WO2024067046A1 - 一种通信方法及装置 - Google Patents

一种通信方法及装置 Download PDF

Info

Publication number
WO2024067046A1
WO2024067046A1 PCT/CN2023/118059 CN2023118059W WO2024067046A1 WO 2024067046 A1 WO2024067046 A1 WO 2024067046A1 CN 2023118059 W CN2023118059 W CN 2023118059W WO 2024067046 A1 WO2024067046 A1 WO 2024067046A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
random number
authentication
information
network device
Prior art date
Application number
PCT/CN2023/118059
Other languages
English (en)
French (fr)
Inventor
徐艺珊
郭龙华
黄康
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2024067046A1 publication Critical patent/WO2024067046A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/37—Managing security policies for mobile devices or for controlling mobile applications

Definitions

  • the embodiments of the present application relate to the field of communication technology, and in particular, to a communication method and device.
  • Passive IoT terminals (such as tags) have simple functions and can be widely used in industry, enterprises, agriculture, animal husbandry, forestry, etc.
  • IoT technology can be combined with wireless communication system technology to enable IoT to have a larger scale of application deployment prospects.
  • how to improve communication security is a technical problem that needs to be solved.
  • the embodiments of the present application provide a communication method and device to improve communication security.
  • a communication method wherein the execution subject of the method may be a core network device, or a component applied in the core network device, such as a chip, a processor, etc.
  • the following description is made by taking the execution subject being a core network device as an example. First, first information is received from a requesting party, where the first information is used to indicate a first terminal. Then, an authentication method corresponding to the first terminal is obtained. Next, a process corresponding to the authentication method is executed.
  • the core network device obtains the authentication method corresponding to the first terminal and executes the corresponding process, which can improve security.
  • the core network device may further obtain the identifier of the first terminal and send the identifier of the first terminal to the requester.
  • the authentication method includes any one of the following: a two-way authentication method and a one-way authentication method.
  • the two-way authentication method includes any one of the following: two-way authentication between the first terminal and the requesting party, and two-way authentication between the first terminal and a first network corresponding to the core network device.
  • the one-way authentication method includes any one of the following: one-way authentication performed by the requester on the first terminal, one-way authentication performed by the first network corresponding to the core network device on the first terminal, one-way authentication performed by the first terminal on the requester, and one-way authentication performed by the first terminal on the first network corresponding to the core network device.
  • a process corresponding to the authentication method is executed, including: when the authentication method is a one-way authentication performed by the first terminal on the requesting party, receiving a random number from the first terminal, and sending the random number to the requesting party; receiving a check value or ciphertext information from the requesting party, and sending the check value or the ciphertext information to the first terminal.
  • a process corresponding to the authentication method is executed, including: when the authentication method is a one-way authentication performed by the requesting party on the first terminal, receiving a random number from the requesting party, and sending the random number to the first terminal; receiving a check value or ciphertext information from the first terminal, and sending the check value or the ciphertext information to the requesting party.
  • a process corresponding to the authentication method is executed, including: when the authentication method is a one-way authentication performed by the requesting party on the first terminal, obtaining a random number and sending the random number to the first terminal; receiving a check value or ciphertext information from the first terminal, sending the random number to the requesting party, and sending the check value or the ciphertext information to the requesting party.
  • a process corresponding to the authentication method is executed, including: when the authentication method is a two-way authentication between the first terminal and the requesting party, receiving a random number from the first terminal, and sending the random number to the requesting party; receiving a first verification value or a first ciphertext information from the requesting party, and sending the first verification value or the first ciphertext information to the first terminal; receiving a second verification value or a second ciphertext information from the first terminal, and sending the second verification value or the second ciphertext information to the requesting party.
  • a process corresponding to the authentication method is executed, including: when the authentication method is a one-way authentication performed by the first terminal on the first network corresponding to the core network device, receiving a first random number from the first terminal; obtaining a second random number; and obtaining a verification value or ciphertext information based on the first random and the second random numbers, and sending the verification value or the ciphertext information to the first terminal.
  • a process corresponding to the authentication method is executed, including: when the authentication method is a one-way authentication performed by the first terminal on the first network corresponding to the core network device, receiving a first random number from the first terminal; and obtaining a check value or ciphertext information based on the first random number, and sending the check value or the ciphertext information to the first terminal.
  • a process corresponding to the authentication method is executed, including: when the authentication method is a one-way authentication performed by the first network corresponding to the core network device on the first terminal, obtaining a random number and sending the random number to the first terminal; receiving a check value or ciphertext information from the first terminal, and verifying the check value or the ciphertext information based on the random number.
  • a process corresponding to the authentication method is executed, including: when the authentication method is a one-way authentication performed by the first network corresponding to the core network device on the first terminal, obtaining a random number and sending the random number to the first terminal; receiving a verification value or ciphertext information from the first terminal, sending the random number to other core network devices, and sending the verification value or the ciphertext information to other core network devices, so that the other core network devices verify the verification value or the ciphertext information based on the random number.
  • a process corresponding to the authentication method is executed, including: when the authentication method is a two-way authentication of the first terminal and the first network corresponding to the core network device, receiving a first random number from the first terminal; obtaining a second random number; and obtaining a first verification value or a first ciphertext information based on the first random number and the second random number, and sending the first verification value or the first ciphertext information to the first terminal; receiving a second verification value or a second ciphertext information from the first terminal, and verifying the second verification value or the second ciphertext information based on the second random number.
  • a process corresponding to the authentication method is executed, including: when the authentication method is a two-way authentication of the first terminal and the first network corresponding to the core network device, receiving a first random number from the first terminal; and obtaining a first verification value or a first ciphertext information based on the first random number, sending the first verification value or the first ciphertext information to the first terminal, and sending a second random number to the first terminal; receiving a second verification value or a second ciphertext information from the first terminal, and verifying the second verification value or the second ciphertext information based on the second random number.
  • the first information is also used to indicate the authentication method corresponding to the first terminal; the core network device obtains the authentication method corresponding to the first terminal, including: obtaining the authentication method corresponding to the first terminal according to the first information.
  • the requester indicates the authentication method, and can indicate the authentication method corresponding to the first terminal to the core network device on demand or dynamically. For the same terminal, the authentication methods indicated by the AF at different times can be the same or different. Indicating the authentication method by the first information can save signaling interaction.
  • the core network device obtains the authentication method corresponding to the first terminal, including: the core network device obtains the first context information, or the first policy information, or the first service configuration, or the first subscription data of the first terminal; wherein the first context information, or the first policy information, or the first service configuration, or the first subscription data includes the authentication method of the first terminal; the core network device obtains the authentication method corresponding to the first terminal based on the first context information, or the first policy information, or the first service configuration, or the first subscription data.
  • the core network device obtains the authentication method corresponding to the first terminal, including: the core network device obtains the second context information, or second policy information, or second service configuration, or second subscription data of the requester; wherein the second context information, or the second policy information, or the second service configuration, or the second subscription data includes the authentication methods corresponding to one or more terminals managed by the requester, and the one or more terminals managed by the requester include the first terminal; the core network device obtains the authentication method corresponding to the first terminal based on the second context information, or the second policy information, or the second service configuration, or the second subscription data.
  • the core network device after the core network device obtains the authentication method corresponding to the first terminal, it can also send information about the authentication method to the first terminal. This method can be applicable to a scenario where the authentication method is not configured in the first terminal. After the first terminal knows its authentication method, it can execute a process corresponding to the authentication method.
  • a communication method is provided, wherein the execution subject of the method may be a core network device, or a component used in the core network device, such as a chip, a processor, etc.
  • the following description is made by taking the execution subject being a core network device as an example.
  • an authentication method corresponding to the first terminal is obtained, wherein the authentication method corresponding to the first terminal is not to perform authentication.
  • it is determined that the location of the first terminal is within a preset location range; and the first network corresponding to the requesting party or the core network device is allowed to skip the authentication process of the first terminal.
  • the final authentication method is further determined based on the location of the terminal, which can improve security.
  • the implementation of the core network device obtaining the authentication method corresponding to the first terminal can refer to the various possible implementations of the first aspect and will not be repeated here.
  • the core network device after the core network device receives the first information from the requester, the core network device further obtains the identifier of the first terminal and sends the identifier of the first terminal to the requester.
  • the core network device determines that the location of the first terminal is outside a preset location range; and executes a process corresponding to a configured authentication method, where the configured authentication method is used to authenticate a terminal accessing the network where the core network device is located.
  • the core network device obtains that the authentication method corresponding to the first terminal is not to perform authentication, further deciding the final authentication method based on the location of the terminal can improve security.
  • the location of the first terminal includes one or more of the following: a geographical location of the first terminal, a geographical location of a second terminal that performs random access to the first terminal; wherein the preset location range is a preset geographical location range.
  • the position of the first terminal is represented by a first identifier
  • the preset position range is a preset identifier range
  • the first identifier includes one or more of the following: an identifier of an access network device accessed by the first terminal, an identifier of a cell where the first terminal is located, an identifier of a tracking area where the first terminal is located, an identifier of a network accessed by the first terminal, an identifier of a slice accessed by the first terminal, an identifier of a closed access group accessed by the first terminal, an identifier of an access network device accessed by the second terminal, an identifier of a cell where the second terminal is located, an identifier of a tracking area where the second terminal is located, an identifier of a network accessed by the second terminal, an identifier of a slice accessed by the second terminal, and an identifier of a closed access group accessed by the second terminal, wherein the second terminal is a terminal that performs random access
  • the core network device before the core network device sends the identifier of the first terminal to the requesting party, it also sends the first terminal an indication that the first terminal has successfully accessed. This allows the first terminal to quickly access the core network, reduces signaling interaction and latency overhead, improves the inventory efficiency of the first terminal, and reduces the power consumption overhead of the first terminal.
  • a communication device wherein the device has the functions of implementing any of the above aspects and any possible implementation of any of the above aspects. These functions can be implemented by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more functional modules corresponding to the above functions.
  • a communication device comprising a processor and, optionally, a memory; the processor and the memory are coupled; the memory is used to store computer programs or instructions; the processor is used to execute part or all of the computer programs or instructions in the memory, and when the part or all of the computer programs or instructions are executed, it is used to implement the functions of any of the above aspects and any possible implementation methods of any aspect.
  • the device may further include a transceiver, the transceiver being configured to send a signal processed by the processor or receive a signal input to the processor.
  • the transceiver may perform a sending action or a receiving action in any aspect and any possible implementation of any aspect.
  • the present application provides a chip system, which includes one or more processors (also referred to as processing circuits), and the processors are electrically coupled to a memory (also referred to as a storage medium);
  • the memory may be located in the chip system or may not be located in the chip system;
  • the memory is used to store computer programs or instructions;
  • the processor is used to execute part or all of the computer programs or instructions in the memory, and when the part or all of the computer programs or instructions are executed, it is used to implement the functions of any of the above aspects and any possible implementation methods of any aspect.
  • the chip system may further include an input/output interface (also referred to as a communication interface), the input/output interface being used to output a signal processed by the processor, or to receive a signal input to the processor.
  • the input/output interface may perform a sending action or a receiving action in any aspect and any possible implementation of any aspect. Specifically, the output interface performs a sending action, and the input interface performs a receiving action.
  • the chip system may be composed of a chip, or may include a chip and other discrete devices.
  • a computer-readable storage medium for storing a computer program, wherein the computer program includes instructions for implementing the functions of any aspect and any possible implementation of any aspect.
  • a computer-readable storage medium is used to store a computer program, which, when executed by a computer, can enable the computer to execute any of the above aspects and any possible implementation method of any of the aspects.
  • a computer program product comprising: a computer program code, when the computer program code is run on a computer, the computer executes a method in any one of the above aspects and any possible implementation of any one of the aspects.
  • a communication system comprising: a core network device executing the first aspect and any possible implementation, and a first terminal interacting with the core network device.
  • the communication system comprises: a core network device executing the second aspect and any possible implementation, and a first terminal interacting with the core network device.
  • the first terminal is used to send the identifier of the first terminal to the core network device.
  • the first terminal is used to perform two-way authentication between the first terminal and the requesting party, or the first terminal and the Bidirectional authentication of the first network corresponding to the core network device, or unidirectional authentication performed by the requester on the first terminal, or unidirectional authentication performed by the first network corresponding to the core network device on the first terminal, or unidirectional authentication performed by the first terminal on the requester, or unidirectional authentication performed by the first terminal on the first network corresponding to the core network device.
  • the first terminal is used to send one or more of a random number, a first random number, a second random number, a check value, ciphertext information, a first check value, a first ciphertext information, a second check value, and a second ciphertext information to a core network device.
  • the first terminal is used to receive one or more of a random number, a first random number, a second random number, a check value, ciphertext information, a first check value, a first ciphertext information, a second check value, and a second ciphertext information from a core network device.
  • the first terminal is used to receive information about the authentication method from the core network device.
  • the communication system also includes a requester that interacts with the core network device.
  • the requester is used to send first information to a core network device, where the first information is used to indicate a first terminal.
  • the requester is used to receive an identifier of a first terminal from a core network device.
  • the requester is used to perform two-way authentication between the first terminal and the requester, or one-way authentication performed by the requester on the first terminal, or one-way authentication performed by the first terminal on the requester.
  • the requester is used to send one or more of a random number, a first random number, a second random number, a check value, ciphertext information, a first check value, a first ciphertext information, a second check value, and a second ciphertext information to the core network device.
  • the requesting party is used to receive one or more of a random number, a first random number, a second random number, a check value, ciphertext information, a first check value, a first ciphertext information, a second check value, and a second ciphertext information from a core network device.
  • FIG1 is a schematic diagram of a communication system structure provided in an embodiment of the present application.
  • FIG2 is a schematic diagram of a communication process provided in an embodiment of the present application.
  • FIG3a is a schematic diagram of a process of a first terminal performing one-way authentication on a requesting party provided in an embodiment of the present application;
  • FIG3b is a schematic diagram of a process of a requesting party performing one-way authentication on a first terminal provided in an embodiment of the present application;
  • FIG3c is a schematic diagram of a process of performing two-way authentication between a first terminal and a requesting party provided in an embodiment of the present application;
  • FIG3d is a schematic diagram of a process of performing one-way authentication on a first network corresponding to a core network device by a first terminal provided in an embodiment of the present application;
  • FIG3e is a schematic diagram of a process in which a first network corresponding to a core network device provided in an embodiment of the present application performs one-way authentication on a first terminal;
  • FIG3f is a schematic diagram of a process of performing two-way authentication between a first terminal and a first network corresponding to a core network device provided in an embodiment of the present application;
  • FIG4 is a schematic diagram of an authentication process between a first terminal and a requesting party provided in an embodiment of the present application
  • FIG5 is a schematic diagram of an authentication process between a first terminal and a first network provided in an embodiment of the present application
  • FIG6 is a schematic diagram of a process of a requester or a first network performing one-way authentication on a first network provided in an embodiment of the present application;
  • FIG7 is a structural diagram of a communication device provided in an embodiment of the present application.
  • FIG8 is a structural diagram of a communication device provided in an embodiment of the present application.
  • Inventory operation can also be called inventory operation, which can obtain the identification information of the terminal (such as electronic tags, tags and other different types of terminal forms, the following takes the terminal as a tag as an example, but is not limited to tags).
  • the terminal identification information can be obtained through query (query), confirmation (ack) and other commands.
  • the identification information of the terminal is, for example, the electronic product code (EPC) and the tag identifier (TID).
  • the read operation can read the data in the storage area of the terminal.
  • the data in the storage area may include identification information (such as electronic product code (EPC), tag identifier (TID)), content stored in the reserved area, or content stored in the user storage area.
  • identification information such as electronic product code (EPC), tag identifier (TID)
  • the write operation can be performed on the storage area of the terminal.
  • the identification information such as EPC, TID
  • the data in the reserved area or the user storage area can be written or rewritten.
  • Kill operation can make the terminal ineffective. For example, the terminal cannot work after being ineffective.
  • Lock operation can lock the terminal information and prevent the tag from being read or written. Or, The lock operation can also lock a memory bank, which can prevent or allow read or write operations on the memory bank.
  • Block write operation allows the reader to write multiple words to the terminal's storage area (such as reserved area, EPC storage area, TID storage area or user storage area) with a single command.
  • Block erase operation allows the reader to perform multi-word erase operations on the terminal's storage area (such as reserved area, EPC storage area, TID storage area or user storage area).
  • Access operation Change a terminal with a non-zero access password from an open state to a secured state.
  • At least one refers to one or more
  • plural refers to two or more.
  • And/or describes the association relationship of associated objects, indicating that three relationships may exist.
  • a and/or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural.
  • the character “/” generally indicates that the previous and next associated objects are in an “or” relationship.
  • At least one of the following” or similar expressions refers to any combination of these items, including any combination of single or plural items.
  • At least one of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c can be single or multiple.
  • ordinal numbers such as “first” and “second” mentioned in the embodiments of the present application are used to distinguish multiple objects, and are not used to limit the size, content, order, timing, priority or importance of multiple objects.
  • first message and the second message are only used to distinguish different messages, and do not indicate the difference in content, priority or importance of the two messages.
  • the communication method provided in the present application can be applied to various communication systems, for example, the Internet of Things (IoT), passive IoT (P-IoT; or ambient IoT, A-IoT), semi-passive IoT (semi-passive IoT), semi-active IoT (semi-active IoT), active IoT (active IoT), narrowband Internet of Things (NB-IoT), long term evolution (LTE), fifth generation (5G) communication system, LTE and 5G hybrid architecture, 6G or new communication system emerging in future communication development, etc.
  • the communication system can also be a machine to machine (M2M) network, machine type communication (MTC) or other network.
  • M2M machine to machine
  • MTC machine type communication
  • FIG1 is a schematic diagram of a possible communication system applicable to an embodiment of the present application, including: a terminal device, an access network device, a core network device, and a requesting party.
  • the requester can perform operations on the terminal device (such as a tag), including but not limited to obtaining information about the terminal device, inventory operations (or inventory operations), read operations, write operations, invalidation operations, deactivation operations, etc.
  • the requester sends operation instructions through the core network device.
  • the core network device instructs the access network device to initiate random access to the terminal device. When the terminal device successfully accesses the random access, the access network device sends or forwards information about the operation to be performed to the terminal device.
  • the core network device instructs the second terminal device to initiate random access to the first terminal device. When the first terminal device successfully accesses the random access, the second terminal device sends or forwards information about the operation to be performed to the first terminal device.
  • the terminal device obtains corresponding information or sends corresponding information according to the received operation information. For example, when the operation is an inventory operation, the terminal device sends the identification information of the terminal device; when the operation is a read operation, the terminal device sends the data information stored in the storage area of the terminal device; when the operation is a write operation, the terminal device stores the data information to be written in the storage area of the terminal device.
  • the access network device sends the information from the terminal device to the core network device; the core network device sends this information to the requester.
  • the terminal device can be a terminal device in the Internet of Things technology, including but not limited to passive terminal devices, semi-passive terminal devices, semi-active terminal devices, active terminal devices, low-power terminal devices, zero-power terminal devices, passive terminal devices, active terminal devices, etc.
  • Terminal equipment can be called user equipment (UE), terminal, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, wireless communication equipment, user agent or user device.
  • Terminal equipment can be widely used in various scenarios, such as internet of things (IOT), device-to-device (D2D), vehicle to everything (V2X) communication, machine-type communication (MTC), internet of things (IOT), virtual reality, augmented reality, industrial control, autonomous driving, telemedicine, smart grid, smart furniture, smart office, smart wear, smart transportation, smart city, etc.
  • IOT internet of things
  • D2D device-to-device
  • V2X vehicle to everything
  • MTC machine-type communication
  • IOT internet of things
  • virtual reality virtual reality
  • augmented reality industrial control
  • autonomous driving telemedicine, smart grid, smart furniture, smart office, smart wear, smart transportation, smart city, etc.
  • the terminal device may be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a handheld device with wireless communication function, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, a terminal device in a 5G network, a terminal device in a future-evolved public land mobile network (PLMN) or a non-terrestrial network (NTN), etc.
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • Terminal device It can also be an end device, a logical entity, an intelligent device, etc., such as a mobile phone, an intelligent terminal and other terminal devices, or a server, a gateway, a base station, a controller and other communication equipment, or a tag (such as a passive tag, an active tag, a semi-active tag, a semi-passive tag), a sensor, an electric meter, a water meter and other Internet of Things (IoT) devices.
  • the terminal device can also be an unmanned aerial vehicle (UAV) with a communication function. When the terminal device is a passive terminal, or a semi-passive terminal, or a semi-active terminal, or an active terminal, or a tag, it can obtain energy to receive or send data.
  • UAV unmanned aerial vehicle
  • the way to obtain energy includes but is not limited to radio, solar energy, light energy, wind energy, water energy, thermal energy, kinetic energy, etc.
  • This application does not limit the way in which passive terminals, semi-passive terminals, semi-active terminals, active terminals, or tags obtain energy.
  • the tags involved in this application can be in the form of tags, or they can also be in any terminal form.
  • the access network equipment is used to access the terminal equipment to the wireless network.
  • the access network equipment may be a base station, a pole station, an indoor base station (e.g., a lamp site), a home base station (e.g., a home NB), a micro base station, an integrated access and backhaul (IAB) node, a mobile base station, a wireless access network, a wireless access network equipment, an evolved NodeB (evolved NodeB) in an LTE system or an evolved LTE system (LTE-Advanced, LTE-A), a next generation NodeB (next generation NodeB, gNB) in a 5G communication system, a transmission reception point (TRP), a baseband unit (base band unit, BBU), a WiFi access point (access point, AP), a base station in a future mobile communication system or an access node in a WiFi system, etc.
  • TRP transmission reception point
  • BBU baseband unit
  • WiFi access point access point
  • AP access
  • the access network equipment may also be a module or unit that completes some functions of a base station, for example, a centralized unit (CU) or a distributed unit (DU).
  • CU centralized unit
  • DU distributed unit
  • the embodiments of the present application do not limit the specific technology and specific equipment form adopted by the access network equipment.
  • the access network device may be a CU node, or a DU node, or an access network device including a CU node and a DU node.
  • the CU node is used to support protocols such as radio resource control (RRC), packet data convergence protocol (PDCP), and service data adaptation protocol (SDAP);
  • the DU node is used to support radio link control (RLC) layer protocol, medium access control (MAC) layer protocol, and physical layer protocol.
  • RRC radio resource control
  • PDCP packet data convergence protocol
  • SDAP service data adaptation protocol
  • the DU node is used to support radio link control (RLC) layer protocol, medium access control (MAC) layer protocol, and physical layer
  • the requester can be understood as a device that sends an operation instruction, such as a third-party device, server, P-IoT server, application server (AS), application function (AF), passive IoT application function (P-IoT AF), IoT application function (IoT AF) or other devices that send operation instructions.
  • the requester can correspond to a certain type of user, which can include enterprises, tenants, third parties or companies without restriction. Among them, the requester corresponding to a certain type of user is understood as the requester belongs to this type of user and is managed by this type of user.
  • the core network equipment may include one or more of the following network elements:
  • the access management network element (also known as the access management network element, mobility management network element, access and mobility management network element) is a control plane network element provided by the operator network, which is responsible for the access control and mobility management of terminal devices accessing the operator network, such as mobile state management, allocation of user temporary identity, authentication and user functions.
  • the access management network element can be an access and mobility management function (AMF) network element.
  • AMF access and mobility management function
  • the access management network element can still be an AMF network element, or it can have other names, which are not limited in this application.
  • the session management network element is mainly responsible for session management in the mobile network, such as session establishment, modification, and release. Specific functions include allocating IP addresses to users, selecting user plane network elements that provide message forwarding functions, etc.
  • the session management network element can be a session management function (SMF) network element.
  • SMF session management function
  • the session management network element can still be an SMF network element, or it can have other names, which are not limited in this application.
  • the user plane network element is responsible for forwarding and receiving user data in the terminal device.
  • User data can be received from the data network and transmitted to the terminal device through the access network device; the user plane network element can also receive user data from the terminal device through the access network device and forward it to the data network.
  • the transmission resources and scheduling functions that provide services to the terminal devices in the user plane network element are managed and controlled by the SMF network element.
  • the user plane network element can be a user plane function (UPF) network element.
  • UPF user plane function
  • future communication systems the user plane network element can still be a UPF network element, or it can have other names, which are not limited in this application.
  • the data management network element is used to generate authentication credentials, user identification processing (such as storing and managing user permanent identities, etc.), access control and contract data management, etc.
  • the data management network element can be a unified data management (UDM) network element.
  • the unified data management can still be a UDM network element, or it can have other names, which are not limited in this application.
  • the policy control network element mainly supports providing a unified policy framework to control network behavior, provides policy rules to the control layer network functions, and is responsible for obtaining user subscription information related to policy decisions.
  • the policy control network element can be policy and billing Policy and charging rules function (PCRF) network element.
  • PCF policy control function
  • the policy control network element may still be a PCF network element, or may have other names, which are not limited in this application.
  • the network storage network element can be used to provide network element discovery function and provide network element information corresponding to the network element type based on the request of other network elements.
  • NRF also provides network element management services, such as network element registration, update, deregistration, network element status subscription and push, etc.
  • the network storage network element can be a network repository function (NRF) network element.
  • NRF network repository function
  • the network storage network element can still be an NRF network element, or it can have other names, which are not limited in this application.
  • the network open network element is a control plane network element provided by the operator.
  • the network open network element opens the external interface of the operator network to the third party in a secure manner. It can be used to provide services and capabilities provided by the 3rd generation partnership project (3GPP) network function equipment for securely opening to the outside.
  • 3GPP 3rd generation partnership project
  • the network open network element can serve as a relay for the communication between the session management network element and the network element of the third party.
  • the network open network element serves as a relay, it can serve as a translator of the identification information of the contracted user and the identification information of the network element of the third party.
  • the network open network element when the network open network element sends the SUPI of the contracted user from the operator network to the third party, the SUPI can be translated into its corresponding external identity (identity, ID). Conversely, when the network open network element sends the external ID (network element ID of the third party) to the operator network, it can translate it into SUPI.
  • the network open function network element can be a network exposure function (NEF) network element. In future communication systems, the network open function network element may still be a NEF network element, or may have other names, which are not limited in this application.
  • NEF network exposure function
  • the network slice selection network element can be used to select a suitable network slice for the terminal's service.
  • the network slice selection network element can be a network slice selection function (NSSF) network element.
  • the network open function network element can still be an NSSF network element, or it can have other names, which are not limited in this application.
  • the network data analysis network element can collect data from various network functions (NF), such as policy control network elements, session management network elements, user plane network elements, access management network elements, and application function network elements (through network capability exposure function network elements), and perform analysis and prediction.
  • NF network functions
  • the network data analysis network element can be a network data analysis function (NWDAF).
  • NWDAF network data analysis function
  • the network exposure function network element can still be an NWDAF network element, or it can have other names, which are not limited in this application.
  • the unified data storage network element is responsible for storing structured data information, including contract information, policy information, and network data or business data defined in a standard format.
  • the unified data storage network element can be a unified data repository (UDR).
  • the network open function network element can still be a UDR network element, or it can have other names, which are not limited in this application.
  • Authentication server function the functional entity of the network authenticating the UE, is used by the network to verify whether the UE is authentic. It can support the access service authentication defined by the 3GPP framework, and can also support the authentication of non-3GPP access networks.
  • the network slice-specific and SNPN authentication and authorization function (NSSAAF) is mainly used to connect with the external AAA server and perform a conversion between the service-based interface (SBI) interface and the AAA interface. It is an intermediate network element that connects the internal network element of the 3GPP network with the external AAA server.
  • NSAAF is pre-configured with the correspondence between the address information of the AAA server and the domain information. When NSSAAF receives the domain information, NSAAF can determine the AAA server based on the address information of the AAA server, and then send the received message to the AAA server.
  • NSSAAF can request the address information of the AAA server from the domain name server (DNS) server based on the domain information, obtain the address information of the AAA server from the DNS server, and then send the received message to the AAA server.
  • DNS domain name server
  • NSSAAF can also be used to support credentials from a credential holder (CH) using an AAA server to access a standalone non-public network, or to support credentials from a default credential server (DCS) using an AAA server to access a standalone non-public network. If the credential holder or the default credential server is from a third party, NSSAAF can communicate with the AAA server through an AAA proxy.
  • CH credential holder
  • DCS default credential server
  • the tag management function which can also be called the IoT management function (IMF) or the IoT device management function (IDMF), can implement one or more of the following functions: 1) Identify the instructions sent by the requester and perform operations on the IoT terminal according to the instructions sent by the requester; 2) Instruct the access network device or terminal device to execute the random access process of the IoT terminal; 3) Obtain the data of the IoT terminal; filter or collect the data sent by the IoT terminal; 4) Send data from the IoT terminal to the requester; 5) Connect to one or more requesters and perform data routing; 6) Execute the security authentication process of the IoT terminal; and execute the security process based on the context information, policy information or contract data corresponding to the requester or the IoT terminal.
  • TMF can be an independent network element or device, deployed independently; it can also be a component of an existing network element or device. Some functions are deployed together with existing network elements or devices, such as TMF and AMF, NEF or UPF.
  • the network element may also be referred to as a "device”, "entity”, etc.
  • the above network element or function may be a network element in a hardware device, a software function running on dedicated hardware, or a virtualized function instantiated on a platform (for example, a cloud platform).
  • the above network element or function may be divided into one or more services, and further, services that exist independently of the network function may also appear.
  • an instance of the above function, or an instance of a service included in the above function, or an instance of a service that exists independently of the network function may be referred to as a service instance.
  • Figure 1 is only an example of an applicable network architecture, and the actual network architecture may include more or fewer network elements than Figure 1.
  • the names of the various network elements used in the embodiments of the present application may remain the same in future communication systems, but the names may change.
  • the embodiments of the present application propose a variety of security authentication schemes to improve communication security. For example, one-way authentication of the terminal device by the requester to ensure that the terminal device is the terminal device of the requester; for example, one-way authentication of the terminal device to the requester to ensure that the requester is trustworthy; another example, two-way authentication between the terminal device and the requester; for example, one-way authentication of the terminal device by the operator; for example, one-way authentication of the terminal device to the operator; for example, two-way authentication between the operator and the terminal device.
  • authentication can be exempted (because executing the authentication process will increase the interaction process between the terminal device and the requester, which increases the time consumption).
  • the method provided in the embodiment of the present application can be applied to industry, enterprises, agriculture, animal husbandry, forestry, etc.
  • it can be applied to the management of products in industry.
  • passive or semi-passive IoT tags on products, it is possible to automatically scan and count products.
  • the relevant information of the goods is automatically collected by the reader, and the management personnel can quickly query the goods information in the system, reduce the risk of discarding or theft, and can increase the speed of goods handover, improve the accuracy, and prevent cross-selling and anti-counterfeiting.
  • asset management such as libraries, art galleries, and museums, where assets are huge or items are valuable. Complete management procedures or rigorous protection measures are required.
  • Passive or semi-passive IoT tags are embedded or attached to books or valuables. When there are abnormal changes in the storage information of books or valuables, the administrator can be reminded in time to deal with the relevant situation.
  • industrial equipment such as forklifts, trailers, automated guided vehicles (AGV), etc.
  • AGV automated guided vehicles
  • it can be applied to the management of farmed products (such as pigs, cattle, sheep, chickens, etc.) in animal husbandry.
  • farmed products such as pigs, cattle, sheep, chickens, etc.
  • the management of farmed products statistics can be achieved.
  • it can be applied to the management of trees in forestry.
  • trees for example, by fixing tags on trees, the management of tree statistics can be achieved.
  • Scenario 1 The first terminal is pre-configured with an authentication method, and the first terminal performs authentication with the requester.
  • the authentication between the first terminal and the requester may include: two-way authentication between the first terminal and the requester, one-way authentication of the requester to the first terminal, and one-way authentication of the first terminal to the requester.
  • Scenario 2 No authentication method is configured in the first terminal, and authentication is performed between the first terminal and the requesting party.
  • the first terminal is pre-configured with an authentication method, and the first terminal performs authentication with the first network corresponding to the core network device (the first network corresponding to the core network device may be referred to as an operator network).
  • the authentication between the first terminal and the first network corresponding to the core network device may include: bidirectional authentication between the first terminal and the first network corresponding to the core network device, unidirectional authentication of the first terminal by the first network corresponding to the core network device, and unidirectional authentication of the first terminal by the first network corresponding to the core network device.
  • Scenario 4 No authentication method is configured in the first terminal, and authentication is performed between the first terminal and the first network corresponding to the core network device (the first network corresponding to the core network device can be called an operator network).
  • the authentication between the first terminal and the first network corresponding to the core network device can be understood as the authentication between the first terminal and the authentication device in the first network.
  • the communication process shown in Figure 2 can be applied to the communication system shown in Figure 1.
  • the requester can be the requester in Figure 1, such as a third-party device, a server, a P-IoT server, an application server AS, an application function AF, a passive Internet of Things application function (P-IoT AF), an Internet of Things application function (IoT AF), etc.
  • the core network device can be the core network device in Figure 1, such as AMF, UDM, TMF, AUSF, NSSAAF, SMF, UPF, PCF, NEF, UDR, etc.
  • the core network device can communicate directly with the requester or communicate through other core network devices;
  • the first terminal can be the terminal device in Figure 1.
  • the process diagram introduced in FIG2 includes at least the following steps:
  • Step 201 The requesting party sends first information to a core network device, where the first information is used to indicate a first terminal.
  • the core network device receives the first information from the requester.
  • the first information may also indicate other terminals.
  • the first information indicates the first terminal
  • one or more of the following methods may be used:
  • the first information includes a terminal identification range
  • the terminal identification range includes an identification of the first terminal.
  • the first information includes identifications of one or more terminals, and the identifications of the one or more terminals include the identification of the first terminal.
  • the first information includes the type of the terminal, and the first terminal belongs to the type.
  • the first information includes information of the requester.
  • the information of the requester may indicate a terminal identification range corresponding to (or managed by) the requester or identifications of one or more terminals.
  • the terminal identification range corresponding to (or managed by) the requester or identifications of one or more terminals includes the identification of the first terminal.
  • the terminal identification range corresponding to (or managed by) the requester or the identification of one or more terminals can be saved or configured on the core network device, or can be saved or configured on other core network devices.
  • the core network device can send the requester's information to other core network devices, and the other core network devices obtain the terminal identification range corresponding to (or managed by) the requester or the identification of one or more terminals based on the requester's information, and send it to the core network device.
  • other core network devices may include UDM, UDR, AUSF, NEF, PCF, SMF, TMF, NSSAAF, AMF and other core network devices.
  • the requesting party's information may include one or more of the following: AF identifier (AF identifier or AF identity, AF ID), service identifier (service identifier or service identity, service ID), application identifier (application identifier or application identity, APP ID), address information of AF, port information of AF, address information of application server AS, port information of application server AS.
  • the address of AF or AS is, for example, an internet protocol address (internet protocol address, IP), a media access control (media access control, MAC) address, an IPv6 prefix, etc.
  • the port of AF or AS is, for example, a transmission control protocol (transmission control protocol, TCP) port, a user datagram protocol (user datagram protocol, UDP) port.
  • the first information may be used to indicate that a first operation is performed on the first terminal.
  • the first operation may be an operation of obtaining an identification of the first terminal (also referred to as an inventory operation, an inventory operation, an inventory), a read operation, a write operation, a delete operation, an encryption operation, an access operation, a block write operation, a block erase operation, or an inactivation operation.
  • the first information includes information about the first operation, and the first operation is indicated by the information about the first operation. Further optionally, the first information also includes an operation parameter corresponding to the first operation.
  • the information about the first operation may be referred to as an instruction type, or the information about the first operation and the operation parameter corresponding to the first operation are collectively referred to as an instruction type.
