，若第一交易包括单个终端的信息，则第一交易的标识包括第一交易的地址。若第一交易包括多个终端的信息，则第一交易的标识包括第一交易的地址和终端在第一交易中的序列号。这样，终端能够根据自己对应的交易的标识与网络进行认证。
在一种可能的实现方式中，该目标网络是根据该终端对应的用户的选择确定的；或者，该目标网络是根据预设策略确定的；或者，该目标网络是该第一节点确定的。
基于上述可能的实现方式，能够灵活选择目标网络。
在一种可能的实现方式中，该密钥信息包括该第一密钥；或者，该密钥信息包括第三密钥，该第三密钥用于确定该第一密钥。
基于上述可能的实现方式，第一节点可以直接向终端指示用于与目标网络进行认证的第一密钥，或者，第一节点可以向终端指示第三密钥，使得终端根据第三密钥生成用于与目标网络进行认证的第一密钥。
在一种可能的实现方式中，该方法还包括：向该第一节点发送第二随机数。
基于上述可能的实现方式，终端可以向第一节点发送第二随机数，使得第一节点根据第二随机数生成第一密钥。
在一种可能的实现方式中，该第三密钥用于确定该第一密钥，包括：该第三密钥用于和该目标网络的标识以及该第二随机数共同确定该第一密钥。
基于上述可能的实现方式，可以根据第三密钥、目标网络的标识和第二随机数确定第一密钥。
在一种可能的实现方式中，该第一消息包括该目标网络的信息。
基于上述可能的实现方式，终端可以向第一节点指示终端想要接入的目标网络。
第二方面，提供了一种获取密钥的方法，执行该方法的通信装置可以为第一节点；也可以为应用于第一节点中的模块，例如芯片或芯片系统。下面以执行主体为第一节点为例进行描述。该方法包括：接收来自终端的第一消息，该第一消息用于指示该终端要接入网络；获取第一密钥，该第一密钥用于该终端与目标网络之间的认证；向区块链节点发送第三消息，该第三消息用于向该目标网络指示第一密钥；向该终端发送第二消息，该第二消息包括密钥信息，该密钥信息是根据该第一密钥确定的。
基于上述第二方面提供的方法，基于终端的触发，第一节点可以获取第一密钥，并向终端和目标网络指示第一密钥。这样，终端和目标网络可以基于第一密钥进行认证，而不需要通过SIM卡中的密钥进行认证，实现了SIM卡与网络解绑。若用户想切换网络，也不需要更换SIM卡，提高了用户体验。
在一种可能的实现方式中，在向该终端发送第二消息之前，该方法还包括：获取第一交易的标识，该第一交易为该第一密钥对应的区块链交易。
基于上述可能的实现方式，第一节点还可以获取第一交易的标识，以便第一节点将第一交易的标识发送给终端，使得终端基于第一交易的标识和第一密钥与目标网络进行认证。
在一种可能的实现方式中，该第二消息还包括该第一交易的标识和以下至少一项：该目标网络的标识或该目标网络的公钥。
基于上述可能的实现方式，第一节点还可以向终端发送第一交易的标识，以及目标网络的标识和/或目标网络的公钥，以便终端根据第一密钥以及这些信息与目标网络进行认证。
在一种可能的实现方式中，该第一交易的标识包括该第一交易的地址，或者，该第一交易的标识包括该第一交易的地址和该终端在该第一交易中的序列号。
基于上述可能的实现方式，可使得第一节点为每个终端配置的密钥所对应的交易的标识是唯一的。例如，若第一交易包括单个终端的信息，则第一交易的标识包括第 一交易的地址。若第一交易包括多个终端的信息，则第一交易的标识包括第一交易的地址和终端在第一交易中的序列号。这样，终端能够根据自己对应的交易的标识与网络进行认证。
在一种可能的实现方式中，该方法还包括：接收来自该终端的第四消息，该第四消息用于指示第二网络；向该区块链节点发送第五消息，该第五消息包括第四密钥，该第四密钥用于该终端与该第二网络之间的认证；向该终端发送第二指示信息，该第二指示信息用于指示该终端生成该第四密钥。
基于上述可能的实现方式，基于终端的触发，第一节点可以为终端和第二网络生成用于认证的第四密钥，使得终端和第二网络可以根据第四密钥进行认证。
在一种可能的实现方式中，该方法还包括：获取第三交易的地址，该第三交易为该第四密钥对应的区块链交易。
基于上述可能的实现方式，第一节点可以获取第四密钥对应的第三交易的地址。
在一种可能的实现方式中，该方法还包括：向该终端发送该第三交易的标识。
基于上述可能的实现方式，第一节点可以向终端发送第三交易的标识，以便终端和第二网络基于第四密钥和第三交易的标识进行认证。
在一种可能的实现方式中，该密钥信息包括该第一密钥；或者，该密钥信息包括第三密钥，该第三密钥用于确定该第一密钥。
基于上述可能的实现方式，第一节点可以直接向终端指示用于与目标网络进行认证的第一密钥，或者，第一节点可以向终端指示第三密钥，使得终端根据第三密钥生成用于与目标网络进行认证的第一密钥。
在一种可能的实现方式中，该方法还包括：接收来自该终端的第二随机数。
基于上述可能的实现方式，第一节点可以根据第二随机数生成第一密钥。
在一种可能的实现方式中，该第三密钥用于确定该第一密钥，包括：该第三密钥用于和该目标网络的标识以及该第二随机数共同确定该第一密钥。
基于上述可能的实现方式，可以根据第三密钥、目标网络的标识和第二随机数确定第一密钥。
在一种可能的实现方式中，该区块链节点包括在该目标网络中，该第三消息是用该目标网络的公钥对该第一密钥进行加密得到的。
基于上述可能的实现方式，区块链节点可根据目标网络的私钥解密第三消息，以确定第三消息是与自己有关的。
在一种可能的实现方式中，该第一消息包括该目标网络的信息。
基于上述可能的实现方式，终端可以向第一节点指示终端想要接入的目标网络。
第三方面，提供了一种获取密钥的方法，执行该方法的通信装置可以为目标网络中的节点；也可以为应用于目标网络中的节点中的模块，例如芯片或芯片系统。下面以执行主体为目标网络中的节点为例进行描述。该方法包括：获取第三消息；根据该第三消息获取第一密钥；该第一密钥用于第一终端与目标网络之间的认证；获取第一交易的标识，该第一交易为该第一密钥对应的区块链交易；根据该第一密钥和该第一交易的标识验证该第一终端；根据验证结果向该第一终端发送验证响应消息。
基于上述第三方面提供的方法，目标网络中的节点可以获取到第一密钥和第一交 易的标识，并根据第一密钥和第一交易的标识验证第一终端。这样，目标网络中的节点和第一终端之间不需要通过第一终端的SIM卡中的密钥进行认证，实现了SIM卡与网络解绑。若用户想切换网络，也不需要更换SIM卡，提高了用户体验。
在一种可能的实现方式中，根据该第一密钥和该第一交易的标识验证该第一终端，包括：接收来自该第一终端的第一请求，该第一请求用于请求接入该目标网络，该第一请求包括该第一交易的标识；向该第一终端发送认证消息，该认证消息是根据第一密钥得到的，该第一密钥是根据该第一请求查询到的。
基于上述可能的实现方式，目标网络中的节点和第一终端可以根据第一密钥和第一交易的标识进行认证。
在一种可能的实现方式中，向该第一终端发送认证消息之前，该方法还包括：向区块链节点发送查询消息，该查询消息用于查询该第一交易对应的密钥，该查询消息包括该第一交易的标识；接收来自区块链节点的响应消息，该响应消息包括该第一密钥。
基于上述可能的实现方式，目标网络中的节点还可以在区块链上查询第一密钥，使得对第一终端的验证结果更为准确。
在一种可能的实现方式中，该方法还包括：接收来自该第一终端的该第一终端的标识。
基于上述可能的实现方式，目标网络中的节点可以基于第一终端的标识确定要认证第一终端。
在一种可能的实现方式中，该方法还包括：接收来自第二终端的第三请求，该第三请求用于请求接入该目标网络，该第三请求包括第四交易的标识和第三网络的标识，该第四交易为第五密钥对应的区块链交易，该第五密钥用于该第二终端与该第三网络之间的认证；向第三网络发送该第四交易的标识；获取第六密钥，该第六密钥用于该第二终端与该目标网络的认证；向该第二终端发送第三指示信息，该第三指示信息用于指示该第二终端生成该第六密钥。
基于上述可能的实现方式，目标网络中的节点可以基于第二终端的请求，请求第三网络为目标网络和第二终端配置用于目标网络和第二终端进行认证的密钥，使得目标网络和第二终端能够基于该密钥进行认证。这样，第二终端和目标网络在认证的过程中，可以不需要第三网络的参与，简化了认证流程。
在一种可能的实现方式中，该方法还包括：获取第五交易的标识，该第五交易为该第六密钥对应的区块链交易；向该第二终端发送该第五交易的标识。
基于上述可能的实现方式，目标网络中的节点可向第二终端发送第五交易的标识，使得第二终端和目标网络可基于第五交易的标识和第六密钥进行认证。
在一种可能的实现方式中，该方法还包括：接收来自第二网络的该第一交易的标识；向该区块链节点发送第二密钥，该第二密钥用于该第一终端与该第二网络之间的认证，该第二密钥是根据该第一密钥得到，该第一密钥是根据该第一交易的标识查询到的。
基于上述可能的实现方式，目标网络中的节点可为第二网络和第一终端配置进行认证的第二密钥，使得第二网络和第一终端基于第二密钥进行认证。这样，第二网络 和第一终端在认证的过程中，可以不需要目标网络的参与，简化了认证流程。
在一种可能的实现方式中，该第一交易的标识包括该第一交易的地址，或者，该第一交易的标识包括该第一交易的地址和该第一终端在该第一交易中的序列号。
基于上述可能的实现方式，可使得第一节点为每个终端配置的密钥所对应的交易的标识是唯一的。例如，若第一交易包括单个终端的信息，则第一交易的标识包括第一交易的地址。若第一交易包括多个终端的信息，则第一交易的标识包括第一交易的地址和终端在第一交易中的序列号。这样，终端能够根据自己对应的交易的标识与网络进行认证。
第四方面，提供了一种认证方法，执行该方法的通信装置可以为终端；也可以为应用于终端中的模块，例如芯片或芯片系统。下面以执行主体为终端为例进行描述。该方法包括：获取第一交易的标识和第一密钥，该第一交易为该第一密钥对应的区块链交易；根据该第一交易的标识和该第一密钥与目标网络进行认证；接收来自该目标网络的验证响应消息。
基于上述第四方面提供的方法，终端可以获取第一交易的标识和第一密钥，并根据第一交易的标识和第一密钥与目标网络进行认证。这样，目标网络可以不用向每个终端分配用户永久标识符(subscription permanent identifier，SUPI)，目标网络不用管理大量的SUPI，既简化了认证流程，又节约了目标网络的存储资源。
在一种可能的实现方式中，根据该第一交易的标识和该第一密钥与该目标网络进行认证，包括：向该目标网络发送第一请求，该第一请求用于请求接入该目标网络，该第一请求包括该第一交易的标识；接收来自该目标网络的认证消息，该认证消息是根据该第一密钥得到的，该第一密钥是根据该第一请求查询到的；验证该认证消息。
基于上述可能的实现方式，终端可以向目标网络发送第一交易的标识，使得目标网络基于第一交易的标识查询到第一密钥，根据第一密钥得到认证消息，并发送给终端，以完成终端与目标网络之间的认证。
在一种可能的实现方式中，该方法还包括：向该目标网络发送该终端的标识。
基于上述可能的实现方式，可以向目标网络指示要接入该网络的终端。
在一种可能的实现方式中，该第一请求是用该目标网络的公钥对该第一交易的标识进行加密得到。
基于上述可能的实现方式，终端可将第一交易的标识进行加密后发送给目标网络，以提高通信安全。
第五方面，提供了一种通信装置用于实现上述第一方面提供的方法。该通信装置可以为上述第一方面中的终端，或者包含上述终端的装置。该通信装置包括实现上述方法相应的模块、单元、或手段(means)，该模块、单元、或means可以通过硬件实现，软件实现，或者通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块或单元。
在一种可能的实现方式中，该通信装置可以包括收发模块。该收发模块，也可以称为收发单元，用以实现上述第一方面及其任意可能的实现方式中的发送和/或接收功能。该收发模块可以由收发电路，收发机，收发器或者通信接口构成。
在一种可能的实现方式中，收发模块包括发送模块和接收模块，分别用于实现上 述第一方面及其任意可能的实现方式中的发送和接收功能。
在一种可能的实现方式中，该通信装置还可以包括处理模块。该处理模块可以用于实现上述第一方面及其任意可能的实现方式中的处理功能。该处理模块例如可以为处理器。
在一种可能的实现方式中，该收发模块，用于向第一节点发送第一消息，该第一消息用于指示该通信装置要接入网络；该收发模块，还用于接收来自该第一节点的第二消息，该第二消息包括密钥信息，该密钥信息用于确定第一密钥，该第一密钥用于该通信装置与目标网络之间的认证。
在一种可能的实现方式中，该第二消息还包括第一交易的标识和以下至少一项：该目标网络的标识或该目标网络的公钥；该第一交易为该第一密钥对应的区块链交易。
在一种可能的实现方式中，该收发模块，还用于向该目标网络发送第一请求，该第一请求用于请求接入该目标网络，该第一请求包括该第一交易的标识；该收发模块，还用于接收来自该目标网络的认证消息，该认证消息与该第一密钥对应。
在一种可能的实现方式中，该收发模块，还用于向该目标网络发送该通信装置的标识。
在一种可能的实现方式中，该收发模块，还用于向第一网络发送第二请求，该第二请求用于请求接入该第一网络，该第二请求包括该第一交易的标识和该目标网络的标识；该收发模块，还用于接收来自该第一网络的第一指示信息，该第一指示信息用于指示该通信装置生成第二密钥，该第二密钥用于该通信装置与该第一网络之间的认证；该处理模块，用于根据该第一密钥和该第一网络的标识生成该第二密钥。
在一种可能的实现方式中，该收发模块，还用于接收来自该第一网络的第二交易的标识，该第二交易为该第二密钥对应的区块链交易。
在一种可能的实现方式中，该收发模块，还用于向该第一节点发送第三消息，该第三消息用于指示第三网络；该收发模块，还用于接收来自该第一节点的第二指示信息，该第二指示信息用于指示该通信装置生成第三密钥，该第三密钥用于该通信装置与该第三网络之间的认证；该处理模块，用于根据该第一密钥和该第三网络的标识生成所述第三密钥。
在一种可能的实现方式中，该收发模块，还用于接收来自该第一节点的第三交易的标识，该第三交易为该第三密钥对应的区块链交易。
在一种可能的实现方式中，该收发模块，还用于向该第一网络发送第一随机数。