  • the operation parameter corresponding to the read operation may include a storage area to be read, a starting word address of the storage area to be read, and the number of words.
  • the operation parameter corresponding to the write operation may include a storage area to be written, a starting word of the storage area to be read, and data to be written.
  • the operation of obtaining an identification of the first terminal (also referred to as an inventory operation, an inventory operation, an inventory) may not need to be carried in the first information. For example, when the first information does not include the first operation, it may be indicated that the first information is used to obtain the identification of the first terminal.
  • the requester needs to periodically perform a first operation on the first terminal.
  • a possible implementation method is that the requester requests the core network device to perform the first operation on the first terminal when the period arrives.
  • the requester sends periodic information to the core network device, and accordingly, the core network device can receive the periodic information from the requester and save it.
  • the core network device periodically triggers the execution of the first operation on the first terminal without the requester periodically requesting the core network device to perform the first operation on the first terminal, which can save signaling interaction.
  • Step 202 The core network device obtains the authentication method corresponding to the first terminal.
  • the core network device can obtain the authentication method corresponding to the first terminal, including but not limited to the following methods.
  • the requester indicates the authentication method corresponding to the first terminal to the core network device.
  • the requester indicates the authentication method corresponding to the first terminal to the core network device through the first information.
  • the first information can be used to indicate the authentication method corresponding to the first terminal; the core network device can obtain the authentication method corresponding to the first terminal according to the first information.
  • the requester can also indicate the authentication method corresponding to the first terminal to the core network device through other information different from the first information. In this manner, if the first terminal is pre-configured with an authentication method, usually, the authentication method indicated by the requester to the core network device must be the same as the authentication method pre-configured in the first terminal.
  • the authentication method indicated by the requester to the core network device is different from the authentication method pre-configured in the first terminal.
  • the first terminal can perform the authentication process according to the authentication method indicated by the requester.
  • the authentication method indicated by the requester has a higher priority than the authentication method pre-configured by the first terminal.
  • the authentication method indicated by the requester to the core network device can be triggered on demand or dynamically indicated.
  • the authentication modes indicated by the requester at different times may be the same or different.
  • the first context information, the first policy information, or the first service configuration (eg, service profile), or the first contract data includes the authentication method corresponding to the first terminal (the authentication method corresponding to the terminal may be the authentication method supported by the terminal).
  • the core network device obtains the first context information, or the first policy information, or the first service configuration, or the first contract data of the first terminal, and the core network device obtains the authentication method corresponding to the first terminal based on the first context information, or the first policy information, or the first service configuration, or the first contract data.
  • the first context information, or the first policy information, or the first service configuration, or the first contract data of the first terminal is stored in one or more of the following devices: an access management device (such as AMF), a policy control device (such as PCF), an authentication device (such as AUSF), a unified data management device (such as UDM), a user database (such as UDR), a session management device (such as SMF), and a tag management function (such as TMF).
  • AMF access management device
  • PCF policy control device
  • PCF authentication device
  • UDM unified data management device
  • UDR user database
  • SMF session management device
  • TMF tag management function
  • the second context information, or second policy information, or second service configuration, or second subscription data of the requester includes the authentication method corresponding to one or more terminals managed by the requester (the authentication method corresponding to the terminal may be an authentication method supported by the terminal), and the one or more terminals managed by the requester include the first terminal.
  • the core network device obtains the second context information, or second policy information, or second service configuration, or second subscription data of the requester, and the core network device obtains the authentication method corresponding to the first terminal based on the second context information, the second policy information, the second service configuration, or the second subscription data.
  • the second context information, or the second policy information, or the second service configuration, or the second subscription data of the requester can be stored in control plane functions such as UDM, UDR, AUSF, NSSAAF, AMF, TMF, PCF, etc.
  • the authentication mode corresponding to the first terminal may be a two-way authentication mode, or a one-way authentication mode, or no authentication is performed.
  • the authentication mode may specifically be any one of the following: two-way authentication between the first terminal and the requesting party, and two-way authentication between the first terminal and the first network corresponding to the core network device.
  • the authentication method can specifically be any one of the following: one-way authentication performed by the requesting party on the first terminal, one-way authentication performed by the first network corresponding to the core network device on the first terminal, one-way authentication performed by the first terminal on the requesting party, and one-way authentication performed by the first terminal on the first network corresponding to the core network device.
  • Step 203 The core network device executes (execution may be understood as initiating, triggering, or participating in) a process corresponding to the authentication method obtained in step 202.
  • the core network device obtains the authentication method corresponding to the first terminal and executes the corresponding process, which can improve security.
  • the random number (RAND) can be a bit string (for example, a bit string of 128 bits in length), or a character string or a number.
  • the check value can be a message authentication code (MAC), and the check value can be a bit string (for example, a bit string of 32 bits in length), or a character string or a number.
  • MAC message authentication code
  • the ciphertext information can be a bit string (for example, a bit string of 32 bits in length), a character string or a number.
  • the plaintext information can be a bit string (for example, a bit string of 128 bits in length), a character string or a number. This application does not limit the structure or length of the plaintext information.
  • FIG. 3 a a schematic diagram of a process flow of multiple possible first terminals performing one-way authentication on a requesting party is introduced.
  • Step 31a The first terminal sends a random number to the core network device, and correspondingly, the core network device receives the random number from the first terminal.
  • the random number may be pre-configured in the first terminal or randomly generated by the first terminal.
  • the random number is carried in a request (e.g., a registration request) message sent by the first terminal to a core network device (e.g., AMF or TMF).
  • a request e.g., a registration request
  • a core network device e.g., AMF or TMF
  • Step 32a The core network device sends the random number to the requester, and correspondingly, the requester receives the random number from the core network device.
  • Step 33a The requesting party obtains a verification value or ciphertext information based on the random number.
  • the process of obtaining the verification value or ciphertext information includes: the requesting party obtains the verification value or ciphertext information based on the random number and the preconfigured key.
  • the requesting party performs a calculation based on the random number and a preconfigured security key to obtain a verification value.
  • the requesting party uses a preconfigured security key to encrypt the random number to obtain ciphertext information.
  • Step 34a The requesting party sends the verification value or ciphertext information to the core network device, and correspondingly, the core network device receives the verification value or ciphertext information from the requesting party.
  • Step 35a The core network device sends the verification value or ciphertext information to the first terminal, and correspondingly, the first terminal receives the verification value or ciphertext information.
  • the check value or ciphertext information is carried in a response (e.g., registration response Registration Accept) message sent by a core network device (e.g., AMF or TMF) to the first terminal.
  • a response e.g., registration response Registration Accept
  • Step 36a The first terminal verifies the verification value or ciphertext information based on the random number.
  • the process of verifying the check value or ciphertext information includes: verifying the check value or ciphertext information based on the random number and a preconfigured key.
  • the process of verifying the ciphertext information includes: decrypting the ciphertext information to obtain a numerical value (the numerical value may be referred to as plaintext information), and comparing the decrypted numerical value with the random number (the random number sent by the first terminal to the core network device in step 31a).
  • the two are the same, the verification is successful, and the one-way authentication of the requesting party by the first terminal is successful.
  • the two are different, the verification fails, and the one-way authentication of the requesting party by the first terminal fails.
  • the process of verifying the check value includes: performing an operation on the random number sent by the first terminal in step 31a and the preconfigured key to obtain a check value, and comparing the check value with the check value received by the first terminal in step 35a.
  • the verification passes, and the one-way authentication of the first terminal to the requesting party passes.
  • the two are different, the verification fails, and the one-way authentication of the first terminal to the requesting party fails.
  • FIG. 3 b a schematic diagram of a process of multiple possible processes of a requesting party performing one-way authentication on a first terminal is introduced.
  • the process of the requesting party performing one-way authentication on the first terminal includes:
  • Step 31b1 The requesting party sends a random number to the core network device, and correspondingly, the core network device receives the random number from the requesting party.
  • the random number may be for the first terminal.
  • the random number sent by the requesting party to the core network device may be different to improve the security of the authentication process.
  • the random number may be for a group terminal.
  • Step 32b1 the core network device sends the random number to the first terminal, and correspondingly, the first terminal receives the random number.
  • the random number is carried in a request (e.g., an authentication request (Authentication Request) or an authentication request (Authorization Request)) message sent by a core network device (e.g., AMF or TMF) to a first terminal.
  • a core network device e.g., AMF or TMF
  • the core network device may send the random number to an access network device, and the access network device broadcasts the random number.
  • a check value or ciphertext information may be obtained based on the broadcast random number.
  • the core network device may send multiple random numbers to the access network device, and the access network device may broadcast different random numbers at different times.
  • the access network device may broadcast different random numbers in random access processes of different periods to improve security.
  • a random access process of a period may be distinguished by broadcasting a select message.
  • the access network device may include different random numbers in select messages sent at different times.
  • Step 33b1 The first terminal obtains a check value or ciphertext information based on the random number.
  • the process of obtaining the check value or ciphertext information includes: the first terminal obtains the check value or ciphertext information based on the random number and the preconfigured key.
  • the first terminal operates the random number and a preconfigured key to obtain a check value.
  • the first terminal uses a preconfigured security key to encrypt the random number to obtain ciphertext information.
  • Step 34b1 The first terminal sends the verification value or ciphertext information to the core network device, and correspondingly, the core network device receives the verification value or ciphertext information from the first terminal.
  • the check value or ciphertext information is carried in a response (e.g., an authentication response (Authentication Response) or an authorization response (Authorization Response)) message sent by the first terminal to a core network device (e.g., AMF or TMF).
  • a response e.g., an authentication response (Authentication Response) or an authorization response (Authorization Response)
  • a core network device e.g., AMF or TMF.
  • Step 35b1 the core network device sends the verification value or ciphertext information to the requester, and correspondingly, the requester receives the verification value or ciphertext information.
  • Step 36b1 The requesting party verifies the verification value or ciphertext information based on the random number.
  • the process of verifying the check value or ciphertext information includes: verifying the check value or ciphertext information based on the random number and a preconfigured key.
  • the process of verifying the ciphertext information includes: decrypting the ciphertext information to obtain a numerical value (the numerical value may be referred to as plaintext information), and comparing the decrypted numerical value with the random number (the random number sent by the requesting party to the core network device in step 31b1).
  • the two are the same, the verification passes, and the one-way authentication of the requesting party to the first terminal passes.
  • the two are different, the verification fails, and the one-way authentication of the requesting party to the first terminal fails.
  • the process of verifying the check value includes: performing an operation on the random number sent by the requesting party in step 31b1 and the preconfigured key to obtain a check value, and comparing the check value with the check value received by the requesting party in step 35b1.
  • the verification passes, and the one-way authentication of the first terminal by the requesting party passes.
  • the two are different, the verification fails, and the one-way authentication of the first terminal by the requesting party fails.
  • the process of the requesting party performing one-way authentication on the first terminal includes:
  • Step 31b2 The core network device obtains a random number.
  • the process of obtaining a random number includes: a core network device generates a random number, or obtains a random number from another core network device.
  • the core network device is an AMF
  • the other core network device is a UDM, a UDR, a NSSAAF, an AUSF, a TMF, or a functional device for performing management on a terminal.
  • Step 32b2 the core network device sends the random number to the first terminal, and correspondingly, the first terminal receives the random number from the core network device.
  • the random number is carried in a request (e.g., an authentication request (Authentication Request) or an authentication request (Authorization Request)) message sent by a core network device (e.g., AMF) to a first terminal.
  • a core network device e.g., AMF
  • the core network device sends a random number to an access network device, and the access network device sends the random number to the terminal.
  • the access network device may broadcast the random number.
  • the random number may be for a group terminal.
  • the core network device may send the random number to the access network device, and the access network device broadcasts the random number.
  • a check value or ciphertext information may be obtained based on the broadcast random number.
  • the core network device may send multiple random numbers to the access network device, and the access network device may broadcast different random numbers at different times.
  • the access network device may broadcast different random numbers in random access processes of different periods to improve security.
  • a random access process of a period may be distinguished by broadcasting a select message.
  • the access network device may include different random numbers in select messages sent at different times.
  • Step 33b2 (same as step 33b1): the first terminal obtains a check value or ciphertext information based on the random number.
  • the process of obtaining the check value or ciphertext information includes: the first terminal obtains the check value or ciphertext information based on the random number and the preconfigured key.
  • the first terminal may perform a calculation on the random number and a preconfigured key to obtain a verification value.
  • the first terminal uses a preconfigured key to encrypt the random number to obtain ciphertext information.
  • Step 34b2 The first terminal sends the verification value or ciphertext information to the core network device, and correspondingly, the core network device receives the verification value or ciphertext information from the first terminal.
  • the check value or ciphertext information is carried in a response (e.g., an authentication response (Authentication Response) or an authorization response (Authorization Response)) message sent by the first terminal to the core network device (e.g., AMF).
  • a response e.g., an authentication response (Authentication Response) or an authorization response (Authorization Response)
  • AMF authentication response
  • AMF authorization response
  • the first terminal may also send the random number (the random number sent by the core network device to the first terminal in step 32b2) to the core network device.
  • the first terminal does not send the random number to the core network device, an eavesdropper can be prevented from monitoring the random number of the first terminal through the air interface, thereby improving security and reliability.
  • Step 35b2 The core network device sends the random number (the random number obtained by the core network device in step 31b2 or the random number from the first terminal in step 34b2) and the verification value (or ciphertext information) to the requesting party, and correspondingly, the requesting party receives the random number and verification value (or ciphertext information) from the core network device.
  • the core network device may send the random number obtained in step 31b2 to the requester.
  • the core network device is AMF or TMF, and the AMF communicates with the requester through NEF.
  • AMF can first send a random number and a check value (or ciphertext information) to NEF, and NEF then sends the random number and the check value (or ciphertext information) to the requester.
  • the random number and check value may be carried in a request message (such as an Authentication Request or Authorization Request) sent by AMF to NEF.
  • a request message such as an Authentication Request or Authorization Request
  • Step 36b2 The requesting party verifies the verification value or ciphertext information based on the random number pair.
  • the process of verifying the check value or ciphertext information includes: verifying the check value or ciphertext information based on the random number and a preconfigured key.
  • the process of verifying the ciphertext information includes: decrypting the ciphertext information to obtain a numerical value (the numerical value may be referred to as plaintext information), and comparing the decrypted numerical value with the random number (the random number received from the core network device in step 35b2).
  • the two are the same, the verification is successful, and the one-way authentication of the requesting party to the first terminal is successful.
  • the two are different, the verification fails, and the one-way authentication of the requesting party to the first terminal fails.
  • the process of verifying the check value includes: performing an operation on the random number received by the requesting party in step 35b2 and the preconfigured key to obtain a check value, and comparing the check value with the check value received by the requesting party in step 35b2.
  • the verification passes, and the one-way authentication of the requesting party to the first terminal passes.
  • the two are different, the verification fails, and the one-way authentication of the requesting party to the first terminal fails.
  • FIG. 3c a schematic diagram of a process flow of multiple possible mutual authentication between the first terminal and the requesting party is introduced.
  • Step 31c The first terminal sends a first random number to the core network device, and correspondingly, the core network device receives the first random number from the first terminal.
  • the first random number may be pre-configured in the first terminal or randomly generated by the first terminal.
  • the random number is carried in a request (e.g., a registration request) message sent by the first terminal to a core network device (e.g., AMF or TMF).
  • a request e.g., a registration request
  • a core network device e.g., AMF or TMF
  • Step 32c The core network device sends the first random number to the requesting party, and correspondingly, the requesting party receives the first random number.
  • Step 33c The requesting party obtains a first verification value or first ciphertext information based on the first random number.
  • This process can include a number of ways:
  • Mode 1 The requesting party obtains the first ciphertext information based on the first random number and the preconfigured key.
  • the requesting party may encrypt the first random number using the preconfigured security key to obtain the first ciphertext information.
  • Mode 2 The requesting party obtains the first verification value based on the first random number and the preconfigured key.
  • the requesting party may perform a calculation on the first random number and the preconfigured key to obtain the first verification value.
  • Mode 3 The requesting party obtains the first ciphertext information based on the first random number and the second random number.
  • the process includes: the requesting party obtains the first ciphertext information based on the first random number, the second random number and the preconfigured key.
  • the requesting party encrypts the first random number and the second random number using the preconfigured key to obtain the first ciphertext information.
  • the second random number may be generated by the requesting party or preconfigured in the requesting party.
  • Mode 4 The requester obtains a first verification value based on a first random number and a second random number.
  • the process includes: the requester obtains a first verification value based on a first random number, a second random number, and a preconfigured key.
  • the requester may perform operations on the first random number, the second random number, and the preconfigured key to obtain the first verification value.
  • the second random number may be generated by the requester or preconfigured in the requester.
  • Step 34c The requesting party sends the first verification value or the first ciphertext information to the core network device, and correspondingly, the core network device receives the first verification value or the first ciphertext information from the requesting party.
  • step 33c when the requesting party obtains the first verification value or the first ciphertext information based on method 1, method 2, or method 4, the requesting party may optionally also send a second random number to the core network device.
  • Step 35c The core network device sends the first verification value or the first ciphertext information to the first terminal, and correspondingly, the first terminal receives the first verification value or the first ciphertext information.
  • the first check value or the first ciphertext information is carried in a request (such as an authentication request (Authentication Request) or an authentication request (Authorization Request)) message sent by a core network device (such as AMF or TMF) to the first terminal.
  • a request such as an authentication request (Authentication Request) or an authentication request (Authorization Request)
  • a core network device such as AMF or TMF
  • the core network device may also send the second random number to the first terminal.
  • Step 36c The first terminal verifies the first verification value or the first ciphertext information based on the first random number.
  • the process of verifying the first verification value or ciphertext information includes: verifying the first verification value or ciphertext information based on the first random number and a preconfigured key.
  • the verification process corresponding to the method 1 of step 33c includes: decrypting the first ciphertext information to obtain a numerical value (the numerical value can be called plaintext information), and comparing the decrypted numerical value with the first random number (the first random number sent by the first terminal in step 31c).
  • the verification passes, and the one-way authentication of the first terminal to the requesting party passes.
  • the two are different, the verification fails, and the one-way authentication of the first terminal to the requesting party fails.
  • the verification process corresponding to the method 2 of step 33c includes: operating the first random number sent by the first terminal in step 31c with the preconfigured key to obtain a verification value, and comparing the verification value with the first verification value received by the first terminal in step 35c.
  • the verification passes, and the one-way authentication of the first terminal to the requesting party passes.
  • the two are different, the verification fails, and the one-way authentication of the first terminal to the requesting party fails.
  • the verification process corresponding to the method 3 of step 33c includes: decrypting the first ciphertext information to obtain two numerical values (the numerical values can be called plaintext information), and comparing the two decrypted numerical values with the first random number (the first random number sent by the first terminal in step 31c).
  • the first random number the first random number sent by the first terminal in step 31c.
  • the verification process corresponding to the mode 4 of step 33c includes: performing an operation on the first random number sent by the first terminal in step 31c, the second random number received in step 35c and the pre-configured key to obtain a verification value, and comparing the verification value with the second random number received by the first terminal in step 35c.
  • the first verification value is compared with the first verification value. When the two are the same, the verification is passed, and the one-way authentication of the first terminal to the requesting party is passed. When the two are different, the verification fails, and the one-way authentication of the first terminal to the requesting party fails.
  • Step 37c On the basis that the one-way authentication of the requesting party by the first terminal is successful, the first terminal generates a second verification value or second ciphertext information.
  • step 35c if the first terminal receives the second random number (i.e., corresponding to method 1, method 2, or method 4), the process of the first terminal generating the second check value or the second ciphertext information includes: the first terminal obtains the second check value or the second ciphertext information based on the second random number and the preconfigured key.
  • the first terminal operates the second random number and the preconfigured key to obtain the second check value.
  • the first terminal encrypts the second random number using the preconfigured key to obtain the second ciphertext information.
  • step 35c if the first terminal does not receive the second random number (i.e., corresponding to mode 3), the process of the first terminal generating the second check value or the second ciphertext information includes: the first terminal generates the second check value or the second ciphertext information based on the third random number and the decrypted value other than the first random number (when the first terminal passes the one-way authentication of the requesting party, the decrypted value other than the first random number is the same as the second random number).
  • the third random number can be pre-configured in the first terminal, or it can be randomly generated by the first terminal.
  • the first terminal generates the second check value or the second ciphertext information based on the third random number, the decrypted value other than the first random number, and the pre-configured key.
  • the first terminal uses the pre-configured key to encrypt the third random number and the decrypted value other than the first random number to obtain the second ciphertext information.
  • the first terminal calculates the third random number, the decrypted value other than the first random number, and the pre-configured key to obtain the second check value.
  • Step 38c The first terminal sends the second verification value or second ciphertext information to the core network device, and correspondingly, the core network device receives the second verification value or second ciphertext information from the first terminal.
  • the first terminal sends the third random number to the core network device.
  • the first terminal calculates the third random number, the decrypted value other than the first random number, and the preconfigured key to obtain the second check value, the first terminal sends the third random number to the core network device.
  • the second verification value (optionally, also including a third random number) is carried in a response (e.g., an authentication response (Authentication Response) or an authorization response (Authorization Response)) message sent by the first terminal to a core network device (e.g., AMF or TMF).
  • a response e.g., an authentication response (Authentication Response) or an authorization response (Authorization Response)
  • a core network device e.g., AMF or TMF.
  • Step 39c The core network device sends the second verification value or second ciphertext information to the requesting party, and correspondingly, the requesting party receives the second verification value or second ciphertext information.
  • the core network device may also send the third random number to the requester.
  • Step 30c The requesting party verifies the second verification value or the second ciphertext information based on the second random number.
  • the process of verifying the second verification value or the second ciphertext information includes: verifying the second verification value or the second ciphertext information based on the second random number and a preconfigured key.
  • step 37c the first terminal uses a preconfigured key to encrypt the second random number to obtain the second ciphertext information.
  • the process of the requesting party verifying the second ciphertext information includes: decrypting the second ciphertext information to obtain a numerical value (the numerical value can be called plaintext information), and comparing the decrypted numerical value with the second random number (the second random number sent by the requesting party in step 34c).
  • the two are the same, the verification passes, and the one-way authentication of the requesting party to the first terminal passes.
  • the two are different, the verification fails, and the one-way authentication of the requesting party to the first terminal fails.
  • step 37c the first terminal operates the second random number and the preconfigured key to obtain a second verification value.
  • the process of the requesting party verifying the second verification value includes: operating the second random number sent by the requesting party in step 34c with the preconfigured key to obtain a verification value, and comparing the verification value with the second verification value received by the requesting party in step 39c.
  • the two are the same, the verification passes, and the one-way authentication of the first terminal by the requesting party passes.
  • the two are different the verification fails, and the one-way authentication of the first terminal by the requesting party fails.
  • step 37c the first terminal uses a preconfigured key to encrypt the third random number and the decrypted values other than the first random number to obtain the second ciphertext information.
  • the process of the requesting party verifying the second ciphertext information includes: decrypting the second ciphertext information to obtain two values (the values can be called plaintext information), and comparing the two decrypted values with the second random number (the second random number in method 3 of step 33c).
  • a certain value the order of decryption can be limited to the first value, or the second value, or the order of decryption can be unlimited
  • the one-way authentication of the first terminal by the requesting party is passed.
  • the one-way authentication of the first terminal by the requesting party fails.
  • the first terminal converts the third random number and the decrypted random number other than the first random number into
  • the second verification value is calculated by the third random number received by the requesting party in step 39c and the second random number generated by the requesting party and the preconfigured key to obtain a second verification value.
  • the process of the requesting party verifying the second verification value includes: calculating the third random number received by the requesting party in step 39c and the second random number generated by the requesting party and the preconfigured key to obtain a verification value, and comparing the verification value with the second verification value received by the requesting party in step 39c.
  • the one-way authentication of the requester by the first terminal is successful, and the one-way authentication of the first terminal by the requester is successful, that is, the two-way authentication of the requester and the first terminal is successful.
  • FIG. 3d a schematic diagram of a process of performing multiple possible one-way authentication of a first terminal on a first network corresponding to a core network device is introduced.
  • Step 31d The first terminal sends a first random number to the core network device, and correspondingly, the core network device receives the first random number from the first terminal.
  • the first random number may be pre-configured in the first terminal, or randomly generated by the first terminal.
  • the random number is carried in a request (e.g., a registration request) message sent by the first terminal to a core network device (e.g., AMF or TMF).
  • a request e.g., a registration request
  • a core network device e.g., AMF or TMF
  • Step 32d The core network device obtains a second random number.
  • This step 32d is an optional step and may not be performed.
  • the core network device One way for the core network device to obtain the second random number is that the core network device generates the second random number, and another way is that the core network device obtains the second random number from other core network devices.
  • the core network device is AMF
  • the other core network devices are UDM, AUSF, UDR, NSSAAF, NEF, PCF, TMF, or functional devices for terminal management or label management.
  • Step 33d The core network device obtains a verification value or ciphertext information based on the first random number.
  • This process can include a number of ways:
  • the core network device obtains the ciphertext information based on the first random number and the preconfigured key.
  • the core network device may encrypt the first random number using the preconfigured security key to obtain the ciphertext information.
  • the core network device obtains the verification value based on the first random number and the preconfigured key.
  • the core network device may perform a calculation on the first random number and the preconfigured key to obtain the verification value.
  • Mode 3 The core network device obtains ciphertext information based on the first random number and the second random number.
  • the process includes: the core network device obtains ciphertext information based on the first random number, the second random number and the preconfigured key.
  • the core network device uses the preconfigured key to encrypt the first random number and the second random number to obtain the ciphertext information.
  • Mode 4 The core network device obtains a verification value based on the first random number and the second random number.
  • the process includes: the core network device obtains a verification value based on the first random number, the second random number and the preconfigured key.
  • the core network device calculates the first random number, the second random number and the preconfigured key to obtain the verification value.
  • Step 34d The core network device sends the verification value or ciphertext information to the first terminal, and correspondingly, the first terminal receives the verification value or ciphertext information from the core network device.
  • step 33d when the core network device obtains the verification value or ciphertext information based on method 1, method 2, or method 4, the core network device may optionally also send a second random number to the first terminal.
  • the check value or ciphertext information is carried in a Registration Accept message sent by a core network device (such as AMF or TMF) to the first terminal.
  • a core network device such as AMF or TMF
  • Step 35d The first terminal verifies the verification value or the ciphertext information based on the first random number.
  • the verification process corresponding to the method 1 of step 33d includes: decrypting the first ciphertext information to obtain a numerical value (the numerical value can be called plaintext information), and comparing the decrypted numerical value with the first random number (the first random number sent by the first terminal in step 31d).
  • the verification passes, and the one-way authentication of the first terminal to the first network corresponding to the core network device passes.
  • the verification fails, and the one-way authentication of the first terminal to the first network corresponding to the core network device fails.
  • the verification process corresponding to the method 2 of step 33d includes: operating the first random number sent by the first terminal in step 31d with the preconfigured key to obtain a verification value, and comparing the verification value with the verification value received by the first terminal in step 34d.
  • the verification passes, and the one-way authentication of the first terminal to the first network corresponding to the core network device passes.
  • the two are different, the verification fails, and the one-way authentication of the first terminal to the first network corresponding to the core network device fails.
  • the verification process corresponding to the method 3 of step 33d includes: decrypting the ciphertext information to obtain two numerical values (the numerical values can be called plaintext information), and comparing the two decrypted numerical values with the first random number (the first random number sent by the first terminal in step 31c).
  • a certain numerical value the order of its decryption can be limited to the first numerical value, or the second numerical value, or the order of its decryption can be unlimited
  • the first terminal fails to perform one-way authentication on the first network corresponding to the core network device.
  • the verification process corresponding to the method 4 of step 33d includes: performing operations on the first random number sent by the first terminal in step 31d, the second random number received in step 34d, and the preconfigured key to obtain a verification value, and comparing the verification value with the verification value received by the first terminal in step 34d.
  • the verification passes, and the one-way authentication of the first terminal to the first network corresponding to the core network device passes.
  • the verification fails, and the one-way authentication of the first terminal to the first network corresponding to the core network device fails.
  • FIG. 3e a schematic diagram of a process of a first network corresponding to various possible core network devices performing one-way authentication on a first terminal is introduced.
  • Step 31e The core network device obtains a random number.
  • One way for a core network device to obtain a random number is that the core network device generates the random number, and another way is that the core network device obtains the random number from other core network devices.
  • the core network device is AMF, and other core network devices are UDM, AUSF, UDR, NSSAAF, NEF, PCF, TMF or functional devices for terminal management or tag management.
  • the core network device generates a different random number for each terminal, which can avoid multiple terminals sharing the same random number and improve the security of the authentication process.
  • the core network device generates random numbers in the process of executing authentication, which can ensure the freshness of the random numbers and further improve the security and reliability of the authentication process.
  • Step 32e The core network device sends the random number to the first terminal, and correspondingly, the first terminal receives the random number from the core network device.
  • the random number is carried in an authentication request (Authentication Request) message or an authentication request (Authorization Request) message sent by a core network device (such as AMF) to a first terminal.
  • the core network device may send the random number to an access network device, and the access network device broadcasts the random number.
  • a check value or ciphertext information may be obtained based on the broadcast random number.
  • the core network device may send multiple random numbers to the access network device, and the access network device may broadcast different random numbers at different times.
  • the access network device may broadcast different random numbers in random access processes of different periods to improve security.
  • a random access process of a period may be distinguished by broadcasting a select message.
  • the access network device may include different random numbers in select messages sent at different times.
  • Step 33e The first terminal obtains a check value or ciphertext information based on the random number.
  • the process of obtaining the check value or ciphertext information includes: the first terminal obtains the check value or ciphertext information based on the random number and the preconfigured key.
  • the first terminal may perform a calculation on the random number and a preconfigured key to obtain a verification value.
  • the first terminal uses a preconfigured key to encrypt the random number to obtain ciphertext information.
  • Step 34e The first terminal sends a verification value or ciphertext information to the core network device, and correspondingly, the core network device receives the verification value or ciphertext information from the first terminal.
  • the check value or ciphertext information is carried in a response (e.g., an authentication response (Authentication Response) or an authorization response (Authorization Response)) message sent by the first terminal to a core network device (e.g., AMF or TMF).
  • a response e.g., an authentication response (Authentication Response) or an authorization response (Authorization Response)
  • a core network device e.g., AMF or TMF.
  • the first terminal may also send the random number to the core network device when sending the check value or ciphertext information to the core network device.
  • the first terminal does not send the random number to the core network device, it can prevent eavesdroppers from monitoring the random number of the first terminal through the air interface, thereby improving security and reliability.
  • Step 35e The core network device verifies the verification value or ciphertext information based on the random number (the random number sent by the core network device in step 32e or the random number received by the core network device in step 34e).
  • the process of verifying the check value or ciphertext information includes: verifying the check value or ciphertext information based on the random number and a preconfigured key.
  • the process of verifying the ciphertext information includes: decrypting the ciphertext information to obtain a numerical value (the numerical value can be called plaintext information), and comparing the decrypted numerical value with a random number (the random number sent by the core network device in step 32e or the random number received by the core network device in step 34e).
  • a numerical value the numerical value can be called plaintext information
  • a random number the random number sent by the core network device in step 32e or the random number received by the core network device in step 34e.
  • the process of verifying the check value includes: performing an operation on the random number (the random number sent by the core network device in step 32e or the random number received by the core network device in step 34e) and the preconfigured key to obtain a check value, and comparing the check value with the random number sent by the core network device in step 32e.
  • step 34e the check value received by the core network device is compared. When the two are the same, the check passes, and the one-way authentication of the first terminal by the first network corresponding to the core network device passes. When the two are different, the check fails, and the one-way authentication of the first terminal by the first network corresponding to the core network device fails.
  • Step 35e and step 36e are two parallel methods.
  • Step 36e The core network device sends the verification value or ciphertext information (optionally, it may also include a random number) to other core network devices.
  • the core network device when the core network device generates a random number in step 31e, instead of obtaining the random number from other core network devices, the core network device may send the random number to other core network devices.
  • Step 37e Other core network devices verify the verification value or ciphertext information based on a random number (the random number obtained by the core network device from other core network devices in step 31e, or the random number received from the core network device in step 36e).
  • step 37e is similar to the verification process of step 35e, and they can be referenced to each other and will not be repeated here.
  • the verification value or ciphertext information may be carried in a request (e.g., an authentication request (Authentication Request) or an authentication request (Authorization Request)) message sent by the core network device to other core network devices.
  • the verification pass/authentication success information may be carried in a response (e.g., an authentication response (Authentication Response) or an authentication response (Authorization Response)) message sent by other core network devices to the core network device.
  • the random number of the terminal device is usually generated by the authenticator and sent to the terminal device, while in this method, the authenticator is other core network devices, and the core network device itself generates a random number for the first terminal and sends it to the terminal device. There is no need for other core network devices to send a random number for the first terminal to the core network device, which can save signaling overhead.
  • FIG. 3f a schematic diagram of a process of bidirectional authentication between multiple possible first terminals and a first network corresponding to a core network device is introduced.
  • Step 31f The first terminal sends a first random number to the core network device, and correspondingly, the core network device receives the first random number from the first terminal.
  • the first random number may be pre-configured in the first terminal or randomly generated by the first terminal.
  • the random number is carried in a request (e.g., a registration request) message sent by the first terminal to a core network device (e.g., AMF).
  • a request e.g., a registration request
  • AMF core network device
  • Step 32f The core network device obtains a second random number.
  • Step 32f is an optional step and may not be performed.
  • One way for the core network device to obtain the second random number is that the core network device generates the second random number, and another way is that the core network device obtains the random number from other core network devices.
  • the core network device is AMF, and other core network devices are UDM, AUSF, UDR, NEF, NSSAAF, PCF or functional devices for terminal management or tag management.
  • the core network device generates a different random number for each terminal, which can avoid multiple terminals sharing the same random number and improve the security of the authentication process.
  • the core network device generates random numbers in the process of executing authentication, which can ensure the freshness of the random numbers and further improve the security and reliability of the authentication process.
  • Step 33f (similar to step 33c): the core network device obtains a first verification value or first ciphertext information based on the first random number.
  • This process can include a number of ways:
  • the core network device obtains the first ciphertext information based on the first random number and the preconfigured key.
  • the core network device may encrypt the first random number using the preconfigured security key to obtain the first ciphertext information.
  • the core network device obtains the first verification value based on the first random number and the preconfigured key.
  • the core network device may perform a calculation on the first random number and the preconfigured key to obtain the first verification value.
  • Mode 3 The core network device obtains the first ciphertext information based on the first random number and the second random number.
  • the process includes: the core network device obtains the first ciphertext information based on the first random number, the second random number and the preconfigured key.
  • the core network device uses the preconfigured key to encrypt the first random number and the second random number to obtain the first ciphertext information.
  • Method 4 The core network device obtains a first verification value based on a first random number and a second random number.
  • the process includes: the core network device obtains a first verification value based on a first random number, a second random number and a preconfigured key.
  • the core network device may operate the first random number, the second random number and the preconfigured key to obtain the first verification value.
  • Step 34f The core network device sends the first verification value or the first ciphertext information to the first terminal, and correspondingly, the first terminal receives the first verification value or the first ciphertext information from the core network device.
  • step 33f when the core network device obtains the first verification value or the first ciphertext information based on method 1, method 2, or method 4, the core network device may optionally also send a second random number to the first terminal.
  • the first check value or the first ciphertext information (optionally, also including a second random number) is carried in a Registration Accept message sent by a core network device (such as AMF or TMF) to the first terminal.
  • a core network device such as AMF or TMF
  • Step 35f (similar to step 36c): the first terminal verifies the first verification value or the first ciphertext information based on the first random number.
  • the process of verifying the first verification value or ciphertext information includes: verifying the first verification value or ciphertext information based on the first random number and a preconfigured key.
  • the verification process corresponding to the method 1 of step 33f includes: decrypting the first ciphertext information to obtain a numerical value (the numerical value can be called plaintext information), and comparing the decrypted numerical value with the first random number (the first random number sent by the first terminal in step 31f).
  • the verification passes, and the one-way authentication of the first terminal to the first network corresponding to the core network device passes.
  • the verification fails, and the one-way authentication of the first terminal to the first network corresponding to the core network device fails.
  • the verification process corresponding to the method 2 of step 33f includes: operating the first random number sent by the first terminal in step 31f with the preconfigured key to obtain a verification value, and comparing the verification value with the first verification value received by the first terminal in step 34f.
  • the verification passes, and the one-way authentication of the first terminal to the first network corresponding to the core network device passes.
  • the two are different, the verification fails, and the one-way authentication of the first terminal to the first network corresponding to the core network device fails.
  • the verification process corresponding to the method 3 of step 33f includes: decrypting the first ciphertext information to obtain two numerical values (the numerical values can be called plaintext information), and comparing the two decrypted numerical values with the first random number (the first random number sent by the first terminal in step 31f).
  • the first random number the first random number sent by the first terminal in step 31f.
  • the verification process corresponding to the method 4 of step 33f includes: performing operations on the first random number sent by the first terminal in step 31f, the second random number received in step 34f and the preconfigured key to obtain a verification value, and comparing the verification value with the first verification value received by the first terminal in step 34f.
  • the verification passes, and the one-way authentication of the first terminal to the first network corresponding to the core network device passes.
  • the verification fails, and the one-way authentication of the first terminal to the first network corresponding to the core network device fails.
  • Step 36f on the basis that the first terminal passes the one-way authentication of the first network, the first terminal generates a second verification value or second ciphertext information.
  • step 34f if the first terminal receives the second random number (i.e., corresponding to method 1, method 2, or method 4), the process of the first terminal generating the second check value or the second ciphertext information includes: the first terminal obtains the second check value or the second ciphertext information based on the second random number and the preconfigured key.
  • the first terminal operates the second random number and the preconfigured key to obtain the second check value.
  • the first terminal encrypts the second random number using the preconfigured key to obtain the second ciphertext information.
  • step 34f if the first terminal does not receive the second random number (i.e., corresponding to mode 3), the process of the first terminal generating the second check value or the second ciphertext information includes: the first terminal generates the second check value or the second ciphertext information based on the third random number and the decrypted value other than the first random number (when the first terminal passes the one-way authentication of the requesting party, the decrypted value other than the first random number is the same as the second random number).
  • the third random number can be pre-configured in the first terminal, or it can be randomly generated by the first terminal.
  • the first terminal generates the second check value or the second ciphertext information based on the third random number, the decrypted value other than the first random number, and the pre-configured key.
  • the first terminal uses the pre-configured key to encrypt the third random number and the decrypted value other than the first random number to obtain the second ciphertext information.
  • the first terminal calculates the third random number, the decrypted value other than the first random number, and the pre-configured key to obtain the second check value.
  • Step 37f The first terminal sends the second verification value or second ciphertext information to the core network device, and correspondingly, the core network device receives the second verification value or second ciphertext information from the first terminal.
  • the first terminal sends the third random number to the core network device.
  • the first terminal calculates the third random number, the decrypted value other than the first random number, and the preconfigured key to obtain the second check value, the first terminal sends the third random number to the core network device.
  • the second check value or the second ciphertext information is carried in a response (e.g., an authentication response (Authentication Response) or an authorization response (Authorization Response)) message sent by the first terminal to a core network device (e.g., AMF or TMF).
  • a response e.g., an authentication response (Authentication Response) or an authorization response (Authorization Response)
  • a core network device e.g., AMF or TMF.
  • the second random number received in step 34f may also be sent to the core network device.
  • malicious monitoring can be prevented.
  • Step 38f (similar to step 30c): the core network device verifies the second verification value or the second ciphertext information based on the second random number.
  • the process of verifying the second verification value or the second ciphertext information includes: verifying the second verification value or the second ciphertext information based on the second random number and a preconfigured key.
  • step 36f the first terminal uses a preconfigured key to encrypt the second random number to obtain the second ciphertext information.
  • the process of the core network device verifying the second ciphertext information includes: decrypting the second ciphertext information to obtain a numerical value (the numerical value can be called plaintext information), and comparing the decrypted numerical value with the second random number (the second random number sent by the requesting party in step 34c).
  • the two are the same, the verification passes, and the one-way authentication of the first terminal by the first network corresponding to the core network device passes.
  • the two are different, the verification fails, and the one-way authentication of the first terminal by the first network corresponding to the core network device fails.
  • step 36f the first terminal operates the second random number and the preconfigured key to obtain a second verification value.
  • the process of the core network device verifying the second verification value includes: operating the second random number sent by the core network device in step 34f with the preconfigured key to obtain a verification value, and comparing the verification value with the second verification value received by the core network device in step 37f.
  • the verification passes, and the one-way authentication of the first terminal by the first network corresponding to the core network device passes.
  • the two are different, the verification fails, and the one-way authentication of the first terminal by the first network corresponding to the core network device fails.
  • step 36f the first terminal uses a preconfigured key to encrypt the third random number and the decrypted values other than the first random number to obtain the second ciphertext information. Then the process of the core network device verifying the second ciphertext information includes: decrypting the second ciphertext information to obtain two values (the values can be called plaintext information), and comparing the two decrypted values with the second random number (the second random number in method 3 of step 33f).
  • the order of decryption can be limited to the first value, or the second value, or the order of decryption can be unlimited
  • the one-way authentication of the first terminal by the first network corresponding to the core network device is passed.
  • the one-way authentication of the first terminal by the first network corresponding to the core network device fails.
  • step 36f the first terminal operates the third random number, the decrypted value other than the first random number, and the preconfigured key to obtain a second verification value.
  • the process of the core network device verifying the second verification value includes: operating the third random number received in step 37f, the second random number obtained in step 32f, and the preconfigured key to obtain a verification value, and comparing the verification value with the second verification value received by the core network device in step 37f.
  • the unidirectional authentication of the first terminal to the first network is passed, and the unidirectional authentication of the first network to the first terminal is passed, that is, the bidirectional authentication of the first network and the first terminal is passed.
  • the parameters for performing authentication (such as a random number, or a first random number, or a check value, or ciphertext information, or a second check value, or a second ciphertext information) sent by the first terminal to the core network device can be carried in the first message.
  • the first message can be a registration request message, or an access request message, or a request message for accessing a network device, or a request message for registering a network. This application does not limit the name of the first message.
  • the first message can be a non-access stratum (NAS) message or a non-NAS message.
  • NAS non-access stratum
  • the authentication method of the first terminal obtained by the core network device is not to perform authentication:
  • the core network device does not need to perform the authentication process, or the core network device skips the authentication process of the first terminal.
  • the core network device may also make further decisions based on the location of the first terminal to determine a final authentication method for the first terminal.
  • the core network device determines that the location of the first terminal is within the preset location range, the core network device allows the requesting party or the first network corresponding to the core network device not to execute the authentication process of the first terminal, or allows the requesting party or the first network corresponding to the core network device to skip the authentication process of the first terminal. It can be understood that when the core network device determines that the location of the first terminal is within the preset location range, the authentication method corresponding to the first terminal is finally determined to not execute authentication.
  • the core network device determines that the position of the first terminal is outside the preset position range or the position of the first terminal is not within the preset range
  • the core network device executes the process corresponding to the configured authentication method, and the configured authentication method is used to authenticate the terminal accessing the network where the core network device is located.
  • the configured authentication method is used to authenticate the first type of terminal accessing the network where the core network device is located.
  • the first type of terminal may include an Internet of Things terminal, a passive Internet of Things terminal, a semi-passive Internet of Things terminal, a semi-active Internet of Things terminal, or an active Internet of Things terminal, etc.
  • the authentication method corresponding to the first terminal is finally determined to be the configured authentication method.
  • the configured authentication method can be configured on the core network device, or can be configured on other core network devices.
  • the core network device can obtain the configured authentication method from other core network devices.
  • the configured authentication method can be one-way authentication of the first terminal to the requester, or one-way authentication of the requester to the first terminal, or bilateral authentication of the first terminal and the requester, or one-way authentication of the first terminal to the first network corresponding to the core network device, or one-way authentication of the first network corresponding to the core network device to the first terminal, or two-way authentication of the first terminal and the first network corresponding to the core network device, or other authentication methods.
  • the location of the first terminal may be represented by a geographical location.
  • the geographical location is longitude and latitude, or a coordinate value.
  • the location of the first terminal includes but is not limited to one or more of the following: a geographical location where the first terminal is located, and a geographical location where a second terminal that performs random access to the first terminal is located.
  • the preset location range may be a preset geographical location range, and the preset geographical location range may be a set of one or more geographical locations.
  • the location of the first terminal can be represented by a first identifier (which can be understood as being represented by the first identifier), for example, the first identifier includes but is not limited to one or more of the following: an identifier of an access network device accessed by the first terminal, an identifier of a cell (cell ID) where the first terminal is located, an identifier of a tracking area (TA) where the first terminal is located (TAI), an identifier of a network accessed by the first terminal, an identifier of a slice accessed by the first terminal, an identifier of a closed access group (CAG) accessed by the first terminal (CAG ID), an identifier of an access network device accessed by the second terminal, an identifier of a cell where the second terminal is located, an identifier of the tracking area where the second terminal is located, an identifier of a network accessed by the second terminal, an identifier of a slice accessed by the first terminal, and an identifier of a closed access
  • the identifier of the access network can be an ID (such as a radio access network global number RAN Global ID or a gNodeB ID, etc.), address information, port information, and domain name information.
  • the identifier of the accessed network can be a public land mobile network (public land mobile network, PLMN) identifier, or it can be a non-public network identifier, such as a combination of a PLMN ID and a network identifier (network identifier, NID).
  • the public land mobile network (public land mobile network, PLMN) identifier can be a combination of a mobile country code (mobile country code, MCC) and a mobile network code (mobile network code, MNC).
  • the preset position range may be a preset identification range, and the preset identification range may be a collection of one or more identifications.
  • the location of the first terminal can be represented by a geographical location and a first identifier. Specific details can be referred to the above description, and will not be repeated.
  • the core network device may also obtain the identifier of the first terminal and send the obtained identifier of the first terminal to the requester.
  • the core network device obtaining the identifier of the first terminal includes: the core network device receives the identifier of the first terminal sent by the first terminal.
  • the core network device instructs the access network device to perform a random access process of the first terminal.
  • the first terminal sends the identifier of the first terminal to the core network device through the access network device.
  • the identifier of the first terminal may be carried in the second message, and the second message may be a registration request message, an access message, an access request message, a request message for accessing the network, or a request message for registering the network.
  • the present application does not limit the name of the second message.
  • the second message may be a NAS message or a non-NAS message.
  • the first message and the second message may be the same or different.
  • the identifier of the terminal device may be carried in the registration request message.
  • the message carrying the identifier of the terminal device is extended and is no longer limited to the registration request message.
  • the first terminal may not need to send parameters (such as a random number, a first random number, a check value, or a second check value) for performing authentication to the core network device through an independent message, which can save signaling interaction.
  • the core network device obtains the identifier of the first terminal in steps 202 and 203. If, after executing the authentication process and determining that the authentication is passed, the core network device obtains the identifier of the first terminal and sends the identifier of the first terminal to the requesting party, security can be improved.
  • the following is an exemplary description of the information interaction in each authentication process, and the sequence of obtaining the identifier of the first terminal from the core network device and sending the obtained identifier of the first terminal to the requester.
  • the identifier and random number of the first terminal sent by the first terminal to the core network device can be sent to the core network device in one message, or in different messages. If the one-way authentication of the requesting party by the first terminal is passed (that is, the first terminal passes the verification value or ciphertext information based on the random number verification), the first terminal sends the identifier of the first terminal to the core network device, which can further improve security. In addition, the identifier and random number of the first terminal sent by the core network device to the requesting party can be sent to the requesting party in one message, or in different messages.
  • the identifier and check value (or ciphertext information) of the first terminal sent by the first terminal to the core network device can be sent to the core network device in one message, or in different messages.
  • the identifier and check value (or ciphertext information) of the first terminal sent by the core network device to the requesting party can be sent to the requesting party in one message, or in different messages.
  • the first terminal sends the identifier of the first terminal to the core network device, which can further improve security.
  • the access network device can send the random number to the first terminal during the random access process of the first terminal performed by the access network device; or the access network device can send the random number to the first terminal after determining that the random access of the first terminal is successful.
  • the identifier of the first terminal and the first random number sent by the first terminal to the core network device can be sent to the core network device in one message, or in different messages.
  • the identifier of the first terminal and the second check value (or second ciphertext information) sent by the first terminal to the core network device can be sent to the core network device in one message, or in different messages.
  • the first terminal verifies the first check value (or second ciphertext information) based on the first random number, the first terminal sends the identifier of the first terminal to the core network device, which can further improve security.
  • the identifier of the first terminal and the first random number sent by the core network device to the requesting party can be sent to the requesting party in one message, or in different messages.
  • the identifier of the first terminal and the second check value (or second ciphertext information) sent by the core network device to the requesting party can be sent to the requesting party in one message, or in different messages.
  • the authentication method corresponding to the first terminal is a one-way authentication of the first terminal to the first network corresponding to the core network device (refer to Figure 3d)
  • the first terminal's identifier and the first random number sent by the first terminal to the core network device can be sent to the core network device in one message or in different messages.
  • the first terminal After the first terminal passes the one-way authentication of the first network corresponding to the core network device (i.e., the first terminal passes the verification value ciphertext information based on the first random number), the first terminal sends the identifier of the first terminal to the core network device, which can further improve security.
  • the authentication method corresponding to the first terminal is a one-way authentication of the first terminal by the first network corresponding to the core network device (refer to Figure 3e)
  • the check value (or ciphertext information) and the identifier of the first terminal sent by the first terminal to the core network device can be sent to the core network device in one message, or in different messages.
  • the first network corresponding to the core network device After the first network corresponding to the core network device performs one-way authentication on the first terminal (that is, the core network device verifies the check value or ciphertext information based on a random number), the first terminal sends the identifier of the first terminal to the core network device, which can further improve security.
  • sending a random number to the first terminal can be that the access network device sends the random number to the first terminal during the random access process of the first terminal performed by the access network device; or the access network device sends the random number to the first terminal after determining that the random access of the first terminal is successful.
  • the first random number sent by the first terminal to the core network device and the identifier of the first terminal can be sent to the core network device in one message, or in different messages.
  • the second check value (or second ciphertext information) sent by the first terminal to the core network device and the identifier of the first terminal can be sent to the core network device in one message, or in different messages.
  • the first terminal After the first terminal passes the first check value or the first ciphertext information based on the first random number, the first terminal sends the identifier of the first terminal to the core network device, which can further improve security.
  • the core network device can also perform the first operation on the first terminal after obtaining the identifier of the first terminal, executing the process corresponding to the authentication method corresponding to the first terminal and determining that the authentication is successful.
  • the first terminal may be pre-configured with an authentication method or may not be pre-configured with an authentication method.
  • the core network device may obtain the authentication method corresponding to the first terminal, and then send the authentication method information to the first terminal.
  • the authentication method information is used to indicate the authentication method corresponding to the first terminal.
  • the core network device may also send the authentication method information to the first terminal. The first terminal knows that it is After selecting the corresponding authentication method, the authentication process corresponding to the authentication method can be executed.
  • the information of the authentication method may display the authentication method corresponding to the first terminal.
  • the authentication method corresponding to the first terminal is indicated by the value of the bit.
  • the authentication method corresponding to the first terminal is indicated by the value of 3 bits or even more bits.
  • the value of 3bit when the value of 3bit is 000, it means that no authentication is performed; when the value of 3bit is 001, it indicates the two-way authentication between the first terminal and the requester; when the value of 3bit is 010, it indicates the two-way authentication between the first terminal and the first network corresponding to the core network device; when the value of 3bit is 011, it indicates the one-way authentication of the first terminal by the requester; when the value of 3bit is 100, it indicates the one-way authentication of the first terminal by the first terminal to the requester; when the value of 3bit is 101, it indicates the one-way authentication of the first terminal by the first network corresponding to the core network device; when the value of 3bit is 110, it indicates the one-way authentication performed by the first terminal on the first network corresponding to the core network device.
  • the meanings represented by the above bit values are only examples and should not limit the scheme.
  • the core network device when the first terminal is not configured with an authentication method and the core network device does not send information about the authentication method to the first terminal, it may indicate that authentication is not performed.
  • the authentication method information may be a random number, indicating that the authentication method is a one-way authentication of the first terminal by the requesting party or a one-way authentication of the first terminal by the first network corresponding to the core network device.
  • the first terminal obtains a check value or ciphertext information based on the random number, and sends the check value or ciphertext information to the core network device.
  • the process of the core network device sending the authentication method information to the first terminal includes: the core network device first sends the authentication method information corresponding to the first terminal to the access network device, and during the process of the access network device performing random access on the first terminal or after the first terminal successfully performs random access, the access network device sends the authentication method information to the first terminal.
  • the access network device can broadcast the authentication method information.
  • a specific communication process diagram is introduced. This communication process is applicable to a scenario in which an authentication method is pre-configured in the first terminal and authentication is performed between the first terminal and the requesting party.
  • the access network device is RAN
  • the core network device is AMF
  • the requesting party is AF.
  • AMF and AF can communicate directly or through other core network devices (such as NEF, SMF, UPF, etc.).
  • Step 400 Initialize the first terminal.
  • the initialization process can be understood as an enterprise or a user (requester) printing (pre-configuring or writing initial data) on the first terminal.
  • the initialization process includes: configuring (or writing) the identifier of the first terminal and the authentication method corresponding to the first terminal in the first terminal.
  • the authentication method corresponding to the first terminal may be a two-way authentication between the first terminal and the AF, or a one-way authentication of the AF to the first terminal, or a one-way authentication of the first terminal to the AF, or no authentication is performed.
  • the authentication method is implemented by setting a flag bit in the first terminal, for example, setting a flag bit of two or more bits, for example, 00 indicates that no authentication is performed, 01 indicates a one-way authentication of the first terminal to the AF; 10 indicates a one-way authentication of the AF to the first terminal; 11 indicates a two-way authentication of the first terminal and the AF.
  • the meaning represented by the value of the bit is only an example and should not limit the scheme.
  • the two-way authentication between the first terminal and the AF can be understood as the two-way authentication between the first terminal and the AAA server;
  • the one-way authentication of the AF to the first terminal can be understood as the one-way authentication of the AAA server to the first terminal;
  • the one-way authentication of the first terminal to the AF can be understood as the one-way authentication of the first terminal to the AAA server.
  • the AF can be used to forward messages that the AAA server interacts with other network elements/devices or as an agent of the AAA server. This application does not limit how the AF interacts with the AAA server.
  • the initialization process may further include: configuring (or writing) one or more of the following in the first terminal: security key, random number, security algorithm, NAS security policy, AS security policy.
  • security key random number, security algorithm, NAS security policy, AS security policy.
  • the authentication mode, security key, random number, security algorithm, NAS security policy, AS security policy, etc. corresponding to the first terminal can be regarded as security parameters.
  • the NAS security policy may include encryption protection and/or integrity protection;
  • the AS security policy may include encryption protection and/or integrity protection.
  • the random number can be used as a parameter for performing authentication in the authentication process, for example, in the one-way authentication of the first terminal to the AF, or in the two-way authentication of the first terminal and the AF, the first terminal sends a random number.
  • the security key can be used to obtain a check value or ciphertext information in the process corresponding to the security authentication, or the security key is used to decrypt the check value or ciphertext information to obtain plaintext information (such as a random number).
  • the NAS security policy can be used to determine whether it is necessary to perform encryption and/or integrity protection at the NAS layer, and the AS security policy can be used to determine whether it is necessary to perform encryption and/or integrity protection at the AS layer.
  • the first terminal may update the pre-configured information, for example, update the pre-configured authentication method.
  • Step 401 AF sends first information to AMF, where the first information is used to indicate a first terminal.
  • AMF receives the first information from AF.
  • step 201 When the first information indicates the first terminal, one or more methods may be used. For details, please refer to the introduction of step 201, which will not be repeated here.
  • the first information may be used to indicate that a first operation is performed on the first terminal.
  • the first information includes information about the first operation, and the first operation is indicated by the information about the first operation.
  • the first information also includes an operation parameter corresponding to the first operation. For details, please refer to the introduction in step 201, and no further description will be given.
  • the AF indicates to the AMF the authentication method corresponding to the first terminal.
  • the AF indicates to the AMF the authentication method corresponding to the first terminal through a first message.
  • the first message is also used to indicate the authentication method corresponding to the first terminal.
  • the AF may also indicate to the AMF the authentication method corresponding to the first terminal through other information different from the first message.
  • the authentication method corresponding to the first terminal indicated by the AF to the AMF is the same as the authentication method pre-configured in the first terminal during the initialization process of step 400.
  • the authentication method corresponding to the first terminal is a two-way authentication between the first terminal and the AF, or a one-way authentication of the AF to the first terminal, or a one-way authentication of the first terminal to the AF, or no authentication is performed.
  • the AF may also send a random number to the AMF, and the random number is used in the authentication process as a parameter for performing authentication.
  • the AF sends the random number to the first terminal through the AMF.
  • the first information includes the random number.
  • the security policy of the first terminal sent by the AF to the AMF includes an authentication method and/or a random number corresponding to the first terminal.
  • the security policy may be included in the first information, or other information different from the first information.
  • Step 402 The AMF instructs the RAN to perform a random access procedure for the first terminal.
  • the AMF and RAN can interact through N2 messages.
  • Step 403 The RAN performs a random access process of the first terminal according to the instruction of the AMF.
  • the RAN initiates random access signaling to the first terminal, and the first terminal performs random access.
  • Step 404 After the first terminal successfully accesses randomly, the first terminal determines the parameter information to be sent to the AMF according to the configuration information in the initialization process.
  • the process in which the first terminal determines the parameter information to be sent to the AMF based on the configuration information in the initialization process includes: the first terminal determines whether to send a random number to the AMF based on a pre-configured authentication method.
  • the authentication method is a one-way authentication of the first terminal to the AF or a two-way authentication of the first terminal and the AF
  • the first terminal needs to send a random number to the AMF.
  • the authentication method is a one-way authentication of the AF to the first terminal or no authentication is performed, the first terminal does not need to send a random number to the AMF.
  • the random number sent by the first terminal to the AMF may be randomly generated by the first terminal or may be pre-configured in the first terminal.
  • Step 405 After the first terminal successfully performs random access, the first terminal sends a registration request message to the AMF through the RAN, where the registration request message includes the identifier of the first terminal.
  • the AMF receives a registration request message from the first terminal.
  • the registration request message also includes the random number.
  • the registration request message can be replaced by an access message, an access request message, or a request message for accessing a network, or a request message for registering a network.
  • This application does not limit the name of the message.
  • the identifier and random number of the first terminal can also be sent to the AMF in different messages.
  • the example of sending the identifier and random number of the first terminal to the AMF in the same registration request message is used as an example.
  • Step 406 AMF obtains the authentication method corresponding to the first terminal.
  • the process of AMF obtaining the authentication method corresponding to the first terminal can refer to the process of the core network device obtaining the authentication method corresponding to the first terminal introduced in step 202, and will not be repeated.
  • AMF does not need to execute the process corresponding to the authentication method; in another possible implementation, AMF can also make further judgments based on the location of the first terminal to determine the final authentication method of the first terminal.
  • the process of AMF making further judgments based on the location of the first terminal to determine the final authentication method of the first terminal can refer to the process of the core network device making further decisions based on the location of the first terminal to determine the final authentication method of the first terminal as described above, and will not be repeated.
  • step 405 and step 406 are not limited.
  • Step 407 If authentication is required, the AMF executes the process corresponding to the authentication method corresponding to the first terminal.
  • the interaction message between the AF and the first terminal may be transmitted through the RAN and/or core network equipment.
  • the process of one-way authentication of the first terminal to the AF can refer to the introduction of Figure 3a
  • the process of one-way authentication of the AF to the first terminal can refer to the introduction of Figure 3b
  • the process of two-way authentication between the first terminal and the AF can refer to the introduction of Figure 3c.
  • step 405 and step 407 are not limited.
  • Step 408 AMF sends the information of the first terminal to AF.
  • the information of the first terminal includes an identifier of the first terminal.
  • the information of the first terminal includes the identifier of the first terminal and/or a random number.
  • the information of the first terminal includes one or more of the following: the identification of the first terminal, a random number, and a check value (or ciphertext information).
  • the information of the first terminal includes one or more of the following: the identification of the first terminal, the first random number, and the second check value (or the second ciphertext information).
  • step 408 There is no restriction on the order of step 408, step 406 and step 407.
  • Step 409 AF sends authentication success information and/or reception success information to AMF.
  • AMF receives authentication success information or reception success information from AF.
  • the successful reception refers to the successful reception of information by the first terminal.
  • the information of the first terminal includes the identifier of the first terminal. That is, after receiving the identifier of the first terminal, the AF feeds back the information of successful reception to the AMF.
  • the information of the first terminal includes the identifier and/or random number of the first terminal.
  • the AF can send a successful reception message to the AMF.
  • the AF sends a successful reception message to the AMF.
  • the successful reception message includes a check value (or ciphertext information) obtained by the AF based on the random number.
  • the information of the first terminal includes one or more of the following: the identification of the first terminal, a random number, and a check value (or ciphertext information).
  • AF sends a successful reception message to AMF; or, after the check value (or ciphertext information) is verified based on the random number, AF sends a successful authentication message to AMF.
  • the successful reception information and the successful authentication information can be sent to AMF in one message or in different messages.
  • the information of the first terminal includes one or more of the following: the identifier of the first terminal, the first random number, and the second check value (or ciphertext information).
  • AF sends a successful reception message to AMF; or, after verifying that the second check value (or second ciphertext information) is passed, AF sends a successful authentication message to AMF.
  • the successful reception information and the successful authentication information can be sent to AMF in one message or in different messages.
  • Step 410 The AMF sends a registration acceptance message to the first terminal.
  • the first terminal receives a registration acceptance message of the first terminal from the AMF.
  • the registration acceptance message means that the first terminal has successfully accessed.
  • the registration acceptance message can be replaced by an indication of successful access of the first terminal, an access success message, or a response message for successful access to the network, or a response message for successful registration on the network. This application does not limit the name of the message.
  • the AMF after receiving the authentication success information from the first terminal, the AMF sends a registration acceptance message to the first terminal.
  • This method can be applicable to the scenario where the first terminal performs one-way authentication on the requester as the authentication method.
  • the AMF after receiving the successful reception information from the AF, the AMF sends a registration acceptance message to the first terminal.
  • This method can be applicable to the scenario of one-way authentication of the requester by the first terminal.
  • the AMF after receiving the authentication success information from the AF, the AMF sends a registration acceptance message to the first terminal.
  • This method can be applicable to the scenario of one-way authentication of the first terminal by the requester, or two-way authentication between the first terminal and the requester.
  • the AMF when the authentication mode corresponding to the first terminal is not to perform authentication, after receiving the registration request message sent by the first terminal (refer to step 405), the AMF can skip the above steps 407, 408, and 409 and directly execute step 410.
  • the AMF determines that there is no need to perform the authentication process, the AMF immediately feeds back a registration acceptance message to the first terminal after receiving the registration request message, so that the first terminal can quickly access the core network, reduce signaling interaction and delay overhead, improve the inventory efficiency of the first terminal, and reduce the power consumption overhead of the first terminal.
  • the AMF when the authentication mode corresponding to the first terminal is not to perform authentication, the AMF receives the first terminal sending After receiving the registration request message (refer to step 405), the above steps 407, 408, 409 and 410 can be skipped.
  • the AMF determines that there is no need to perform the authentication process, the AMF does not need to send a message to the first terminal after receiving the registration request message.
  • the access network device can continue to execute the random access process of the next terminal after forwarding the message of step 405 to the AMF.
  • the AMF can instruct the access network device to execute the random access process of the next terminal after receiving the registration request message, without sending a message to the first terminal.
  • the specific communication process has many similarities with the communication process described in FIG. 4 , and the differences from the communication process described in FIG. 4 include:
  • the initialization process (refer to the description of step 400) does not include configuring the authentication method in the first terminal.
  • the authentication method corresponding to the first terminal indicated by the AF to the AMF does not need to be the same as the authentication method pre-configured in the first terminal during the initialization process.
  • the AF can indicate the authentication method corresponding to the first terminal to the AMF on demand or dynamically. For the same terminal, the authentication methods indicated by the AF at different times can be the same or different.
  • the first terminal After the first terminal successfully accesses the random access (refer to step 404), the first terminal cannot determine whether to send a random number to the AMF according to the authentication method.
  • One alternative is that if a random number is pre-configured in the first terminal, the first terminal determines to send a random number to the AMF. If the random number is not configured, the random number is not sent to the AMF.
  • the AMF or RAN indicates to the first terminal whether a random number needs to be sent. For example, the AMF or RAN sends information about the authentication method corresponding to the first terminal to the first terminal. The first terminal can determine its own corresponding authentication method through the information about the authentication method of the first terminal, thereby deciding whether to send a random number.
  • the first terminal needs to send a random number.
  • the authentication method is a one-way authentication of the AF to the first terminal or no authentication is performed, the first terminal does not need to send a random number.
  • the random number sent by the first terminal can be randomly generated by the first terminal or pre-configured in the first terminal.
  • a specific communication process diagram is introduced. This communication process is applicable to the scenario in which an authentication method is pre-configured in the first terminal, and authentication is performed between the first terminal and the first network corresponding to the core network device.
  • the access network device is RAN
  • the core network device is AMF
  • the requesting party is AF.
  • AMF and AF can communicate directly or through other core network devices (such as NEF, SMF, UPF, etc.).
  • AMF and UDM can communicate directly or through other core network devices (such as NEF, SMF, UPF, etc.).
  • Step 500a Initialize the first terminal.
  • the initialization process can be understood as an enterprise or a user (requester) printing (pre-configuring or writing initial data) on the first terminal.
  • the initialization process includes: configuring (or writing) the identifier of the first terminal and the authentication method corresponding to the first terminal in the first terminal.
  • the authentication method corresponding to the first terminal may be a two-way authentication between the first terminal and the first network, or a one-way authentication of the first network to the first terminal, or a one-way authentication of the first terminal to the first network, or no authentication is performed.
  • the authentication method is implemented by setting an identification bit in the first terminal, such as setting a flag bit of two bits or more bits, for example, 00 indicates that no authentication is performed, 01 indicates a one-way authentication of the first terminal to the first network; 10 indicates a one-way authentication of the first network to the first terminal; 11 indicates a two-way authentication of the first terminal and the first network.
  • the meaning represented by the bit value is only an example and should not limit the scheme.
  • the initialization process may further include: configuring (or writing) one or more of the following in the first terminal: security key, random number, security algorithm, NAS security policy, AS security policy.
  • security key random number, security algorithm, NAS security policy, AS security policy.
  • the authentication method, security key, random number, security algorithm, NAS security policy, AS security policy, etc. corresponding to the first terminal can be regarded as security parameters.
  • the NAS security policy may include encryption protection and/or integrity protection;
  • the AS security policy may include encryption protection and/or integrity protection.
  • the random number can be used as a parameter for performing authentication in the authentication process to be used in the authentication method corresponding to the first terminal. For example, in the one-way authentication of the first terminal to the first network, or in the two-way authentication of the first terminal and the first network, the first terminal sends a random number to the AMF.
  • the security key can be used to obtain a check value or ciphertext information in the process corresponding to the security authentication, or the security key can be used to decrypt the check value or ciphertext information to obtain plaintext information (such as a random number).
  • the NAS security policy can be used to determine whether it is necessary to perform encryption and/or integrity protection at the NAS layer, and the AS security policy can be used to determine whether it is necessary to perform encryption and/or integrity protection at the AS layer.
  • the first terminal may update the pre-configured information, for example, update the pre-configured authentication method.
  • Step 500b The AF indicates the authentication method corresponding to the first terminal to the UDM.
  • the authentication method corresponding to the first terminal indicated by the AF to the UDM may be the same as the authentication method pre-configured in the first terminal, for example, bidirectional authentication between the first terminal and the first network, or unidirectional authentication of the first network to the first terminal, or unidirectional authentication of the first terminal to the first network, or no authentication is performed.
  • the AF indicates to the UDM the authentication method corresponding to the first terminal, including: the AF sends the identifier of the first terminal and the authentication method corresponding to the first terminal to the UDM.
  • the AF indicates to the UDM the authentication method corresponding to the first terminal, including: the AF sends the terminal identification range and the authentication method corresponding to the terminal identification range to the UDM; wherein the terminal identification range includes the identification of the first terminal.
  • the authentication method corresponding to the terminal identification range can be understood as for any terminal in the identification range whose identification belongs to the terminal, the corresponding authentication method is the authentication method corresponding to the identification range of the terminal.
  • the AF indicates to the UDM the authentication method corresponding to the first terminal, including: the AF sends the AF information and the authentication method to the UDM; wherein the AF information can be used to indicate the AF corresponding to (or managed by) or the terminal identification range or the identification of one or more terminals.
  • the AF corresponding to (or managed by) or the terminal identification range or the identification of one or more terminals includes the identification of the first terminal.
  • the AF information can be referred to the previous introduction and will not be repeated.
  • AF indicates the authentication method corresponding to the first terminal to UDM
  • it can be indicated by two bits or even more bits. For example, 00 means no authentication is performed, 01 means one-way authentication of the first terminal to the first network; 10 means one-way authentication of the first network to the first terminal; 11 means two-way authentication between the first terminal and the first network.
  • the meaning represented by the bit value is only an example and should not limit the scheme.
  • AF does not indicate the authentication method corresponding to the first terminal to UDM, it can be understood that the authentication method corresponding to the first terminal is not to perform authentication.
  • the AF also sends one or more of the following to the UDM: a random number, a security key.
  • the random number can be used as a parameter for performing authentication in the authentication process.
  • the core network device needs to send a random number to the first terminal.
  • the security key can be used to obtain a check value or ciphertext information in the process corresponding to the security authentication, or use the security key to decrypt the check value or ciphertext information to obtain plaintext information (such as a random number).
  • the authentication method and random number corresponding to the first terminal may be included in the security policy information corresponding to the first terminal, that is, the AF sends the security policy information corresponding to the first terminal to the UDM, and the security policy information includes the authentication method and/or random number corresponding to the first terminal.
  • the authentication method, random number, security key, etc. corresponding to the first terminal may be stored in the context information of the first terminal, the policy information of the first terminal, the service configuration of the first terminal, or the subscription data of the first terminal.
  • the core network device may not need to interact with the requesting party, which can further save signaling overhead, improve the access, registration or communication efficiency of the first terminal, and reduce the power consumption overhead of the first terminal.
  • the AF and the UDM may communicate directly or through the NEF or other network elements.
  • Step 500b is an optional step and may not be performed.
  • Step 501 AF sends first information to AMF, where the first information is used to indicate a first terminal.
  • AMF receives the first information from AF.
  • step 201 When the first information indicates the first terminal, one or more methods may be used. For details, please refer to the introduction of step 201, which will not be repeated here.
  • the first information may be used to indicate that a first operation is performed on the first terminal.
  • the first information includes information about the first operation, and the first operation is indicated by the information about the first operation.
  • the first information also includes an operation parameter corresponding to the first operation. For details, please refer to the introduction in step 201, and no further description will be given.
  • AF indicates to AMF the authentication method corresponding to the first terminal, which may be applicable to the scenario where step 500b is not performed.