在一种可能的实现方式中，该第一交易的标识包括该第一交易的地址，或者，该第一交易的标识包括该第一交易的地址和该通信装置在该第一交易中的序列号。
在一种可能的实现方式中，该目标网络是根据该通信装置对应的用户的选择确定的；或者，该目标网络是根据预设策略确定的；或者，该目标网络是该第一节点确定的。
在一种可能的实现方式中，该密钥信息包括该第一密钥；或者，该密钥信息包括第三密钥，该第三密钥用于确定该第一密钥。
在一种可能的实现方式中，该收发模块，还用于向该第一节点发送第二随机数。
在一种可能的实现方式中，该第三密钥用于确定该第一密钥，包括：该第三密钥用于和该目标网络的标识以及该第二随机数共同确定该第一密钥。
在一种可能的实现方式中，该第一消息包括该目标网络的信息。
第六方面，提供了一种通信装置用于实现上述第二方面提供的方法。该通信装置可以为上述第二方面中的第一节点，或者包含上述第一节点的装置。该通信装置包括实现上述方法相应的模块、单元、或手段(means)，该模块、单元、或means可以通过硬件实现，软件实现，或者通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块或单元。
在一种可能的实现方式中，该通信装置可以包括收发模块和处理模块。该收发模块，也可以称为收发单元，用以实现上述第二方面及其任意可能的实现方式中的发送和/或接收功能。该收发模块可以由收发电路，收发机，收发器或者通信接口构成。该处理模块可以用于实现上述第二方面及其任意可能的实现方式中的处理功能。该处理模块例如可以为处理器。
在一种可能的实现方式中，收发模块包括发送模块和接收模块，分别用于实现上述第二方面及其任意可能的实现方式中的发送和接收功能。
在一种可能的实现方式中，该收发模块，用于接收来自终端的第一消息，该第一消息用于指示该终端要接入网络；该处理模块，用于获取第一密钥，该第一密钥用于该终端与目标网络之间的认证；该收发模块，还用于向区块链节点发送第三消息，该第三消息用于向该目标网络指示第一密钥；该收发模块，还用于向该终端发送第二消息，该第二消息包括密钥信息，该密钥信息是根据该第一密钥确定的。
在一种可能的实现方式中，该处理模块，还用于获取第一交易的标识，该第一交易为该第一密钥对应的区块链交易。
在一种可能的实现方式中，该第二消息还包括该第一交易的标识和以下至少一项：该目标网络的标识或该目标网络的公钥。
在一种可能的实现方式中，该第一交易的标识包括该第一交易的地址，或者，该第一交易的标识包括该第一交易的地址和该终端在该第一交易中的序列号。
在一种可能的实现方式中，该收发模块，还用于接收来自该终端的第四消息，该第四消息用于指示第二网络；该收发模块，还用于向该区块链节点发送第五消息，该第五消息包括第四密钥，该第四密钥用于该终端与该第二网络之间的认证；该收发模块，还用于向该终端发送第二指示信息，该第二指示信息用于指示该终端生成该第四密钥。
在一种可能的实现方式中，该处理模块，还用于获取第三交易的地址，该第三交易为该第四密钥对应的区块链交易。
在一种可能的实现方式中，该收发模块，还用于向该终端发送该第三交易的标识。
在一种可能的实现方式中，该密钥信息包括该第一密钥；或者，该密钥信息包括第三密钥，该第三密钥用于确定该第一密钥。
在一种可能的实现方式中，该收发模块，还用于接收来自该终端的第二随机数。
在一种可能的实现方式中，该第三密钥用于确定该第一密钥，包括：该第三密钥 用于和该目标网络的标识以及该第二随机数共同确定该第一密钥。
在一种可能的实现方式中，该区块链节点包括在该目标网络中，该第三消息是用该目标网络的公钥对该第一密钥进行加密得到的。
在一种可能的实现方式中，该第一消息包括该目标网络的信息。
第七方面，提供了一种通信装置用于实现上述第三方面提供的方法。该通信装置可以为上述第三方面中的目标网络中的节点，或者包含上述目标网络中的节点的装置。该通信装置包括实现上述方法相应的模块、单元、或手段(means)，该模块、单元、或means可以通过硬件实现，软件实现，或者通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块或单元。
在一种可能的实现方式中，该通信装置可以包括处理模块和发送模块。该处理模块可以用于实现上述第三方面及其任意可能的实现方式中的处理功能。该处理模块例如可以为处理器。该收发模块，也可以称为收发单元，用以实现上述第三方面及其任意可能的实现方式中的发送和/或接收功能。该收发模块可以由收发电路，收发机，收发器或者通信接口构成。
在一种可能的实现方式中，收发模块包括发送模块和接收模块，分别用于实现上述第三方面及其任意可能的实现方式中的发送和接收功能。
在一种可能的实现方式中，该处理模块，用于获取第三消息；该处理模块，还用于根据该第三消息获取第一密钥；该第一密钥用于第一终端与目标网络之间的认证；该处理模块，还用于获取第一交易的标识，该第一交易为该第一密钥对应的区块链交易；该处理模块，还用于根据该第一密钥和该第一交易的标识验证该第一终端；该收发模块，用于根据验证结果向该第一终端发送验证响应消息。
在一种可能的实现方式中，该处理模块，具体用于通过该收发模块接收来自该第一终端的第一请求，该第一请求用于请求接入该目标网络，该第一请求包括该第一交易的标识；该处理模块，还具体用于通过该收发模块向该第一终端发送认证消息，该认证消息是根据第一密钥得到的，该第一密钥是根据该第一请求查询到的。
在一种可能的实现方式中，该收发模块，还用于向区块链节点发送查询消息，该查询消息用于查询该第一交易对应的密钥，该查询消息包括该第一交易的标识；该收发模块，还用于接收来自区块链节点的响应消息，该响应消息包括该第一密钥。
在一种可能的实现方式中，该收发模块，还用于接收来自该第一终端的该第一终端的标识。
在一种可能的实现方式中，该收发模块，还用于接收来自第二终端的第三请求，该第三请求用于请求接入该目标网络，该第三请求包括第四交易的标识和第三网络的标识，该第四交易为第五密钥对应的区块链交易，该第五密钥用于该第二终端与该第三网络之间的认证；该收发模块，还用于向第三网络发送该第四交易的标识；该处理模块，还用于获取第六密钥，该第六密钥用于该第二终端与该目标网络的认证；该收发模块，还用于向该第二终端发送第三指示信息，该第三指示信息用于指示该第二终端生成该第六密钥。
在一种可能的实现方式中，该处理模块，还用于获取第五交易的标识，该第五交易为该第六密钥对应的区块链交易；该收发模块，还用于向该第二终端发送该第五交 易的标识。
在一种可能的实现方式中，该收发模块，还用于接收来自第二网络的该第一交易的标识；该收发模块，还用于向该区块链节点发送第二密钥，该第二密钥用于该第一终端与该第二网络之间的认证，该第二密钥是根据该第一密钥得到，该第一密钥是根据该第一交易的标识查询到的。
在一种可能的实现方式中，该第一交易的标识包括该第一交易的地址，或者，该第一交易的标识包括该第一交易的地址和该第一终端在该第一交易中的序列号。
第八方面，提供了一种通信装置用于实现上述第四方面提供的方法。该通信装置可以为上述第四方面中的终端，或者包含上述终端的装置。该通信装置包括实现上述方法相应的模块、单元、或手段(means)，该模块、单元、或means可以通过硬件实现，软件实现，或者通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块或单元。
在一种可能的实现方式中，该通信装置可以包括处理模块和收发模块。该处理模块可以用于实现上述第四方面及其任意可能的实现方式中的处理功能。该处理模块例如可以为处理器。该收发模块，也可以称为收发单元，用以实现上述第四方面及其任意可能的实现方式中的发送和/或接收功能。该收发模块可以由收发电路，收发机，收发器或者通信接口构成。
在一种可能的实现方式中，收发模块包括发送模块和接收模块，分别用于实现上述第四方面及其任意可能的实现方式中的发送和接收功能。
在一种可能的实现方式中，该处理模块，用于获取第一交易的标识和第一密钥，该第一交易为该第一密钥对应的区块链交易；该处理模块，还用于根据该第一交易的标识和该第一密钥与目标网络进行认证；该收发模块，用于接收来自该目标网络的验证响应消息。
在一种可能的实现方式中，该处理模块，具体用于通过该收发模块向该目标网络发送第一请求，该第一请求用于请求接入该目标网络，该第一请求包括该第一交易的标识；该处理模块，还具体用于通过该收发模块接收来自该目标网络的认证消息，该认证消息是根据该第一密钥得到的，该第一密钥是根据该第一请求查询到的；该处理模块，还具体用于验证该认证消息。
在一种可能的实现方式中，该收发模块，还用于向该目标网络发送该通信装置的标识。
在一种可能的实现方式中，该第一请求是用该目标网络的公钥对该第一交易的标识进行加密得到。
第九方面，提供了一种通信装置，包括：处理器；该处理器用于与存储器耦合，并读取存储器中的指令之后，根据该指令执行如上述任一方面所述的方法。该通信装置可以为上述第一方面中的终端，或者包含上述终端的装置；或者，该通信装置可以为上述第二方面中的第一节点，或者包含上述第一节点的装置；或者，该通信装置可以为上述第三方面中的目标网络中的节点，或者包含上述目标网络中的节点的装置；或者，该通信装置可以为上述第四方面中的终端，或者包含上述终端的装置。
在一种可能的实现方式中，该通信装置还包括存储器，该存储器，用于保存必要 的程序指令和数据。
在一种可能的实现方式中，该通信装置为芯片或芯片系统。可选的，该通信装置是芯片系统时，可以由芯片构成，也可以包含芯片和其他分立器件。
第十方面，提供了一种通信装置，包括：处理器和接口电路；接口电路，用于接收计算机程序或指令并传输至处理器；处理器用于执行所述计算机程序或指令，以使该通信装置执执行如上述任一方面所述的方法。
在一种可能的实现方式中，该通信装置为芯片或芯片系统。可选的，该通信装置是芯片系统时，可以由芯片构成，也可以包含芯片和其他分立器件。
第十一方面，提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述任一方面所述的方法。
第十二方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述任一方面所述的方法。
其中，第五方面至第十二方面中任一种可能的实现方式所带来的技术效果可参见上述第一方面至第四方面中任一方面或任一方面中不同可能的实现方式所带来的技术效果，此处不再赘述。
第十三方面，提供了一种通信系统，该通信系统包括用于执行上述第一方面所述的方法的终端、用于执行上述第二方面所述的方法的第一节点以及用于执行上述第三方面所述的方法的目标网络中的节点。
可以理解的是，在方案不矛盾的前提下，上述各个方面中的方案均可以结合。
附图说明
图1A为本申请实施例提供的通信系统架构示意图一；
图1B为本申请实施例提供的网络的架构示意图一；
图1C为本申请实施例提供的网络的架构示意图二；
图1D为本申请实施例提供的通信系统架构示意图二；
图2为本申请实施例提供的通信装置的硬件结构示意图；
图3为本申请实施例提供的获取密钥的方法的流程示意图一；
图4为本申请实施例提供的认证方法的流程示意图；
图5为本申请实施例提供的获取密钥的方法的流程示意图二；
图6为本申请实施例提供的更新密钥的方法的流程示意图；
图7为本申请实施例提供的通信装置的结构示意图一；
图8为本申请实施例提供的通信装置的结构示意图二。
具体实施方式
在介绍本申请实施例之前，对本申请实施例涉及的相关技术术语进行解释说明。可以理解的是，这些解释说明是为了让本申请实施例更容易被理解，而不应该视为对本申请实施例所要求的保护范围的限定。
一、区块链(block chain，BC)
本申请实施例中，区块链是一种通过密码学机制保障的防篡改的技术。一般来说，区块链节点可以运行在物理节点上，或者，也可以运行在物理节点中的虚拟环境 中，不予限制。
一种可能的设计，区块链是一种账本技术。该账本是分布式的，可通过多个节点同步维护该账本。该多个节点在维护账本时，可采用密码学机制以防止账本被篡改。
示例性的，区块链是一种按照时间顺序将数据区块以顺序相连的方式组合成的一种链式数据结构，并以密码学方式保证的不可篡改和不可伪造的分布式账本。一般来说，区块链系统具有多个区块链节点，而且由于在区块链当中，没有一个中心化的管理机构，因此，区块链节点对每一区块信息要达成一致共识，即每个区块链节点都存储有相同的区块链信息。依赖于区块链技术的特性，区块链可以作为统一的可信平台实现历史事件的追溯和/或自动化的网络管理。如：区块链可实现以下至少一项功能：日志的审计、自动化的结算或者安全的接入和验证等等。
可以理解的，在本申请实施例中，区块链还可以有其他的命名方式，如分布式账本或账本等，不予限制。
二、终端
本申请实施例中，终端是一种具有无线收发功能的设备。终端可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。终端还可以称为终端设备，终端设备可以是用户设备(user equipment，UE)，其中，UE包括具有无线通信功能的手持式设备、车载设备、可穿戴设备或计算设备。示例性地，UE可以是手机(mobile phone)、平板电脑或带无线收发功能的电脑。终端设备还可以是虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制中的无线终端、无人驾驶中的无线终端、远程医疗中的无线终端、智能电网中的无线终端、智慧城市(smart city)中的无线终端、或智慧家庭(smart home)中的无线终端等等。
作为示例而非限定，在本申请中，终端可以是可穿戴设备。可穿戴设备也可以称为穿戴式智能设备，是应用穿戴式技术对日常穿戴进行智能化设计、开发出可以穿戴的设备的总称，如眼镜、手套、手表、服饰及鞋等。可穿戴设备即直接穿在身上，或是整合到用户的衣服或配件的一种便携式设备。例如，可穿戴设备不仅仅是一种硬件设备，更是通过软件支持以及数据交互、云端交互来实现强大的功能的设备。广义穿戴式智能设备包括功能全、尺寸大、可不依赖智能手机实现完整或者部分的功能的设备，例如：智能手表或智能眼镜等，以及包括只专注于某一类应用功能，需要和其它设备如智能手机配合使用的设备，如各类进行体征监测的智能手环、智能首饰等。
在本申请中，终端可以是物联网(internet of things，IoT)系统中的终端，IoT是未来信息技术发展的重要组成部分，其主要技术特点是将物品通过通信技术与网络连接，从而实现人机互连，物物互连的智能化网络。本申请中的终端可以是机器类型通信(machine type communication，MTC)中的终端。本申请的终端可以是作为一个或多个部件或者单元而内置于车辆的车载模块、车载模组、车载部件、车载芯片或者车载单元，车辆通过内置的所述车载模块、车载模组、车载部件、车载芯片或者车载单元可以实施本申请的方法。
三、密钥提供装置
本申请实施例中，密钥提供装置可以是任意一种具有计算功能的设备，能够为其 他设备或装置提供密钥。例如，密钥提供装置可以为终端提供用于与网络认证(或鉴权)的密钥。其中，密钥提供装置可以是终端的生产厂商维护的，或者可以是除终端的生产厂商之外的第三方维护的，不予限制。
下面结合附图对本申请实施例的实施方式进行详细描述。
本申请实施例提供的方法可用于各种能够获取密钥的通信系统。下面以图1A和图1D所示的通信系统为例，对本申请实施例提供的方法进行描述。图1A和图1D仅为示意图，并不构成对本申请提供的技术方案的适用场景的限定。
如图1A所示，为本申请实施例提供的一种通信系统10的架构示意图。图1A中，通信系统10可以包括节点101，以及能够与节点101通信的终端102和网络103。
其中，网络103可包括至少一个节点。节点101和终端102可通过网络103中的节点与网络103通信。例如，节点101可通过网络103中的节点1031与网络103通信，终端102可通过网络103中的节点1032与网络103通信。
在图1A中，网络103可为终端102提供服务。例如，网络103为运营商的网络，可为终端102提供无线接入服务。应理解，网络103还可以是其他类型的网络，如无线局域网等，不予限制。节点101可为终端102和网络103提供用于与对方通信的密钥。其中，节点101可以为密钥提供装置。终端和密钥提供装置的介绍可参考前文对本申请实施例涉及的技术术语中的解释说明，在此不做赘述。
一种可能的设计，节点101为区块链节点，和/或，节点1031为区块链节点。即：通信系统10可以包括以下任意一种场景：场景1，节点101为区块链节点，节点1031为区块链节点；场景2，节点101不是区块链节点，节点1031为区块链节点；场景3，节点101是区块链节点，节点1031不是区块链节点。下面分别对上述场景进行阐述。
场景1：节点101为区块链节点，节点1031为区块链节点。
在场景1中，网络103的架构可如图1B所示。在图1B中，网络包括接入和移动性管理功能(access and mobility management function，AMF)网元、会话管理功能(session management function，SMF)网元、用户面功能(user plane function，UPF)网元、接入网设备和区块链(BC)网元。可选的，网络还包括统一数据管理(unified data management，UDM)-统一数据存储库(unified data repository，UDR)扩展(extension)网元，和/或，网络开放功能(network exposure function，NEF)网元等。可以理解的，图1B仅是网络的示意图，在具体应用中，网络可包括比图1B所示更多或更少的网元，不予限制。例如，网络不包括UDM-UDR扩展网元，而是包括UDM网元，和/或，UDR网元。
在场景1中，节点1031在图1B中所对应的网元为BC网元，即节点101可通过BC网元与网络103通信。若终端102通过节点1032与网络103通信，则节点1032在图1B中所对应的网元为接入网设备。
场景2：节点101不是区块链节点，节点1031为区块链节点。
在场景2中，网络103的网络架构可如图1B所示。其中，节点1031在图1B中所对应的网元为BC网元，即节点101可通过BC网元与网络103通信。若终端102 通过节点1032与网络103通信，则节点1032在图1B中所对应的网元为接入网设备。
场景3：节点101是区块链节点，节点1031不是区块链节点。
在场景3中，网络103的网络架构可如图1C所示。在图1C中，网络包括AMF网元、SMF网元、UPF网元、接入网设备和账本锚点功能(ledger anchor function，
LAF)网元。可选的，网络还包括UDM-UDR扩展网元，和/或，NEF网元等。可以理解的，图1C仅是网络的示意图，在具体应用中，网络可包括比图1C所示更多或更少的网元，不予限制。例如，网络不包括UDM-UDR扩展网元，而是包括UDM网元，和/或，UDR网元。
在场景3中，节点1031在图1C中所对应的网元为LAF网元，即节点101可通过LAF网元与网络103通信。若终端102通过节点1032与网络103通信，则节点1032在图1C中所对应的网元为接入网设备。
可选的，通信系统10还包括能够与节点101通信的网络104。网络104可为终端102提供服务。例如，网络104为运营商的网络，终端102从网络103的覆盖区域移动到网络104的覆盖区域的情况下，网络104可以为终端102提供无线接入服务。网络104所对应的运营商与网络103所对应的运营商可以相同也可以不同，不予限制。
其中，网络104可包括至少一个节点。节点101可通过网络104中的节点，如节点1041与网络104通信。若终端102从网络103的覆盖区域移动到网络104的覆盖区域，则终端102也可通过网络104中的节点，如节点1042与网络104通信。
可以理解的，网络104可包括区块链节点，也可不包括区块链节点，不予限制。若网络104包括区块链节点，则网络104的架构可如图1B所示。若网络104不包括区块链节点，则网络104的架构可如图1C所示。
图1A所示的通信系统10仅用于举例，并非用于限制本申请的技术方案。本领域的技术人员应当明白，在具体实现过程中，通信系统10还可以包括其他设备，同时也可根据具体需要来确定终端、网络和图1A所示的各个节点的数量，不予限制。
如图1D所示，为本申请实施例提供的又一种通信系统11的架构示意图。图1D中，通信系统11可以包括节点111，能够与节点111通信的终端112和区块链节点114，以及能够与区块链节点114通信的网络113。
其中，网络113可包括至少一个节点。区块链节点114和终端112可通过网络113中的节点与网络113通信。例如，区块链节点114可通过网络113中的节点1131与网络113通信，终端112可通过网络113中的节点1132与网络113通信。
在图1D中，网络113可为终端112提供服务。例如，网络113为运营商的网络，可为终端112提供无线接入服务。应理解，网络113还可以是其他类型的网络，如无线局域网等，不予限制。节点111可为终端112和网络113提供用于与对方通信的密钥。其中，节点111可以为密钥提供装置。终端和密钥提供装置的介绍可参考前文对本申请实施例涉及的技术术语中的解释说明，在此不做赘述。
一种可能的实现方式，节点111和节点1131中至少有一个节点不是区块链节点。即：通信系统11可以包括以下任意一种场景：场景4，节点111不是区块链节 点，节点1131不是区块链节点；场景5，节点111是区块链节点，节点1131不是区块链节点；场景6，节点111不是区块链节点，节点1131是区块链节点。下面分别对上述场景进行阐述。
场景4：节点111不是区块链节点，节点1131不是区块链节点。
在场景4中，网络113的网络架构可如图1C所示。其中，节点1131在图1C中所对应的网元为LAF网元，即区块链节点114可通过LAF网元与网络113通信。若终端112通过节点1132与网络113通信，则节点1132在图1C中所对应的网元为接入网设备。
场景5：节点111是区块链节点，节点1131不是区块链节点。
在场景5中，网络113的网络架构可如图1C所示。其中，节点1131在图1C中所对应的网元为LAF网元，即区块链节点114可通过LAF网元与网络113通信。若终端112通过节点1132与网络113通信，则节点1132在图1C中所对应的网元为接入网设备。
场景6：节点111不是区块链节点，节点1131是区块链节点。
在场景6中，网络113的网络架构可如图1B所示。其中，节点1131在图1B中所对应的网元为BC网元，即区块链节点114可通过BC网元与网络113通信。若终端112通过节点1132与网络113通信，则节点1132在图1B中所对应的网元为接入网设备。
可选的，通信系统11还包括能够与区块链节点114通信的网络115。网络115可为终端112提供服务。例如，网络115为运营商的网络，终端112从网络113的覆盖区域移动到网络115的覆盖区域的情况下，网络115可以为终端112提供无线接入服务。网络115所对应的运营商与网络113所对应的运营商可以相同也可以不同，不予限制。
其中，网络115可包括至少一个节点。节点111可通过网络115中的节点，如节点1151与网络115通信。若终端112从网络113的覆盖区域移动到网络115的覆盖区域，则终端112也可通过网络115中的节点，如节点1152与网络115通信。
可以理解的，网络115可包括区块链节点，也可不包括区块链节点，不予限制。若网络115包括区块链节点，则网络115的架构可如图1B所示。若网络115不包括区块链节点，则网络115的架构可如图1C所示。
图1D所示的通信系统11仅用于举例，并非用于限制本申请的技术方案。本领域的技术人员应当明白，在具体实现过程中，通信系统11还可以包括其他设备，同时也可根据具体需要来确定终端、网络和图1D所示的各个节点的数量，不予限制。
可选的，本申请实施例图1A或图1D中的各节点或设备(例如、节点101、节点1031、终端102、节点111、节点1131、或终端112等)也可以称之为通信装置，其可以是一个通用设备或者是一个专用设备，本申请实施例对此不作具体限定。
可选的，本申请实施例图1A或图1D中的各节点或设备的相关功能可以由一个设备实现，也可以由多个设备共同实现，还可以是由一个设备内的一个或多个功能模块实现，本申请实施例对此不作具体限定。可以理解的是，上述功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行的软件功能，或者硬件与软件的结合， 或者平台(例如，云平台)上实例化的虚拟化功能。
在具体实现时，本申请实施例图1A或图1D中的各节点或设备都可以采用图2所示的组成结构，或者包括图2所示的部件。图2所示为可适用于本申请实施例的通信装置的硬件结构示意图。该通信装置20包括至少一个处理器201和至少一个通信接口204，用于实现本申请实施例提供的方法。该通信装置20还可以包括通信线路202和存储器203。
处理器201可以是一个通用中央处理器(central processing unit，CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
通信线路202可包括一通路，在上述组件之间传送信息，例如总线。
通信接口204，用于与其他设备或通信网络通信。通信接口204可以是任何收发器一类的装置，如可以是以太网接口、无线接入网(radio access network，RAN)接口、无线局域网(wireless local area networks，WLAN)接口、收发器、管脚、总线、或收发电路等。
存储器203可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过通信线路202与处理器201相耦合。存储器203也可以和处理器201集成在一起。本申请实施例提供的存储器通常可以具有非易失性。
其中，存储器203用于存储执行本申请实施例提供的方案所涉及的计算机执行指令，并由处理器201来控制执行。处理器201用于执行存储器203中存储的计算机执行指令，从而实现本申请实施例提供的方法。或者，可选的，本申请实施例中，也可以是处理器201执行本申请下述实施例提供的方法中的处理相关的功能，通信接口204负责与其他设备或通信网络通信，本申请实施例对此不作具体限定。
可选的，本申请实施例中的计算机执行指令也可以称之为应用程序代码，本申请实施例对此不作具体限定。
本申请实施例中的耦合是装置、单元或模块之间的间接耦合或通信连接，可以是电性，机械或其它的形式，用于装置、单元或模块之间的信息交互。
作为一种实施例，处理器201可以包括一个或多个CPU，例如图2中的CPU0和CPU1。
作为一种实施例，通信装置20可以包括多个处理器，例如图2中的处理器201和处理器207。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
作为一种实施例，通信装置20还可以包括输出设备205和/或输入设备206。输出设备205和处理器201耦合，可以以多种方式来显示信息。例如，输出设备205可以是液晶显示器(liquid crystal display，LCD)，发光二极管(light emitting diode，LED)显示设备，阴极射线管(cathode ray tube，CRT)显示设备，或投影仪(projector)等。输入设备206和处理器201耦合，可以以多种方式接收用户的输入。例如，输入设备206可以是鼠标、键盘、触摸屏设备或传感设备等。
可以理解的，图2中示出的组成结构并不构成对该通信装置的限定，除图2所示部件之外，该通信装置可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
下面将结合附图，对本申请实施例提供的方法进行描述。下述实施例中的各网元可以具备图2所示部件，不予赘述。
可以理解的是，本申请下述实施例中各个网元之间的消息名字或消息中各参数的名字等只是一个示例，具体实现中也可以是其他的名字，本申请实施例对此不作具体限定。