  • AF indicates to AMF the authentication method corresponding to the first terminal through a first message.
  • the first message is also used to indicate the authentication method corresponding to the first terminal.
  • AF may also indicate to AMF the authentication method corresponding to the first terminal through other information different from the first message.
  • the authentication method corresponding to the first terminal indicated by AF to AMF is the same as the authentication method pre-configured in the first terminal during the initialization process of step 500a.
  • the authenticator corresponding to the first terminal may be a two-way authentication between the first terminal and the first network, or a one-way authentication of the first network to the first terminal, or a one-way authentication of the first terminal to the first network, or no authentication is performed.
  • the AF may also send a random number to the AMF, and the random number is used in the authentication process as a parameter for performing authentication.
  • the AF sends a random number to the first terminal through the AMF.
  • the first information includes the random number.
  • the authentication method and/or the random number corresponding to the first terminal is included in the security policy corresponding to the first terminal.
  • the security policy may be included in the first information or other information different from the first information.
  • the AF may also send a security key to the AMF.
  • the security key may be used to obtain a check value or ciphertext information in a process corresponding to security authentication, or to decrypt the check value or ciphertext information using the security key to obtain plaintext information (such as a random number).
  • the security key may be included in the first information, or other information different from the first information.
  • the AF and AMF can communicate directly or through the NEF or other network elements.
  • Step 502 The AMF instructs the RAN to perform a random access procedure for the first terminal.
  • the AMF and RAN can interact through N2 messages.
  • Step 503 The RAN performs a random access process of the first terminal according to the instruction of the AMF.
  • the RAN initiates random access signaling to the first terminal, and the first terminal performs random access.
  • Step 504 After the first terminal successfully accesses randomly, the first terminal determines the parameter information to be sent to the AMF according to the configuration information in the initialization process.
  • the process in which the first terminal determines the parameter information to be sent to the AMF based on the configuration information in the initialization process includes: the first terminal determines whether to send a random number to the AMF based on a pre-configured authentication method.
  • the authentication method is a one-way authentication of the first terminal to the first network or a two-way authentication of the first terminal and the first network
  • the first terminal needs to send a random number to the AMF.
  • the authentication method is a one-way authentication of the first network to the first terminal or no authentication is performed, the first terminal does not need to send a random number to the AMF.
  • the random number sent by the first terminal to the AMF may be randomly generated by the first terminal or may be pre-configured in the first terminal.
  • Step 505 After the first terminal successfully performs random access, the first terminal sends a registration request message to the AMF through the RAN, where the registration request message includes the identifier of the first terminal.
  • the AMF receives a registration request message from the first terminal.
  • the registration request message also includes the random number.
  • the registration request message can be replaced by an access message, an access request message, or a request message for accessing a network, or a request message for registering a network.
  • This application does not limit the name of the message.
  • the identifier and random number of the first terminal can also be sent to the AMF in different messages.
  • the example of sending the identifier and random number of the first terminal to the AMF in the same registration request message is used as an example.
  • Step 506 AMF obtains the authentication method corresponding to the first terminal.
  • the process of AMF obtaining the authentication method corresponding to the first terminal can refer to the process of the core network device obtaining the authentication method corresponding to the first terminal introduced in step 202.
  • step 500b if step 500b is executed, and the AF indicates the authentication method corresponding to the first terminal to the UDM, the AMF can obtain the context information of the first terminal, the policy information of the first terminal, the service configuration of the first terminal, or the contract data of the first terminal from the UDM based on the identifier of the first terminal or the AF identifier information, and obtain the authentication method corresponding to the first terminal from the context information of the first terminal or the contract data of the first terminal.
  • the AF does not indicate the authentication method corresponding to the first terminal to the UDM, it can be understood that the authentication method corresponding to the first terminal is not to perform authentication.
  • the AMF may obtain the authentication method corresponding to the first terminal based on the instruction of the AF, for example, the first information includes the authentication method corresponding to the first terminal, and the AMF obtains the authentication method corresponding to the first terminal based on the first information. Specifically, the AMF may obtain the authentication method corresponding to the first terminal from the security policy information corresponding to the first terminal included in the first information.
  • AMF does not need to execute the process corresponding to the authentication method; in another possible implementation, AMF can make further judgments based on the location of the first terminal to determine the final authentication method of the first terminal.
  • the process of AMF making further judgments based on the location of the first terminal to determine the final authentication method of the first terminal can refer to the process of the core network device making further decisions based on the location of the first terminal to determine the final authentication method of the first terminal as described above, and will not be repeated.
  • step 505 and step 506 are not limited.
  • Step 507 If authentication is required, the AMF executes the process corresponding to the authentication method corresponding to the first terminal.
  • the interaction message between the AF and the first terminal may be transmitted through the RAN and/or core network equipment.
  • the process of unidirectional authentication of the first terminal to the first network can refer to the introduction of Figure 3d
  • the process of unidirectional authentication of the first network to the first terminal can refer to the introduction of Figure 3e
  • the process of bidirectional authentication between the first terminal and the first network can refer to the introduction of Figure 3f.
  • step 505 and step 507 are not limited.
  • Step 508 AMF sends the information of the first terminal to AF.
  • step 508 step 506 and step 507.
  • the information of the first terminal includes an identifier of the first terminal.
  • the information of the first terminal includes the identifier of the first terminal and/or the first random number.
  • the information of the first terminal includes one or more of the following: the identification of the first terminal, a random number, and a check value (or ciphertext information).
  • the information of the first terminal includes one or more of the following: the identification of the first terminal, the first random number, and the second check value (or the second ciphertext information).
  • Step 509 AF sends a successful reception message to AMF.
  • AMF receives successful reception information from AF.
  • the successful reception refers to the successful reception of information by the first terminal.
  • Step 510 The AMF sends a registration acceptance message to the first terminal.
  • the first terminal receives a registration acceptance message of the first terminal from the AMF.
  • the meaning of the registration acceptance message is that the first terminal has successfully accessed.
  • the registration acceptance message can be replaced by an indication message of successful access of the first terminal, or an access success message, or a response message for successful access to the network, or a response message for successful registration on the network. This application does not limit the name of the message.
  • the AMF after receiving the authentication success information from the first terminal, the AMF sends a registration acceptance message to the first terminal.
  • This method can be applicable to the scenario where the first terminal performs one-way authentication on the first network as the authentication method.
  • the AMF after the AMF generates a check value (or ciphertext information) based on a random number, it sends a registration acceptance message to the first terminal, including the check value (or ciphertext information).
  • This method can be applicable to the scenario of one-way authentication of the first terminal to the first network.
  • the AMF after determining that the authentication is successful, sends a registration acceptance message to the first terminal.
  • This method can be applicable to the scenario of one-way authentication of the first terminal to the first terminal, or two-way authentication of the first terminal to the first terminal.
  • the AMF when the authentication mode corresponding to the first terminal is not to perform authentication, after receiving the registration request message sent by the first terminal (refer to step 505), the AMF can skip the above steps 507, 508, and 509 and directly execute step 510.
  • the AMF determines that there is no need to perform the authentication process, the AMF immediately feeds back a registration acceptance message to the first terminal after receiving the registration request message, so that the first terminal can quickly access the core network, reduce signaling interaction and delay overhead, improve the inventory efficiency of the first terminal, and reduce the power consumption overhead of the first terminal.
  • the AMF when the authentication method corresponding to the first terminal is not to perform authentication, after receiving the registration request message sent by the first terminal (refer to step 505), the AMF can skip the above steps 507, 508, 509 and 510.
  • the AMF determines that there is no need to perform the authentication process, the AMF does not need to send a message to the first terminal after receiving the registration request message.
  • the access network device can continue to execute the random access process of the next terminal after forwarding the message of step 405 to the AMF.
  • the AMF can instruct the access network device to execute the random access process of the next terminal after receiving the registration request message, without sending a message to the first terminal.
  • the specific communication process has many similarities with the communication process described in FIG. 5 , and the differences from the communication process described in FIG. 5 include:
  • the initialization process (refer to the description of step 500) does not include configuring the authentication method in the first terminal.
  • the authentication method corresponding to the first terminal indicated by the AF to the AMF does not need to be the same as the authentication method pre-configured in the first terminal during the initialization process.
  • the AF can indicate the authentication method corresponding to the first terminal to the AMF on demand or dynamically. For the same terminal, the authentication methods indicated by the AF at different times can be the same or different.
  • the first terminal After the first terminal successfully accesses the random access (refer to step 504), the first terminal cannot determine whether to send a random number to the AMF according to the authentication method.
  • One alternative method is that if a random number is pre-configured in the first terminal, the first terminal determines to send a random number to the AMF. If the random number is not configured, the random number is not sent.
  • Another alternative method is that the AMF or RAN indicates to the first terminal whether a random number needs to be sent. For example, the AMF or RAN sends information about the authentication method corresponding to the first terminal to the first terminal. The first terminal can determine its own corresponding authentication method through the information about the authentication method of the first terminal, thereby deciding whether to send a random number.
  • the first terminal when the authentication method is a one-way authentication of the first terminal to the first network or a two-way authentication of the first terminal and the first network, the first terminal needs to send a random number. For example, when the authentication method is a one-way authentication of the first network to the first terminal or no authentication is performed, the first terminal does not need to send a random number.
  • the random number sent by the first terminal can be randomly generated by the first terminal or pre-configured in the first terminal.
  • This communication process can be applicable to the one-way authentication of the requesting party to the first terminal or the one-way authentication of the first network to the first terminal.
  • the authentication method can be pre-configured in the first terminal or not.
  • the access network device is RAN
  • the core network device is AMF
  • the requesting party is AF.
  • AMF and AF can communicate directly or through other core network devices (such as NEF, SMF, UPF, etc.).
  • AMF and UDM can communicate directly or through other core network devices (such as NEF, SMF, UPF, etc.).
  • Step 600a Initialize the first terminal.
  • the initialization process can be understood as an enterprise or a user (requester) printing (pre-configuring or writing initial data) on the first terminal.
  • the initialization process includes: configuring (or writing) the identifier of the first terminal in the first terminal.
  • the initialization process may further include: configuring or writing one or more of the following security parameters in the first terminal: an authentication method, a security key, a random number, a security algorithm, a NAS security policy, and an AS security policy corresponding to the first terminal.
  • the authentication method corresponding to the first terminal may be a one-way authentication of the first terminal by the AF, or a one-way authentication of the first terminal by the first network.
  • NAS security policy can include encryption protection and/or integrity protection
  • AS security policy can include encryption protection and/or integrity protection.
  • Security keys can be used to obtain verification values or ciphertext information in the process corresponding to security authentication, or use security keys to decrypt verification values or ciphertext information to obtain plaintext information (such as random numbers).
  • NAS security policy can be used to determine whether encryption and/or integrity protection of the NAS layer needs to be performed, and AS security policy can be used to determine whether encryption and/or integrity protection of the AS layer needs to be performed.
  • the first terminal may update the pre-configured information, for example, update the pre-configured authentication method.
  • Step 600b The AF indicates the authentication method corresponding to the first terminal to the UDM.
  • the authentication method corresponding to the first terminal indicated by the AF to the UDM is the same as the authentication method pre-configured in the first terminal.
  • the process of AF indicating the authentication method corresponding to the first terminal to UDM can refer to the introduction in step 500b.
  • the difference includes that in this example, the authentication method corresponding to the first terminal is a unidirectional authentication of the first terminal by the first network or the requesting party.
  • the remaining details can refer to step 500b.
  • Step 600b is an optional step and may not be performed.
  • Step 601 AF sends first information to AMF, where the first information is used to indicate a first terminal.
  • AMF receives the first information from AF.
  • step 201 When the first information indicates the first terminal, one or more methods may be used. For details, please refer to the introduction of step 201, which will not be repeated here.
  • the first information may be used to indicate that a first operation is performed on the first terminal.
  • the first information includes information about the first operation, and the first operation is indicated by the information about the first operation.
  • the first information also includes an operation parameter corresponding to the first operation. For details, please refer to the introduction in step 201, and no further description will be given.
  • AF indicates to AMF the authentication method corresponding to the first terminal, which may be applicable to the scenario where step 600b is not performed.
  • AF indicates to AMF the authentication method corresponding to the first terminal through the first information.
  • the first information is also used to indicate the authentication method corresponding to the first terminal.
  • AF may also indicate to AMF the authentication method corresponding to the first terminal through other information different from the first information. If the authentication method is configured in the first terminal during the initialization process of step 600a, the authentication method corresponding to the first terminal indicated by AF to AMF is the same as the authentication method pre-configured in the first terminal during the initialization process of step 600a.
  • the authentication method corresponding to the first terminal is a one-way authentication of the first terminal by the requesting party, or a one-way authentication of the first terminal by the first network.
  • the AF may also send a random number to the AMF, and the random number is used in the authentication process as a parameter for performing authentication.
  • the random number is used in the authentication process as a parameter for performing authentication.
  • a random number needs to be sent to the first terminal.
  • the first information includes the random number.
  • the authentication method and/or the random number corresponding to the first terminal is included in the security policy corresponding to the first terminal.
  • the security policy may be included in the first information or other information different from the first information.
  • the AF may also send a security key to the AMF.
  • the security key may be used to obtain a check value or ciphertext information in a process corresponding to security authentication, or to decrypt the check value or ciphertext information using the security key to obtain plaintext information (such as a random number).
  • the security key may be included in the first information, or other information different from the first information.
  • the AF and AMF can communicate directly or through the NEF or other network elements.
  • Step 602 The AMF instructs the RAN to perform a random access procedure for the first terminal.
  • the AMF and the RAN may interact via N2 messages.
  • the AMF may send a random number to the RAN.
  • the random number may be used to perform security authentication.
  • Step 603 The RAN performs a random access procedure of the first terminal according to the instruction of the AMF.
  • the AMF sends a random number to the RAN
  • the RAN may broadcast the random number.
  • the RAN initiates random access signaling to the first terminal, and the first terminal performs random access.
  • Step 604 After the first terminal successfully accesses randomly, the first terminal determines the parameter information to be sent to the AMF according to the configuration information in the initialization process.
  • the process in which the first terminal determines the parameter information to be sent to the AMF according to the configuration information in the initialization process includes the following:
  • the first terminal determines whether to send a random number to the AMF according to a pre-configured authentication method. For example, when the authentication method is a one-way authentication of the first terminal by the first network or the requesting party, the first terminal does not need to send a random number to the AMF.
  • the first terminal determines to send the random number to the AMF; if the random number is not configured, the first terminal does not send the random number to the AMF.
  • Another alternative manner is that the AMF or RAN indicates to the first terminal whether a random number needs to be sent to the AMF.
  • Step 605 After the first terminal successfully performs random access, the first terminal sends a registration request message to the AMF through the RAN, where the registration request message includes the identifier of the first terminal.
  • the AMF receives a registration request message from the first terminal.
  • the registration request message can be replaced by an access message, an access request message, or a request message for accessing a network, or a request message for registering a network.
  • This application does not limit the name of the message.
  • Step 606 AMF obtains the authentication method corresponding to the first terminal, that is, the one-way authentication of the first terminal by the first network or the one-way authentication of the first terminal by the requesting party.
  • the process of AMF obtaining the authentication method corresponding to the first terminal can refer to the process of the core network device obtaining the authentication method corresponding to the first terminal introduced in step 202.
  • step 600b if step 600b is executed, and the AF indicates the authentication method corresponding to the first terminal to the UDM, the AMF can obtain the context information of the first terminal, the policy information of the first terminal, the service configuration of the first terminal, or the contract data of the first terminal from the UDM based on the identifier of the first terminal or the AF identifier information, and obtain the authentication method corresponding to the first terminal from the context information of the first terminal or the contract data of the first terminal.
  • the AF does not indicate the authentication method corresponding to the first terminal to the UDM, it can be understood that the authentication method corresponding to the first terminal is not to perform authentication.
  • the AMF may obtain the authentication method corresponding to the first terminal based on the instruction of the AF, for example, the first information includes the authentication method corresponding to the first terminal, and the AMF obtains the authentication method corresponding to the first terminal based on the first information. Specifically, the AMF may obtain the authentication method corresponding to the first terminal from the security policy information corresponding to the first terminal included in the first information.
  • step 605 and step 606 are not limited.
  • Step 607 If authentication is required, the AMF executes the process corresponding to the authentication method corresponding to the first terminal.
  • the interaction message between the AF and the first terminal may be transmitted through the RAN and/or core network equipment.
  • the unidirectional authentication process of the AF to the first terminal can refer to the introduction of FIG. 3b
  • the unidirectional authentication process of the first network to the first terminal can refer to the introduction of FIG. 3e .
  • step 605 and step 607 are not limited.
  • step 607 includes the following steps:
  • Step 6071 AMF obtains the random number corresponding to the first terminal.
  • AMF obtains random numbers in the following ways:
  • Method 1 Receive the random number sent by AF.
  • Method 2 Obtain a random number from the first context information, first policy information, first service configuration, or first subscription data corresponding to the first terminal.
  • the first context information, first policy information, first service configuration, or first subscription data corresponding to the first terminal is usually stored in UDM, AUSF, NSSAAF, NEF, PCF, TMF, or UDR.
  • Mode 3 AMF generates a random number by itself. For example, when the message sent by AF to AMF does not include a random number, AMF generates a random number. For example, when the first context information, or the first policy information, or the first service configuration, or the first subscription data corresponding to the first terminal does not include a random number, AMF generates a random number. For example, AMF can determine to generate a random number based on the configuration information.
  • Step 6072 (same as step 32b1, step 32b2, and step 32e): AMF sends the random number to the first terminal. Correspondingly, The first terminal receives a random number from the AMF.
  • the random number is carried in a request message (e.g., an authentication request (Authentication Request) or an authentication request (Authorization Request)) sent by the AMF to the first terminal.
  • a request message e.g., an authentication request (Authentication Request) or an authentication request (Authorization Request)
  • the AMF sends the random number to the RAN, and the RAN broadcasts the random number.
  • step 6072 can be implemented by step 602 and step 603, and in this case, step 6072 does not require a separate message.
  • Step 6073 (same as step 33b1, step 33b2, and step 33e): the first terminal obtains a check value or ciphertext information based on the random number.
  • the process of obtaining the check value or ciphertext information includes: the first terminal obtains the check value or ciphertext information based on the random number and the preconfigured key.
  • the first terminal may perform an operation on the random number and the preconfigured key to obtain the check value.
  • the first terminal encrypts the random number using the preconfigured key to obtain the ciphertext information.
  • Step 6074 (similar to step 34b1, step 34b2, and step 34e): the first terminal sends the check value or ciphertext information to the AMF. If the first terminal obtains the random number through the broadcast message in step 603, the first terminal may include the check value or ciphertext information of the first terminal in the message of step 605. That is, step 6074 can be completed through step 605.
  • AMF receives the verification value or ciphertext information from the first terminal.
  • the check value or ciphertext information is carried in a response message (e.g., an authentication response (Authentication Response) or an authorization response (Authorization Response)) sent by the first terminal to the AMF.
  • a response message e.g., an authentication response (Authentication Response) or an authorization response (Authorization Response)
  • the first terminal sends the check value or ciphertext information to the AMF, it can also send the random number to the AMF.
  • the first terminal does not send the random number to the AMF, it can prevent eavesdroppers from monitoring the random number of the first terminal through the air interface, which can improve security and reliability.
  • Step 6075 If the first terminal does not send a random number in step 6074, the AMF obtains the random number corresponding to the first terminal obtained in step 6071.
  • steps 6076 to 6078 may be executed (refer to the introduction in FIG. 3 b ).
  • Step 6076 (similar to step 35b1 and step 35b2): AMF sends the verification value or ciphertext information to AF.
  • AF receives the check value or ciphertext information from AMF.
  • the AMF may also send a random number to the AF, such as a random number corresponding to the first terminal obtained by the AMF in step 6071 or a random number from the first terminal in step 6074.
  • AMF and AF communicate through NEF.
  • AMF may first send a random number and a check value (or ciphertext information) to NEF, and NEF then sends the random number (optional) and the check value (or ciphertext information) to AF.
  • the random number (optional) and the check value (or ciphertext information) may be carried in a request (e.g., an Authentication Request or an Authorization Request) message sent from AMF to NEF.
  • Step 6077 AF verifies the verification value or ciphertext information based on the random number.
  • step 6077 can refer to step 36b1 and step 36b2, which will not be repeated here.
  • Step 6078 AF sends authentication success or verification pass information to AMF.
  • AMF receives authentication success or verification pass information sent by AF.
  • the AMF and the AF communicate through the NEF.
  • the AF may first send information of successful authentication or verification to the NEF, and the NEF then sends the information of successful authentication or verification to the AF.
  • information about successful authentication or passed verification may be carried in a response message (such as an Authentication Response or Authorization Response) sent from NEF to AMF.
  • a response message such as an Authentication Response or Authorization Response
  • the random number of a terminal device is usually generated by the authenticator and sent to the terminal device.
  • the authenticator is AF
  • the AMF itself generates a random number for the first terminal and sends it to the terminal device. There is no need for AF to send the random number for the first terminal to AMF, which can save signaling overhead.
  • steps 6079 to 6081 can be executed (refer to the introduction in Figure 3e). Steps 6079 to 6081 are described using UDM to perform authentication as an example. This application does not limit the core network device that performs authentication, and can be a device with authentication function such as AUSF, NSSAAF, NEF, AAA server, etc.
  • Step 6079 (same as step 36e): AMF sends a check value or ciphertext information (optionally, also including a random number) to UDM.
  • UDM receives the check value or ciphertext information (optionally, also including a random number) from AMF.
  • the check value or ciphertext information may be carried in the AMF to UDM In the request (such as authentication request or authorization request) message sent.
  • Step 6080 (same as step 37e): UDM verifies the check value or ciphertext information based on the random number.
  • step 6080 can refer to step 37e and will not be repeated here.
  • Step 6081 UDM sends authentication success or verification pass information to AMF.
  • AMF receives authentication success or verification pass information sent by UDM.
  • the verification pass/authentication success information may be carried in a response message (e.g., an Authentication Response or an Authorization Response) sent by the UDM to the AMF.
  • a response message e.g., an Authentication Response or an Authorization Response
  • the random number of a terminal device is usually generated by the authenticator and sent to the terminal device.
  • the authenticator is the UDM, and the AMF itself generates a random number for the first terminal and sends it to the terminal device.
  • the UDM does not need to send the random number for the first terminal to the AMF, which can save signaling overhead.
  • Step 608 AMF sends the information of the first terminal to AF.
  • step 608 There is no restriction on the order of step 608, step 606 and step 607.
  • Step 609 The AMF sends a registration acceptance message to the first terminal.
  • the first terminal receives a registration acceptance message from the AMF.
  • step 609 and step 608 is not limited.
  • the meaning of the registration acceptance message is that the first terminal has successfully accessed.
  • the registration acceptance message can be replaced by an indication message of successful access of the first terminal, or an access success message, or a response message for successful access to the network, or a response message for successful registration on the network. This application does not limit the name of the message.
  • the above describes the method of the embodiment of the present application, and the following describes the device in the embodiment of the present application.
  • the method and the device are based on the same technical concept. Since the principles of the method and the device to solve the problem are similar, the implementation of the device and the method can refer to each other, and the repeated parts will not be repeated.
  • the embodiment of the present application can divide the functional modules of the device according to the above method example. For example, each function can be divided into each functional module, or two or more functions can be integrated into one module. These modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in the specific implementation.
  • a schematic diagram of the structure of a communication device 700 is provided, and the communication device 700 may include one or more of the following: a processing module 710, a receiving module 720a, a sending module 720b, and a storage module 730.
  • the processing module 710 may be connected to the storage module 730, the receiving module 720a, and the sending module 720b, respectively, and the storage module 730 may also be connected to the receiving module 720a and the sending module 720b.
  • the above-mentioned receiving module 720a and sending module 720b can also be integrated together and defined as a transceiver module.
  • the communication device 700 may be a core network device, or a chip or functional unit applied to a core network device.
  • the communication device 700 has any function of the core network device in the above method, for example, the communication device 700 can execute each step performed by the core network device in the method of Figures 2, 3a, 3b, 3c, 3d, 3e, 3f, 4, 5, and 6.
  • the receiving module 720a may execute the receiving action performed by the core network device in the above method embodiment.
  • the sending module 720b can execute the sending action performed by the core network device in the above method embodiment.
  • the processing module 710 may execute other actions except the sending action and the receiving action among the actions executed by the core network device in the above method embodiment.
  • the receiving module 720a is used to receive first information from a requesting party, where the first information is used to indicate a first terminal; the processing module 710 is used to obtain an authentication method corresponding to the first terminal and execute a process corresponding to the authentication method.
  • the processing module 710 is further used to obtain the identifier of the first terminal; and the sending module 720b is used to send the identifier of the first terminal to the requesting party.
  • the authentication method includes any one of the following: a two-way authentication method and a one-way authentication method.
  • the two-way authentication method includes any one of the following: two-way authentication between the first terminal and the requesting party, and two-way authentication between the first terminal and a first network corresponding to the core network device.
  • the one-way authentication method includes any one of the following: one-way authentication performed by the requester on the first terminal, one-way authentication performed by the first network corresponding to the core network device on the first terminal, one-way authentication performed by the first terminal on the requester To authenticate, the first terminal performs unidirectional authentication on the first network corresponding to the core network device.
  • the receiving module 720a is also used to receive a random number from the first terminal; the sending module 720b is also used to send the random number to the requesting party; the receiving module 720a is also used to receive a verification value or ciphertext information from the requesting party; the sending module 720b is also used to send the verification value or the ciphertext information to the first terminal.
  • the receiving module 720a is also used to receive a random number from the requesting party; the sending module 720b is also used to send the random number to the first terminal; the receiving module 720a is also used to receive a verification value or ciphertext information from the first terminal; the sending module 720b is also used to send the verification value or the ciphertext information to the requesting party.
  • the processing module 710 is also used to obtain a random number; the sending module 720b is also used to send the random number to the first terminal; the receiving module 720a is also used to receive a verification value or ciphertext information from the first terminal; the sending module 720b is also used to send the random number to the requesting party, and send the verification value or the ciphertext information to the requesting party.
  • the receiving module 720a is also used to receive a random number from the first terminal; the sending module 720b sends the random number to the requesting party; the receiving module 720a is also used to receive a first verification value or a first ciphertext information from the requesting party; the sending module 720b is also used to send the first verification value or the first ciphertext information to the first terminal; the receiving module 720a is also used to receive a second verification value or a second ciphertext information from the first terminal; the sending module 720b is also used to send the second verification value or the second ciphertext information to the requesting party.
  • the receiving module 720a is also used to receive a first random number from the first terminal; the processing module 710 is also used to obtain a second random number, and obtain a verification value or ciphertext information based on the first random and the second random numbers; the sending module 720b is also used to send the verification value or the ciphertext information to the first terminal.
  • the receiving module 720a is also used to receive a first random number from the first terminal; the processing module 710 is also used to obtain a verification value or ciphertext information based on the first random number; the sending module 720b is also used to send the verification value or the ciphertext information to the first terminal.
  • the processing module 710 when the authentication method is a one-way authentication performed by the first network corresponding to the core network device on the first terminal, the processing module 710 is also used to obtain a random number; the sending module 720b is also used to send the random number to the first terminal; the receiving module 720a is also used to receive a verification value or ciphertext information from the first terminal; the processing module 710 is also used to verify the verification value or the ciphertext information based on the random number.
  • the processing module 710 is also used to obtain a random number; the sending module 720b is also used to send the random number to the first terminal; the receiving module 720a is also used to receive a verification value or ciphertext information from the first terminal; the sending module 720b is also used to send the random number to other core network devices, and to send the verification value or the ciphertext information to other core network devices, so that the other core network devices verify the verification value or the ciphertext information based on the random number.
  • the receiving module 720a is also used to receive a first random number from the first terminal; the processing module 710 is also used to obtain a second random number, and obtain a first verification value or a first ciphertext information based on the first random number and the second random number; the sending module 720b is also used to send the first verification value or the first ciphertext information to the first terminal; the receiving module 720a is also used to receive a second verification value or a second ciphertext information from the first terminal; the processing module 710 is also used to verify the second verification value or the second ciphertext information based on the second random number.
  • the receiving module 720a is also used to receive a first random number from the first terminal; the processing module 710 is also used to obtain a first verification value or a first ciphertext information based on the first random number; the sending module 720b is also used to send the first verification value or the first ciphertext information to the first terminal, and send a second random number to the first terminal; the receiving module 720a is also used to receive a second verification value or a second ciphertext information from the first terminal; the processing module 710 is also used to verify the second verification value or the second ciphertext information based on the second random number.
  • the first information is also used to indicate the authentication method corresponding to the first terminal; the processing module 710 is specifically used to obtain the authentication method corresponding to the first terminal according to the first information.
  • the processing module 710 is specifically used to obtain first context information, or first policy information, or first service configuration, or first contract data of the first terminal; wherein the first context information, or the first policy information, or the first service configuration, or the first contract data includes an authentication method of the first terminal; based on the first context information, or the first policy information, or the first service configuration, or the first contract data, obtain the authentication method corresponding to the first terminal.
  • the processing module 710 is specifically used to obtain the second context information, or second policy information, or second service configuration, or second contract data of the requesting party; wherein the second context information, or the second policy information, or the second service configuration, or the second contract data includes the authentication methods corresponding to one or more terminals managed by the requesting party, and the one or more terminals managed by the requesting party include the first terminal; based on the second context information, or the second policy information, or the second service configuration, or the second contract data, the authentication method corresponding to the first terminal is obtained.
  • the sending module 720b is further used to send information of the authentication method to the first terminal.
  • the receiving module 720a is used to receive first information from a requesting party, wherein the first information is used to indicate a first terminal; the processing module 710 is used to obtain an authentication method corresponding to the first terminal, wherein the authentication method corresponding to the first terminal is not to perform authentication; determine that the location of the first terminal is within a preset location range; and allow the first network corresponding to the requesting party or the core network device to skip the authentication process of the first terminal.
  • the processing module 710 is also used to determine that the location of the first terminal is outside a preset location range; execute a process corresponding to a configured authentication method, and the configured authentication method is used to authenticate a terminal accessing the network where the core network device is located.
  • the location of the first terminal includes one or more of the following: the geographical location of the first terminal, the geographical location of a second terminal that performs random access to the first terminal; and the preset location range is a preset geographical location range.
  • the position of the first terminal is represented by a first identifier
  • the preset position range is a preset identifier range
  • the first identifier includes one or more of the following: an identifier of an access network device accessed by the first terminal, an identifier of a cell where the first terminal is located, an identifier of a tracking area where the first terminal is located, an identifier of a network accessed by the first terminal, an identifier of a slice accessed by the first terminal, an identifier of a closed access group accessed by the first terminal, an identifier of an access network device accessed by the second terminal, an identifier of a cell where the second terminal is located, an identifier of a tracking area where the second terminal is located, an identifier of a network accessed by the second terminal, an identifier of a slice accessed by the second terminal, and an identifier of a closed access group accessed by the second terminal, wherein the second terminal is a terminal that performs random access to
  • the sending module 720b is further used to send indication information that the first terminal has successfully accessed to the first terminal.
  • the storage module 730 may store computer execution instructions of the method executed by the core network device, so that the processing module 710, the receiving module 720a and the sending module 720b execute the method executed by the core network device in the above example.
  • the storage module may include one or more memories, and the memory may be a device in one or more devices or circuits for storing programs or data.
  • the storage module may be a register, a cache, or a RAM, etc., and the storage module may be integrated with the processing module.
  • the storage module may be a ROM or other types of static storage devices that can store static information and instructions, and the storage module may be independent of the processing module.
  • the transceiver module may be an input or output interface, a pin or a circuit, etc.
  • the device can be implemented by a general bus architecture.
  • FIG8 a schematic block diagram of a communication device 800 is provided.
  • the communication device 800 may include one or more of the following: a processor 810, a transceiver 820, and a memory 830.
  • the transceiver 820 may be used to receive a program or instruction and transmit it to the processor 810, or the transceiver 820 may be used for the communication device 800 to communicate and interact with other communication devices, such as interactive control signaling and/or business data.
  • the transceiver 820 may be a code and/or data read/write transceiver, or the transceiver 820 may be a signal transmission transceiver between a processor and a transceiver.
  • the processor 810 and the memory 830 are electrically coupled.
  • the communication device 800 can be a core network device, or a chip used in a core network device. It should be understood that the device has any function of the core network device in the above method.
  • the communication device 800 can execute each step performed by the core network device in the method of Figures 2, 3a, 3b, 3c, 3d, 3e, 3f, 4, 5, and 6.
  • the memory 830 is used to store computer programs; the processor 810 can be used to call the computer programs stored in the memory 830.
  • the machine program or instruction executes the method executed by the core network device in the above example, or the method executed by the core network device in the above example is executed through the transceiver 820.
  • the processing module 710 in FIG. 7 may be implemented by the processor 810 .
  • the receiving module 720a and the sending module 720b in Fig. 7 may be implemented by the transceiver 820.
  • the transceiver 820 is divided into a receiver and a transmitter, the receiver performs the function of the receiving module, and the transmitter performs the function of the sending module.
  • the storage module 730 in FIG. 7 may be implemented by the memory 830 .
  • the device may be implemented by a general-purpose processor (a general-purpose processor may also be referred to as a chip or a chip system).
  • a general-purpose processor may also be referred to as a chip or a chip system.
  • a general processor of an apparatus for implementing an application in a core network device includes: a processing circuit (a processing circuit may also be referred to as a processor); optionally, it also includes: an input/output interface internally connected to and communicating with the processing circuit, and a storage medium (a storage medium may also be referred to as a memory), wherein the storage medium is used to store instructions executed by the processing circuit to execute the method executed by the core network device in the above example.
  • the processing module 710 in FIG. 7 may be implemented by a processing circuit.
  • the receiving module 720a and the sending module 720b in Fig. 7 can be implemented by an input/output interface.
  • the input/output interface is divided into an input interface and an output interface, the input interface performs the function of the receiving module, and the output interface performs the function of the sending module.
  • the storage module 730 in FIG. 7 may be implemented by a storage medium.
  • the device of the embodiment of the present application can also be implemented using the following: one or more FPGAs (field programmable gate arrays), PLDs (programmable logic devices), controllers, state machines, gate logic, discrete hardware components, any other suitable circuits, or any combination of circuits capable of performing the various functions described throughout the present application.
  • FPGAs field programmable gate arrays
  • PLDs programmable logic devices
  • controllers state machines, gate logic, discrete hardware components, any other suitable circuits, or any combination of circuits capable of performing the various functions described throughout the present application.
  • the embodiment of the present application further provides a computer-readable storage medium storing a computer program, which, when executed by a computer, enables the computer to perform the above communication method.
  • the computer program includes instructions for implementing the above communication method.
  • the embodiment of the present application also provides a computer program product, including: computer program code, when the computer program code is executed on a computer, the computer can execute the communication method provided above.
  • An embodiment of the present application also provides a communication system, which includes at least two of the following: a core network device that executes the above-mentioned communication method, a first terminal, other core network devices, and a requester.
  • the processor mentioned in the embodiment of the present application may be a central processing unit (CPU), a baseband processor, the baseband processor and the CPU may be integrated together or separated, or may be a network processor (NP) or a combination of a CPU and a NP.
  • the processor may further include a hardware chip or other general-purpose processor.
  • the above-mentioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof.
  • the above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) and other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. or any combination thereof.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.
  • the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories.
  • the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory.
  • the volatile memory may be a random access memory (RAM), which is used as an external cache.