可以理解的是，在本申请实施例中，“/”可以表示前后关联的对象是一种“或”的关系，例如，A/B可以表示A或B；“和/或”可以用于描述关联对象存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A，B可以是单数或者复数。此外，类似于“A、B和C中的至少一项”或“A、B或C中的至少一项”的表述通常用于表示如下中任一项：单独存在A；单独存在B；单独存在C；同时存在A和B；同时存在A和C；同时存在B和C；同时存在A、B和C。以上是以A、B和C共三个元素进行举例来说明该项目的可选用条目，当表述中具有更多元素时，该表述的含义可以按照前述规则获得。
为了便于描述本申请实施例的技术方案，在本申请实施例中，可以采用“第一”、“第二”等字样对功能相同或相似的技术特征进行区分。该“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。在本申请实施例中，“示例性的”或者“例如”等词用于表示例子、例证或说明，被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念，便于理解。
可以理解，说明书通篇中提到的“实施例”意味着与实施例有关的特定特征、结构或特性包括在本申请的至少一个实施例中。因此，在整个说明书各个实施例未必一定指相同的实施例。此外，这些特定的特征、结构或特性可以任意适合的方式结合在一个或多个实施例中。可以理解，在本申请的各种实施例中，各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
可以理解，在本申请中，“当…时”、“若”以及“如果”均指在某种客观情况下会做出相应的处理，并非是限定时间，且也不要求实现时一定要有判断的动作，也不意味着存在其它限定。
本申请中的“同时”可以理解为在相同的时间点，也可以理解为在一段时间段 内，还可以理解为在同一个周期内。
可以理解，本申请实施例中的一些可选的特征，在某些场景下，可以不依赖于其他特征，比如其当前所基于的方案，而独立实施，解决相应的技术问题，达到相应的效果，也可以在某些场景下，依据需求与其他特征进行结合。相应的，本申请实施例中给出的装置也可以相应的实现这些特征或功能，在此不予赘述。
可以理解的，本申请实施例中同一个步骤或者具有相同功能的步骤或者技术特征在不同实施例之间可以互相参考借鉴。
可以理解的，本申请实施例中，任意一个节点和/或终端可以执行本申请实施例中的部分或全部步骤，这些步骤仅是示例，本申请实施例还可以执行其它步骤或者各种步骤的变形。此外，各个步骤可以按照本申请实施例呈现的不同的顺序来执行，并且有可能并非要执行本申请实施例中的全部步骤。
如图3所示，为本申请实施例提供的一种获取密钥的方法，该方法可以包括如下步骤：
S301：终端向第一节点发送第一消息。相应的，第一节点接收来自终端的第一消息。
其中，该终端可以是图1A中的终端102，第一节点为图1A中的节点101；或者，该终端可以是图1D中的终端112，第一节点为图1D中的节点111。
本申请实施例中，第一消息可以用于指示终端要接入网络。这样，第一节点接收到第一消息后可以为终端确定终端要接入的网络，即为终端确定目标网络。第一节点还可以为终端和该目标网络生成密钥，以便终端和该目标网络通信，例如，终端通过生成的密钥与该目标网络认证。
可选的，第一消息包括目标网络的信息。如此，终端可以向第一节点指示终端要接入的网络，以便第一节点为终端和目标网络生成密钥，使得终端和目标网络通信。其中，若终端为图1A中的终端102，第一节点为图1A中的节点101，则目标网络为图1A中的网络103。若终端是图1D中的终端112，第一节点为图1D中的节点111，则目标网络为图1D中的网络113。
一种可能的设计，目标网络的信息用于指示目标网络，例如，目标网络的信息包括目标网络的标识。
一种可能的设计，目标网络是根据终端对应的用户的选择确定的；或者，目标网络是根据预设策略确定的。
示例性的，用户通过终端上的软件选择目标网络，响应于用户的操作，终端确定目标网络。或者，终端根据用户提交的入网需求信息，如：流量需求信息，和/或，通话时间需求信息等，确定目标网络。或者，终端根据环境信息，如：终端的位置信息，和/或，终端测量的周围网络的信号质量等，确定目标网络。
可选的，终端还向第一节点发送第二随机数，以便第一节点根据第二随机数生成密钥。相应的，第一节点接收来自终端的第二随机数。
可以理解的，第二随机数可以包括在第一消息中发送给第一节点，或者通过另一条消息发送给第一节点，不予限制。
S302：第一节点获取第一密钥。
本申请实施例中，第一密钥可以用于终端与目标网络之间的认证。其中，第一密钥为对称密钥。
一种可能的实现方式，第一节点通过密钥生成算法生成第一密钥。或者，第一节点从其他能够生成密钥的设备获取第一密钥。
可以理解的，若第一节点还接收到了第二随机数，则第一节点根据密钥生成算法和第二随机数生成第一密钥。
S303：第一节点向区块链节点发送第三消息。相应的，区块链节点接收来自第一节点的第三消息。
本申请实施例中，第三消息可以用于向目标网络指示第一密钥。
例如，若区块链节点包括在目标网络中，第三消息是用目标网络的公钥(如目标网络中的节点的公钥)对第一密钥进行加密得到的。这样，目标网络接收到第三消息后，用自己的私钥解密，即可得到第一密钥。
又例如，若区块链节点未包括在目标网络中，第三消息是用区块链节点的公钥对第一密钥和第四指示信息进行加密得到的。其中，第四指示信息用于指示区块链节点向目标网络发送第一密钥。例如，第四指示信息包括目标网络的标识。区块链节点接收到第三消息后，用自己的私钥解密，得到第一密钥和第四指示信息，根据第四指示信息向目标网络发送第一密钥。
可选的，区块链节点接收到第三消息后，向第一节点发送第三消息的响应消息，以向第一节点指示接收到第三消息。
可以理解的，在S303中，第一节点可在区块链上触发第一密钥对应的区块链交易(以下简称第一交易)的生成。例如，若第一节点为区块链中的节点，则第一节点自己触发第一交易的生成；若第一节点不是区块链中的节点，则第一节点触发区块链节点生成第一交易。后续，目标网络可以获取第三消息，例如，目标网络可以通过区块链获取第三消息。下面结合上述场景1至场景6进行具体阐述。
对于场景1，S303中的区块链节点为图1A中的节点1031。节点101生成第一交易，将第一密钥作为第一交易的内容，用节点1031在链上的公钥对第一交易加密，用节点101在链上的私钥对第一密钥签名，得到第三消息，并将第三消息发布至区块链。区块链上的节点达成共识后，完成第一交易上链。后续，区块链上的每个节点用节点101在链上的公钥验证签名，用自己在链上的私钥进行解密，若验证并且解密成功，则表明第一交易与自己有关，并且能够获取到第一密钥。本例中，节点1031能够验证并且解密成功，获取到第一密钥。如此，目标网络(本例中为网络103)即获取到了第一密钥。可选的，目标网络还在链上获取第一交易的标识。
作为一种示例，第三消息的格式可以如下所示：{EncapPK_节点1031(TX(Initial:节点101，Receiver：节点1031，Content：第一密钥))，Sigsk-节点101}，可表示第三消息的发送方为节点101，第三消息的接收方为节点1031，第三消息的内容包括第一密钥。EncapPK_节点1031(TX(Initial:节点101，Receiver：节点1031，Content：第一密钥))表示用节点1031在链上的公钥对第一密钥加密后的信息。Sigsk-节点101表示用节点101在链上的私钥对第一密钥签名后的信息。
对于场景2，S303中的区块链节点为图1A中的节点1031。节点101将第一密钥 用节点1031的公钥加密，得到第三消息，并向节点1031发送第三消息。节点1031接收到第三消息后，用自己的私钥解密第三消息得到第一密钥。如此，目标网络(本例中为网络103)即获取到了第一密钥。后续，节点1031生成第一交易，将第一密钥作为第一交易的内容，对第一交易加密，并将加密后的消息发布至区块链。区块链上的节点达成共识后，完成第一交易上链。可以理解的，第一交易上链后，目标网络可在链上获取第一交易的标识。
对于场景3，S303中的区块链节点为区块链中除节点101之外的节点，如目标网络(在本例中为网络103)对应的区块链节点。目标网络对应的区块链节点可以理解为区块链上能够与目标网络通信的节点。节点101生成第一交易，将第一密钥和第四指示信息作为第一交易的内容，用网络103对应的区块链节点在链上的公钥对第一交易加密，用节点101在链上的私钥对第一密钥签名，得到第三消息，并将第三消息发布至区块链。区块链上的节点达成共识后，完成第一交易上链。后续，区块链上的每个节点用节点101在链上的公钥验证签名，用自己在链上的私钥进行解密，若验证并且解密成功，则表明第一交易与自己有关，并且能够获取到第一密钥和第四指示信息。应理解，本例中，网络103对应的区块链节点能够验证并解密成功，得到第一密钥和第四指示信息，并用节点1031的公钥对第一密钥加密，根据第四指示信息向节点1031发送加密后的信息。节点1031接收到加密后的信息，用自己的私钥解密，即可得到第一密钥。如此，目标网络即获取到了第一密钥。可选的，网络103对应的区块链节点还在链上获取第一交易的标识，并将第一交易的标识发送给节点1031。这样，目标网络可获取到第一交易的标识。
作为一种示例，第三消息的格式如下：{EncapPK_网络103对应的区块链节点(TX(Initial:节点101，Receiver：网络103对应的区块链节点，Content：第一密钥和第四指示信息))，Sigsk-节点101}，可表示第三消息的发送方为节点101，第三消息的接收方为网络103对应的区块链节点，第三消息的内容包括第一密钥和第四指示信息。EncapPK_网络103对应的区块链节点(TX(Initial:节点101，Receiver：网络103对应的区块链节点，Content：第一密钥和第四指示信息))表示用网络103对应的区块链节点在链上的公钥对第一密钥和第四指示信息加密后的信息。Sigsk-节点101表示用节点101在链上的私钥对第一密钥签名后的信息。
对于场景4，S303中的区块链节点为图1D中的区块链节点114。其中，区块链节点114为节点111对应的区块链节点，即区块链上能够与节点111通信的节点。节点111将第一密钥和第四指示信息用区块链节点114的公钥加密，得到第三消息，并向区块链节点114发送第三消息。区块链节点114接收到第三消息后，用自己的私钥解密第三消息得到第一密钥和第四指示信息。后续，区块链节点114生成第一交易，将第一密钥和第四指示信息作为第一交易的内容，用网络113对应的区块链节点在链上的公钥对第一交易加密，用区块链节点114在链上的私钥对第一密钥签名，得到消息1，并将消息1发布至区块链。区块链上的节点达成共识后，完成第一交易上链。后续，区块链上的每个节点用区块链节点114在链上的公钥验证签名，用自己在链上的私钥进行解密，若验证并且解密成功，则表明第一交易与自己有关，并且能够获取到第一密钥和第四指示信息。本例中，网络113对应的区块链节点能验证并解密成 功，得到第一密钥和第四指示信息，用节点1131的公钥对第一密钥加密，根据第四指示信息向节点1131发送加密后的信息。节点1131接收到加密后的信息，用自己的私钥解密，即可得到第一密钥。如此，目标网络(本例中为网络113)即获取到了第一密钥。可选的，网络113对应的区块链节点在链上获取第一交易的标识，并将第一交易的标识发送给节点1131。如此，目标网络可获取到第一交易的标识。
对于场景5，S303中的区块链节点为图1D中的区块链节点114。其中，区块链节点114为目标网络(本例中为网络113)对应的区块链节点，即区块链上能够与目标网络通信的节点。节点111生成第一交易，将第一密钥和第四指示信息作为第一交易的内容，用网络113对应的区块链节点在链上的公钥对第一交易加密，用节点111在链上的私钥对第一密钥签名，得到第三消息，并将第三消息发布至区块链。区块链上的节点达成共识后，完成第一交易上链。后续，区块链上的每个节点用节点111在链上的公钥验证签名，用自己在链上的私钥进行解密，若验证并且解密成功，则表明第一交易与自己有关，并且能够获取到第一密钥和第四指示信息。应理解，网络113对应的区块链节点能够验证并解密成功，得到第一密钥和第四指示信息，并用节点1131的公钥对第一密钥加密，根据第四指示信息向节点1131发送加密后的信息。节点1131接收到加密后的信息，用自己的私钥解密，即可得到第一密钥。如此，目标网络即获取到了第一密钥。可选的，网络113对应的区块链节点在链上获取第一交易的标识，并将第一交易的标识发送给节点1131。如此，目标网络可获取到第一交易的标识。
作为一种示例，第三消息的格式如下：{EncapPK_网络113对应的区块链节点(TX(Initial:节点111，Receiver：网络113对应的区块链节点，Content：第一密钥和第四指示信息))，Sigsk-节点111}，可表示第三消息的发送方为节点111，第三消息的接收方为网络113对应的区块链节点，第三消息的内容包括第一密钥和第四指示信息。EncapPK_网络113对应的区块链节点(TX(Initial:节点111，Receiver：网络113对应的区块链节点，Content：第一密钥和第四指示信息))表示用网络113对应的区块链节点在链上的公钥对第一密钥和第四指示信息加密后的信息。Sigsk-节点111表示用节点111在链上的私钥对第一密钥签名后的信息。
对于场景6，S303中的区块链节点为图1D中的区块链节点114。其中，区块链节点114为节点111对应的区块链节点，即区块链上能够与节点111通信的节点。节点111将第一密钥和第四指示信息用区块链节点114的公钥加密，得到第三消息，并向区块链节点114发送第三消息。区块链节点114接收到第三消息后，用自己的私钥解密第三消息得到第一密钥和第四指示信息。后续，区块链节点114生成第一交易，将第一密钥作为第一交易的内容，用节点1131在链上的公钥对第一交易加密，用区块链节点114在链上的私钥对第一密钥签名，得到消息2，并将消息2发布至区块链。区块链上的节点达成共识后，完成第一交易上链。后续，区块链上的每个节点用区块链节点114在链上的公钥验证签名，用自己在链上的私钥进行解密，若验证并且解密成功，则表明第一交易与自己有关，并且能够获取到第一密钥。本例中，节点1131能验证并解密成功，得到第一密钥。如此，目标网络(本例中为网络113)即获取到了第一密钥。可选的，目标网络还在区块链上获取第一交易的标识。
可以理解的，上述第三消息的格式仅是示例性的，在具体应用中，上述消息可包括比上述示例更多或更少的信息，不予限制。例如，在场景3中，第三消息可不包括第四指示信息，而是通过隐式的方式指示网络103对应的区块链节点向节点1031发送第一密钥。
一种可能的实现方式，第一节点还获取第一交易的标识。例如，若第一节点为区块链中的节点，则第一节点直接在区块链上获取第一交易的标识；若第一节点不是区块链中的节点，则第一节点接收来自区块链节点的第一交易的标识。
一种可能的设计，第一交易的标识包括第一交易的地址，或者，第一交易的标识包括第一交易的地址和终端在第一交易中的序列号。其中，第一交易地址为第一交易在区块链上的地址。
可以理解的，若第一交易包括单个终端的信息，则第一交易的标识包括第一交易的地址。若第一交易包括多个终端的信息，则第一交易的标识包括第一交易的地址和终端在第一交易中的序列号。如此，可使得第一节点为每个终端配置的密钥所对应的交易的标识是唯一的。
作为一种示例，若第一交易包括终端1对应的密钥，则可将第一交易的地址作为第一交易的标识。若第一交易包括：{序号1：终端1对应的密钥，序号2：终端2对应的密钥}，则对于终端1来说，可将序号1添加到第一交易的地址的后面作为第一交易的标识，对于终端2来说，可将序号2添加到第一交易的地址的后面作为第一交易的标识。
S304：第一节点向终端发送第二消息。相应的，终端接收来自第一节点的第二消息。
本申请实施例中，第二消息可以包括密钥信息。其中，密钥信息是根据第一密钥确定的。终端接收到第二消息后，可根据密钥信息确定第一密钥。可选的，第二消息还包括第一交易的标识和以下至少一项：目标网络的标识或目标网络的公钥。
一种可能的实现方式，密钥信息包括第一密钥，或者，密钥信息就是第一密钥。也就是说，第一节点可将第一密钥包括在第二消息中发送给终端，终端接收到第二消息后，即可获得第一密钥，第一节点还通过区块链将第一密钥发送给目标网络。这样，终端和目标网络之间就可根据第一密钥进行认证。
另一种可能的实现方式，密钥信息包括第三密钥，或者，密钥信息就是第三密钥。其中，第三密钥是根据第一密钥确定的。也就是说，第一节点先获取第三密钥，根据第三密钥生成第一密钥，将第一密钥通过区块链发送给目标网络，将第三密钥发送给终端。终端接收到第三密钥后，可根据第三密钥生成第一密钥。这样，一方面，终端和目标网络之间可通过第一密钥认证；另一方面，目标网络可以获取到第一密钥，但是不能获取到第三密钥，所以第三密钥作为派生出第一密钥的根密钥可以被隐藏和保护。后续，第一节点还可根据第三密钥更新终端与目标网络之间的认证密钥，或者根据第三密钥为终端与其他网络配置认证密钥，不仅操作方便而且提高了终端与网络之间的通信安全。
一种可能的设计，第一密钥是根据第三密钥和目标网络的标识得到的；或者，第一密钥是根据第三密钥、目标网络的标识和第二随机数得到的。也就是说，第一节点 和终端可采用密钥生成算法对第三密钥和目标网络的标识进行计算得到第一密钥，或者采用密钥生成算法对第三密钥、目标网络的标识和第二随机数进行计算得到第一密钥。
一种可能的实现方式，第一节点过安全接口对终端进行空中写卡，将第二消息包括的内容写入终端。
作为一种示例，第二消息包括：HTTPS：UE-Root_Key，Target-OP-profile(ID OP，PK OP)，TX-addr。其中，UE-Root_Key为第三密钥，Target-OP-profile为目标网络的信息，ID OP为目标网络的标识，PK OP为目标网络的公钥，TX-addr为第一交易的标识。
可选的，在S304之后，终端可根据下述图6所示的方法更新密钥。
其中，上述S301-S304中的终端或者第一节点或者目标网络(可以是目标网络中的节点)的动作可以由图2所示的通信装置20中的处理器201调用存储器203中存储的应用程序代码来执行，本申请实施例对此不做任何限制。
基于图3所示的方法，终端可触发第一节点为终端和目标网络配置第一密钥。后续，终端和目标网络可根据第一密钥进行认证或鉴权，以便终端接入目标网络。如此，终端和目标网络之间不需要使用SIM卡中的密钥进行认证或鉴权，实现了SIM卡与网络解绑，用户若想切换网络，不需要更换SIM卡，使得终端能够灵活入网，提高了用户体验。
如图4所示，为本申请实施例提供的一种认证方法，该认证方法可包括如下步骤：
S401：终端获取第一交易的标识和第一密钥。
其中，该终端可以是图1A中的终端102；或者，该终端可以是图1D中的终端112。第一交易为第一密钥对应的区块链交易。第一密钥可用于终端和目标网络之间的认证。
可以理解的，若终端是图1A中的终端102，则目标网络可以是图1A中的网络103；若终端是图1D中的终端112，则目标网络可以是图1D中的网络113。
一种可能的实现方式，终端通过图3所示的方法获取第一交易的标识和第一密钥，例如，终端接收来自第一节点的第二消息，第二消息包括密钥信息和第一交易的标识。其中，密钥信息和第一交易的标识也可以分别包括在不同的消息中，不予限制。或者，终端通过其他方式获取第一交易的标识和第一密钥，不予限制。
S402：目标网络获取第一交易的标识和第一密钥。
可以理解的，S402的执行主体可以是目标网络中的第二节点。例如，若目标网络是图1A中的网络103，则节点1031获取第一交易的标识和第一密钥，即第二节点为节点1031；若目标网络是图1D中的网络113，则节点1131获取第一交易的标识和第一密钥，即第二节点为节点1131。
一种可能的实现方式，目标网络通过图3所示的方法获取第一交易的标识和第一密钥，例如，目标网络在链上获取第一交易的标识和第一密钥，或者目标网络从区块链节点或第一节点获取第一交易的标识和第一密钥。或者，目标网络通过其他方式获取第一交易的标识和第一密钥，不予限制。
可以理解的，本申请不限制S401和S402的执行顺序，例如，可以先执行S401，再执行S402，或者先执行S402，再执行S401，或者同时执行S401和S402。
S403：终端和目标网络之间根据第一交易的标识和第一密钥进行认证。
可以理解的，S403的执行主体可以是目标网络中的第三节点。例如，若目标网络是图1A中的网络103，则终端和节点1032之间根据第一交易的标识和第一密钥进行认证，即第三节点为节点1032；若目标网络是图1D中的网络113，则终端和节点1132之间根据第一交易的标识和第一密钥进行认证，即第三节点为节点1132。在上述示例中，第二节点与第三节点不同。然而，在具体应用中，第二节点与第三节点也可以相同，不予限制。
一种可能的实现方式，终端向目标网络发送第一请求。其中，第一请求可以用于请求接入目标网络。目标网络接收到第一请求后，向终端发送认证消息。其中，认证消息是根据第一密钥得到的，也可以描述为认证消息与第一密钥对应。这样，终端接收到认证消息后，可验证认证消息。
本申请实施例中，第一请求可以包括第一交易的标识。如此，目标网络接收到第一请求后，可根据第一交易的标识获取到第一密钥，例如，以第一交易的标识为索引查询到第一密钥。
可选的，终端还向目标网络发送终端的标识，以向目标网络指示要认证的终端。可以理解的，终端的标识可包括在第一请求中发送给目标网络，或者，终端的标识包括在其他消息中发送给目标网络，不予限制。
作为一种示例，终端用目标网络的公钥对第一交易的标识加密得到第一请求，并向目标网络发送第一请求。目标网络接收到第一请求后，用目标网络的私钥进行解密，得到第一交易的标识，根据第一交易的标识获取第一密钥，根据第一密钥和目标网络的标识得到认证消息，并向终端发送认证消息。终端接收到认证消息后，根据第一密钥和目标网络的标识验证认证消息。
作为另一种示例，终端用目标网络的公钥对第一交易的标识和终端的标识加密得到第一请求，并向目标网络发送第一请求。目标网络接收到第一请求后，用目标网络的私钥进行解密，得到第一交易的标识和终端的标识，根据第一交易的标识获取第一密钥，根据第一密钥、目标网络的标识(可替换为目标网络的序列号)和目标网络生成的第三随机数得到认证消息，并向终端发送认证消息和第三随机数。终端接收到认证消息和第三随机数后，根据第一密钥、目标网络的标识和第三随机数验证认证消息。
一种可能的实现方式，目标网络根据第一请求获取到第一交易的标识后，可以根据第一交易的标识在目标网络中查询第一密钥。
例如，在S403之前，第三节点从第二节点获取第一交易的标识和第一密钥。第三节点根据第一请求获取到第一交易的标识后，可根据第一交易的标识在本地查询到第一密钥。或者，第三节点根据第一请求获取到第一交易的标识后，向第二节点发送第一交易的标识。第二节点接收到第一交易的标识后，根据第一交易的标识在本地查询到第一密钥，并向第三节点发送第一密钥。
可选的，目标网络通过区块链验证第一交易的标识。
例如，目标网络向区块链节点发送查询消息。该查询消息可以用于查询第一交易对应的密钥，如：该查询消息可以包括第一交易的标识。区块链节点接收到查询消息后，可根据第一交易的标识查询第一密钥，并向目标网络发送响应消息。该响应消息包括第一密钥。目标网络接收到响应消息后，验证自己查询到的第一密钥和区块链节点发送的第一密钥是否相同，若相同，向终端发送认证消息，若不相同，向终端发送认证失败消息。
可选的，终端验证认证消息后，向目标网络发送验证结果。相应的，目标网络接收来自终端的验证结果。其中，验证结果包括验证失败或验证成功。
可选的，目标网络接收到验证结果后，根据验证结果向终端发送验证响应消息。相应的，终端接收来自目标网络的验证响应消息。该验证响应消息可指示认证通过或认证未通过，或者，该验证响应消息可指示允许接入目标网络或不允许接入目标网络。
其中，上述S401-S403中的终端或者目标网络(可以是目标网络中的节点)的动作可以由图2所示的通信装置20中的处理器201调用存储器203中存储的应用程序代码来执行，本申请实施例对此不做任何限制。
基于图4所示的方法，终端和目标网络之间可通过第一交易的标识和第一密钥进行认证。这样，目标网络可以不用向每个终端分配用户永久标识符(subscription permanent identifier，SUPI)，目标网络不用管理大量的SUPI，既简化了认证流程，又节约了目标网络的存储资源。
如图5所示，为本申请实施例提供的又一种获取密钥的方法，该方法可包括如下步骤：
S501：终端获取第一交易的标识和第一密钥。
S502：目标网络获取第一交易的标识和第一密钥。
S501-S502同图4所示的方法中的S401-S402，相关描述可参考图4所示的方法，在此不再赘述。
S503：终端向第一网络发送第二请求。相应的，第一网络接收来自终端的第二请求。
一种可能的设计，目标网络为终端归属地的网络，第一网络为终端漫游地的网络。
示例1，以图1A所示的通信系统10为例，第一网络为网络104，终端102从网络103的覆盖区域移动到网络104的覆盖区域后，向网络104发送第二请求，例如向节点1042发送第二请求。
示例2，以图1D所示的通信系统11为例，第一网络为网络115，终端112从网络113的覆盖区域移动到网络115的覆盖区域后，向网络115发送第二请求，例如向节点1152发送第二请求。
本申请实施例中，第二请求可以用于请求接入第一网络。其中，第二请求可以包括第一交易的标识和目标网络的标识。
可选的，终端还向第一网络发送第一随机数。相应的，第一网络接收来自终端的第一随机数。可以理解的，第一随机数可以包括在第二请求中发送给第一网络，也可 以包括在其他消息中发送给第一网络，不予限制。
S504：第一网络向目标网络发送第一交易的标识。相应的，目标网络接收来自第一网络的第一交易的标识。
一种可能的实现方式，第一网络根据目标网络的标识，确定向目标网络发送第一交易的标识。目标网络接收到第一交易的标识后，根据第一交易的标识获取第一密钥。
对于上述示例1，节点1042接收到第二请求后，根据网络103的标识向节点1032发送第一交易的标识。节点1032接收到第一交易的标识后，根据第一交易的标识进行查询，得到第一密钥。
对于上述示例2，节点1152接收到第二请求后，根据网络113的标识向节点1132发送第一交易的标识。节点1132接收到第一交易的标识后，根据第一交易的标识进行查询，得到第一密钥。
可选的，第一网络向目标网络发送第一随机数。相应的，目标网络接收来自第一网络的第一随机数。
可选的，第一网络向目标网络发送第一网络的标识。相应的，目标网络接收来自第一网络的第一网络的标识。
可选的，第一网络向目标网络发送目标网络的标识。相应的，目标网络接收来自第一网络的目标网络的标识。
可以理解的，上述第一交易的标识、第一随机数、第一网络的标识和目标网络的标识可包括在一个消息中发送给目标网络，也可以分别包括在不同的消息中发送给目标网络，不予限制。
S505：目标网络向区块链节点发送第二密钥。相应的，区块链节点接收来自目标网络的第二密钥。
一种可能的设计，第二密钥可以用于终端与第一网络之间的认证。第二密钥是根据第一密钥得到。
对于上述示例1，节点1032根据第一密钥得到第二密钥。例如，节点1032根据密钥生成算法对第一密钥进行计算得到第二密钥，或者根据密钥生成算法对第一密钥和网络104的标识进行计算得到第二密钥，或者根据密钥生成算法对第一密钥、网络104的标识和第一随机数进行计算得到第二密钥，并向区块链节点发送第二密钥。例如，节点1032得到第二密钥后，将第二密钥发送至节点1031。节点1031接收到第二密钥后，向区块链节点发送第二密钥。
对于上述示例2，节点1132根据第一密钥得到第二密钥。例如，节点1132根据密钥生成算法对第一密钥进行计算得到第二密钥，或者根据密钥生成算法对第一密钥和网络115的标识进行计算得到第二密钥，或者根据密钥生成算法对第一密钥、网络115的标识和第一随机数进行计算得到第二密钥，并向区块链节点发送第二密钥。例如，节点1132得到第二密钥后，将第二密钥发送至节点1131。节点1131接收到第二密钥后，向区块链节点发送第二密钥。