  • RAM Synchronous RAM
  • DRAM Dynamic RAM
  • SDRAM Synchronous DRAM
  • DDR SDRAM Double Data Rate SDRAM
  • ESDRAM Enhanced SDRAM
  • SLDRAM Synchronous RAM
  • DR RAM Direct Rambus RAM
  • the transceiver mentioned in the embodiments of the present application may include a separate transmitter and/or a separate receiver, or the transmitter and the receiver may be integrated into one.
  • the transceiver may work under the instruction of the corresponding processor.
  • the transmitter may correspond to the transmitter in the physical device.
  • the transmitter and the receiver may correspond to the receiver in the physical device.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only schematic.
  • the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or it can be an electrical, mechanical or other form of connection.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present application.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or partly contributed to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请涉及通信技术领域，提供一种通信方法及装置，用以提高通信安全。核心网设备接收来自请求方的第一信息，所述第一信息用于指示第一终端；核心网设备获取所述第一终端对应的认证方式；并执行与所述认证方式对应的流程。核心网设备获取第一终端对应的认证方式，并执行对应的流程，可以提高安全性。

Description

一种通信方法及装置
相关申请的交叉引用
本申请要求在2022年09月26日提交中国专利局、申请号为202211174577.5、申请名称为“一种通信方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术领域，尤其涉及一种通信方法及装置。
背景技术
无源物联网终端(例如标签)功能简单，可以广泛应用于工业、企业、农业、畜牧业、林业等。物联技术可以结合无线通信系统技术，使物联网具有更大规模的应用部署前景。在物联网中，如何提高通信安全，是需要解决的技术问题。
发明内容
本申请实施例提供一种通信方法及装置，用以提高通信安全。
第一方面，提供了一种通信方法，该方法的执行主体可以是核心网设备，也可以是应用于核心网设备中的部件，例如芯片、处理器等。下面以执行主体是核心网设备为例进行描述。首先，接收来自请求方的第一信息，所述第一信息用于指示第一终端。然后，获取所述第一终端对应的认证方式。接下来，执行与所述认证方式对应的流程。
核心网设备获取第一终端对应的认证方式，并执行对应的流程，可以提高安全性。
在一种可能的实现中，核心网设备在接收来自请求方的第一信息之后，还可以获取所述第一终端的标识，并向所述请求方发送所述第一终端的标识。
在一种可能的实现中，所述认证方式包括以下任一项：双向认证方式、单向认证方式。
在一种可能的实现中，所述双向认证方式包括以下任一项：所述第一终端与所述请求方的双向认证、所述第一终端与所述核心网设备对应的第一网络的双向认证。
在一种可能的实现中，所述单向认证方式包括以下任一项：所述请求方对所述第一终端执行的单向认证、所述核心网设备对应的第一网络对所述第一终端执行的单向认证、所述第一终端对所述请求方执行的单向认证、所述第一终端对所述核心网设备对应的第一网络执行的单向认证。
在一种可能的实现中，执行与所述认证方式对应的流程，包括：当所述认证方式为所述第一终端对所述请求方执行的单向认证时，接收来自所述第一终端的随机数，向所述请求方发送所述随机数；接收来自所述请求方的校验值或密文信息，向所述第一终端发送所述校验值或所述密文信息。
在一种可能的实现中，执行与所述认证方式对应的流程，包括：当所述认证方式为所述请求方对所述第一终端执行的单向认证时，接收来自所述请求方的随机数，向所述第一终端发送所述随机数；接收来自所述第一终端的校验值或密文信息，向所述请求方发送所述校验值或所述密文信息。
在一种可能的实现中，执行与所述认证方式对应的流程，包括：当所述认证方式为所述请求方对所述第一终端执行的单向认证时，获取随机数，向所述第一终端发送所述随机数；接收来自所述第一终端的校验值或密文信息，向所述请求方发送所述随机数、以及向请求方发送所述校验值或所述密文信息。
在一种可能的实现中，执行与所述认证方式对应的流程，包括：当所述认证方式为所述第一终端与所述请求方的双向认证时，接收来自所述第一终端的随机数，向所述请求方发送所述随机数；接收来自所述请求方的第一校验值或第一密文信息，向所述第一终端发送所述第一校验值或所述第一密文信息；接收来自所述第一终端的第二校验值或第二密文信息，向所述请求方发送所述第二校验值或所述第二密文信息。
在一种可能的实现中，执行与所述认证方式对应的流程，包括：当所述认证方式为所述第一终端对所述核心网设备对应的第一网络执行的单向认证时，接收来自所述第一终端的第一随机数；获取第二随机数；并基于所述第一随机和所述第二随机数获取校验值或密文信息，向所述第一终端发送所述校验值或所述密文信息。
在一种可能的实现中，执行与所述认证方式对应的流程，包括：当所述认证方式为所述第一终端对所述核心网设备对应的第一网络执行的单向认证时，接收来自所述第一终端的第一随机数；并基于所述第一随机获取校验值或密文信息，向所述第一终端发送所述校验值或所述密文信息。
在一种可能的实现中，执行与所述认证方式对应的流程，包括：当所述认证方式为所述核心网设备对应的第一网络对所述第一终端执行的单向认证时，获取随机数，向所述第一终端发送所述随机数；接收来自所述第一终端的校验值或密文信息，并基于所述随机数校验所述校验值或所述密文信息。
在一种可能的实现中，执行与所述认证方式对应的流程，包括：当所述认证方式为所述核心网设备对应的第一网络对所述第一终端执行的单向认证时，获取随机数，向所述第一终端发送所述随机数；接收来自所述第一终端的校验值或密文信息，向其它核心网设备发送所述随机数、以及其它核心网设备发送所述校验值或所述密文信息，以使所述其它核心网设备基于所述随机数校验所述校验值或所述密文信息。
在一种可能的实现中，执行与所述认证方式对应的流程，包括：当所述认证方式为所述第一终端与所述核心网设备对应的第一网络的双向认证时，接收来自所述第一终端的第一随机数；获取第二随机数；并基于所述第一随机数和所述第二随机数获取第一校验值或第一密文信息，向所述第一终端发送所述第一校验值或所述第一密文信息；接收来自所述第一终端的第二校验值或第二密文信息，并基于所述第二随机数校验所述第二校验值或所述第二密文信息。
在一种可能的实现中，执行与所述认证方式对应的流程，包括：当所述认证方式为所述第一终端与所述核心网设备对应的第一网络的双向认证时，接收来自所述第一终端的第一随机数；并基于所述第一随机数获取第一校验值或第一密文信息，向所述第一终端发送所述第一校验值或所述第一密文信息，以及向第一终端发送第二随机数；接收来自所述第一终端的第二校验值或第二密文信息，并基于所述第二随机数校验所述第二校验值或所述第二密文信息。
在一种可能的实现中，所述第一信息还用于指示所述第一终端对应的所述认证方式；核心网设备获取所述第一终端对应的认证方式，包括：根据所述第一信息，获取所述第一终端对应的认证方式。请求方指示认证方式，可以按需或动态地向核心网设备指示第一终端对应的认证方式，针对同一终端，AF在不同时间指示的认证方式可以是相同或不同的。通过第一信息指示认证方式，可以节省信令交互。
在一种可能的实现中，核心网设备获取所述第一终端对应的认证方式，包括：核心网设备获取所述第一终端的第一上下文信息、或第一策略信息、或第一业务配置、或第一签约数据；其中，所述第一上下文信息、或所述第一策略信息、或所述第一业务配置、或所述第一签约数据包括所述第一终端的认证方式；核心网设备基于所述第一上下文信息、或所述第一策略信息、或所述第一业务配置、或所述第一签约数据，获取所述第一终端对应的认证方式。
在一种可能的实现中，核心网设备获取所述第一终端对应的认证方式，包括：核心网设备获取所述请求方的第二上下文信息、或第二策略信息、或第二业务配置、或第二签约数据；其中，所述第二上下文信息、或所述第二策略信息、或所述第二业务配置、或所述第二签约数据包括所述请求方管理的一个或多个终端各自对应的认证方式，所述请求方管理的一个或多个终端包括所述第一终端；核心网设备基于所述第二上下文信息、或所述第二策略信息、或所述第二业务配置、或所述第二签约数据，获取所述第一终端对应的认证方式。
在一种可能的实现中，核心网设备获取所述第一终端对应的认证方式之后，还可以向所述第一终端发送所述认证方式的信息。该方式可以适用于第一终端中未配置认证方式的场景，第一终端知道其认证方式后，可以执行与认证方式对应的流程。
第二方面，提供了一种通信方法，该方法的执行主体可以是核心网设备，也可以是应用于核心网设备中的部件，例如芯片、处理器等。下面以执行主体是核心网设备为例进行描述。首先，接收来自请求方的第一信息，所述第一信息用于指示第一终端。然后，获取所述第一终端对应的认证方式，其中，所述第一终端对应的认证方式为不执行认证。接下来，确定所述第一终端的位置属于预设位置范围内；允许所述请求方或所述核心网设备对应的第一网络跳过所述第一终端的认证流程。
核心网设备获取第一终端对应的认证方式为不执行认证时，通过终端的位置进行进一步决策最终的认证方式，可以提高安全性。
核心网设备获取所述第一终端对应的认证方式的实现，可以参考第一方面的多种可能的实现，不再重复赘述。
在一种可能的实现中，核心网设备接收来自请求方的第一信息之后，核心网设备还获取所述第一终端的标识，向所述请求方发送所述第一终端的标识。
在一种可能的实现中，核心网设备确定所述第一终端的位置在预设位置范围外；执行与配置的认证方式对应的流程，所述配置的认证方式用于认证接入所述核心网设备所在的网络的终端。核心网设备获取第一终端对应的认证方式为不执行认证时，通过终端的位置进行进一步决策最终的认证方式，可以提高安全性。
在一种可能的实现中，所述第一终端的位置包括以下的一项或多项：第一终端的地理位置、对所述第一终端执行随机接入的第二终端的地理位置；其中，所述预设位置范围为预设地理位置范围。
在一种可能的实现中，所述第一终端的位置由第一标识表征，所述预设位置范围为预设标识范围；其中，第一标识包括以下的一项或多项：第一终端接入的接入网设备的标识、第一终端所在的小区的标识、第一终端所在的跟踪区的标识、第一终端接入的网络的标识、第一终端接入的切片的标识、第一终端接入的封闭接入组的标识、第二终端接入的接入网设备的标识、第二终端所在的小区的标识、第二终端所在的跟踪区的标识、第二终端接入的网络的标识、第二终端接入的切片的标识、第二终端接入的封闭接入组的标识，其中，所述第二终端为对所述第一终端执行随机接入的终端。
在一种可能的实现中，核心网设备向所述请求方发送所述第一终端的标识之前，还向所述第一终端发送所述第一终端接入成功的指示信息。可以使第一终端快速接入核心网，可以减少信令交互和时延开销，提高第一终端的盘存效率、减少第一终端的功耗开销。
第三方面，提供了一种通信装置，所述装置具有实现上述任一方面及任一方面的任一可能的实现中的功能。这些功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的功能模块。
第四方面，提供了一种通信装置，包括处理器，可选的，还包括存储器；所述处理器和所述存储器耦合；所述存储器，用于存储计算机程序或指令；所述处理器，用于执行所述存储器中的部分或者全部计算机程序或指令，当所述部分或者全部计算机程序或指令被执行时，用于实现上述任一方面及任一方面的任一可能的实现的方法中的功能。
在一种可能的实现中，所述装置还可以包括收发器，所述收发器，用于发送所述处理器处理后的信号，或者接收输入给所述处理器的信号。所述收发器可以执行任一方面及任一方面的任一可能的实现中的发送动作或接收动作。
第五方面，本申请提供了一种芯片系统，该芯片系统包括一个或多个处理器(也可以称为处理电路)，所述处理器与存储器(也可以称为存储介质)之间电耦合；所述存储器可以位于所述芯片系统中，也可以不位于所述芯片系统中；所述存储器，用于存储计算机程序或指令；所述处理器，用于执行所述存储器中的部分或者全部计算机程序或指令，当所述部分或者全部计算机程序或指令被执行时，用于实现上述任一方面及任一方面的任一可能的实现的方法中的功能。
在一种可能的实现中，所述芯片系统还可以包括输入输出接口(也可以称为通信接口)，所述输入输出接口，用于输出所述处理器处理后的信号，或者接收输入给所述处理器的信号。所述输入输出接口可以执行任一方面及任一方面的任一可能的实现中的发送动作或接收动作。具体的，输出接口执行发送动作，输入接口执行接收动作。
在一种可能的实现中，该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
第六方面，提供了一种计算机可读存储介质，用于存储计算机程序，所述计算机程序包括用于实现任一方面及任一方面的任一可能的实现中的功能的指令。
或者，一种计算机可读存储介质，用于存储计算机程序，所述计算机程序被计算机执行时，可以使得所述计算机执行上述任一方面及任一方面的任一可能的实现的方法。
第七方面，提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序代码，当所述计算机程序代码在计算机上运行时，使得计算机执行上述任一方面及任一方面的任一可能的实现中的方法。
第八方面，提供了一种通信系统，所述通信系统包括：执行上述第一方面及任一可能的实现的核心网设备，及与所述核心网设备进行交互的第一终端。或者，所述通信系统包括：执行上述第二方面及任一可能的实现的核心网设备，及与所述核心网设备进行交互的第一终端。
例如，所述第一终端，用于向核心网设备发送所述第一终端的标识。
例如，所述第一终端，用于执行所述第一终端与所述请求方的双向认证、或所述第一终端与所述 核心网设备对应的第一网络的双向认证、或所述请求方对所述第一终端执行的单向认证、或所述核心网设备对应的第一网络对所述第一终端执行的单向认证、或所述第一终端对所述请求方执行的单向认证、或所述第一终端对所述核心网设备对应的第一网络执行的单向认证。
例如，所述第一终端，用于向核心网设备发送随机数、第一随机数、第二随机数、校验值、密文信息、第一校验值、第一密文信息、第二校验值、第二密文信息中的一项或多项。
例如，所述第一终端，用于接收来自核心网设备的随机数、第一随机数、第二随机数、校验值、密文信息、第一校验值、第一密文信息、第二校验值、第二密文信息中的一项或多项。
例如，所述第一终端，用于接收来自核心网设备的认证方式的信息。
在一种可能的示例中，所述通信系统还包括与所述核心网设备进行交互的请求方。
例如，所述请求方，用于向核心网设备发送第一信息，所述第一信息用于指示第一终端。
例如，所述请求方，用于接收来自核心网设备的第一终端的标识。
例如，所述请求方，用于执行所述第一终端与所述请求方的双向认证、或所述请求方对所述第一终端执行的单向认证、或所述第一终端对所述请求方执行的单向认证。
例如，所述请求方，用于向核心网设备发送随机数、第一随机数、第二随机数、校验值、密文信息、第一校验值、第一密文信息、第二校验值、第二密文信息中的一项或多项。
例如，所述请求方，用于接收来自核心网设备的随机数、第一随机数、第二随机数、校验值、密文信息、第一校验值、第一密文信息、第二校验值、第二密文信息中的一项或多项。
上述第三方面至第八方面的技术效果可以参照第一方面至第二方面中的描述，重复之处不再赘述。
附图说明
图1为本申请实施例中提供的一种通信系统结构示意图；
图2为本申请实施例中提供的一种通信流程示意图；
图3a为本申请实施例中提供的第一终端对请求方执行单向认证的流程示意图；
图3b为本申请实施例中提供的请求方对第一终端执行单向认证的流程示意图；
图3c为本申请实施例中提供的第一终端与请求方进行双向认证的流程示意图；
图3d为本申请实施例中提供的第一终端对核心网设备对应的第一网络执行单向认证的流程示意图；
图3e为本申请实施例中提供的核心网设备对应的第一网络对第一终端执行单向认证的流程示意图；
图3f为本申请实施例中提供的第一终端与核心网设备对应的第一网络执行双向认证的流程示意图；
图4为本申请实施例中提供的一种第一终端与请求方之间的认证流程示意图；
图5为本申请实施例中提供的一种第一终端与第一网络之间的认证流程示意图；
图6为本申请实施例中提供的一种请求方或第一网络对第一网络执行单向认证的流程示意图；
图7为本申请实施例中提供的一种通信装置结构图；
图8为本申请实施例中提供的一种通信装置结构图。
具体实施方式
以下对本申请实施例中的部分用语进行解释说明，以便于本领域技术人员理解。
1)盘点操作：盘点操作也可以称为盘存操作，该操作可以获取终端(例如电子标签、标签等不同类型的终端形态，以下以终端为标签为例阐述，但不限于标签)的标识信息，例如，可以通过查询(query)、确认(ack)等命令用来获取终端的标识信息。终端的标识信息例如电子产品编码(electronic product code，EPC)、标签标识(tag identifier，TID)。
2)读(Read)操作：读操作可以读取终端的存储区中的数据。示例性的，存储区中的数据可以包括标识信息(例如电子产品编码(electronic product code，EPC)、标签标识(tag identifier，TID))、保留区中存储的内容或用户存储区中存储的内容等。
3)写(Write)操作：写操作可以对终端的存储区进行写入操作。示例性的，可以对存储区中的标识信息(例如EPC、TID)进行写入或改写。或者，可以对保留区或用户存储区中的数据进行写入或者改写操作。
4)灭活(Kill)操作：灭活操作可以让终端失效。示例性的，失效后的终端无法工作。
5)锁(Lock)操作：锁操作可以锁住终端的信息，可以防止对该标签进行读操作或写操作。或者， 锁操作也可以锁住存储区域(memory banks)，可以防止或允许对该存储区域进行读操作或写操作。
6)块写操作：可以让读写器以单命令对终端的存储区(例如保留区、EPC存储区、TID存储区或用户存储区)进行多字的写操作。
7)块擦操作：可以让读写器对终端的存储区(例如保留区、EPC存储区、TID存储区或用户存储区)进行多字的擦除操作。
8)访问操作：让具有非零值访问密码(access password)的终端从开(open)状态转变为安全(secured)状态。
本申请实施例中“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b，或c中的至少一项(个)，可以表示：a，b，c，a-b，a-c，b-c，或a-b-c，其中a，b，c可以是单个，也可以是多个。
以及，除非有相反的说明，本申请实施例提及“第一”、“第二”等序数词是用于对多个对象进行区分，不用于限定多个对象的大小、内容、顺序、时序、优先级或者重要程度等。例如，第一消息和第二消息，只是为了区分不同的消息，而并不是表示这两个消息的内容、优先级或者重要程度等的不同。
本申请提供的通信方法可以应用于各类通信系统中，例如，可以是物联网(internet of things，IoT)、无源物联网(passive IoT，P-IoT；或者ambient IoT，A-IoT)、半无源物联网(semi-passive IoT)、半有源物联网(semi-active IoT)、有源物联网(active IoT)、窄带物联网(narrow band internet of things，NB-IoT)、长期演进(long term evolution，LTE)，也可以是第五代(5th generation，5G)通信系统，还可以是LTE与5G混合架构，也可以是6G或者未来通信发展中出现的新的通信系统等。通信系统还可以是机器到机器(machine to machine，M2M)网络、机器类通信(machine type communication，MTC)或者其他网络。
图1为适用于本申请实施例的一种可能的通信系统示意图，包括：终端设备、接入网设备、核心网设备、请求方。
请求方可以对终端设备(例如标签)执行操作，操作包括但不限于获取终端设备的信息、盘点操作(或者称为盘存操作)、读操作、写操作、失效操作、灭活操作等。请求方通过核心网设备发送操作指令。一种可能的实现中，核心网设备指示接入网设备向终端设备发起随机接入。当终端设备随机接入成功后，接入网设备向终端设备发送或者转发需要执行的操作的信息。另一种可能的实现方式中，核心网设备指示第二终端设备向第一终端设备发起随机接入。当第一终端设备随机接入成功后，第二终端设备向第一终端设备发送或者转发需要执行的操作的信息。
终端设备根据接收到的操作的信息，获取相应信息或发送相应信息。例如，当操作为盘点操作时，终端设备发送终端设备的标识信息；当操作为读操作时，终端设备发送存储在终端设备的存储区中的数据信息；当操作为写操作时，终端设备将需要写入的数据信息存储至终端设备的存储区中。
接入网设备向核心网设备发送来自终端设备的信息；核心网设备向请求方发送这些信息。
终端设备可以是物联技术中的终端设备，包括但不限于无源终端设备、半无源终端设备、半有源终端设备、有源终端设备、低功耗终端设备、零功耗终端设备、被动(passive)终端设备、主动(active)终端设备等。
终端设备可以称用户设备(user equipment，UE)、终端、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、无线通信设备、用户代理或用户装置。终端设备可以广泛应用于各种场景，例如，物联网(internet of things，IOT)、设备到设备(device-to-device，D2D)、车物(vehicle to everything，V2X)通信、机器类通信(machine-type communication，MTC)、物联网(internet of things，IOT)、虚拟现实、增强现实、工业控制、自动驾驶、远程医疗、智能电网、智能家具、智能办公、智能穿戴、智能交通、智慧城市等。终端设备可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备、5G网络中的终端设备、未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中或者非陆地网络(non-terrestrial networks，NTN)的终端设备等。终端设备 还可以是端设备、逻辑实体、智能设备等，如手机、智能终端等终端设备，或者服务器、网关、基站、控制器等通信设备，或者标签(例如无源标签、有源标签、半有源标签、半无源标签)、传感器、电表、水表等物联网(internet of things，IoT)设备。终端设备还可以是具有通信功能的无人机(unmanned aerial vehicle或uncrewed aerial vehicle，UAV)。当终端设备为无源终端、或半无源终端、或半有源终端、或有源终端、或标签时，可以通过获取能量以接收或者发送数据。获取能量的方式包括但不限于无线电、太阳能、光能、风能、水能、热能、动能等。本申请对于无源终端、半无源终端、半有源终端、有源终端、或标签获取能量的方式不做限定。另外，本申请中涉及到的标签可以是标签形态，或者，也可以是任意终端形态。
接入网设备用于将终端设备接入到无线网络。所述接入网设备可以是基站(base station)、杆站、室内基站(例如Lampsite)、家庭基站(例如home NB)、微型基站、接入回传一体化(integrated access and backhaul，IAB)节点、移动基站、无线接入网、无线接入网设备、LTE系统或演进的LTE系统(LTE-Advanced，LTE-A)中的演进型基站(evolved NodeB，eNodeB)、5G通信系统中的下一代基站(next generation NodeB，gNB)、发送接收点(transmission reception point，TRP)、基带单元(base band unit，BBU)、WiFi接入点(access point，AP)、未来移动通信系统中的基站或WiFi系统中的接入节点等。接入网设备也可以是完成基站部分功能的模块或单元，例如，可以是集中式单元(central unit，CU)，或者分布式单元(distributed unit，DU)。本申请实施例对接入网设备所采用的具体技术和具体设备形态不作限定。例如，在一种网络结构中，接入网设备可以为CU节点、或DU节点、或为包括CU节点和DU节点的接入网设备。具体的，CU节点用于支持无线资源控制(radio resource control，RRC)、分组数据汇聚协议(packet data convergence protocol，PDCP)、业务数据适配协议(service data adaptation protocol，SDAP)等协议；DU节点用于支持无线链路控制(radio link control，RLC)层协议、媒体接入控制(medium access control，MAC)层协议和物理层协议。接入网设备还可以是具有阅读器(reader)功能的设备。
请求方，可以理解为发送操作指令的设备，例如，第三方设备、服务器(server)、P-IoT server、应用服务器(application server，AS)、应用功能(application function，AF)、无源物联网应用功能(P-IoT AF)、物联应用功能(IoT AF)或者其他发送操作指令的设备。请求方可以对应某类用户，该类用户可以包括企业、租户、第三方或者公司，不予限制。其中，请求方对应某类用户可以理解为请求方属于该类用户，由该类用户管理。
核心网设备可包括以下网元中的一个或多个：
接入管理网元(也可以称为接入管理网元、移动性管理网元、接入与移动性管理网元)，是由运营商网络提供的控制面网元，负责终端设备接入运营商网络的接入控制和移动性管理，例如包括移动状态管理，分配用户临时身份标识，认证和用户等功能。在5G通信系统中，该接入管理网元可以是接入与移动性管理功能(access and mobility management function，AMF)网元。在未来通信系统中，接入管理网元仍可以是AMF网元，或者，还可以有其它的名称，本申请不做限定。
会话管理网元，主要负责移动网络中的会话管理，如会话建立、修改、释放。具体功能如为用户分配IP地址、选择提供报文转发功能的用户面网元等。在5G通信系统中，该会话管理网元可以是会话管理功能(session management function，SMF)网元。在未来通信系统中，会话管理网元仍可以是SMF网元，或者，还可以有其它的名称，本申请不做限定。
用户面网元，负责终端设备中用户数据的转发和接收。可以从数据网络接收用户数据，通过接入网设备传输给终端设备；用户面网元还可以通过接入网设备从终端设备接收用户数据，转发到数据网络。用户面网元中为终端设备提供服务的传输资源和调度功能由SMF网元管理控制的。在5G通信系统中，该用户面网元可以是用户面功能(user plane function，UPF)网元。在未来通信系统中，用户面网元仍可以是UPF网元，或者，还可以有其它的名称，本申请不做限定。
数据管理网元，用于生成认证信任状，用户标识处理(如存储和管理用户永久身份等)，接入控制和签约数据管理等。在5G通信系统中，该数据管理网元可以是统一数据管理(unified data management，UDM)网元。在未来通信系统中，统一数据管理仍可以是UDM网元，或者，还可以有其它的名称，本申请不做限定。
策略控制网元，主要支持提供统一的策略框架来控制网络行为，提供策略规则给控制层网络功能，同时负责获取与策略决策相关的用户签约信息。在4G通信系统中，该策略控制网元可以是策略和计费 规则功能(policy and charging rules function，PCRF)网元。在5G通信系统中，该策略控制网元可以是策略控制功能(policy control function，PCF)网元。在未来通信系统中，策略控制网元仍可以是PCF网元，或者，还可以有其它的名称，本申请不做限定。
网络存储网元，可用于提供网元发现功能，基于其他网元的请求，提供网元类型对应的网元信息。NRF还提供网元管理服务，如网元注册、更新、去注册以及网元状态订阅和推送等。在5G通信系统中，该网络存储网元可以是网络注册功能(network repository function，NRF)网元。在未来通信系统中，网络存储网元仍可以是NRF网元，或者，还可以有其它的名称，本申请不做限定。
网络开放网元，是由运营商提供控制面网元，网络开放网元以安全的方式对第三方开放运营商网络的对外接口，可用于提供用于安全地向外部开放由第三代合作伙伴计划(3rd generation partnership project，3GPP)网络功能设备提供的业务和能力等。例如，在会话管理网元需要与第三方的网元通信时，网络开放网元可作为会话管理网元与第三方的网元通信的中继。网络开放网元作为中继时，可作为签约用户的标识信息的翻译，以及第三方的网元的标识信息的翻译。比如，网络开放网元将签约用户的SUPI从运营商网络发送到第三方时，可以将SUPI翻译成其对应的外部身份标识(identity，ID)。反之，网络开放网元将外部ID(第三方的网元ID)发送到运营商网络时，可将其翻译成SUPI。在5G通信系统中，网络开放功能网元可以是网络开放功能(network exposure function，NEF)网元。在未来通信系统中，网络开放功能网元仍可以是NEF网元，或者，还可以有其它的名称，本申请不做限定。
网络切片选择网元，可用于为终端的业务选择合适的网络切片。在5G通信系统中，网络切片选择网元可以是网络切片选择功能(network slice selection function，NSSF)网元。在未来通信系统中，网络开放功能网元仍可以是NSSF网元，或者，还可以有其它的名称，本申请不做限定。
网络数据分析网元，可以从各个网络功能(network function，NF)，例如策略控制网元、会话管理网元、用户面网元、接入管理网元、应用功能网元(通过网络能力开放功能网元)收集数据，并进行分析和预测。在5G通信系统中，网络数据分析网元可以是网络数据分析功能(network data analytics function，NWDAF)。在未来通信系统中，网络开放功能网元仍可以是NWDAF网元，或者，还可以有其它的名称，本申请不做限定。
统一数据存储网元，负责存储结构化的数据信息，其中包括签约信息，策略信息，以及有标准格式定义的网络数据或业务数据。在5G通信系统中，统一数据存储网元可以是统一数据存储(unified data repository，UDR)。在未来通信系统中，网络开放功能网元仍可以是UDR网元，或者，还可以有其它的名称，本申请不做限定。
鉴权服务功能(authentication server function，AUSF)，网络认证UE的功能实体，用于网络验证UE是否是真实的，可支持3GPP框架定义的接入服务鉴权，同时也可以支持非3GPP接入网的鉴权。
网络切片和独立非公共网络特定的鉴权和授权功能(network slice-specific and SNPN authentication and authorization function，NSSAAF)，主要作用是与外部AAA服务器连接，做一个服务化接口(service based interface，SBI)接口与AAA接口转换的作用，是一个连接3GPP网络内部网元与外部AAA服务器的中间网元。比如，NSAAF预配置有AAA服务器的地址信息与域信息的对应关系，当NSSAAF收到域信息后，NSAAF可以根据AAA服务器的地址信息确定AAA服务器，然后将收到的消息发送给AAA服务器。再比如，NSSAAF可以根据域信息向网域名称服务器(domain name server,DNS)服务器请求AAA服务器的地址信息，并从DNS服务器获得AAA服务器地址信息，然后将收到的消息发送给AAA服务器。NSSAAF还可以用于支持来自使用AAA服务器的凭证持有者(credentials holder，CH)的凭证(credentials)接入独立非公共网络，或者，用于支持来自使用AAA服务器的默认凭证服务器(default credentials server，DCS)的凭证(credentials)接入独立非公共网络。如果凭证持有者或者默认凭证服务器来自第三方，NSSAAF可以通过AAA代理(AAA proxy)与AAA服务器通信。
标签管理功能(tag management function，TMF)，也可以称为物联管理功能(IoT management function，IMF)、或物联终端管理功能(IoT device management function，IDMF)，其可以实现以下功能中的一项或多项：1)识别请求方发送的指令、根据请求发送的指令向物联终端执行操作；2)指示接入网设备或者终端设备执行物联终端的随机接入流程；3)获取物联终端的数据；可以对物联终端发送的数据执行过滤或者收集；4)向请求方发送来自物联终端的数据；5)对接一个或多个请求方，执行数据路由；6)执行物联终端的安全认证流程；可以根据请求方或者物联终端对应的上下文信息、策略信息或者签约数据，执行安全流程。TMF可以是一个独立的网元或者设备，独立部署；也可以为已有网元或者设备的 一部分功能，与已有的网元或者设备共同部署，例如TMF与AMF、NEF或UPF共同部署。
可以理解的是，网元也可以称为“设备”、“实体”等。上述网元或者功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行的软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。上述网元或者功能可划分出一个或多个服务，进一步，还可能会出现独立于网络功能存在的服务。在本申请中，上述功能的实例、或上述功能中包括的服务的实例、或独立于网络功能存在的服务实例均可称为服务实例。
应当理解，图1仅为适用的网络架构的一种示例，实际应用的网络架构可以包括比图1更多或更少的网元。本申请实施例上述所使用的各个网元的名称，在未来通信系统中，可能保持功能相同，但名称会改变。
本申请实施例提出了多种安全认证的方案，以提高通信安全。例如，请求方对终端设备的单向认证，以确保终端设备为请求方的终端设备；例如，终端设备对请求方的单向认证，以确保请求方是可信的；再例如，终端设备与请求方之间的双向认证；例如，运营商对终端设备的单向认证；例如，终端设备对运营商的单向认证；例如，运营商和终端设备之间的双向认证。在一些物理环境相对安全的场景下，例如终端设备处于园区环境内，为了提高效率，可以免去认证(因为执行认证流程会增加终端设备与请求方的交互流程，耗时增加)。