可以理解的，在S505中，目标网络可在区块链上触发第二密钥对应的区块链交易(以下简称第二交易)的生成。例如，若节点1031或节点1131为区块链中的节 点，则节点1031或节点1131自己触发第二交易的生成；若节点1031或节点1131不是区块链中的节点，则节点1031或节点1131触发区块链节点生成第二交易。后续，第一网络可以通过区块链获取第二密钥。可选的，第一网络还获取第二交易的标识。上述过程与S303中第一节点向区块链节点发送第三消息的过程类似，可以参考S303中对应的描述，在此不做赘述。
一种可能的设计，第二交易的标识包括第二交易的地址，或者，第二交易的标识包括第二交易的地址和终端在第二交易中的序列号。其中，第二交易地址为第二交易在区块链上的地址。
S506：第一网络向终端发送第一指示信息。相应的，终端接收来自第一网的第一指示信息。
本申请实施例中，第一指示信息可以用于指示终端生成第二密钥或者指示终端生成新的密钥。
对于上述示例1，节点1032向终端102发送第一指示信息。对于上述示例2，节点1132向终端112发送第一指示信息。
可选的，第一网络还向终端发送第二交易的标识。相应的，终端接收来自第一网络的第二交易的标识。
可以理解的，第二交易的标识可以和第一指示信息包括在一个消息中发送给终端，也可以分别包括在不同的消息中发送给终端，不予限制。
S507：终端根据第一密钥生成第二密钥。
对于上述示例1，终端102根据第一密钥得到第二密钥。例如，终端102根据密钥生成算法对第一密钥进行计算得到第二密钥，或者根据密钥生成算法对第一密钥和网络104的标识进行计算得到第二密钥，或者根据密钥生成算法对第一密钥、网络104的标识和第一随机数进行计算得到第二密钥。
对于上述示例2，终端112根据第一密钥得到第二密钥。例如，终端112根据密钥生成算法对第一密钥进行计算得到第二密钥，或者根据密钥生成算法对第一密钥和网络115的标识进行计算得到第二密钥，或者根据密钥生成算法对第一密钥、网络115的标识和第一随机数进行计算得到第二密钥。
可以理解的，在S507之后，终端和第一网络可以获取到第二密钥和第二交易的标识。
可选的，在S507之后，终端和第一网络可根据第二密钥和第二交易的标识进行认证。具体可参考S403中对应的介绍。
可选的，在S507之后，终端可根据下述图6所示的方法更新密钥。
其中，上述S501-S507中的终端或者目标网络(可以是目标网络中的节点)或者第一网络(可以是第一网络中的节点)的动作可以由图2所示的通信装置20中的处理器201调用存储器203中存储的应用程序代码来执行，本申请实施例对此不做任何限制。
基于图5所示的方法，目标网络可为第一网络和终端配置第二密钥。后续，终端和第一网络可根据第二密钥进行认证或鉴权，而不需要目标网络参与认证，简化了认证流程。
如图6所示，为本申请实施例提供的一种更新密钥的方法，该方法可以包括如下步骤：
S601：终端获取第一交易的标识和第一密钥。
S602：目标网络获取第一交易的标识和第一密钥。
S601-S602同图4所示的方法中的S401-S402，相关描述可参考图4所示的方法，在此不再赘述。
S603：终端向第一节点发送第四消息。相应的，第一节点接收来自终端的第四消息。
其中，若终端是图1A中的终端102，第一节点为图1A中的节点101；或者，若终端是图1D中的终端112，第一节点为图1D中的节点111。
本申请实施例中，第四消息可以用于指示第二网络。例如，第四消息包括第二网络的标识。第二网络和目标网络可以相同也可以不同。例如，第二网络为图1A中的网络103或网络104；或者，第二网络为图1D中的网络113或网络115。
可以理解的，若第二网络与目标网络相同，则表示终端触发更新终端与目标网络之间用于认证的密钥。若第二网络与目标网络不同，则表示终端要切换到第二网络，终端触发第一节点为终端和第二网络配置用于认证的密钥。
可以理解的，在图6所示的方法中，也可不包括S603。此时，第一节点可触发更新密钥。
可选的，终端向第一节点发送第四随机数。相应的，第一节点接收来自终端的第四随机数。
可以理解的，第四随机数包括在第四消息中发送给第一节点，或者第四随机数包括在与第四消息不同的消息中发送给第一节点。
S604：第一节点向区块链节点发送第五消息。相应的，区块链节点接收来自第一节点的第五消息。
本申请实施例中，第五消息包括第四密钥。第四密钥可以用于终端与第二网络之间的认证。
可以理解的，第一节点接收到第四消息后，根据第一密钥生成第四密钥。例如，第一节点根据密钥生成算法对第一密钥进行计算，得到第四密钥，或者根据密钥生成算法对第一密钥和第二网络的标识进行计算，得到第四密钥，或者根据密钥生成算法对第一密钥、第二网络的标识和第四随机数进行计算，得到第四密钥。后续，第一节点可以向区块链节点发送第五消息。
可以理解的，在S604中，第一节点可在区块链上触发第四密钥对应的区块链交易(以下称为第三交易)的生成。例如，若第一节点为区块链中的节点，则第一节点自己触发第三交易的生成；若第一节点不是区块链中的节点，则第一节点触发区块链节点生成第三交易。后续，第二网络可以通过区块链获取第四密钥。可选的，第二网络还获取第三交易的标识。上述过程与S303中第一节点向区块链节点发送第三消息的过程类似，可以参考S303中对应的描述，在此不做赘述。
一种可能的设计，第三交易的标识包括第三交易的地址，或者，第三交易的标识包括第三交易的地址和终端在第三交易中的序列号。其中，第三交易地址为第三交易 在区块链上的地址。
可选的，区块链节点接收到第五消息后，向第一节点发送第五消息的响应消息，以向第一节点指示接收到第五消息。
S605：第一节点向终端发送第二指示信息。相应的，终端接收来自第一节点的第二指示信息。
本申请实施例中，第二指示信息可以用于指示终端生成第四密钥，或者用于指示终端生成新的密钥。
可选的，第一节点向终端发送第三交易的标识。相应的，终端接收来自第一节点的第三交易的标识。
可以理解的，第三交易的标识可以和第二指示信息包括在一个消息中发送给终端，也可以分别包括在不同的消息中发送给终端，不予限制。
S606：终端根据第一密钥生成第四密钥。
例如，终端根据密钥生成算法对第一密钥进行计算，得到第四密钥，或者根据密钥生成算法对第一密钥和第二网络的标识进行计算，得到第四密钥，或者根据密钥生成算法对第一密钥、第二网络的标识和第四随机数进行计算，得到第四密钥。
可以理解的，在S606之后，终端和第二网络可以获取到第四密钥和第三交易的标识。
可选的，在S606之后，终端和第二网络可根据第四密钥和第三交易的标识进行认证。具体可参考S403中对应的介绍。
其中，上述S601-S606中的终端或者第一节点或者目标网络(可以是目标网络中的节点)的动作可以由图2所示的通信装置20中的处理器201调用存储器203中存储的应用程序代码来执行，本申请实施例对此不做任何限制。
基于图6所示的方法，终端可以触发第一节点为终端和第二网络配置密钥。如果第二网络与目标网络相同，终端可以触发更新终端与目标网络之间用于认证的密钥，提高通信安全。若第二网络与目标网络不同，终端可以根据第一节点配置的密钥接入第二网络，而不需要更换SIM卡，十分便捷。
本申请上文中提到的各个实施例之间在方案不矛盾的情况下，均可以进行结合，不作限制。
可以理解的，以上各个实施例中，由终端实现的方法和/或步骤，也可以由可用于终端的部件(例如芯片或者电路)实现；由第一节点实现的方法和/或步骤，也可以由可用于第一节点的部件(例如芯片或者电路)实现；由目标网络中的节点实现的方法和/或步骤，也可以由可用于目标网络中的节点的部件(例如芯片或者电路)实现；由第一网络中的节点实现的方法和/或步骤，也可以由可用于第一网络中的节点的部件(例如芯片或者电路)实现；由第二网络中的节点实现的方法和/或步骤，也可以由可用于第二网络中的节点的部件(例如芯片或者电路)实现。
上述主要从各个网元之间交互的角度对本申请实施例提供的方案进行了介绍。相应的，本申请实施例还提供了通信装置，该通信装置可以为上述方法实施例中的终端，或者包含上述终端的装置，或者为可用于终端的部件；或者，该通信装置可以为上述方法实施例中的第一节点，或者包含上述第一节点的装置，或者为可用于第一节 点的部件；或者，该通信装置可以为上述方法实施例中的目标网络中的节点，或者包含上述目标网络中的节点的装置，或者为可用于目标网络中的节点的部件；或者，该通信装置可以为上述方法实施例中的第一网络中的节点，或者包含上述第一网络中的节点的装置，或者为可用于第一网络中的节点的部件；或者，该通信装置可以为上述方法实施例中的第二网络中的节点，或者包含上述第二网络中的节点的装置，或者为可用于第二网络中的节点的部件。可以理解的是，上述终端或者第一节点或者目标网络中的节点或者第一网络中的节点或者第二网络中的节点等为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法操作，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对终端或者第一节点或者目标网络中的节点或者第一网络中的节点或者第二网络中的节点等进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。可以理解的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
比如，以采用集成的方式划分各个功能模块的情况下，图7示出了一种通信装置70的结构示意图。通信装置70包括收发模块701。可选的，该通信装置70还包括处理模块702。收发模块701，也可以称为收发单元用于执行收发操作，例如可以是收发电路，收发机，收发器或者通信接口等。处理模块702，也可以称为处理单元用于执行除了收发操作之外的操作，例如可以是处理电路或者处理器等。
在一些实施例中，该通信装置70还可以包括存储模块(图7中未示出)，用于存储程序指令和数据。
示例性地，通信装置70用于实现终端的功能。通信装置70例如为图3所示的实施例，图4所示的实施例，图5所示的实施例或图6所示实施例所述的终端。
其中，收发模块701，用于向第一节点发送第一消息，该第一消息用于指示通信装置70要接入网络。例如，收发模块701可以用于执行S301。
收发模块701，还用于接收来自该第一节点的第二消息，该第二消息包括密钥信息，该密钥信息用于确定第一密钥，该第一密钥用于该通信装置70与目标网络之间的认证。例如，收发模块701还用于执行S304。
在一种可能的实现方式中，该第二消息还包括第一交易的标识和以下至少一项：该目标网络的标识或该目标网络的公钥；该第一交易为该第一密钥对应的区块链交易。
在一种可能的实现方式中，收发模块701，还用于向目标网络发送第一请求，第一请求用于请求接入目标网络，该第一请求包括该第一交易的标识；收发模块701，还用于接收来自目标网络的认证消息，认证消息与第一密钥对应。
在一种可能的实现方式中，收发模块701，还用于向目标网络发送通信装置70的标识。
在一种可能的实现方式中，收发模块701，还用于向第一网络发送第二请求，该第二请求用于请求接入该第一网络，该第二请求包括该第一交易的标识和该目标网络的标识；收发模块701，还用于接收来自该第一网络的第一指示信息，该第一指示信息用于指示该通信装置70生成第二密钥，该第二密钥用于通信装置70与该第一网络之间的认证；处理模块702，用于根据第一密钥和第一网络的标识生成第二密钥。
在一种可能的实现方式中，收发模块701，还用于接收来自第一网络的第二交易的标识，第二交易为第二密钥对应的区块链交易。
在一种可能的实现方式中，收发模块701，还用于向第一节点发送第三消息，第三消息用于指示第三网络；收发模块701，还用于接收来自第一节点的第二指示信息，第二指示信息用于指示通信装置70生成第三密钥，该第三密钥用于通信装置70与第三网络之间的认证；处理模块702，用于根据第一密钥和第三网络的标识生成第三密钥。
在一种可能的实现方式中，收发模块701，还用于接收来自第一节点的第三交易的标识，该第三交易为该第三密钥对应的区块链交易。
在一种可能的实现方式中，收发模块701，还用于向第一网络发送第一随机数。
在一种可能的实现方式中，第一交易的标识包括第一交易的地址，或者，第一交易的标识包括第一交易的地址和通信装置70在该第一交易中的序列号。
在一种可能的实现方式中，目标网络是根据通信装置70对应的用户的选择确定的；或者，目标网络是根据预设策略确定的；或者，目标网络是第一节点确定的。
在一种可能的实现方式中，密钥信息包括第一密钥；或者，密钥信息包括第三密钥，第三密钥用于确定第一密钥。
在一种可能的实现方式中，收发模块701，还用于向第一节点发送第二随机数。
在一种可能的实现方式中，第三密钥用于确定第一密钥，包括：第三密钥用于和目标网络的标识以及第二随机数共同确定该第一密钥。
在一种可能的实现方式中，第一消息包括目标网络的信息。
当用于实现终端的功能时，关于通信装置70所能实现的其他功能，可参考图3所示的实施例，图4所示的方法实施例，图5所示的实施例或图6所示的实施例的相关介绍，不多赘述。
在一个简单的实施例中，本领域的技术人员可以想到通信装置70可以采用图2所示的形式。比如，图2中的处理器201可以通过调用存储器203中存储的计算机执行指令，使得通信装置70执行上述方法实施例中所述的方法。
示例性的，图7中的收发模块701和处理模块702的功能/实现过程可以通过图2中的处理器201调用存储器203中存储的计算机执行指令来实现。或者，图7中的处理模块702的功能/实现过程可以通过图2中的处理器201调用存储器203中存储的计算机执行指令来实现，图7中的收发模块701的功能/实现过程可以通过图2中的通信接口204来实现。
比如，以采用集成的方式划分各个功能模块的情况下，图8示出了一种通信装置 80的结构示意图。通信装置80包括收发模块801和处理模块802。收发模块801，也可以称为收发单元用于执行收发操作，例如可以是收发电路，收发机，收发器或者通信接口等。处理模块802，也可以称为处理单元用于执行除了收发操作之外的操作，例如可以是处理电路或者处理器等。
在一些实施例中，该通信装置80还可以包括存储模块(图8中未示出)，用于存储程序指令和数据。
示例性地，通信装置80用于实现第一节点的功能。通信装置80例如为图3所示的实施例或图6所示的实施例所述的第一节点。
其中，收发模块801，用于接收来自终端的第一消息，该第一消息用于指示该终端要接入网络。例如，收发模块801可以用于执行S301。
处理模块802，用于获取第一密钥，该第一密钥用于终端与目标网络之间的认证。例如，处理模块802可以用于执行S302。
收发模块801，还用于向区块链节点发送第三消息，该第三消息用于向目标网络指示第一密钥。例如，收发模块801还可以用于执行S303。
收发模块801，还用于向该终端发送第二消息，该第二消息包括密钥信息，该密钥信息是根据该第一密钥确定的。例如，收发模块801还可以用于执行S304。
在一种可能的实现方式中，处理模块802，还用于获取第一交易的标识，该第一交易为该第一密钥对应的区块链交易。
在一种可能的实现方式中，第二消息还包括该第一交易的标识和以下至少一项：目标网络的标识或目标网络的公钥。
在一种可能的实现方式中，第一交易的标识包括第一交易的地址，或者，第一交易的标识包括第一交易的地址和终端在第一交易中的序列号。
在一种可能的实现方式中，收发模块801，还用于接收来自终端的第四消息，该第四消息用于指示第二网络；收发模块801，还用于向区块链节点发送第五消息，该第五消息包括第四密钥，该第四密钥用于终端与第二网络之间的认证；收发模块801，还用于向终端发送第二指示信息，该第二指示信息用于指示终端生成第四密钥。
在一种可能的实现方式中，处理模块802，还用于获取第三交易的地址，该第三交易为该第四密钥对应的区块链交易。
在一种可能的实现方式中，收发模块801，还用于向终端发送第三交易的标识。
在一种可能的实现方式中，密钥信息包括该第一密钥；或者，密钥信息包括第三密钥，该第三密钥用于确定第一密钥。
在一种可能的实现方式中，收发模块801，还用于接收来自终端的第二随机数。
在一种可能的实现方式中，该第三密钥用于确定该第一密钥，包括：该第三密钥用于和目标网络的标识以及第二随机数共同确定该第一密钥。
在一种可能的实现方式中，区块链节点包括在该目标网络中，第三消息是用目标网络的公钥对第一密钥进行加密得到的。
在一种可能的实现方式中，第一消息包括目标网络的信息。
当用于实现第一节点的功能时，关于通信装置80所能实现的其他功能，可参考 图3所示的实施例或图6所示的实施例的相关介绍，不多赘述。
或者，示例性地，通信装置80用于实现目标网络中的节点的功能。通信装置80例如为图4所示的实施例，图5所示的实施例或图6所示的实施例所述的目标网络中的节点。
其中，处理模块802，用于获取第三消息。
处理模块802，还用于根据第三消息获取第一密钥；该第一密钥用于第一终端与目标网络之间的认证。
处理模块802，还用于获取第一交易的标识，该第一交易为第一密钥对应的区块链交易。
处理模块802，还用于根据第一密钥和第一交易的标识验证第一终端。
收发模块801，还用于根据验证结果向该第一终端发送验证响应消息。
在一种可能的实现方式中，处理模块802，具体用于通过收发模块801接收来自该第一终端的第一请求，该第一请求用于请求接入目标网络，该第一请求包括第一交易的标识；处理模块802，还具体用于通过收发模块801向该第一终端发送认证消息，该认证消息是根据第一密钥得到的，该第一密钥是根据第一请求查询到的。
在一种可能的实现方式中，收发模块801，还用于向区块链节点发送查询消息，该查询消息用于查询第一交易对应的密钥，该查询消息包括第一交易的标识；收发模块801，还用于接收来自区块链节点的响应消息，该响应消息包括该第一密钥。
在一种可能的实现方式中，收发模块801，还用于接收来自第一终端的第一终端的标识。
在一种可能的实现方式中，收发模块801，还用于接收来自第二终端的第三请求，该第三请求用于请求接入目标网络，该第三请求包括第四交易的标识和第三网络的标识，该第四交易为第五密钥对应的区块链交易，该第五密钥用于第二终端与第三网络之间的认证；收发模块801，还用于向第三网络发送该第四交易的标识；处理模块802，还用于获取第六密钥，该第六密钥用于第二终端与目标网络的认证；收发模块801，还用于向第二终端发送第三指示信息，该第三指示信息用于指示第二终端生成第六密钥。
在一种可能的实现方式中，处理模块802，还用于获取第五交易的标识，该第五交易为第六密钥对应的区块链交易；收发模块801，还用于向第二终端发送该第五交易的标识。
在一种可能的实现方式中，收发模块801，还用于接收来自第二网络的第一交易的标识；收发模块801，还用于向区块链节点发送第二密钥，该第二密钥用于第一终端与第二网络之间的认证，该第二密钥是根据第一密钥得到，该第一密钥是根据第一交易的标识查询到的。
在一种可能的实现方式中，第一交易的标识包括第一交易的地址，或者，第一交易的标识包括第一交易的地址和第一终端在该第一交易中的序列号。
当用于实现目标网络中的节点的功能时，关于通信装置80所能实现的其他功能，可参考图3所示的实施例或图6所示的实施例的相关介绍，不多赘述。
或者，示例性地，通信装置80用于实现终端的功能。通信装置80例如为图4所 示的实施例所述的终端。
其中，处理模块802，用于获取第一交易的标识和第一密钥，该第一交易为第一密钥对应的区块链交易。例如，处理模块802可以用于执行S401。
处理模块802，还用于根据第一交易的标识和第一密钥与目标网络进行认证。例如，处理模块802还可以用于执行S403。
收发模块801，用于接收来自目标网络的验证响应消息。
在一种可能的实现方式中，处理模块802，具体用于通过收发模块801向目标网络发送第一请求，该第一请求用于请求接入目标网络，该第一请求包括第一交易的标识；处理模块802，还具体用于通过收发模块801接收来自目标网络的认证消息，该认证消息是根据第一密钥得到的，该第一密钥是根据第一请求查询到的；处理模块802，还具体用于验证该认证消息。
在一种可能的实现方式中，收发模块801，还用于向该目标网络发送通信装置80的80标识。
在一种可能的实现方式中，该第一请求是用目标网络的公钥对第一交易的标识进行加密得到。
当用于实现终端的功能时，关于通信装置80所能实现的其他功能，可参考图4所示的实施例的相关介绍，不多赘述。
在一个简单的实施例中，本领域的技术人员可以想到通信装置80可以采用图2所示的形式。比如，图2中的处理器201可以通过调用存储器203中存储的计算机执行指令，使得通信装置80执行上述方法实施例中所述的方法。
示例性的，图8中的收发模块801和处理模块802的功能/实现过程可以通过图2中的处理器201调用存储器203中存储的计算机执行指令来实现。或者，图8中的处理模块802的功能/实现过程可以通过图2中的处理器201调用存储器203中存储的计算机执行指令来实现，图8中的收发模块801的功能/实现过程可以通过图2中的通信接口204来实现。
可以理解的是，以上模块或单元的一个或多个可以软件、硬件或二者结合来实现。当以上任一模块或单元以软件实现的时候，所述软件以计算机程序指令的方式存在，并被存储在存储器中，处理器可以用于执行所述程序指令并实现以上方法流程。该处理器可以内置于SoC(片上系统)或ASIC，也可是一个独立的半导体芯片。该处理器内处理用于执行软件指令以进行运算或处理的核外，还可进一步包括必要的硬件加速器，如现场可编程门阵列(field programmable gate array，FPGA)、PLD(可编程逻辑器件)、或者实现专用逻辑运算的逻辑电路。
当以上模块或单元以硬件实现的时候，该硬件可以是CPU、微处理器、数字信号处理(digital signal processing，DSP)芯片、微控制单元(microcontroller unit，MCU)、人工智能处理器、ASIC、SoC、FPGA、PLD、专用数字电路、硬件加速器或非集成的分立器件中的任一个或任一组合，其可以运行必要的软件或不依赖于软件以执行以上方法流程。
可选的，本申请实施例还提供了一种芯片系统，包括：至少一个处理器和接口，该至少一个处理器通过接口与存储器耦合，当该至少一个处理器执行存储器中的计算 机程序或指令时，使得上述任一方法实施例中的方法被执行。在一种可能的实现方式中，该芯片系统还包括存储器。可选的，该芯片系统可以由芯片构成，也可以包含芯片和其他分立器件，本申请实施例对此不作具体限定。
可选的，本申请实施例还提供了一种计算机可读存储介质。上述方法实施例中的全部或者部分流程可以由计算机程序来指令相关的硬件完成，该程序可存储于上述计算机可读存储介质中，该程序在执行时，可包括如上述各方法实施例的流程。计算机可读存储介质可以是前述任一实施例的通信装置的内部存储单元，例如通信装置的硬盘或内存。上述计算机可读存储介质也可以是上述通信装置的外部存储设备，例如上述通信装置上配备的插接式硬盘，智能存储卡(smart media card，SMC)，安全数字(secure digital，SD)卡，闪存卡(flash card)等。进一步地，上述计算机可读存储介质还可以既包括上述通信装置的内部存储单元也包括外部存储设备。上述计算机可读存储介质用于存储上述计算机程序以及上述通信装置所需的其他程序和数据。上述计算机可读存储介质还可以用于暂时地存储已经输出或者将要输出的数据。
可选的，本申请实施例还提供了一种计算机程序产品。上述方法实施例中的全部或者部分流程可以由计算机程序来指令相关的硬件完成，该程序可存储于上述计算机程序产品中，该程序在执行时，可包括如上述各方法实施例的流程。
可选的，本申请实施例还提供了一种计算机指令。上述方法实施例中的全部或者部分流程可以由计算机指令来指令相关的硬件(如计算机、处理器、接入网设备、移动性管理网元或会话管理网元等)完成。该程序可被存储于上述计算机可读存储介质中或上述计算机程序产品中。
可选的，本申请实施例还提供了一种通信系统，包括：上述实施例中的终端和第一节点。
可选的，本申请实施例还提供了一种通信系统，包括：上述实施例中的终端和目标网络中的节点。
可选的，本申请实施例还提供了一种通信系统，包括：上述实施例中的终端、第一节点和目标网络中的节点。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个装置，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是一个物理单元或多个物理单元，即可以位于一个地方，或者也可以分布到多个不同地方。可以根据实际的需要选择其中的部分或者全部单元来实现本实施 例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何在本申请揭露的技术范围内的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (41)

  1. 一种获取密钥的方法，其特征在于，应用于终端，所述方法包括：
    向第一节点发送第一消息，所述第一消息用于指示所述终端要接入网络；
    接收来自所述第一节点的第二消息，所述第二消息包括密钥信息，所述密钥信息用于确定第一密钥，所述第一密钥用于所述终端与目标网络之间的认证。
  2. 根据权利要求1所述的方法，其特征在于，所述第二消息还包括第一交易的标识和以下至少一项：所述目标网络的标识或所述目标网络的公钥；
    所述第一交易为所述第一密钥对应的区块链交易。
  3. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    向所述目标网络发送第一请求，所述第一请求用于请求接入所述目标网络，所述第一请求包括所述第一交易的标识；
    接收来自所述目标网络的认证消息，所述认证消息与所述第一密钥对应。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    向所述目标网络发送所述终端的标识。
  5. 根据权利要求2-4中任一项所述的方法，其特征在于，所述方法还包括：
    发送第二请求，所述第二请求用于请求接入第一网络，所述第二请求包括所述第一交易的标识和所述目标网络的标识；
    接收第一指示信息，所述第一指示信息用于指示所述终端生成第二密钥，所述第二密钥用于所述终端与所述第一网络之间的认证；
    根据所述第一密钥和所述第一网络的标识生成所述第二密钥。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    接收第二交易的标识，所述第二交易为所述第二密钥对应的区块链交易。
  7. 根据权利要求5或6所述的方法，其特征在于，所述方法还包括：
    向所述第一网络发送第一随机数。
  8. 根据权利要求2-7中任一项所述的方法，其特征在于，所述第一交易的标识包括所述第一交易的地址，或者，所述第一交易的标识包括所述第一交易的地址和所述终端在所述第一交易中的序列号。
  9. 根据权利要求1-8中任一项所述的方法，其特征在于，所述目标网络是根据所述终端对应的用户的选择确定的；或者，所述目标网络是根据预设策略确定的；或者，所述目标网络是所述第一节点确定的。
  10. 根据权利要求1-9中任一项所述的方法，其特征在于，
    所述密钥信息包括所述第一密钥；或者，
    所述密钥信息包括第三密钥，所述第三密钥用于确定所述第一密钥。
  11. 根据权利要求10所述的方法，其特征在于，所述方法还包括：
    向所述第一节点发送第二随机数。
  12. 根据权利要求11所述的方法，其特征在于，所述第三密钥用于确定所述第一密钥，包括：
    所述第三密钥用于和所述目标网络的标识以及所述第二随机数共同确定所述第一密钥。
  13. 根据权利要求1-12中任一项所述的方法，其特征在于，所述第一消息包括所述目标网络的信息。
  14. 一种获取密钥的方法，其特征在于，所述方法包括：
    接收来自终端的第一消息，所述第一消息用于指示所述终端要接入网络；
    获取第一密钥，所述第一密钥用于所述终端与目标网络之间的认证；
    向区块链节点发送第三消息，所述第三消息用于向所述目标网络指示第一密钥；
    向所述终端发送第二消息，所述第二消息包括密钥信息，所述密钥信息是根据所述第一密钥确定的。