本申请实施例提供的方法可以应用于工业、企业、农业、畜牧业、林业等。一种举例说明中，可以应用于工业中对产品的管理，例如，通过在产品上嵌入或贴上无源或半无源物联网标签，可以实现自动对产品进行扫描、统计等管理。例如，在仓库、运输、物资等方面，存放在仓库、商场等货品在物流过程中，货品相关信息被阅读器自动采集，管理人员就可以在系统迅速查询货品信息，降低丢弃或者被盗的风险，可以提高货品交接速度，提高准确率，并且防止窜货和防伪。另一种举例说明中，可以应用于资产管理，例如图书馆、艺术馆及博物馆等资产庞大或者物品贵重的一些场所，需要有完整的管理程序或者严谨的保护措施，在书籍或者贵重物品上嵌入或贴上无源或半无源物联网标签，当书籍或者贵重物品的存放信息有异常变动，可以及时提醒管理员，从而处理相关情况。另一种举例说明中，可以应用于工业对设备(如叉车、拖车、自动导引运输车(automated guided vehicle，AGV)等)的管理，例如，通过在设备上装有标签，可以实现对设备的生命周期、利用率、位置等的管理。再一种举例说明中，可以应用于畜牧业中对养殖品(如猪、牛、羊、鸡等)进行管理，例如，通过在养殖品上固定标签，可以实现对养殖品的统计等的管理。再一种举例说明中，可以应用于林业中对树木进行管理，例如，通过在树木上固定标签，可以实现对树木的统计等的管理。
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。
如图2所示，提供了一种通信流程示意图；该通信流程可以适用于以下多种场景：
场景1：第一终端中预先配置有认证方式，第一终端与请求方之间进行认证。其中，第一终端与请求方之间进行认证可以包括：第一终端与请求方的双向认证，请求方对第一终端的单向认证，第一终端对请求方的单向认证。
场景2：第一终端中未配置认证方式，第一终端与请求方之间进行认证。
场景3：第一终端中预先配置有认证方式，第一终端与核心网设备对应的第一网络(核心网设备对应的第一网络可以称为运营商网络)之间进行认证。其中，第一终端与核心网设备对应的第一网络之间进行认证可以包括：第一终端与核心网设备对应的第一网络的双向认证，核心网设备对应的第一网络对第一终端的单向认证，第一终端对核心网设备对应的第一网络的单向认证。
场景4：第一终端中未配置认证方式，第一终端与核心网设备对应的第一网络(核心网设备对应的第一网络可以称为运营商网络)之间进行认证。
其中，第一终端与核心网设备对应的第一网络之间进行认证可以理解为第一终端与第一网络中的鉴权设备进行认证。
图2所示的通信流程可以应用于图1所示的通信系统中。其中，请求方可以是图1中的请求方，例如第三方设备、服务器(server)、P-IoT server、应用服务器AS、应用功能AF、无源物联网应用功能(P-IoT AF)、物联网应用功能(IoT AF)等；核心网设备可以是图1中的核心网设备，例如AMF、UDM、TMF、AUSF、NSSAAF、SMF、UPF、PCF、NEF、UDR等，核心网设备与请求方直接可以直接通信，也可以通过其它核心网设备进行通信；第一终端可以是图1中的终端设备。
图2介绍的流程示意图至少包括以下步骤：
步骤201：请求方向核心网设备发送第一信息，所述第一信息用于指示第一终端。
相应的，核心网设备接收来自请求方的第一信息。
可以理解的是，第一信息除了指示第一终端外，还可以指示其它终端。
第一信息指示第一终端时，可以采用如下一种或多种方式：
例如，第一信息包括终端标识范围，终端标识范围包括第一终端的标识。
例如，第一信息包括一个或多个终端的标识，所述一个或多个终端的标识包括第一终端的标识。
例如，第一信息包括终端的类型，第一终端属于所述类型。
例如，第一信息包括请求方的信息。请求方的信息可以指示请求方对应的(或者管理的)终端标识范围或一个或多个终端的标识。请求方对应的(或者管理的)终端标识范围或一个或多个终端的标识包括第一终端的标识。
请求方对应的(或者管理的)终端标识范围或一个或多个终端的标识，可以保存或配置在核心网设备上，也可以保存或配置在其它核心网设备上。核心网设备可以向其它核心网设备发送请求方的信息，其它核心网设备根据请求方的信息获取请求方对应的(或者管理的)终端标识范围或一个或多个终端的标识，并发送给核心网设备。示例性的，其他核心网设备可以包括UDM、UDR、AUSF、NEF、PCF、SMF、TMF、NSSAAF、AMF等核心网设备。
请求方的信息可以包括以下的一项或多项：AF标识符(AF identifier或AF identity，AF ID)、业务标识(service identifier或service identity，service ID)、应用标识(application identifier或application identity，APP ID)、AF的地址信息、AF的端口信息、应用服务器AS的地址信息、应用服务器AS的端口信息。其中，AF或AS的地址例如为互联网协议地址(internet protocol address，IP)、介质访问控制(media access control，MAC)地址、IPv6prefix等；其中，AF或AS的端口例如为传输控制协议(transmission control protocol，TCP)端口、用户数据报协议(user datagram protocol，UDP)端口。
在一种可能的实现方式中，第一信息可以用于指示对第一终端执行第一操作。第一操作可以是获取第一终端的标识的操作(也可称为盘点操作、盘存操作、Inventory)、读操作、写操作、删除操作、加密操作、访问操作、块写操作、块擦操作或灭活操作等。例如，第一信息包括第一操作的信息，通过第一操作的信息来指示第一操作。进一步可选的，第一信息还包括第一操作对应的操作参数。第一操作的信息可以称为指令类型，或者第一操作的信息和第一操作对应的操作参数一起称为指令类型。举例说明，读操作对应的操作参数可以包括读取的存储区，读取存储区的起始字地址以及字数目等。写操作对应的操作参数可以包括写入的存储区，读取存储区的起始字以及写入的数据。另外，获取第一终端的标识的操作(也可称为盘点操作、盘存操作、Inventory)可以无需携带在第一信息中，例如，当第一信息不包括第一操作时，可以表示第一信息用于获取第一终端的标识。
在一种可能的场景中，请求方需要周期性地对第一终端执行第一操作。在该场景中，一种可能的实现方式为，请求方在周期到达时，向核心网设备请求对第一终端执行第一操作。另一种可能的实现方式为，请求方向核心网设备发送周期信息，相应的，核心网设备可以接收来自请求方的周期信息，并保存。进而，核心网设备周期性地触发对第一终端执行第一操作，而无需请求方周期性地向核心网设备请求对第一终端执行第一操作，可以节省信令交互。
步骤202：核心网设备获取第一终端对应的认证方式。
核心网设备获取第一终端对应的认证方式的方式有多种，包括但不限于以下的方式。
一种方式中，请求方向核心网设备指示第一终端对应的认证方式。示例性的，请求方通过第一信息向核心网设备指示第一终端对应的认证方式。具体的，所述第一信息可以用于指示所述第一终端对应的认证方式；核心网设备可以根据所述第一信息，获取所述第一终端对应的所述认证方式。当然，请求方也可以通过不同于第一信息的其它信息向核心网设备指示第一终端对应的认证方式。在该方式中，如果第一终端预配置有认证方式，通常情况下，请求方向核心网设备指示的认证方式与第一终端中预配置的认证方式需相同，当然，不排除请求方向核心网设备指示的认证方式与第一终端中预配置的认证方式不同的情况。当第一终端预配置的认证方式与请求方向核心网设备指示的认证方式不同时，一种可能的实现方式中，第一终端可以按照请求方指示的认证方式执行认证流程。示例性的，请求方指示的认证方式优先级高于第一终端预配置的认证方式。请求方向核心网设备指示的认证方式可以是按需触发或者动态指示的。示例性的，针对同一终端，请求方在不同时间指示的认证方式可以是相同或不同的。
一种方式中，所述第一终端的第一上下文信息、或第一策略信息、或第一业务配置(例如service  profile)、或第一签约数据中包括所述第一终端对应的认证方式(终端对应的认证方式可以为终端支持的认证方式)。核心网设备获取所述第一终端的第一上下文信息、或第一策略信息、或第一业务配置、或第一签约数据，核心网设备基于所述第一上下文信息、或第一策略信息、或第一业务配置、或所述第一签约数据，获取所述第一终端对应的认证方式。第一终端的第一上下文信息、或第一策略信息、或第一业务配置、或第一签约数据保存在以下一个或多个设备中：接入管理设备(例如AMF)、策略控制设备(例如PCF)、鉴权设备(例如AUSF)、统一数据管理设备(例如UDM)、用户数据库(例如UDR)、会话管理设备(例如SMF)、标签管理功能(例如TMF)。
一种方式中，请求方的第二上下文信息、或第二策略信息、或第二业务配置、或第二签约数据中包括所述请求方管理的一个或多个终端对应的认证方式(终端对应的认证方式可以为终端支持的认证方式)，所述请求方管理的一个或多个终端包括所述第一终端。核心网设备获取所述请求方的第二上下文信息、或第二策略信息、或第二业务配置、或第二签约数据，核心网设备基于所述第二上下文信息、第二策略信息、第二业务配置、或所述第二签约数据，获取所述第一终端对应的认证方式。请求方的第二上下文信息、或第二策略信息、或第二业务配置、或第二签约数据可以保存在UDM、UDR、AUSF、NSSAAF、AMF、TMF、PCF等控制面功能。
第一终端对应的认证方式可以是双向认证方式，或者单向认证方式，或者不执行认证。
当认证方式为双向认证方式时，认证方式具体可以是以下任一项：所述第一终端与所述请求方的双向认证、所述第一终端与所述核心网设备对应的第一网络的双向认证。
当认证方式为单向认证方式时，认证方式具体可以是以下任一项：所述请求方对所述第一终端执行的单向认证、所述核心网设备对应的第一网络对所述第一终端执行的单向认证、所述第一终端对所述请求方执行的单向认证、所述第一终端对所述核心网设备对应的第一网络执行的单向认证。
步骤203：核心网设备执行(执行可以理解为发起、或触发、或参与)与步骤202中获取到的认证方式对应的流程。
核心网设备获取第一终端对应的认证方式，并执行对应的流程，可以提高安全性。
以下结合图3a至图3f，对各个认证方式对应的流程进行详细介绍。其中，随机数(RAND)可以是比特串(例如128比特长度的比特串)，也可以是字符串或者数字，本申请对于随机数的构造或者长度不限制。校验值可以是消息身份验证码(message authentication code，MAC)，校验值可以是比特串(例如32比特长度的比特串)，也可以是字符串或者数字，本申请对于校验值的构造或者长度不限制。密文信息可以是比特串(例如32比特长度的比特串)、字符串或者数字，本申请对于密文信息的构造或者长度不限制。明文信息可以是比特串(例如128比特长度的比特串)、字符串或者数字，本申请对于明文信息的构造或者长度不限制。
如图3a所示，介绍了多种可能的第一终端对请求方执行单向认证的流程示意图。
步骤31a：第一终端向核心网设备发送随机数，相应的，核心网设备接收来自第一终端的随机数。
该随机数可以是第一终端中预先配置的，也可以是第一终端随机生成的。在一种可能的实现中，随机数携带在第一终端向核心网设备(例如AMF或TMF)发送的请求(例如注册请求Registration Request)消息中。
步骤32a：核心网设备向请求方发送所述随机数，相应的，请求方接收来自核心网设备的随机数。
步骤33a：请求方基于所述随机数获取校验值或者密文信息。
例如，获取校验值或者密文信息的过程包括：请求方基于所述随机数和预配置的密钥，获取校验值或者密文信息。
一种可能的实现方式中，请求方基于所述随机数与预配置的安全密钥进行运算，获取校验值。
另一种可能的实现方式中，请求方采用预配置的安全密钥对所述随机数进行加密，获取密文信息。
步骤34a：请求方向核心网设备发送所述校验值或密文信息，相应的，核心网设备接收来自请求方的校验值或密文信息。
步骤35a：核心网设备向第一终端发送所述校验值或密文信息，相应的，第一终端接收校验值或密文信息。
在一种可能的实现中，校验值或密文信息携带在核心网设备(例如AMF或TMF)向第一终端发送的响应(例如注册响应Registration Accept)消息中。
步骤36a：第一终端基于所述随机数校验所述校验值或密文信息。
例如，校验所述校验值或者密文信息的过程包括：基于所述随机数和预配置的密钥，校验所述校验值或者密文信息。
一种可能的实现方式中，校验密文信息的过程包括：解密所述密文信息，得到一数值(该数值可以称为明文信息)，将解密得到的数值与随机数(步骤31a中第一终端向核心网设备发送的随机数)进行比对。当两者相同时校验通过，则第一终端对请求方的单向认证通过。当两者不同时校验不通过，则第一终端对请求方的单向认证不通过。
另一种可能的实现方式中，校验该校验值的过程包括：将步骤31a中第一终端发送的随机数与预配置的密钥进行运算，获取校验值，将该校验值与步骤35a中第一终端接收的校验值进行比对。当两者相同时校验通过，则第一终端对请求方的单向认证通过。当两者不同时校验不通过，则第一终端对请求方的单向认证不通过。
如图3b所示，介绍了多种可能的请求方对第一终端执行单向认证的流程示意图。
一种可能的实现方式中，请求方对第一终端执行单向认证的流程包括：
步骤31b1：请求方向核心网设备发送随机数，相应的，核心网设备接收来自请求方的随机数。
示例性的，该随机数可以是针对第一终端的。针对不同的终端，请求方向核心网设备发送的随机数可以不同，以提高认证流程的安全性。示例性的，该随机数可以是针对群组终端的。
步骤32b1：核心网设备向第一终端发送所述随机数，相应的，第一终端接收随机数。
在一种可能的实现中，随机数携带在核心网设备(例如AMF或TMF)向第一终端发送的请求(例如鉴权请求(Authentication Request)或者认证请求(Authorization Request))消息中。另一种可能的实现方式中，核心网设备可以向接入网设备发送该随机数，接入网设备广播该随机数。当该接入网设备覆盖范围内的一个或多个终端随机接入成功后，可以基于该广播的随机数获取校验值或密文信息。一种可能的实现方式中，核心网设备可以向接入网设备发送多个随机数，接入网设备可以在不同时刻广播不同的随机数，例如接入网设备可以在不同周期的随机接入流程中广播不同的随机数，以提高安全性。示例性的，一个周期的随机接入流程可以是以广播select消息作为区分。例如，接入网设备可以在不同时刻发送的select消息中包括不同的随机数。
步骤33b1：第一终端基于所述随机数获取校验值或密文信息。
例如，获取校验值或密文信息的过程包括：第一终端基于所述随机数和预配置的密钥，获取校验值或密文信息。
一种可能的实现方式中，第一终端将所述随机数和预配置的密钥进行运算，获取校验值。
另一种可能的实现方式中，第一终端采用预配置的安全密钥将所述随机数进行加密，获取密文信息。
步骤34b1：第一终端向核心网设备发送所述校验值或密文信息，相应的，核心网设备接收来自所述第一终端的校验值或密文信息。
在一种可能的实现中，校验值或密文信息携带在第一终端向核心网设备(例如AMF或TMF)发送的响应(例如鉴权响应(Authentication Response)或者认证响应(Authorization Response))消息中。
步骤35b1：核心网设备向请求方发送所述校验值或密文信息，相应的，请求方接收校验值或密文信息。
步骤36b1：请求方基于所述随机数校验所述校验值或密文信息。
例如，校验所述校验值或者密文信息的过程包括：基于所述随机数和预配置的密钥，校验所述校验值或者密文信息。
一种可能的实现方式中，校验密文信息的过程包括：解密所述密文信息，得到一数值(该数值可以称为明文信息)，将解密得到的数值与随机数(步骤31b1中请求方向核心网设备发送的随机数)进行比对。当两者相同时校验通过，则请求方对第一终端的单向认证通过。当两者不同时校验不通过，则请求方对第一终端的单向认证不通过。
另一种可能的实现方式中，校验该校验值的过程包括：将步骤31b1中请求方发送的随机数与预配置的密钥进行运算，获取校验值，将该校验值与步骤35b1中请求方接收的校验值进行比对。当两者相同时校验通过，则请求方对第一终端的单向认证通过。当两者不同时校验不通过，则请求方对第一终端的单向认证不通过。
另一种可能的实现方式中，请求方对第一终端执行单向认证的流程包括：
步骤31b2：核心网设备获取随机数。
例如，获取随机数的过程包括：核心网设备生成随机数，或从其它核心网设备处获取随机数。一种可能的实现中，核心网设备为AMF，其它核心网设备为UDM、UDR、NSSAAF、AUSF、TMF或用于对终端执行管理的功能设备。
步骤32b2(与步骤32b1相同)：核心网设备向第一终端发送所述随机数，相应的，第一终端接收来自核心网设备的随机数。
在一种可能的实现中，随机数携带在核心网设备(例如AMF)向第一终端发送的请求(例如鉴权请求(Authentication Request)或者认证请求(Authorization Request))消息中。另一种可能的实现方式中，核心网设备向接入网设备发送随机数，接入网设备向终端发送该随机数。例如，接入网设备可以广播该随机数。示例性的，该随机数可以是针对群组终端的。例如，核心网设备可以向接入网设备发送该随机数，接入网设备广播该随机数。当该接入网设备覆盖范围内的一个或多个终端随机接入成功后，可以基于该广播的随机数获取校验值或密文信息。一种可能的实现方式中，核心网设备可以向接入网设备发送多个随机数，接入网设备可以在不同时刻广播不同的随机数，例如接入网设备可以在不同周期的随机接入流程中广播不同的随机数，以提高安全性。示例性的，一个周期的随机接入流程可以是以广播select消息作为区分。例如，接入网设备可以在不同时刻发送的select消息中包括不同的随机数。
步骤33b2(与步骤33b1相同)：第一终端基于所述随机数获取校验值或密文信息。
例如，获取校验值或密文信息的过程包括：第一终端基于所述随机数和预配置的密钥，获取校验值或密文信息。
一种可能的实现方式中，第一终端可以将所述随机数和预配置的密钥进行运算，获取校验值。
另一种可能的实现方式中，第一终端采用预配置的密钥将所述随机数进行加密，获取密文信息。
步骤34b2：第一终端向核心网设备发送所述校验值或密文信息，相应的，核心网设备接收来自所述第一终端的校验值或密文信息。
在一种可能的实现中，校验值或密文信息携带在第一终端向核心网设备(例如AMF)发送的响应(例如鉴权响应(Authentication Response)或者认证响应(Authorization Response))消息中。
进一步可选的，第一终端在向核心网设备发送校验值或密文信息时，也可以将随机数(步骤32b2中核心网设备向第一终端发送的随机数)发送给核心网设备。当第一终端不向核心网设备发送随机数时，可以防止窃听者通过空口监听第一终端的随机数，可以提高安全性、可靠性。
步骤35b2：核心网设备向所述请求方发送所述随机数(核心网设备在步骤31b2中获取到的随机数或步骤34b2中来自第一终端的随机数)和所述校验值(或密文信息)，相应的，请求方接收来自核心网设备的随机数和校验值(或密文信息)。
示例性的，当第一终端没有向核心网设备发送随机数时，核心网设备可以向请求方发送步骤31b2中获取的随机数。
在一种具体的示例中，核心网设备为AMF或者TMF，AMF与请求方之间通过NEF进行通信。AMF可以先向NEF发送随机数和校验值(或密文信息)，NEF再将随机数和校验值(或密文信息)发送给请求方。
一种可能的实现中，随机数和校验值(或密文信息)可以携带在AMF发送给NEF的请求(例如鉴权请求(Authentication Request)或者认证请求(Authorization Request))消息中。
步骤36b2：请求方基于所述随机数对校验所述校验值或密文信息。
例如，校验所述校验值或者密文信息的过程包括：基于所述随机数和预配置的密钥，校验所述校验值或者密文信息。
一种可能的实现方式中，校验密文信息的过程包括：解密所述密文信息，得到一数值(该数值可以称为明文信息)，将解密得到的数值与随机数(步骤35b2中从核心网设备接收到的随机数)进行比对。当两者相同时校验通过，则请求方对第一终端的单向认证通过。当两者不同时校验不通过，则请求方对第一终端的单向认证不通过。
另一种可能的实现方式中，校验该校验值的过程包括：将步骤35b2中请求方接收的随机数与预配置的密钥进行运算，获取校验值，将该校验值与步骤35b2中请求方接收的校验值进行比对。当两者相同时校验通过，则请求方对第一终端的单向认证通过。当两者不同时校验不通过，则请求方对第一终端的单向认证不通过。
如图3c所示，介绍了多种可能的第一终端与请求方进行双向认证的流程示意图。
步骤31c：第一终端向核心网设备发送第一随机数，相应的，核心网设备接收来自第一终端的第一随机数。
第一随机数可以是第一终端中预先配置的，也可以是第一终端随机生成的。在一种可能的实现中，随机数携带在第一终端向核心网设备(例如AMF或TMF)发送的请求(例如注册请求(Registration Request))消息中。
步骤32c：核心网设备向所述请求方发送所述第一随机数，相应的，请求方接收第一随机数。
步骤33c：请求方基于所述第一随机数获取第一校验值或第一密文信息。
该过程可以包括以下多种方式：
方式1：请求方基于第一随机数和预配置的密钥，获取第一密文信息。一种可能的实现方式中，请求方可以采用预配置的安全密钥将第一随机数进行加密，获取第一密文信息。
方式2：请求方基于第一随机数和预配置的密钥，获取第一校验值。一种可能的实现方式中，请求方可以将第一随机数和预配置的密钥进行运算，获取第一校验值。
方式3：请求方基于第一随机数和第二随机数，获取第一密文信息。示例性的，该过程包括：请求方基于第一随机数、第二随机数和预配置的密钥，获取第一密文信息。一种可能的实现方式中，请求方采用预配置的密钥将第一随机数、第二随机数进行加密，获取第一密文信息。第二随机数可以是请求方生成的或请求方中预配置的。
方式4：请求方基于第一随机数和第二随机数，获取第一校验值。示例性的，该过程包括：请求方基于第一随机数、第二随机数和预配置的密钥，获取第一校验值。一种可能的实现方式中，请求方可以将第一随机数、第二随机数和预配置的密钥进行运算，获取第一校验值。第二随机数可以是请求方生成的或请求方中预配置的。
步骤34c：请求方向核心网设备发送所述第一校验值或第一密文信息，相应的，核心网设备接收来自请求方的第一校验值或第一密文信息。
在步骤33c中，请求方基于方式1、或方式2、或方式4获取第一校验值或第一密文信息时，可选的，请求方还可以将第二随机数发送给核心网设备。
步骤35c：核心网设备向第一终端发送所述第一校验值或第一密文信息，相应的，第一终端接收第一校验值或第一密文信息。
在一种可能的实现中，第一校验值或第一密文信息携带在核心网设备(例如AMF或TMF)向第一终端发送的请求(例如鉴权请求(Authentication Request)或者认证请求(Authorization Request))消息中。
可选的，在步骤34c接收到第二随机数的场景下，核心网设备还可以向第一终端发送第二随机数。
步骤36c：第一终端基于所述第一随机数校验所述第一校验值或第一密文信息。
例如，校验所述第一校验值或者密文信息的过程包括：基于所述第一随机数和预配置的密钥，校验所述第一校验值或者密文信息。
与步骤33c的方式1相对应的校验过程包括：解密所述第一密文信息，得到一数值(该数值可以称为明文信息)，将解密得到的数值与第一随机数(步骤31c中第一终端发送的第一随机数)进行比对。当两者相同时校验通过，则第一终端对请求方的单向认证通过。当两者不同时校验不通过，则第一终端对请求方的单向认证不通过。
与步骤33c的方式2相对应的校验过程包括：将步骤31c中第一终端发送的第一随机数与预配置的密钥进行运算，获取校验值，将该校验值与步骤35c中第一终端接收的第一校验值进行比对。当两者相同时校验通过，则第一终端对请求方的单向认证通过。当两者不同时校验不通过，则第一终端对请求方的单向认证不通过。
与步骤33c的方式3相对应的校验过程包括：解密第一密文信息，得到两个数值(数值可以称为明文信息)，将解密得到的两个数值与第一随机数(步骤31c中第一终端发送的第一随机数)进行比对。当某一个数值(可以限制其解密出来的顺序为第一个数值，或第二个数值，也可以不限制其解密出来的顺序)与第一随机数相同时，第一终端对请求方的单向认证通过。当任一数值与第一随机数不同时，第一终端对请求方的单向认证不通过。
与步骤33c的方式4相对应的校验过程包括：将步骤31c中第一终端发送的第一随机数、步骤35c中接收到的第二随机数与预配置的密钥进行运算，获取校验值，将该校验值与步骤35c中第一终端接收 的第一校验值进行比对。当两者相同时校验通过，则第一终端对请求方的单向认证通过。当两者不同时校验不通过，则第一终端对请求方的单向认证不通过。
步骤37c：在第一终端对请求方的单向认证通过的基础上，第一终端生成第二校验值或者第二密文信息。
在步骤35c中，若第一终端接收到第二随机数(即对应方式1、方式2或方式4)，第一终端生成第二校验值或第二密文信息的过程包括：第一终端基于所述第二随机数和预配置的密钥，获取第二校验值或第二密文信息。一种可能的实现方式中，第一终端将所述第二随机数和预配置的密钥进行运算，获取第二校验值。另一种可能的实现方式中，第一终端采用预配置的密钥将所述第二随机数进行加密，获取第二密文信息。
在步骤35c中，若第一终端未接收到第二随机数(即对应方式3)，第一终端生成第二校验值或第二密文信息的过程包括：第一终端基于第三随机数和解密出的除第一随机数之外的数值(在第一终端对请求方的单向认证通过的情况下，解密出的除第一随机数之外的数值是与第二随机数相同的数值)，生成第二校验值或者第二密文信息。第三随机数可以是第一终端中预先配置的，也可以是第一终端随机生成的。例如，第一终端基于第三随机数、解密出的除第一随机数之外的数值和预配置的密钥，生成第二校验值或者第二密文信息。一种可能的实现方式中，第一终端采用预配置的密钥将第三随机数和解密出的除第一随机数之外的数值进行加密，获取第二密文信息。一种可能的实现方式中，第一终端将第三随机数、解密出的除第一随机数之外的数值和预配置的密钥进行运算，获取第二校验值。
步骤38c：第一终端向核心网设备发送所述第二校验值或者第二密文信息，相应的，核心网设备接收来自所述第一终端的第二校验值或者第二密文信息。
可选的，第一终端向核心网设备发送所述第三随机数。例如，步骤37c中，当第一终端将第三随机数、解密出的除第一随机数之外的数值和预配置的密钥进行运算，获取第二校验值时，第一终端向核心网设备发送第三随机数。
在一种可能的实现中，第二校验值(可选的，还包括第三随机数)携带在第一终端向核心网设备(例如AMF或TMF)发送的响应(例如鉴权响应(Authentication Response)或者认证响应(Authorization Response))消息中。
步骤39c：核心网设备向所述请求方发送所述第二校验值或者第二密文信息，相应的，请求方接收第二校验值或者第二密文信息。
可选的，在步骤38c中接收到第三随机数时，核心网设备还可以向请求方发送第三随机数。
步骤30c：请求方基于第二随机数校验所述第二校验值或者第二密文信息。
例如，校验所述第二校验值或者第二密文信息的过程包括：基于所述第二随机数和预配置的密钥，校验所述第二校验值或者第二密文信息。
一种可能的实现方式中，若步骤37c中，第一终端采用预配置的密钥将所述第二随机数进行加密，获取第二密文信息。则请求方校验第二密文信息的过程包括：解密第二密文信息，得到一数值(数值可以称为明文信息)，将解密得到的数值与第二随机数(步骤34c中请求方发送第二随机数)进行比对。当两者相同时校验通过，请求方对第一终端的单向认证通过。当两者不同时校验不通过，请求方对第一终端的单向认证不通过。
一种可能的实现方式中，若步骤37c中，第一终端将所述第二随机数和预配置的密钥进行运算，获取第二校验值。则请求方校验第二校验值的过程包括：将步骤34c中请求方发送第二随机数与预配置的密钥进行运算，获取校验值，将该校验值与步骤39c中请求方接收的第二校验值进行比对。当两者相同时校验通过，则请求方对第一终端的单向认证通过。当两者不同时校验不通过，则请求方对第一终端的单向认证不通过。
一种可能的实现方式中，若步骤37c中，第一终端采用预配置的密钥将第三随机数和解密出的除第一随机数之外的数值进行加密，获取第二密文信息。则请求方校验第二密文信息的过程包括：解密第二密文信息，得到两个数值(数值可以称为明文信息)，将解密得到的两个数值与第二随机数(步骤33c的方式3中的第二随机数)进行比对。当某一个数值(可以限制其解密出来的顺序为第一个数值，或第二个数值，也可以不限制其解密出来的顺序)与第二随机数相同时，请求方对第一终端的单向认证通过。当任一数值与第二随机数不同时，请求方对第一终端的单向认证不通过。
另一种可能的实现方式中，若步骤37c中，第一终端将第三随机数、解密出的除第一随机数之外的 数值和预配置的密钥进行运算，获取第二校验值。则请求方校验第二校验值的过程包括：将请求方在步骤39c中接收的第三随机数、请求方生成的第二随机数与预配置的密钥进行运算，获取校验值，将该校验值与步骤39c中请求方接收的第二校验值进行比对。当两者相同时校验通过，则请求方对第一终端的单向认证通过。当两者不同时校验不通过，则请求方对第一终端的单向认证不通过。
第一终端对请求方的单向认证通过，且请求方对第一终端的单向认证通过，即请求方与第一终端的双向认证通过。
如图3d所示，介绍了多种可能的第一终端对核心网设备对应的第一网络执行单向认证的流程示意图。
步骤31d：第一终端向核心网设备发送第一随机数，相应的，核心网设备接收来自第一终端的第一随机数。
第一随机数可以是第一终端中预先配置的，或者第一终端随机生成的。在一种可能的实现中，随机数携带在第一终端向核心网设备(例如AMF或TMF)发送的请求(例如注册请求(Registration Request))消息中。
步骤32d：核心网设备获取第二随机数。
该步骤32d为可选的步骤，可以不执行。
核心网设备获取第二随机数的一种方式为核心网设备生成第二随机数，另一种方式为核心网设备从其它核心网设备处获取第二随机数。一种可能的实现中，核心网设备为AMF，其它核心网设备为UDM、AUSF、UDR、NSSAAF、NEF、PCF、TMF或用于对终端管理或者标签管理的功能设备。
步骤33d：核心网设备基于所述第一随机数，获取校验值或者密文信息。
该过程可以包括以下多种方式：
方式1：核心网设备基于第一随机数和预配置的密钥，获取密文信息。一种可能的实现方式中，核心网设备可以采用预配置的安全密钥将第一随机数进行加密，获取密文信息。
方式2：核心网设备基于第一随机数和预配置的密钥，获取校验值。一种可能的实现方式中，核心网设备可以将第一随机数和预配置的密钥进行运算，获取校验值。
方式3：核心网设备基于第一随机数和第二随机数，获取密文信息。示例性的，该过程包括：核心网设备基于第一随机数、第二随机数和预配置的密钥，获取密文信息。一种可能的实现方式中，核心网设备采用预配置的密钥将第一随机数、第二随机数进行加密，获取密文信息。
方式4：核心网设备基于第一随机数和第二随机数，获取校验值。示例性的，该过程包括：核心网设备基于第一随机数、第二随机数和预配置的密钥，获取校验值。一种可能的实现方式中，核心网设备将第一随机数、第二随机数和预配置的密钥进行运算，获取校验值。
步骤34d：核心网设备向第一终端发送所述校验值或者密文信息，相应的，第一终端接收来自核心网设备的校验值或密文信息。
在步骤33d中，核心网设备基于方式1、或方式2、或方式4获取校验值或密文信息时，可选的，核心网设备还可以将第二随机数发送给第一终端。
在一种可能的实现中，校验值或密文信息携带在核心网设备(例如AMF或TMF)向第一终端发送的注册接受(Registration Accept)消息中。
步骤35d：第一终端基于第一随机数校验所述校验值或密文信息。
与步骤33d的方式1相对应的校验过程包括：解密所述第一密文信息，得到一数值(该数值可以称为明文信息)，将解密得到的数值与第一随机数(步骤31d中第一终端发送的第一随机数)进行比对。当两者相同时校验通过，则第一终端对核心网设备对应的第一网络的单向认证通过。当两者不同时校验不通过，则第一终端对核心网设备对应的第一网络的单向认证不通过。
与步骤33d的方式2相对应的校验过程包括：将步骤31d中第一终端发送的第一随机数与预配置的密钥进行运算，获取校验值，将该校验值与步骤34d中第一终端接收的校验值进行比对。当两者相同时校验通过，则第一终端对核心网设备对应的第一网络的单向认证通过。当两者不同时校验不通过，则第一终端对核心网设备对应的第一网络的单向认证不通过。
与步骤33d的方式3相对应的校验过程包括：解密所述密文信息，得到两个数值(数值可以称为明文信息)，将解密得到的两个数值与第一随机数(步骤31c中第一终端发送的第一随机数)进行比对。当某一个数值(可以限制其解密出来的顺序为第一个数值，或第二个数值，也可以不限制其解密出来的 顺序)与第一随机数相同时校验通过，则第一终端对核心网设备对应的第一网络的单向认证通过。当任一数值与第一随机数不同时校验不通过，则第一终端对核心网设备对应的第一网络执行单向认证不通过。
与步骤33d的方式4相对应的校验过程包括：将步骤31d中第一终端发送的第一随机数、步骤34d中接收到的第二随机数与预配置的密钥进行运算，获取校验值，将该校验值与步骤34d中第一终端接收的校验值进行比对。当两者相同时校验通过，则第一终端对核心网设备对应的第一网络的单向认证通过。当两者不同时校验不通过，则第一终端对核心网设备对应的第一网络的单向认证不通过。
如图3e所示，介绍了多种可能的核心网设备对应的第一网络对第一终端执行单向认证的流程示意图。
步骤31e：核心网设备获取随机数。
核心网设备获取随机数的一种方式为核心网设备生成随机数，另一种方式为核心网设备从其它核心网设备处获取随机数。
一种可能的实现中，核心网设备为AMF，其它核心网设备为UDM、AUSF、UDR、NSSAAF、NEF、PCF、TMF或用于对终端管理或者标签管理的功能设备。核心网设备针对每个终端生成不同的随机数，可以避免多个终端共用相同的随机数，可以提高认证流程的安全性提高安全。核心网设备在执行认证的流程中生成随机数，可以保证随机数的新鲜，进一步提高认证流程的安全性可靠性。
步骤32e：核心网设备向所述第一终端发送所述随机数，相应的，第一终端接收来自核心网设备的随机数。
在一种可能的实现中，随机数携带在核心网设备(例如AMF)向第一终端发送的鉴权请求(Authentication Request)消息或者认证请求(Authorization Request)消息中。另一种可能的实现方式中，核心网设备可以向接入网设备发送该随机数，接入网设备广播该随机数。当该接入网设备覆盖范围内的一个或多个终端随机接入成功后，可以基于该广播的随机数获取校验值或密文信息。一种可能的实现方式中，核心网设备可以向接入网设备发送多个随机数，接入网设备可以在不同时刻广播不同的随机数，例如接入网设备可以在不同周期的随机接入流程中广播不同的随机数，以提高安全性。示例性的，一个周期的随机接入流程可以是以广播select消息作为区分。例如，接入网设备可以在不同时刻发送的select消息中包括不同的随机数。
步骤33e：第一终端基于随机数获取校验值或密文信息。
例如，获取校验值或密文信息的过程包括：第一终端基于所述随机数和预配置的密钥，获取校验值或密文信息。
一种可能的实现方式中，第一终端可以将所述随机数和预配置的密钥进行运算，获取校验值。
另一种可能的实现方式中，第一终端采用预配置的密钥将所述随机数进行加密，获取密文信息。
步骤34e：第一终端向核心网设备发送校验值或密文信息，相应的，核心网设备接收来自所述第一终端的校验值或密文信息。
在一种可能的实现中，校验值或密文信息携带在第一终端向核心网设备(例如AMF或TMF)发送的响应(例如鉴权响应(Authentication Response)或者认证响应(Authorization Response))消息中。
进一步可选的，第一终端在向核心网设备发送校验值或密文信息时，也可以将随机数发送给核心网设备。当第一终端不向核心网设备发送随机数时，可以防止窃听者通过空口监听第一终端的随机数，可以提高安全性、可靠性。
步骤35e：核心网设备基于随机数(步骤32e中核心网设备发送的随机数或步骤34e中核心网设备接收的随机数)对所述校验值或密文信息进行校验。
例如，校验所述校验值或者密文信息的过程包括：基于所述随机数和预配置的密钥，校验所述校验值或者密文信息。