  15. 根据权利要求14所述的方法，其特征在于，在向所述终端发送第二消息之前，所述方法还包括：
    获取第一交易的标识，所述第一交易为所述第一密钥对应的区块链交易。
  16. 根据权利要求15所述的方法，其特征在于，所述第二消息还包括所述第一交易的标识和以下至少一项：所述目标网络的标识或所述目标网络的公钥。
  17. 根据权利要求16所述的方法，其特征在于，所述第一交易的标识包括所述第一交易的地址，或者，所述第一交易的标识包括所述第一交易的地址和所述终端在所述第一交易中的序列号。
  18. 根据权利要求14-17中任一项所述的方法，其特征在于，所述方法还包括：
    接收来自所述终端的第四消息，所述第四消息用于指示第二网络；
    向所述区块链节点发送第五消息，所述第五消息包括第四密钥，所述第四密钥用于所述终端与所述第二网络之间的认证；
    向所述终端发送第二指示信息，所述第二指示信息用于指示所述终端生成所述第四密钥。
  19. 根据权利要求18所述的方法，其特征在于，所述方法还包括：
    获取第三交易的地址，所述第三交易为所述第四密钥对应的区块链交易。
  20. 根据权利要求19所述的方法，其特征在于，所述方法还包括：
    向所述终端发送所述第三交易的标识。
  21. 根据权利要求14-20中任一项所述的方法，其特征在于，
    所述密钥信息包括所述第一密钥；或者，
    所述密钥信息包括第三密钥，所述第三密钥用于确定所述第一密钥。
  22. 根据权利要求21所述的方法，其特征在于，所述方法还包括：
    接收来自所述终端的第二随机数。
  23. 根据权利要求22所述的方法，其特征在于，所述第三密钥用于确定所述第一密钥，包括：
    所述第三密钥用于和所述目标网络的标识以及所述第二随机数共同确定所述第一密钥。
  24. 根据权利要求14-23中任一项所述的方法，其特征在于，所述区块链节点包括在所述目标网络中，所述第三消息是用所述目标网络的公钥对所述第一密钥进行加密得到的。
  25. 根据权利要求14-24中任一项所述的方法，其特征在于，所述第一消息包括 所述目标网络的信息。
  26. 一种获取密钥的方法，其特征在于，应用于目标网络中的节点，所述方法包括：
    获取第三消息；
    根据所述第三消息获取第一密钥；所述第一密钥用于第一终端与目标网络之间的认证；
    获取第一交易的标识，所述第一交易为所述第一密钥对应的区块链交易；
    根据所述第一密钥和所述第一交易的标识验证所述第一终端；
    根据验证结果向所述第一终端发送验证响应消息。
  27. 根据权利要求26所述的方法，其特征在于，所述根据所述第一密钥和所述第一交易的标识验证所述第一终端，包括：
    接收来自所述第一终端的第一请求，所述第一请求用于请求接入所述目标网络，所述第一请求包括所述第一交易的标识；
    向所述第一终端发送认证消息，所述认证消息是根据第一密钥得到的，所述第一密钥是根据所述第一请求查询到的。
  28. 根据权利要求27所述的方法，其特征在于，所述向所述第一终端发送认证消息之前，所述方法还包括：
    向区块链节点发送查询消息，所述查询消息用于查询所述第一交易对应的密钥，所述查询消息包括所述第一交易的标识；
    接收来自区块链节点的响应消息，所述响应消息包括所述第一密钥。
  29. 根据权利要求27或28所述的方法，其特征在于，所述方法还包括：
    接收来自所述第一终端的所述第一终端的标识。
  30. 根据权利要求26-29中任一项所述的方法，其特征在于，所述方法还包括：
    接收来自第二终端的第三请求，所述第三请求用于请求接入所述目标网络，所述第三请求包括第四交易的标识和第三网络的标识，所述第四交易为第五密钥对应的区块链交易，所述第五密钥用于所述第二终端与所述第三网络之间的认证；
    向第三网络发送所述第四交易的标识；
    获取第六密钥，所述第六密钥用于所述第二终端与所述目标网络的认证；
    向所述第二终端发送第三指示信息，所述第三指示信息用于指示所述第二终端生成所述第六密钥。
  31. 根据权利要求30所述的方法，其特征在于，所述方法还包括：
    获取第五交易的标识，所述第五交易为所述第六密钥对应的区块链交易；
    向所述第二终端发送所述第五交易的标识。
  32. 根据权利要求26-29中任一项所述的方法，其特征在于，所述方法还包括：
    接收来自第二网络的所述第一交易的标识；
    向所述区块链节点发送第二密钥，所述第二密钥用于所述第一终端与所述第二网络之间的认证，所述第二密钥是根据所述第一密钥得到，所述第一密钥是根据所述第一交易的标识查询到的。
  33. 根据权利要求26-28、32中任一项所述的方法，其特征在于，所述第一交易 的标识包括所述第一交易的地址，或者，所述第一交易的标识包括所述第一交易的地址和所述第一终端在所述第一交易中的序列号。
  34. 一种认证方法，其特征在于，应用于终端，所述方法包括：
    获取第一交易的标识和第一密钥，所述第一交易为所述第一密钥对应的区块链交易；
    根据所述第一交易的标识和所述第一密钥与目标网络进行认证；
    接收来自所述目标网络的验证响应消息。
  35. 根据权利要求34所述的方法，其特征在于，所述根据所述第一交易的标识和所述第一密钥与所述目标网络进行认证，包括：
    向所述目标网络发送第一请求，所述第一请求用于请求接入所述目标网络，所述第一请求包括所述第一交易的标识；
    接收来自所述目标网络的认证消息，所述认证消息是根据所述第一密钥得到的，所述第一密钥是根据所述第一请求查询到的；
    验证所述认证消息。
  36. 根据权利要求35所述的方法，其特征在于，所述方法还包括：
    向所述目标网络发送所述终端的标识。
  37. 根据权利要求35或36所述的方法，其特征在于，所述第一请求是用所述目标网络的公钥对所述第一交易的标识进行加密得到。
  38. 一种通信装置，其特征在于，包括用于执行如权利要求1至13中任一项所述方法的单元或模块，或者包括用于执行如权利要求14至25中任一项所述方法的单元或模块，或者包括用于执行如权利要求26至33中任一项所述方法的单元或模块，包括用于执行如权利要求34至37中任一项所述方法的单元或模块。
  39. 一种通信装置，其特征在于，包括：处理器，所述处理器与存储器耦合，所述存储器用于存储程序或指令，当所述程序或指令被所述处理器执行时，使得所述装置执行如权利要求1至13中任一项所述的方法，或者执行如权利要求14至25中任一项所述的方法，或者执行如权利要求26至33中任一项所述的方法，或者执行如权利要求34至37中任一项所述的方法。
  40. 一种计算机可读存储介质，其上存储有计算机程序或指令，其特征在于，所述计算机程序或指令被执行时使得计算机执行如权利要求1至13中任一项所述的方法，或者如权利要求14至25中任一项所述的方法，或者如权利要求26至33中任一项所述的方法，或者如权利要求34至37中任一项所述的方法。
  41. 一种计算机程序产品，所述计算机程序产品中包括计算机程序代码，其特征在于，当所述计算机程序代码在计算机上运行时，使得计算机实现权利要求1至13中任一项所述的方法，或者实现权利要求14至25中任一项所述的方法，或者实现权利要求26至33中任一项所述的方法，或者实现权利要求34至37中任一项所述的方法。
PCT/CN2022/113779 2022-08-19 2022-08-19 获取密钥的方法及装置 WO2024036645A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/113779 WO2024036645A1 (zh) 2022-08-19 2022-08-19 获取密钥的方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/113779 WO2024036645A1 (zh) 2022-08-19 2022-08-19 获取密钥的方法及装置

Publications (1)

Publication Number Publication Date
WO2024036645A1 true WO2024036645A1 (zh) 2024-02-22

Family

ID=89940485

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/113779 WO2024036645A1 (zh) 2022-08-19 2022-08-19 获取密钥的方法及装置

Country Status (1)

Country Link
WO (1) WO2024036645A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109168156A (zh) * 2018-11-01 2019-01-08 中国联合网络通信集团有限公司 一种虚拟sim卡的实现方法及服务器
CN110300102A (zh) * 2019-06-17 2019-10-01 中电科大数据研究院有限公司 一种基于区块链的物联网安全接入系统及方法
CN110493261A (zh) * 2019-09-16 2019-11-22 腾讯科技（深圳）有限公司 基于区块链的验证码获取方法、客户端、服务器及存储介质
US20220094555A1 (en) * 2020-09-18 2022-03-24 Fujitsu Limited Validator control for transaction between blockchains
CN114650533A (zh) * 2020-12-17 2022-06-21 华为技术有限公司 无线通信的方法及通信装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109168156A (zh) * 2018-11-01 2019-01-08 中国联合网络通信集团有限公司 一种虚拟sim卡的实现方法及服务器
CN110300102A (zh) * 2019-06-17 2019-10-01 中电科大数据研究院有限公司 一种基于区块链的物联网安全接入系统及方法
CN110493261A (zh) * 2019-09-16 2019-11-22 腾讯科技（深圳）有限公司 基于区块链的验证码获取方法、客户端、服务器及存储介质
US20220094555A1 (en) * 2020-09-18 2022-03-24 Fujitsu Limited Validator control for transaction between blockchains
CN114650533A (zh) * 2020-12-17 2022-06-21 华为技术有限公司 无线通信的方法及通信装置

Similar Documents

Publication Publication Date Title
US11784788B2 (en) Identity management method, device, communications network, and storage medium
EP3308522B1 (en) System, apparatus and method for multi-owner transfer of ownership of a device
CN109547471B (zh) 网络通信方法和装置
CN109314705B (zh) 使用组加密密钥的用于大规模可伸缩动态多点虚拟私有网络的系统、装置和方法
CN108614878B (zh) 协议数据管理方法、装置、存储介质及系统
WO2017186100A1 (zh) 身份认证方法、系统及设备
WO2018176781A1 (zh) 信息发送方法、信息接收方法、装置及系统
US10516654B2 (en) System, apparatus and method for key provisioning delegation
CN110460439A (zh) 信息传输方法、装置、客户端、服务端及存储介质
WO2016082801A1 (zh) 一种用于建立无线连接的方法及设备
CN109600392A (zh) 一种防止信息篡改的方法及装置
CN111869187A (zh) Iot服务层系统与分布式分类账系统之间的互通
KR20130111165A (ko) 블루투스 저 에너지 프라이버시
CN111737366A (zh) 区块链的隐私数据处理方法、装置、设备以及存储介质
CN109495429B (zh) 一种鉴权方法、终端及服务器
JP2014508446A (ja) Ｃｐｎｓ環境におけるユーザ認証のための認証キー発給システム及び方法
CN111935166B (zh) 通信认证方法、系统、电子设备、服务器及存储介质
CN114584613B (zh) 一种推送消息的方法、消息推送系统及电子设备
US20240143202A1 (en) Customer-specific activation of functionality in a semiconductor device
CN111787540A (zh) 接入物联网的方法、装置、电子设备及可读存储介质
CN111328060A (zh) 一种蓝牙设备mesh入网方法和系统及其设备
CN110572268B (zh) 一种匿名认证方法和装置
CN113852459B (zh) 密钥协商方法、设备及计算机可读存储介质
WO2022001951A1 (zh) 一种通信方法及通信装置
WO2022042417A1 (zh) 认证方法、装置及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22955425

Country of ref document: EP

Kind code of ref document: A1