一种可能的实现方式中，校验密文信息的过程包括：解密密文信息，得到一数值(数值可以称为明文信息)，将解密得到的数值与随机数(步骤32e中核心网设备发送的随机数或步骤34e中核心网设备接收的随机数)进行比对。当两者相同时校验通过，则核心网设备对应的第一网络对第一终端执行的单向认证通过。当两者不同时校验不通过，则核心网设备对应的第一网络对所述第一终端执行的单向认证不通过。
另一种可能的实现方式中，校验该校验值的过程包括：将随机数(步骤32e中核心网设备发送的随机数或步骤34e中核心网设备接收的随机数)与预配置的密钥进行运算，获取校验值，将该校验值与 步骤34e中核心网设备接收的校验值进行比对。当两者相同时校验通过，则核心网设备对应的第一网络对第一终端的单向认证通过。当两者不同时校验不通过，则核心网设备对应的第一网络对第一终端的单向认证不通过。
步骤35e与步骤36e为两种并列的方式。
步骤36e：核心网设备将校验值或密文信息(可选的，还可以包括随机数)发送给其它核心网设备。
一种可能的实现方式中，当核心网设备在步骤31e生成随机数，而非从其它核心网设备获取随机数，核心网设备可以向其他核心网设备发送该随机数。
步骤37e：其它核心网设备基于随机数(步骤31e中核心网设备从其它核心网设备处获取的随机数，或步骤36e中从核心网设备接收到的随机数)对所述校验值或密文信息进行校验。
步骤37e的校验过程与步骤35e的校验过程类似，可以相互参考，不再重复赘述。
在校验通过后，其它核心网设备向核心网设备发送校验通过/认证成功的信息。在一种可能的实现中，校验值或密文信息(可选的，还可以包括随机数)可以携带在核心网设备向其它核心网设备发送的请求(例如鉴权请求(Authentication Request)或者认证请求(Authorization Request))消息中。校验通过/认证成功的信息可以携带在其它核心网设备向核心网设备发送的响应(例如鉴权响应(Authentication Response)或者认证响应(Authorization Response))消息中。在目前的技术中，终端设备的随机数通常由认证方生成并发送给终端设备，而在该方式中，认证方为其它核心网设备，由核心网设备自身生成针对第一终端的随机数并发送给终端设备，无需其它核心网设备向核心网设备发送针对第一终端的随机数，可以节省信令开销。
如图3f所示，介绍了多种可能的第一终端与核心网设备对应的第一网络的双向认证的流程示意图。
步骤31f：第一终端向核心网设备发送第一随机数，相应的，核心网设备接收来自所述第一终端的第一随机数。
第一随机数可以是第一终端中预先配置的，也可以是第一终端随机生成的。在一种可能的实现中，随机数携带在第一终端向核心网设备(例如AMF)发送的请求(例如注册请求(Registration Request))消息中。
步骤32f：核心网设备获取第二随机数。
步骤32f为可选的步骤，可以不执行。
核心网设备获取第二随机数的一种方式为核心网设备生成第二随机数，另一种方式为核心网设备从其它核心网设备处获取随机数。
一种可能的实现中，核心网设备为AMF，其它核心网设备为UDM、AUSF、UDR、NEF、NSSAAF、PCF或用于对终端管理或者标签管理的功能设备。核心网设备针对每个终端生成不同的随机数，可以避免多个终端共用相同的随机数，可以提高认证流程的安全性提高安全。核心网设备在执行认证的流程中生成随机数，可以保证随机数的新鲜，进一步提高认证流程的安全性可靠性。
步骤33f(与步骤33c类似)：核心网设备基于所述第一随机数获取第一校验值或第一密文信息。
该过程可以包括以下多种方式：
方式1：核心网设备基于第一随机数和预配置的密钥，获取第一密文信息。一种可能的实现方式中，核心网设备可以采用预配置的安全密钥将第一随机数进行加密，获取第一密文信息。
方式2：核心网设备基于第一随机数和预配置的密钥，获取第一校验值。一种可能的实现方式中，核心网设备可以将第一随机数和预配置的密钥进行运算，获取第一校验值。
方式3：核心网设备基于第一随机数和第二随机数，获取第一密文信息。示例性的，该过程包括：核心网设备基于第一随机数、第二随机数和预配置的密钥，获取第一密文信息。一种可能的实现方式中，核心网设备采用预配置的密钥将第一随机数、第二随机数进行加密，获取第一密文信息。
方式4：核心网设备基于第一随机数和第二随机数，获取第一校验值。示例性的，该过程包括：核心网设备基于第一随机数、第二随机数和预配置的密钥，获取第一校验值。一种可能的实现方式中，核心网设备可以将第一随机数、第二随机数和预配置的密钥进行运算，获取第一校验值。
步骤34f：核心网设备向所述第一终端发送所述第一校验值或第一密文信息，相应的，第一终端接收来自核心网设备的第一校验值或第一密文信息。
在步骤33f中，核心网设备基于方式1、或方式2、或方式4获取第一校验值或第一密文信息时，可选的，核心网设备还可以将第二随机数发送给第一终端。
在一种可能的实现中，第一校验值或第一密文信息(可选的，还包括第二随机数)携带在核心网设备(例如AMF或TMF)向第一终端发送的注册接受(Registration Accept)消息中。
步骤35f(与步骤36c类似)：第一终端基于所述第一随机数校验所述第一校验值或第一密文信息。
例如，校验所述第一校验值或者密文信息的过程包括：基于所述第一随机数和预配置的密钥，校验所述第一校验值或者密文信息。
与步骤33f的方式1相对应的校验过程包括：解密所述第一密文信息，得到一数值(该数值可以称为明文信息)，将解密得到的数值与第一随机数(步骤31f中第一终端发送的第一随机数)进行比对。当两者相同时校验通过，则第一终端对核心网设备对应的第一网络的单向认证通过。当两者不同时校验不通过，则第一终端对核心网设备对应的第一网络的单向认证不通过。
与步骤33f的方式2相对应的校验过程包括：将步骤31f中第一终端发送的第一随机数与预配置的密钥进行运算，获取校验值，将该校验值与步骤34f中第一终端接收的第一校验值进行比对。当两者相同时校验通过，则第一终端对核心网设备对应的第一网络的单向认证通过。当两者不同时校验不通过，则第一终端对核心网设备对应的第一网络的单向认证不通过。
与步骤33f的方式3相对应的校验过程包括：解密第一密文信息，得到两个数值(数值可以称为明文信息)，将解密得到的两个数值与第一随机数(步骤31f中第一终端发送的第一随机数)进行比对。当某一个数值(可以限制其解密出来的顺序为第一个数值，或第二个数值，也可以不限制其解密出来的顺序)与第一随机数相同时，第一终端对核心网设备对应的第一网络的单向认证通过。当任一数值与第一随机数不同时，第一终端对核心网设备对应的第一网络的单向认证不通过。
与步骤33f的方式4相对应的校验过程包括：将步骤31f中第一终端发送的第一随机数、步骤34f中接收到的第二随机数与预配置的密钥进行运算，获取校验值，将该校验值与步骤34f中第一终端接收的第一校验值进行比对。当两者相同时校验通过，则第一终端对核心网设备对应的第一网络的单向认证通过。当两者不同时校验不通过，则第一终端对核心网设备对应的第一网络的单向认证不通过。
步骤36f(与步骤37c类似)：在第一终端对第一网络的单向认证通过的基础上，第一终端生成第二校验值或第二密文信息。
在步骤34f中，若第一终端接收到第二随机数(即对应方式1、方式2或方式4)，第一终端生成第二校验值或第二密文信息的过程包括：第一终端基于所述第二随机数和预配置的密钥，获取第二校验值或第二密文信息。一种可能的实现方式中，第一终端将所述第二随机数和预配置的密钥进行运算，获取第二校验值。另一种可能的实现方式中，第一终端采用预配置的密钥将所述第二随机数进行加密，获取第二密文信息。
在步骤34f中，若第一终端未接收到第二随机数(即对应方式3)，第一终端生成第二校验值或第二密文信息的过程包括：第一终端基于第三随机数和解密出的除第一随机数之外的数值(在第一终端对请求方的单向认证通过的情况下，解密出的除第一随机数之外的数值是与第二随机数相同的数值)，生成第二校验值或者第二密文信息。第三随机数可以是第一终端中预先配置的，也可以是第一终端随机生成的。例如，第一终端基于第三随机数、解密出的除第一随机数之外的数值和预配置的密钥，生成第二校验值或者第二密文信息。一种可能的实现方式中，第一终端采用预配置的密钥将第三随机数和解密出的除第一随机数之外的数值进行加密，获取第二密文信息。一种可能的实现方式中，第一终端将第三随机数、解密出的除第一随机数之外的数值和预配置的密钥进行运算，获取第二校验值。
步骤37f：第一终端向核心网设备发送所述第二校验值或第二密文信息，相应的，核心网设备接收来自所述第一终端的第二校验值或第二密文信息。
可选的，第一终端向核心网设备发送所述第三随机数。例如，在步骤36f中，当第一终端将第三随机数、解密出的除第一随机数之外的数值和预配置的密钥进行运算，获取第二校验值时，第一终端向核心网设备发送第三随机数。
在一种可能的实现中，第二校验值或第二密文信息携带在第一终端向核心网设备(例如AMF或TMF)发送的响应(例如鉴权响应(Authentication Response)或者认证响应(Authorization Response))消息中。
进一步可选的，第一终端在向核心网设备发送第二校验值或第二密文信息时，也可以将步骤34f中接收到的第二随机数发送给核心网设备。当第一终端不向核心网设备发送第二随机数时，可以防止恶意监听。
步骤38f(与步骤30c类似)：核心网设备基于所述第二随机数对所述第二校验值或第二密文信息进行校验。
例如，校验所述第二校验值或者第二密文信息的过程包括：基于所述第二随机数和预配置的密钥，校验所述第二校验值或者第二密文信息。
一种可能的实现方式中，若步骤36f中，第一终端采用预配置的密钥将所述第二随机数进行加密，获取第二密文信息。则核心网设备校验第二密文信息的过程包括：解密第二密文信息，得到一数值(数值可以称为明文信息)，将解密得到的数值与第二随机数(步骤34c中请求方发送第二随机数)进行比对。当两者相同时校验通过，核心网设备对应的第一网络对第一终端的单向认证通过。当两者不同时校验不通过，核心网设备对应的第一网络对第一终端的单向认证不通过。
一种可能的实现方式中，若步骤36f中，第一终端将所述第二随机数和预配置的密钥进行运算，获取第二校验值。则核心网设备校验第二校验值的过程包括：将步骤34f中核心网设备发送第二随机数与预配置的密钥进行运算，获取校验值，将该校验值与步骤37f中核心网设备接收的第二校验值进行比对。当两者相同时校验通过，则核心网设备对应的第一网络对第一终端的单向认证通过。当两者不同时校验不通过，则核心网设备对应的第一网络对第一终端的单向认证不通过。
一种可能的实现方式中，若步骤36f中，第一终端采用预配置的密钥将第三随机数和解密出的除第一随机数之外的数值进行加密，获取第二密文信息。则核心网设备校验第二密文信息的过程包括：解密第二密文信息，得到两个数值(数值可以称为明文信息)，将解密得到的两个数值与第二随机数(步骤33f的方式3中的第二随机数)进行比对。当某一个数值(可以限制其解密出来的顺序为第一个数值，或第二个数值，也可以不限制其解密出来的顺序)与第二随机数相同时，核心网设备对应的第一网络对第一终端的单向认证通过。当任一数值与第二随机数不同时，核心网设备对应的第一网络对第一终端的单向认证不通过。
另一种可能的实现方式中，若步骤36f中，第一终端将第三随机数、解密出的除第一随机数之外的数值和预配置的密钥进行运算，获取第二校验值。则核心网设备校验第二校验值的过程包括：将在步骤37f中接收的第三随机数、步骤32f中获取的第二随机数与预配置的密钥进行运算，获取校验值，将该校验值与步骤37f中核心网设备接收的第二校验值进行比对。当两者相同时校验通过，则核心网设备对应的第一网络对第一终端的单向认证通过。当两者不同时校验不通过，则核心网设备对应的第一网络对第一终端的单向认证不通过。
第一终端对第一网络的单向认证通过，且第一网络对第一终端的单向认证通过，即第一网络与第一终端的双向认证通过。
在上述各个认证方式对应的流程中，第一终端向核心网设备发送的用于执行认证的参数(例如随机数、或第一随机数、或校验值、或密文信息、或第二校验值、第二密文信息)，可以携带在第一消息中，第一消息可以是注册请求消息、或接入请求消息、或用于接入网设备的请求消息、或用于注册网络的请求消息，本申请对于第一消息的名称不做限定。第一消息可以是非接入层(non-access stratum，NAS)消息或非NAS消息。
针对核心网设备获取到的第一终端的认证方式为不执行认证的场景：
一种可能的实现中，核心网设备无需执行认证流程，或者核心网设备跳过第一终端的认证流程。
另一种可能的实现中，核心网设备还可以基于第一终端的位置做进一步决策，来确定最终的第一终端的认证方式。
例如，核心网设备确定第一终端的位置属于预设位置范围内时，核心网设备允许所述请求方或所述核心网设备对应的第一网络不执行所述第一终端的认证流程，或者允许所述请求方或所述核心网设备对应的第一网络跳过所述第一终端的认证流程。可以理解为核心网设备确定第一终端的位置属于预设位置范围内时，第一终端对应的认证方式最终确定为不执行认证。
例如，核心网设备确定第一终端的位置在预设位置范围外或者第一终端的位置不属于预设范围内时，核心网设备执行配置的认证方式对应的流程，所述配置的认证方式用于认证接入所述核心网设备所在的网络的终端。进一步地，所述配置的认证方式用于认证接入所述核心网设备所在的网络的第一类型终端。第一类型终端可以包括物联终端、无源物联终端、半无源物联终端、半有源物联终端或者有源物联终端等。可以理解为核心网设备确定第一终端的位置在预设位置范围外时，第一终端对应的认证方式最终确定为配置的认证方式。其中，配置的认证方式可以配置于该核心网设备，或者可以配置于其他核心网设 备，该核心网设备可以从其他核心网设备获取该配置的认证方式。
配置的认证方式可以是第一终端对请求方的单向认证、或请求方对第一终端的单向认证、或第一终端与请求方的双方认证、或第一终端对核心网设备对应的第一网络的单向认证、或核心网设备对应的第一网络对第一终端的单向认证、或第一终端与核心网设备对应的第一网络的双向认证，或者其他认证方式。
一种可选的示例中，第一终端的位置可以通过地理位置来表示。例如，地理位置为经纬度，或坐标值。第一终端的位置包括但不限于以下的一项或多项：第一终端所在的地理位置，对第一终端执行随机接入的第二终端所在的地理位置。
预设位置范围可以是预设地理位置范围，预设地理位置范围可以是一个或多个地理位置的集合。
确定所述第一终端的位置属于预设位置范围内具体可以是，确定表示第一终端的位置的地理位置属于预设地理位置范围内。确定第一终端的位置在预设位置范围外具体可以是，确定表示第一终端的位置的地理位置在预设地理位置范围外。
一种可选的示例中，第一终端的位置可以由第一标识表征(可以理解为通过第一标识来表示)，例如，第一标识包括但不限于以下的一项或多项：第一终端接入的接入网设备的标识、第一终端所在的小区(cell)的标识(cell ID)、第一终端所在的跟踪区(tracking area，TA)的标识(TAI)、第一终端接入的网络的标识、第一终端接入的切片的标识、第一终端接入的封闭接入组(closed access group，CAG)的标识(CAG ID)、第二终端接入的接入网设备的标识、第二终端所在的小区的标识、第二终端所在的跟踪区的标识、第二终端接入的网络的标识、第一终端接入的切片的标识、第二终端接入的封闭接入组的标识，其中，所述第二终端为对所述第一终端执行随机接入的终端。
其中，接入网的标识可以是ID(例如无线接入网全球编号RAN Global ID或者gNodeB ID等)、地址信息、端口信息、域名信息。接入的网络的标识可以是公共陆地移动网络(public land mobile network，PLMN)标识，也可以是非公共网络标识，如PLMN ID和网络标识符(network identifier，NID)的组合。示例性的，公共陆地移动网络(public land mobile network，PLMN)标识可以是移动国家码(mobile country code，MCC)和移动网络码(mobile network code，MNC)的组合。
预设位置范围可以是预设标识范围，预设标识范围可以是一个或多个标识的集合。
确定所述第一终端的位置属于预设位置范围内具体可以是，确定表示第一终端的位置的第一标识属于预标识范围内。确定所述第一终端的位置在预设位置范围外具体可以是，确定表示第一终端的位置的第一标识在不属于预设标识范围或者属于预设标识范围外。
一种可选的示例中，第一终端的位置可以通过地理位置和第一标识来表示。具体细节可以参考上文描述，不再重复赘述。
在一种可能的实现中，在上述示例的基础上，核心网设备在接收到来自请求方的第一信息之后，核心网设备还可以获取第一终端的标识，并向请求方发送获取到的第一终端的标识。例如，核心网设备获取第一终端的标识包括：核心网设备接收来自第一终端发送的第一终端的标识。
示例性的，核心网设备在接收到第一信息后，指示接入网设备执行第一终端的随机接入过程。接入网设备执行第一终端的随机接入过程后，第一终端通过接入网设备向核心网设备发送第一终端的标识。第一终端的标识可以携带在第二消息中，第二消息可以是注册请求消息、或接入消息、或接入请求消息、或用于接入网络的请求消息、或用于注册网络的请求消息，本申请对于第二消息的名称不做限定。第二消息可以是NAS消息或非NAS消息。第一消息与第二消息可以相同，也可以不同。在目前的技术中，终端设备的标识可以携带在注册请求消息中，在本申请实施例中，对于携带终端设备的标识的消息进行扩展，不再受限于注册请求消息。另外，当第一消息与第二消息相同时，第一终端可以无需通过独立的消息向核心网设备发送用于执行认证的参数(例如随机数、或第一随机数、或校验值、或第二校验值)，可以节省信令交互。
步骤202和步骤203，与核心网设备获取第一终端的标识的先后顺序不进行限制。若在执行认证流程且确定认证通过后，核心网设备获取第一终端的标识并向请求方发送第一终端的标识，可以提高安全性。
以下对各个认证流程中的信息交互，与核心网设备获取第一终端的标识并向请求方发送获取到的第一终端的标识的先后顺序进行示例性说明。
在第一终端对应的认证方式为第一终端对请求方的单向认证(参考图3a)时，第一终端向核心网设备发送的第一终端的标识和随机数可以在一条消息中发送给核心网设备，也可以在不同消息中发送给核心网设备。若在第一终端对请求方的单向认证通过(即第一终端基于随机数校验所述校验值或密文信息通过)后，第一终端再将第一终端的标识发送给核心网设备，可以进一步提高安全性。另外，核心网设备向请求方发送的第一终端的标识和随机数可以在一条消息中发送给请求方，也可以在不同消息中发送给请求方。
在第一终端对应的认证方式为请求方对第一终端的单向认证(参考图3b)时，第一终端向核心网设备发送的第一终端的标识和校验值(或密文信息)可以在一条消息中发送给核心网设备，也可以在不同消息中发送给核心网设备。另外，核心网设备向请求方发送的第一终端的标识和校验值(或密文信息)可以在一条消息中发送给请求方，也可以在不同消息中发送给请求方。若在请求方对第一终端的单向认证通过(即请求方基于随机数校验所述校验值(或密文信息)通过)后，第一终端再将第一终端的标识发送给核心网设备，可以进一步提高安全性。另外，向第一终端发送随机数时，可以是在接入网设备执行第一终端的随机接入过程中，接入网设备将随机数发送给第一终端；也可以是接入网设备确定第一终端随机接入成功后，将随机数发送给第一终端。
在第一终端对应的认证方式为第一终端与请求方的双向认证(参考图3c)时，第一终端向核心网设备发送的第一终端的标识和第一随机数可以在一条消息中发送给核心网设备，也可以在不同的消息中发送给核心网设备。另外，第一终端向核心网设备发送的第一终端的标识和第二校验值(或第二密文信息)可以在一条消息中发送给核心网设备，也可以在不同的消息中发送给核心网设备。第一终端在基于第一随机数校验所述第一校验值(或第二密文信息)通过之后，再向核心网设备发送第一终端的标识，可以进一步提高安全性。另外，核心网设备向请求方发送的第一终端的标识和第一随机数可以在一条消息中发送给请求方，也可以在不同消息中发送给请求方。另外，核心网设备向请求方发送的第一终端的标识和第二校验值(或第二密文信息)可以在一条消息中发送给请求方，也可以在不同消息中发送给请求方。
在第一终端对应的认证方式为第一终端对核心网设备对应的第一网络的单向认证(参考图3d)时，第一终端向核心网设备发送的第一终端的标识和第一随机数可以在一条消息中发送给核心网设备，也可以在不同消息中发送给核心网设备。在第一终端对核心网设备对应的第一网络的单向认证通过(即第一终端基于第一随机数校验所述校验值密文信息通过)后，第一终端再向核心网设备发送第一终端的标识，可以进一步提高安全性。
在第一终端对应的认证方式为核心网设备对应的第一网络对第一终端的单向认证(参考图3e)时，第一终端向核心网设备发送的校验值(或密文信息)和第一终端的标识可以在一条消息中发送给核心网设备，也可以在不同消息中发送给核心网设备。在核心网设备对应的第一网络对第一终端的单向认证(即核心网设备基于随机数对所述校验值或密文信息校验通过)后，第一终端再将第一终端的标识发送给核心网设备，可以进一步提高安全性。另外，向第一终端发送随机数，可以是在接入网设备执行第一终端的随机接入过程中，接入网设备将随机数发送给第一终端；也可以是接入网设备确定第一终端随机接入成功后，将随机数发送给第一终端。
在第一终端对应的认证方式为第一终端与核心网设备对应的第一网络的双向认证(参考图3f)时，第一终端向核心网设备发送的第一随机数和第一终端的标识可以在一条消息中发送给核心网设备，也可以在不同消息中发送给核心网设备。另外，第一终端向核心网设备发送的第二校验值(或第二密文信息)和第一终端的标识可以在一条消息中发送给核心网设备，也可以在不同消息中发送给核心网设备。第一终端在基于第一随机数对第一校验值或第一密文信息通过后，再向核心网设备发送第一终端的标识，可以进一步提高安全性。
在一种可能的实现中，当第一操作为读操作、写操作、删除操作、加密操作、访问操作、块写操作、块擦操作或灭活操作等一项或多项时，核心网设备在获取到第一终端的标识，执行第一终端对应的认证方式对应的流程且确定认证通过后，核心网设备还可以对第一终端执行第一操作。
对于第一终端来说，第一终端中可以预先配置有认证方式，也可以未配置认证方式。当第一终端未配置认证方式时，可以由核心网设备获取到第一终端对应的认证方式后，核心网设备向所述第一终端发送所述认证方式的信息，所述认证方式的信息用于指示所述第一终端对应的认证方式。当然，当第一终端预配置认证方式时，核心网设备也可以向第一终端发送所述认证方式的信息。第一终端知道自身对 应的认证方式后，进而可以执行与认证方式对应的认证流程。
在一种可能的实现方式中，认证方式的信息可以显示指示第一终端对应的认证方式。例如，通过比特位的取值来指示第一终端对应的认证方式。例如，通过3个比特甚至更多比特的取值来指示第一终端对应的认证方式。例如，3bit的取值为000时，表示不执行认证；3bit的取值为001时，表示第一终端与请求方的双向认证；3bit的取值为010时，表示第一终端与核心网设备对应的第一网络的双向认证；3bit的取值为011时，表示请求方对第一终端的单向认证；3bit的取值为100时，表示第一终端对请求方的单向认证；3bit的取值为101时，表示核心网设备对应的第一网络对第一终端的单向认证；3bit的取值为110时，表示第一终端对核心网设备对应的第一网络执行的单向认证。以上比特的取值所表示的含义仅是一种示例，不应造成对方案的限定。
在一种可能的实现方式中，当第一终端未配置认证方式，核心网设备未向所述第一终端发送所述认证方式的信息，则可以表示不执行认证。
在一种可能的实现方式中，认证方式的信息可以是随机数，表示认证方式为请求方对第一终端的单向认证或核心网设备对应的第一网络对第一终端的单向认证。在认证过程中，第一终端基于随机数获取校验值或密文信息，并向核心网设备发送校验值或密文信息。
例如，核心网设备向所述第一终端发送所述认证方式的信息的过程包括：核心网设备先向接入网设备发送第一终端对应认证方式的信息，接入网设备对第一终端执行随机接入的过程中或第一终端随机接入成功后，接入网设备向第一终端发送认证方式的信息。一种可能的实现方式中，接入网设备可以广播该认证方式的信息。
以下结合具体的场景，介绍具体的通信流程。
如图4所示，介绍了一种具体的通信流程示意图。该通信流程适用于第一终端中预先配置有认证方式，第一终端与请求方之间进行认证的场景。在该示例中，以接入网设备为RAN、核心网设备为AMF、请求方为AF为例进行介绍。AMF与AF可以直接通信，也可以通过其它核心网设备(例如NEF、SMF、UPF等)进行通信。
步骤400：对第一终端进行初始化。
初始化过程可以理解为企业或者用户(请求方)对第一终端进行打印(预配置或者写入初始数据)。
初始化过程包括：在第一终端中配置(或者写入)第一终端的标识、第一终端对应的认证方式。
第一终端对应的认证方式可以为第一终端与AF的双向认证，或者，AF对第一终端的单向认证，或者，第一终端对AF的单向认证，或者，不执行认证。一种可能的实现方式，认证方式通过在第一终端中设置标识位来实现，例如设置两个比特甚至更多比特的标志位，例如，00表示不执行认证，01表示第一终端对AF的单向认证；10表示AF对第一终端的单向认证；11表示第一终端与AF的双向认证。比特位的取值所代表的含义仅是一种示例，不应造成对方案的限定。一种可能的实现方式中，当企业或者用户部署了鉴权服务器(例如AAA服务器)来执行认证时，第一终端与AF的双向认证可以理解为第一终端与AAA服务器的双向认证；AF对第一终端的单向认证可以理解为AAA服务器对第一终端的单向认证；第一终端对AF的单向认证可以理解为第一终端对AAA服务器的单向认证。AF可以用于转发AAA服务器与其它网元/设备交互的消息或者作为AAA服务器的代理。本申请对于AF如何与AAA服务器交互不限制。
初始化过程进一步还可以包括：在第一终端中配置(或者写入)以下的一项或多项：安全密钥、随机数、安全算法、NAS安全策略、AS安全策略。第一终端对应的认证方式、安全密钥、随机数、安全算法、NAS安全策略、AS安全策略等可以看作是安全参数。NAS安全策略可以包括加密保护和/或完整性保护；AS安全策略可以包括加密保护和/或完整性保护。随机数可以作为用于执行认证的参数在认证流程中被使用，例如，在第一终端对AF的单向认证中、或第一终端与AF的双向认证中，第一终端发送随机数。安全密钥可以用于执行安全认证对应的流程中获取校验值或密文信息，或者采用安全密钥将校验值或密文信息解密来获取明文信息(例如随机数)，NAS安全策略可以用于确定是否需要执行NAS层的加密和/或完整性保护，AS安全策略可以用于确定是否需要执行AS层的加密和/或完整性保护。
另外，需要注意的是，第一终端可以更新预先配置信息，例如，更新预先配置的认证方式。
步骤401：AF向AMF发送第一信息，第一信息用于指示第一终端。
相应的，AMF接收来自AF的第一信息。
第一信息指示第一终端时，可以采用一种或多种方式，具体可以参考步骤201的介绍，不再重复赘述。
在一种可能的实现方式中，第一信息可以用于指示对第一终端执行第一操作。例如，第一信息包括第一操作的信息，通过第一操作的信息来指示第一操作。进一步可选的，第一信息还包括第一操作对应的操作参数。具体细节可以参考步骤201中的介绍，不再重复赘述。
在一种可能的实现中，AF向AMF指示第一终端对应的认证方式。示例性的，AF通过第一信息向AMF指示第一终端对应的认证方式。具体的，所述第一信息还用于指示所述第一终端对应的认证方式。当然，AF也可以通过不同于第一信息的其它信息向AMF指示第一终端对应的认证方式。在该示例中，AF向AMF指示的第一终端对应的认证方式与步骤400初始化过程中在第一终端中预先配置的认证方式相同。第一终端对应的认证方式为第一终端与AF的双向认证，或AF对第一终端的单向认证，或第一终端对AF的单向认证，或不执行认证。
在一种可能的实现中，AF还可以向AMF发送随机数，该随机数作为用于执行认证的参数在认证流程中被使用，例如，在AF对第一终端的单向认证中，AF通过AMF向第一终端发送随机数。示例性的，第一信息包括所述随机数。
在一种具体的示例中，AF向AMF发送的第一终端的安全策略，第一终端的安全策略包括第一终端对应的认证方式和/或随机数包含在。其中，安全策略可以包含在第一信息中，或其它不同于第一信息的其它信息中。
步骤402：AMF指示RAN执行第一终端的随机接入过程。
AMF与RAN之间可以通过N2消息进行交互。
步骤403：RAN根据AMF的指示执行第一终端的随机接入过程。
例如，RAN向第一终端发起随机接入信令，第一终端执行随机接入。
步骤404：在第一终端随机接入成功后，第一终端根据初始化过程中的配置信息，确定向AMF发送的参数信息。
例如，第一终端根据初始化过程中的配置信息，确定向AMF发送的参数信息的过程包括：第一终端根据预先配置的认证方式，确定是否向AMF发送随机数。例如，当认证方式为第一终端对AF的单向认证或第一终端与AF的双向认证时，第一终端需要向AMF发送随机数。例如，当认证方式为AF对第一终端的单向认证或不执行认证时，第一终端无需向AMF发送随机数。第一终端向AMF发送的随机数可以是第一终端随机生成的，也可以是预先配置在第一终端中的。
步骤405：第一终端随机接入成功后，第一终端通过RAN向AMF发送注册请求消息，注册请求消息包括所述第一终端的标识。
相应的，AMF接收来自第一终端的注册请求消息。
如果第一终端需要向AMF发送随机数，在一种可能的实现中，注册请求消息还包括随机数。
可以理解的是，注册请求消息可以替换为接入消息、接入请求消息、或用于接入网络的请求消息、或用于注册网络的请求消息，本申请对于消息的名称不做限定。
另外，可以理解的是，第一终端的标识和随机数也可以在不同的消息中发送给AMF，此处仅是以第一终端的标识和随机数在同一条注册请求消息中发送给AMF为例进行介绍。
步骤406：AMF获取第一终端对应的认证方式。
AMF获取第一终端对应的认证方式的过程可以参考步骤202中介绍的核心网设备获取第一终端对应的认证方式的过程，不再重复赘述。
针对AMF获取到的第一终端的认证方式为不执行认证的场景，一种可能的实现中，AMF无需执行与认证方式对应的流程；另一种可能的实现中，AMF还可以基于第一终端的位置进行进一步判断，来确定最终的第一终端的认证方式。其中，AMF基于第一终端的位置进行进一步判断，来确定最终的第一终端的认证方式的过程，可以参考前文介绍的核心网设备基于第一终端的位置做进一步决策，来确定最终的第一终端的认证方式的过程，不再重复赘述。
步骤405与步骤406的先后顺序不进行限制。
步骤407：在需要认证的情况下，AMF执行第一终端对应的认证方式对应的流程。
AF与第一终端之间的交互消息可以通过RAN和/或核心网设备传输。
示例性的，第一终端对AF的单向认证的流程可以参考图3a的介绍，AF对第一终端的单向认证的流程可以参考图3b的介绍，第一终端与AF的双向认证的流程可以参考图3c的介绍。
步骤405与步骤407的先后顺序不进行限制。
步骤408：AMF向AF发送第一终端的信息。
在第一终端对应的认证方式为不执行认证时，第一终端的信息包括第一终端的标识。
在第一终端对应的认证方式为第一终端对AF的单向认证(可以参考图3a介绍的认证流程)时，第一终端的信息包括第一终端的标识和/或随机数。
在第一终端对应的认证方式为AF对第一终端的单向认证(可以参考图3b介绍的认证流程)时，第一终端的信息包括以下的一项或多项：第一终端的标识、随机数、校验值(或密文信息)。
在第一终端对应的认证方式为第一终端与AF的双向认证(可以参考图3c介绍的认证流程)时，第一终端的信息包括以下的一项或多项：第一终端的标识、第一随机数、第二校验值(或第二密文信息)。
步骤408与步骤406、步骤407的先后顺序不进行限制。
步骤409：AF向AMF发送认证成功的信息和/或接收成功的信息。
相应的，AMF接收来自AF的认证成功的信息或接收成功的信息。
其中，接收成功是指第一终端的信息接收成功。
在第一终端对应的认证方式为不执行认证时，第一终端的信息包括第一终端的标识。即AF在接收到第一终端的标识后，向AMF反馈接收成功的信息。
在第一终端对应的认证方式为第一终端对AF的单向认证(可以参考图3a介绍的认证流程)时，第一终端的信息包括第一终端的标识和/或随机数。AF在接收到第一终端的标识后，可以向AMF发送接收成功的信息。或者，AF在接收到第一终端的标识和随机数后，向AMF发送接收成功的信息，可选的，接收成功的信息中包括AF基于随机数获取的校验值(或密文信息)。
在第一终端对应的认证方式为AF对第一终端的单向认证(可以参考图3b介绍的认证流程)时，第一终端的信息包括以下的一项或多项：第一终端的标识、随机数、校验值(或密文信息)。AF在接收到第一终端的信息后，向AMF发送接收成功的信息；或者，AF在基于随机数校验所述校验值(或密文信息)通过后，向AMF发送认证成功的信息。接收成功的信息和认证成功的信息可以在一条消息中发送给AMF，也可以在不同消息中发送给AMF。
在第一终端对应的认证方式为第一终端与AF的双向认证(可以参考图3c介绍的认证流程)时，第一终端的信息包括以下的一项或多项：第一终端的标识、第一随机数、第二校验值(或密文信息)。AF在接收到第一终端的信息后，向AMF发送接收成功的信息；或者，AF在校验第二校验值(或第二密文信息)通过后，向AMF发送认证成功的信息。接收成功的信息和认证成功的信息可以在一条消息中发送给AMF，也可以在不同消息中发送给AMF。
步骤410：AMF向第一终端发送注册接受消息。
相应的，第一终端接收来自AMF的所述第一终端的注册接受消息。
可以理解的是，注册接受消息所代表的含义是第一终端接入成功，注册接受消息可以替换为第一终端接入成功的指示信息、接入成功消息、或用于接入网络成功的响应消息、或用于注册网络成功的响应消息，本申请对于该消息的名称不做限定。
在一种可能的实现中，AMF在接收来自第一终端的认证成功的信息后，向第一终端发送注册接受消息。该方式可以适用于第一终端对请求方的单向认证当认证方式的场景。
在一种可能的实现中，AMF在接收到来自AF的接收成功的信息后，向第一终端发送注册接受消息。该方式可以适用于第一终端对请求方的单向认证的场景。
在一种可能的实现中，AMF在接收到来自AF的认证成功的信息后，向第一终端发送注册接受消息。该方式可以适用于请求方对第一终端的单向认证，或第一终端与请求方的双向认证的场景。
在一种可能的实现中，当第一终端对应的认证方式为不执行认证时，AMF在接收到第一终端发送的注册请求消息(参考步骤405)后，可以跳过上述的步骤407、步骤408、步骤409，直接执行步骤410。AMF在确定无需执行认证流程时，AMF接收到注册请求消息后立刻向第一终端反馈注册接受消息，可以使第一终端快速接入核心网，可以减少信令交互和时延开销，提高第一终端的盘存效率、减少第一终端的功耗开销。
在一种可能的实现中，当第一终端对应的认证方式为不执行认证时，AMF在接收到第一终端发送 的注册请求消息(参考步骤405)后，可以跳过上述的步骤407、步骤408、步骤409和步骤410。AMF在确定无需执行认证流程时，AMF接收到注册请求消息后无需向第一终端发送消息。接入网设备可以在向AMF转发步骤405的消息后，继续执行下一终端的随机接入流程。或者AMF可以在接收到注册请求消息后指示接入网设备执行下一终端的随机接入流程，且无需向第一终端发送消息。
在第一终端中未配置认证方式，第一终端与请求方之间进行认证的场景中，具体的通信流程与图4介绍的通信流程有很多相同之处，与图4介绍的通信流程的不同之处包括：
在初始化过程(参考步骤400的介绍)中不包括在第一终端中配置认证方式。
AF向AMF指示的第一终端对应的认证方式，无需与初始化过程中在第一终端中预先配置的认证方式相同。AF可以按需或者动态地向AMF指示第一终端对应的认证方式，针对同一终端，AF在不同时间指示的认证方式可以是相同或不同的。
在第一终端随机接入成功后(参考步骤404)，第一终端不能根据认证方式，确定是否向AMF发送随机数。一种可替换的方式为，第一终端中预先配置有随机数，则第一终端确定向AMF发送随机数，若未配置随机数，则不向AMF发送随机数。另一种可替换的方式为，AMF或RAN向第一终端指示，是否需要发送随机数。例如AMF或RAN向第一终端发送第一终端对应的认证方式的信息，第一终端可以通过第一终端的认证方式的信息确定自身对应的认证方式，从而决定是否发送随机数。例如当认证方式为第一终端对AF的单向认证或第一终端与AF的双向认证时，第一终端需要发送随机数。例如，当认证方式为AF对第一终端的单向认证或不执行认证时，第一终端无需发送随机数。第一终端发送的随机数可以是第一终端随机生成的，也可以是预先配置在第一终端中的。
其它过程可以参考图4的介绍，不再重复赘述。
如图5所示，介绍了一种具体的通信流程示意图。该通信流程适用于第一终端中预先配置有认证方式，第一终端与核心网设备对应的第一网络之间进行认证的场景。在该示例中，以接入网设备为RAN、核心网设备为AMF、请求方为AF为例进行介绍。AMF与AF可以直接通信，也可以通过其它核心网设备(例如NEF、SMF、UPF等)进行通信，AMF与UDM可以直接通信，也可以通过其它核心网设备(例如NEF、SMF、UPF等)进行通信。
步骤500a：对第一终端进行初始化。
初始化过程可以理解为企业或者用户(请求方)对第一终端进行打印(预配置或者写入初始数据)。
初始化过程包括：在第一终端中配置(或者写入)第一终端的标识、第一终端对应的认证方式。
第一终端对应的认证方式可以为第一终端与第一网络的双向认证，或者，第一网络对第一终端的单向认证，或者，第一终端对第一网络的单向认证，或者，不执行认证。一种可能的实现方式，认证方式通过在第一终端中设置标识位来实现，例如设置两个比特甚至更多比特的标志位，例如，00表示不执行认证，01表示第一终端对第一网络的单向认证；10表示第一网络对第一终端的单向认证；11表示第一终端与第一网络的双向认证。比特位的取值所代表的含义仅是一种示例，不应造成对方案的限定。
初始化过程进一步还可以包括：在第一终端中配置(或者写入)以下的一项或多项：安全密钥、随机数、安全算法、NAS安全策略、AS安全策略。第一终端对应的认证方式、安全密钥、随机数、安全算法、NAS安全策略、AS安全策略等可以看作是安全参数。NAS安全策略可以包括加密保护和/或完整性保护；AS安全策略可以包括加密保护和/或完整性保护。随机数可以作为用于执行认证的参数在认证流程中被使用在执行第一终端对应的认证方式中使用，例如，在第一终端对第一网络的单向认证中、或第一终端与第一网络的双向认证中，第一终端向AMF发送随机数。安全密钥可以用于执行安全认证对应的流程中获取校验值或密文信息，或者采用安全密钥将校验值或密文信息解密来获取明文信息(例如随机数)，NAS安全策略可以用于确定是否需要执行NAS层的加密和/或完整性保护，AS安全策略可以用于确定是否需要执行AS层的加密和/或完整性保护。
另外，需要注意的是，第一终端可以更新预先配置信息，例如，更新预先配置的认证方式。
步骤500b：AF向UDM指示第一终端对应的认证方式。
AF向UDM指示的第一终端对应的认证方式可以与第一终端中预先配置的认证方式相同。例如，第一终端与第一网络的双向认证，或者，第一网络对第一终端的单向认证，或者，第一终端对第一网络的单向认证，或者，不执行认证。
一种可能的实现方式中，AF向UDM指示第一终端对应的认证方式，包括：AF向UDM发送第一终端的标识和第一终端对应的认证方式。
另一种可能的实现方式中，AF向UDM指示第一终端对应的认证方式，包括：AF向UDM发送终端的标识范围和终端的标识范围对应的认证方式；其中，终端的标识范围包括第一终端的标识。示例性的，终端的标识范围对应的认证方式可以理解为对于标识属于该终端的标识范围中的任意一个终端，其对应的认证方式即为该终端的标识范围对应的认证方式。
另一种可能的实现方式中，AF向UDM指示第一终端对应的认证方式，包括：AF向UDM发送AF的信息和认证方式；其中AF的信息可以用于指示AF对应的(或者管理的)或终端标识范围或一个或多个终端的标识。AF对应的(或者管理的)或终端标识范围或一个或多个终端的标识包括第一终端的标识。AF的信息可以参考前文介绍，不再重复赘述。
AF向UDM指示第一终端对应的认证方式时，可以通过两个比特甚至更多比特的取值来指示，例如，00表示不执行认证，01表示第一终端对第一网络的单向认证；10表示第一网络对第一终端的单向认证；11表示第一终端与第一网络的双向认证。比特位的取值所代表的含义仅是一种示例，不应造成对方案的限定。在一种可能的实现中，当AF未向UDM指示第一终端对应的认证方式时，可以理解为第一终端对应的认证方式为不执行认证。
进一步可选的，AF还向UDM发送以下的一项或多项：随机数、安全密钥。随机数可以作为用于执行认证的参数在认证流程中被使用，例如，第一网络对第一终端的单向认证中，核心网设备需要向第一终端发送随机数。安全密钥可以用于执行安全认证对应的流程中获取校验值或密文信息，或者采用安全密钥将校验值或密文信息解密来获取明文信息(例如随机数)。
在一种可能的实现中，第一终端对应的认证方式和随机数可以包含在第一终端对应的安全策略信息中，即AF向UDM发送第一终端对应的安全策略信息，安全策略信息中包括第一终端对应的认证方式和/或随机数。
第一终端对应的认证方式、随机数、安全密钥等可以保存在第一终端的上下文信息、第一终端的策略信息、第一终端的业务配置、或第一终端的签约数据中。
如果请求方在核心网设备中配置第一终端对应的安全策略信息，在第一终端的接入过程中，核心网设备可以无需与请求方进行交互，可以进一步节省信令开销，提高第一终端的接入、注册或者通信效率，降低第一终端的功耗开销。
可以理解的是，AF与UDM可以直接通信，也可以通过NEF或其它网元进行通信。
步骤500b为可选的步骤，也可以不执行步骤500b。
步骤501：AF向AMF发送第一信息，第一信息用于指示第一终端。
相应的，AMF接收来自AF的第一信息。
第一信息指示第一终端时，可以采用一种或多种方式，具体可以参考步骤201的介绍，不再重复赘述。
在一种可能的实现方式中，第一信息可以用于指示对第一终端执行第一操作。例如，第一信息包括第一操作的信息，通过第一操作的信息来指示第一操作。进一步可选的，第一信息还包括第一操作对应的操作参数。具体细节可以参考步骤201中的介绍，不再重复赘述。
在一种可能的实现中，AF向AMF指示第一终端对应的认证方式，该方式可以适用于未执行步骤500b的情景。示例性的，AF通过第一信息向AMF指示第一终端对应的认证方式。具体的，所述第一信息还用于指示所述第一终端对应的认证方式。当然，AF也可以通过不同于第一信息的其它信息向AMF指示第一终端对应的认证方式。在该示例中，AF向AMF指示的第一终端对应的认证方式与步骤500a的初始化过程中在第一终端中预先配置的认证方式相同。第一终端对应的认证方可以为第一终端与第一网络的双向认证，或第一网络对第一终端的单向认证，或第一终端对第一网络的单向认证，或不执行认证。
在一种可能的实现中，AF还可以向AMF发送随机数，该随机数作为用于执行认证的参数在认证流程中被使用。例如，在第一网络对第一终端的单向认证中，AF通过AMF向第一终端发送随机数。示例性的，第一信息包括所述随机数。
在一种具体的示例中，第一终端对应的认证方式和/或随机数包含在第一终端对应的安全策略中。其中，安全策略可以包含在第一信息中，或其它不同于第一信息的其它信息中。
在一种可能的实现中，AF还可以向AMF发送安全密钥。安全密钥可以用于执行安全认证对应的流程中获取校验值或密文信息，或者采用安全密钥将校验值或密文信息解密来获取明文信息(例如随机数)。其中，安全密钥可以包含在第一信息中，或其它不同于第一信息的其它信息中。
可以理解的是，AF与AMF可以直接通信，也可以通过NEF或其它网元进行通信。
步骤502：AMF指示RAN执行第一终端的随机接入过程。
AMF与RAN之间可以通过N2消息进行交互。
步骤503：RAN根据AMF的指示执行第一终端的随机接入过程。
例如，RAN向第一终端发起随机接入信令，第一终端执行随机接入。
步骤504：在第一终端随机接入成功后，第一终端根据初始化过程中的配置信息，确定向AMF发送的参数信息。
例如，第一终端根据初始化过程中的配置信息，确定向AMF发送的参数信息的过程包括：第一终端根据预先配置的认证方式，确定是否向AMF发送随机数。例如，当认证方式为第一终端对第一网络的单向认证或第一终端与第一网络的双向认证时，第一终端需要向AMF发送随机数。例如，当认证方式为第一网络对第一终端的单向认证或不执行认证时，第一终端无需向AMF发送随机数。第一终端向AMF发送的随机数可以是第一终端随机生成的，也可以是预先配置在第一终端中的。
步骤505：第一终端随机接入成功后，第一终端通过RAN向AMF发送注册请求消息，注册请求消息包括所述第一终端的标识。
相应的，AMF接收来自第一终端的注册请求消息。
如果第一终端需要向AMF发送随机数，在一种可能的实现中，注册请求消息还包括随机数。
可以理解的是，注册请求消息可以替换为接入消息、接入请求消息、或用于接入网络的请求消息、或用于注册网络的请求消息，本申请对于消息的名称不做限定。
另外，可以理解的是，第一终端的标识和随机数也可以在不同的消息中发送给AMF，此处仅是以第一终端的标识和随机数在同一条注册请求消息中发送给AMF为例进行介绍。
步骤506：AMF获取第一终端对应的认证方式。
AMF获取第一终端对应的认证方式的过程可以参考步骤202中介绍的核心网设备获取第一终端对应的认证方式的过程。
一种具体的示例中，如果执行了步骤500b，AF向UDM指示第一终端对应的认证方式，则AMF可以基于第一终端的标识或者AF标识信息，从UDM处获取第一终端的上下文信息、第一终端的策略信息、第一终端的业务配置或第一终端的签约数据，从第一终端的上下文信息或第一终端的签约数据中获取第一终端对应的认证方式。或者，当AF未向UDM指示第一终端对应的认证方式时，可以理解为第一终端对应的认证方式为不执行认证。
另一种具体的示例中，如果未执行步骤500b，AMF可以基于AF的指示来获取第一终端对应的认证方式，例如第一信息中包括第一终端对应的认证方式，AMF基于第一信息，获取第一终端对应的认证方式。具体的，AMF可以从第一信息中包括的第一终端对应的安全策略信息中获取第一终端对应的认证方式。
针对AMF获取到的第一终端的认证方式为不执行认证的场景，一种可能的实现中，AMF无需执行与认证方式对应的流程；另一种可能的实现中，AMF可以基于第一终端的位置进行进一步判断，来确定最终的第一终端的认证方式。其中，AMF基于第一终端的位置进行进一步判断，来确定最终的第一终端的认证方式的过程，可以参考前文介绍的核心网设备基于第一终端的位置做进一步决策，来确定最终的第一终端的认证方式的过程，不再重复赘述。
步骤505与步骤506的先后顺序不进行限制。
步骤507：在需要认证的情况下，AMF执行第一终端对应的认证方式对应的流程。
AF与第一终端之间的交互消息可以通过RAN和/或核心网设备传输。
示例性的，第一终端对第一网络的单向认证的流程可以参考图3d的介绍，第一网络对第一终端的单向认证的流程可以参考图3e的介绍，第一终端与第一网络的双向认证的流程可以参考图3f的介绍。
步骤505与步骤507的先后顺序不进行限制。
步骤508：AMF向AF发送第一终端的信息。
步骤508与步骤506、步骤507的先后顺序不进行限制。
在第一终端对应的认证方式为不执行认证时，第一终端的信息包括第一终端的标识。
在第一终端对应的认证方式为第一终端对第一网络的单向认证(可以参考图3d介绍的认证流程)时，第一终端的信息包括第一终端的标识和/或第一随机数。
在第一终端对应的认证方式为第一网络对第一终端的单向认证(可以参考图3e介绍的认证流程)时，第一终端的信息包括以下的一项或多项：第一终端的标识、随机数、校验值(或密文信息)。
在第一终端对应的认证方式为第一终端与第一网络的双向认证(可以参考图3f介绍的认证流程)时，第一终端的信息包括以下的一项或多项：第一终端的标识、第一随机数、第二校验值(或第二密文信息)。
步骤509：AF向AMF发送接收成功的信息。
相应的，AMF接收来自AF的接收成功的信息。
其中，接收成功是指第一终端的信息接收成功。
步骤510：AMF向第一终端发送注册接受消息。
相应的，第一终端接收来自AMF的所述第一终端的注册接受消息。
可以理解的是，注册接受消息所代表的含义是第一终端接入成功，注册接受消息可以替换为第一终端接入成功的指示信息、或接入成功消息、或用于接入网络成功的响应消息、或用于注册网络成功的响应消，本申请对于该消息的名称不做限定。
在一种可能的实现中，AMF在接收来自第一终端的认证成功的信息后，向第一终端发送注册接受消息。该方式可以适用于第一终端对第一网络的单向认证当认证方式的场景。
在一种可能的实现中，AMF在基于随机数生成校验值(或密文信息)后，向第一终端发送注册接受消息，其中包括校验值(或密文信息)。该方式可以适用于第一终端对第一网络的单向认证的场景。
在一种可能的实现中，AMF在确定认证通过后，向第一终端发送注册接受消息。该方式可以适用于第一终端对第一终端的单向认证，或第一终端与第一终端的双向认证的场景。
在一种可选的示例中，当第一终端对应的认证方式为不执行认证时，AMF在接收到第一终端发送的注册请求消息(参考步骤505)后，可以跳过上述的步骤507、步骤508、步骤509，直接执行步骤510。AMF在确定无需执行认证流程时，AMF接收到注册请求消息后立刻向第一终端反馈注册接受消息，可以使第一终端快速接入核心网，可以减少信令交互和时延开销，提高第一终端的盘存效率、减少第一终端的功耗开销。
在一种可选的示例中，当第一终端对应的认证方式为不执行认证时，AMF在接收到第一终端发送的注册请求消息(参考步骤505)后，可以跳过上述的步骤507、步骤508、步骤509和步骤510。AMF在确定无需执行认证流程时，AMF接收到注册请求消息后无需向第一终端发送消息。接入网设备可以在向AMF转发步骤405的消息后，继续执行下一终端的随机接入流程。或者AMF可以在接收到注册请求消息后指示接入网设备执行下一终端的随机接入流程，且无需向第一终端发送消息。
在第一终端中未配置认证方式，第一终端与第一网络之间进行认证的场景中，具体的通信流程与图5介绍的通信流程有很多相同之处，与图5介绍的通信流程的不同之处包括：
在初始化过程(参考步骤500的介绍)中不包括在第一终端中配置认证方式。
AF向AMF指示的第一终端对应的认证方式，无需与初始化过程中在第一终端中预先配置的认证方式相同。AF可以按需或者动态地向AMF指示第一终端对应的认证方式，针对同一终端，AF在不同时间指示的认证方式可以是相同或不同的。
在第一终端随机接入成功后(参考步骤504)，第一终端不能根据认证方式，确定是否向AMF发送随机数。一种可替换的方式为，第一终端中预先配置有随机数，则第一终端确定向AMF发送随机数，若未配置随机数，则不发送随机数。另一种可替换的方式为，AMF或RAN向第一终端指示，是否需要送随机数。例如AMF或RAN向第一终端发送第一终端对应的认证方式的信息，第一终端可以通过第一终端的认证方式的信息确定自身对应的认证方式，从而决定是否发送随机数。例如当认证方式为第一终端对第一网络的单向认证或第一终端与第一网络的双向认证时，第一终端需要发送随机数。例如，当认证方式为第一网络对第一终端的单向认证或不执行认证时，第一终端无需发送随机数。第一终端发送的随机数可以是第一终端随机生成的，也可以是预先配置在第一终端中的。
其它过程可以参考图5的介绍，不再重复赘述。
如图6所示，介绍了一种具体的通信流程示意图。该通信流程可以适用于请求方对第一终端的单向认证或第一网络对第一终端的单向认证，第一终端中可以预先配置认证方式，也可以未配置认证方式。在该示例中，以接入网设备为RAN、核心网设备为AMF、请求方为AF为例进行介绍。AMF与AF可以直接通信，也可以通过其它核心网设备(例如NEF、SMF、UPF等)进行通信，AMF与UDM可以直接通信，也可以通过其它核心网设备(例如NEF、SMF、UPF等)进行通信。
步骤600a：对第一终端进行初始化。
初始化过程可以理解为企业或者用户(请求方)对第一终端进行打印(预配置或者写入初始数据)。
初始化过程包括：在第一终端中配置(或写入)第一终端的标识。
初始化过程进一步还可以包括：在第一终端中配置或写入以下的一项或多项安全参数：第一终端对应的认证方式、安全密钥、随机数、安全算法、NAS安全策略、AS安全策略。
第一终端对应的认证方式可以为AF对第一终端的单向认证，或第一网络对第一终端的单向认证。
NAS安全策略可以包括加密保护和/或完整性保护；AS安全策略可以包括加密保护和/或完整性保护。安全密钥可以用于执行安全认证对应的流程中获取校验值或密文信息，或者采用安全密钥将校验值或密文信息解密来获取明文信息(例如随机数)，NAS安全策略可以用于确定是否需要执行NAS层的加密和/或完整性保护，AS安全策略可以用于确定是否需要执行AS层的加密和/或完整性保护。
另外，需要注意的是，第一终端可以更新预先配置信息，例如，更新预先配置的认证方式。
步骤600b：AF向UDM指示第一终端对应的认证方式。
若第一终端中预先配置有认证方式，AF向UDM指示的第一终端对应的认证方式与第一终端中预先配置的认证方式相同。
AF向UDM指示第一终端对应的认证方式的过程可以参考步骤500b中的介绍，不同之处包括，该示例中，第一终端对应的认证方式为第一网络或请求方对第一终端的单向认证，其余细节均可以参考步骤500b。
步骤600b为可选的步骤，也可以不执行步骤600b。
步骤601：AF向AMF发送第一信息，第一信息用于指示第一终端。
相应的，AMF接收来自AF的第一信息。
第一信息指示第一终端时，可以采用一种或多种方式，具体可以参考步骤201的介绍，不再重复赘述。
在一种可能的实现方式中，第一信息可以用于指示对第一终端执行第一操作。例如，第一信息包括第一操作的信息，通过第一操作的信息来指示第一操作。进一步可选的，第一信息还包括第一操作对应的操作参数。具体细节可以参考步骤201中的介绍，不再重复赘述。
在一种可能的实现中，AF向AMF指示第一终端对应的认证方式，该方式可以适用于未执行步骤600b的情景。示例性的，AF通过第一信息向AMF指示第一终端对应的认证方式。具体的，所述第一信息还用于指示所述第一终端对应的认证方式。当然，AF也可以通过不同于第一信息的其它信息向AMF指示第一终端对应的认证方式。如果在步骤600a的初始化过程中在第一终端中配置认证方式，则AF向AMF指示的第一终端对应的认证方式与步骤600a的初始化过程中在第一终端中预先配置的认证方式相同。第一终端对应的认证方式为请求方对第一终端的单向认证，或第一网络对第一终端的单向认证。
在一种可能的实现中，AF还可以向AMF发送随机数，该随机数作为用于执行认证的参数在认证流程中被使用。例如，在第一网络或请求方对第一终端的单向认证中，需要向第一终端发送随机数。示例性的，第一信息包括所述随机数。
在一种具体的示例中，第一终端对应的认证方式和/或随机数包含在第一终端对应的安全策略中。其中，安全策略可以包含在第一信息中，或其它不同于第一信息的其它信息中。
在一种可能的实现中，AF还可以向AMF发送安全密钥。安全密钥可以用于执行安全认证对应的流程中获取校验值或密文信息，或者采用安全密钥将校验值或密文信息解密来获取明文信息(例如随机数)。其中，安全密钥可以包含在第一信息中，或其它不同于第一信息的其它信息中。
可以理解的是，AF与AMF可以直接通信，也可以通过NEF或其它网元进行通信。
步骤602：AMF指示RAN执行第一终端的随机接入过程。
AMF与RAN之间可以通过N2消息进行交互。一种可能的实现方式中，AMF可以向RAN发送随机数。该随机数可以用于执行安全认证。
步骤603：RAN根据AMF的指示执行第一终端的随机接入过程。一种可能的实现方式中，若AMF向RAN发送随机数，RAN可以广播该随机数。
例如，RAN向第一终端发起随机接入信令，第一终端执行随机接入。
步骤604：在第一终端随机接入成功后，第一终端根据初始化过程中的配置信息，确定向AMF发送的参数信息。
例如，第一终端根据初始化过程中的配置信息，确定向AMF发送的参数信息的过程包括以下多种：
第一终端根据预先配置的认证方式，确定是否向AMF发送随机数。例如，当认证方式为第一网络或请求方对第一终端的单向认证时，第一终端无需向AMF发送随机数。
或者，第一终端中预先配置有随机数，则第一终端确定向AMF发送随机数，若未配置随机数，则不向AMF发送随机数。
另一种可替换的方式为，AMF或RAN向第一终端指示，是否需要向AMF发送随机数。
步骤605：第一终端随机接入成功后，第一终端通过RAN向AMF发送注册请求消息，注册请求消息包括所述第一终端的标识。
相应的，AMF接收来自第一终端的注册请求消息。
可以理解的是，注册请求消息可以替换为接入消息、接入请求消息、或用于接入网络的请求消息、或用于注册网络的请求消息，本申请对于消息的名称不做限定。
步骤606：AMF获取第一终端对应的认证方式，即第一网络对第一终端的单向认证或请求方对第一终端的单向认证。
AMF获取第一终端对应的认证方式的过程可以参考步骤202中介绍的核心网设备获取第一终端对应的认证方式的过程。
一种具体的示例中，如果执行了步骤600b，AF向UDM指示第一终端对应的认证方式，则AMF可以基于第一终端的标识或者AF标识信息，从UDM处获取第一终端的上下文信息、第一终端的策略信息、第一终端的业务配置或第一终端的签约数据，从第一终端的上下文信息或第一终端的签约数据中获取第一终端对应的认证方式。或者，当AF未向UDM指示第一终端对应的认证方式时，可以理解为第一终端对应的认证方式为不执行认证。
另一种具体的示例中，如果未执行步骤600b，AMF可以基于AF的指示来获取第一终端对应的认证方式，例如第一信息中包括第一终端对应的认证方式，AMF基于第一信息，获取第一终端对应的认证方式。具体的，AMF可以从第一信息中包括的第一终端对应的安全策略信息中获取第一终端对应的认证方式。
步骤605与步骤606的先后顺序不进行限制。
步骤607：在需要认证的情况下，AMF执行第一终端对应的认证方式对应的流程。
AF与第一终端之间的交互消息可以通过RAN和/或核心网设备传输。
AF对第一终端的单向认证流程可以参考图3b的介绍，第一网络对第一终端的单向认证的流程可以参考图3e的介绍。
步骤605与步骤607的先后顺序不进行限制。
在一种具体的实现中，步骤607包括以下步骤：
步骤6071：AMF获取第一终端对应的随机数。
AMF获取随机数的方式包括以下几种：
方式1：接收AF发送的随机数。
方式2：从第一终端对应的第一上下文信息、或第一策略信息、或第一业务配置或者第一签约数据中获取随机数。第一终端对应的第一上下文信息、或第一策略信息、或第一业务配置或者第一签约数据通常保存在UDM、AUSF、NSSAAF、NEF、PCF、TMF、UDR中。
方式3：AMF自身生成随机数。例如，当AF向AMF发送的消息中未包括随机数时，AMF生成随机数。例如，当第一终端对应的第一上下文信息、或第一策略信息、或第一业务配置或者第一签约数据中未包括随机数时，AMF生成随机数。例如，AMF可以根据配置信息确定生成随机数。
步骤6072(与步骤32b1、步骤32b2、步骤32e相同)：AMF向第一终端发送所述随机数，相应的， 第一终端接收来自AMF的随机数。
在一种可能的实现中，随机数携带在AMF向第一终端发送的请求(例如鉴权请求(Authentication Request)或者认证请求(Authorization Request))消息中。另一种可能的实现方式中，AMF向RAN发送随机数，RAN广播该随机数。示例性的，步骤6072可以通过步骤602和步骤603实现，此时步骤6072无需单独的消息。
步骤6073(与步骤33b1、步骤33b2、步骤33e相同)：第一终端基于所述随机数获取校验值或者密文信息。
例如，获取校验值或密文信息的过程包括：第一终端基于所述随机数和预配置的密钥，获取校验值或密文信息。一种可能的实现方式中，第一终端可以将所述随机数和预配置的密钥进行运算，获取校验值。另一种可能的实现方式中，第一终端采用预配置的密钥将所述随机数进行加密，获取密文信息。
步骤6074(与步骤34b1、步骤34b2、步骤34e类似)：第一终端向AMF发送所述校验值或者密文信息。若第一终端是通过步骤603中的广播消息获取随机数，则第一终端可以在步骤605的消息中包括所述第一终端的校验值或者密文信息。即步骤6074可以通过步骤605完成。
相应的，AMF接收来自所述第一终端的校验值或者密文信息。
在一种可能的实现中，校验值或者密文信息携带在第一终端向AMF发送的响应(例如鉴权响应(Authentication Response)或者认证响应(Authorization Response))消息中。进一步可选的，第一终端在向AMF发送校验值或密文信息时，也可以将随机数发送给AMF。当第一终端不向AMF发送随机数时，可以防止窃听者通过空口监听第一终端的随机数，可以提高安全性、可靠性。
步骤6075：若在步骤6074中第一终端未发送随机数，则AMF获取步骤6071中获取到的第一终端对应的随机数。
若第一终端对应的认证方式为请求方对第一终端的单向认证，可以执行步骤6076至步骤6078(可以参考图3b中的介绍)。
步骤6076(与步骤35b1、步骤35b2类似)：AMF向AF发送所述校验值或密文信息。
相应的，AF接收来自AMF的校验值或密文信息。
可选的，AMF还可以向AF发送随机数，例如AMF在步骤6071中获取到的第一终端对应的随机数或步骤6074中来自第一终端的随机数。
在一种具体的示例中，AMF与AF之间通过NEF进行通信。AMF可以先向NEF发送随机数和校验值(或者密文信息)，NEF再将随机数(可选的)和校验值(或者密文信息)发送给AF。一种可能的实现中，随机数(可选的)和校验值(或者密文信息)可以携带在AMF发送给NEF的请求(例如鉴权请求(Authentication Request)或者认证请求(Authorization Request))消息中。
步骤6077：AF基于所述随机数对所述校验值或者密文信息进行校验。
步骤6077的具体过程可以参考步骤36b1、步骤36b2，不再重复赘述。
步骤6078：AF向AMF发送认证成功或校验通过的信息。
相应的，AMF接收来自AF发送的认证成功或校验通过的信息。
在一种具体的示例中，AMF与AF之间通过NEF进行通信。AF可以先向NEF发送认证成功或校验通过的信息，NEF再将认证成功或校验通过的信息发送给AF。
一种可能的实现中，认证成功或校验通过的信息可以携带在NEF发送给AMF的响应(例如鉴权响应(Authentication Response)或者认证响应(Authorization Response))消息中。
在目前的技术中，终端设备的随机数通常由认证方生成并发送给终端设备，而在该方式中，认证方为AF，由AMF自身生成针对第一终端的随机数并发送给终端设备，无需AF向AMF发送针对第一终端的随机数，可以节省信令开销。
若第一终端对应的认证方式为核心网设备对应的网络对第一终端的单向认证，可以执行步骤6079至步骤6081(可以参考图3e中的介绍)。步骤6079至步骤6081以UDM执行认证为例进行阐述，本申请不限制执行认证的核心网设备，可以是AUSF、NSSAAF、NEF、AAA server等具有鉴权功能的设备。
步骤6079(与步骤36e相同)：AMF向UDM发送校验值或密文信息(可选的，还包括随机数)。
相应的，UDM接收来自AMF的校验值或密文信息(可选的，还包括随机数)。
在一种可能的实现中，校验值或密文信息(可选的，还可以包括随机数)可以携带在AMF向UDM 发送的请求(例如鉴权请求(Authentication Request)或者认证请求(Authorization Request))消息中。
步骤6080(与步骤37e相同)：UDM基于随机数对校验值或密文信息进行校验。
步骤6080的具体过程可以参考步骤37e，不再重复赘述。
步骤6081：UDM向AMF发送认证成功或校验通过的信息。
相应的，AMF接收来自UDM发送的认证成功或校验通过的信息。
在一种可能的实现中，校验通过/认证成功的信息可以携带在UDM向AMF发送的响应(例如鉴权响应(Authentication Response)或者认证响应(Authorization Response))消息中。在目前的技术中，终端设备的随机数通常由认证方生成并发送给终端设备，而在该方式中，认证方为UDM，由AMF自身生成针对第一终端的随机数并发送给终端设备，无需UDM向AMF发送针对第一终端的随机数，可以节省信令开销。
步骤608：AMF向AF发送第一终端的信息。
步骤608与步骤606、步骤607的先后顺序不进行限制。
步骤609：AMF向第一终端发送注册接受消息。
相应的，第一终端接收来自AMF的注册接受消息。
步骤609与步骤608的先后顺序不进行限制。
可以理解的是，注册接受消息所代表的含义是第一终端接入成功，注册接受消息可以替换为第一终端接入成功的指示信息、或接入成功消息、或用于接入网络成功的响应消息、或用于注册网络成功的响应消，本申请对于该消息的名称不做限定。
前文介绍了本申请实施例的方法，下文中将介绍本申请实施例中的装置。方法、装置是基于同一技术构思的，由于方法、装置解决问题的原理相似，因此装置与方法的实施可以相互参见，重复之处不再赘述。
本申请实施例可以根据上述方法示例，对装置进行功能模块的划分，例如，可以对应各个功能划分为各个功能模块，也可以将两个或两个以上的功能集成在一个模块中。这些模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，具体实现时可以有另外的划分方式。
基于与上述方法的同一技术构思，参见图7，提供了一种通信装置700结构示意图，该通信装置700可以包括以下的一项或多项：处理模块710、接收模块720a、发送模块720b、存储模块730。处理模块710可以分别与存储模块730和接收模块720a和发送模块720b相连，所述存储模块730也可以与接收模块720a和发送模块720b相连。
在一种示例中，上述的接收模块720a和发送模块720b也可以集成在一起，定义为收发模块。
在一种示例中，该通信装置700可以为核心网设备，也可以为应用于核心网设备中的芯片或功能单元。该通信装置700具有上述方法中核心网设备的任意功能，例如，该通信装置700能够执行上述图2、图3a、图3b、图3c、图3d、图3e、图3f、图4、图5、图6的方法中由核心网设备执行的各个步骤。
所述接收模块720a，可以执行上述方法实施例中核心网设备执行的接收动作。
所述发送模块720b，可以执行上述方法实施例中核心网设备执行的发送动作。
所述处理模块710，可以执行上述方法实施例中核心网设备执行的动作中，除发送动作和接收动作外的其它动作。
在一种示例中，所述接收模块720a，用于接收来自请求方的第一信息，所述第一信息用于指示第一终端；所述处理模块710，用于获取所述第一终端对应的认证方式，并执行与所述认证方式对应的流程。
在一种示例中，所述处理模块710，还用于获取所述第一终端的标识；所述发送模块720b，用于向所述请求方发送所述第一终端的标识。
在一种示例中，所述认证方式包括以下任一项：双向认证方式、单向认证方式。
在一种示例中，所述双向认证方式包括以下任一项：所述第一终端与所述请求方的双向认证、所述第一终端与所述核心网设备对应的第一网络的双向认证。
在一种示例中，所述单向认证方式包括以下任一项：所述请求方对所述第一终端执行的单向认证、所述核心网设备对应的第一网络对所述第一终端执行的单向认证、所述第一终端对所述请求方执行的单 向认证、所述第一终端对所述核心网设备对应的第一网络执行的单向认证。
在一种示例中，当所述认证方式为所述第一终端对所述请求方执行的单向认证时，所述接收模块720a，还用于接收来自所述第一终端的随机数；所述发送模块720b，还用于向所述请求方发送所述随机数；所述接收模块720a，还用于接收来自所述请求方的校验值或密文信息；所述发送模块720b，还用于向所述第一终端发送所述校验值或所述密文信息。
在一种示例中，当所述认证方式为所述请求方对所述第一终端执行的单向认证时，所述接收模块720a，还用于接收来自所述请求方的随机数；所述发送模块720b，还用于向所述第一终端发送所述随机数；所述接收模块720a，还用于接收来自所述第一终端的校验值或密文信息；所述发送模块720b，还用于向所述请求方发送所述校验值或所述密文信息。
在一种示例中，当所述认证方式为所述请求方对所述第一终端执行的单向认证时，所述处理模块710，还用于获取随机数；所述发送模块720b，还用于向所述第一终端发送所述随机数；所述接收模块720a，还用于接收来自所述第一终端的校验值或密文信息；所述发送模块720b，还用于向所述请求方发送所述随机数、以及向请求方发送所述校验值或所述密文信息。
在一种示例中，当所述认证方式为所述第一终端与所述请求方的双向认证时，所述接收模块720a，还用于接收来自所述第一终端的随机数；所述发送模块720b，向所述请求方发送所述随机数；所述接收模块720a，还用于接收来自所述请求方的第一校验值或第一密文信息；所述发送模块720b，还用于向所述第一终端发送所述第一校验值或所述第一密文信息；所述接收模块720a，还用于接收来自所述第一终端的第二校验值或第二密文信息；所述发送模块720b，还用于向所述请求方发送所述第二校验值或所述第二密文信息。
在一种示例中，当所述认证方式为所述第一终端对所述核心网设备对应的第一网络执行的单向认证时，所述接收模块720a，还用于接收来自所述第一终端的第一随机数；所述处理模块710，还用于获取第二随机数，并基于所述第一随机和所述第二随机数获取校验值或密文信息；所述发送模块720b，还用于向所述第一终端发送所述校验值或所述密文信息。
在一种示例中，当所述认证方式为所述第一终端对所述核心网设备对应的第一网络执行的单向认证时，所述接收模块720a，还用于接收来自所述第一终端的第一随机数；所述处理模块710，还用于基于所述第一随机获取校验值或密文信息；所述发送模块720b，还用于向所述第一终端发送所述校验值或所述密文信息。
在一种示例中，当所述认证方式为所述核心网设备对应的第一网络对所述第一终端执行的单向认证时，所述处理模块710，还用于获取随机数；所述发送模块720b，还用于向所述第一终端发送所述随机数；所述接收模块720a，还用于接收来自所述第一终端的校验值或密文信息；所述处理模块710，还用于基于所述随机数校验所述校验值或所述密文信息。
在一种示例中，当所述认证方式为所述核心网设备对应的第一网络对所述第一终端执行的单向认证时，所述处理模块710，还用于获取随机数；所述发送模块720b，还用于向所述第一终端发送所述随机数；所述接收模块720a，还用于接收来自所述第一终端的校验值或密文信息；所述发送模块720b，还用于向其它核心网设备发送所述随机数、以及其它核心网设备发送所述校验值或所述密文信息，以使所述其它核心网设备基于所述随机数校验所述校验值或所述密文信息。
在一种示例中，当所述认证方式为所述第一终端与所述核心网设备对应的第一网络的双向认证时，所述接收模块720a，还用于接收来自所述第一终端的第一随机数；所述处理模块710，还用于获取第二随机数，并基于所述第一随机数和所述第二随机数获取第一校验值或第一密文信息；所述发送模块720b，还用于向所述第一终端发送所述第一校验值或所述第一密文信息；所述接收模块720a，还用于接收来自所述第一终端的第二校验值或第二密文信息；所述处理模块710，还用于基于所述第二随机数校验所述第二校验值或所述第二密文信息。
在一种示例中，当所述认证方式为所述第一终端与所述核心网设备对应的第一网络的双向认证时，所述接收模块720a，还用于接收来自所述第一终端的第一随机数；所述处理模块710，还用于基于所述第一随机数获取第一校验值或第一密文信息；所述发送模块720b，还用于向所述第一终端发送所述第一校验值或所述第一密文信息，以及向第一终端发送第二随机数；所述接收模块720a，还用于接收来自所述第一终端的第二校验值或第二密文信息；所述处理模块710，还用于基于所述第二随机数校验所述第二校验值或所述第二密文信息。
在一种示例中，所述第一信息还用于指示所述第一终端对应的所述认证方式；所述处理模块710，具体用于根据所述第一信息，获取所述第一终端对应的认证方式。
在一种示例中，所述处理模块710，具体用于获取所述第一终端的第一上下文信息、或第一策略信息、或第一业务配置、或第一签约数据；其中，所述第一上下文信息、或所述第一策略信息、或所述第一业务配置、或所述第一签约数据包括所述第一终端的认证方式；基于所述第一上下文信息、或所述第一策略信息、或所述第一业务配置、或所述第一签约数据，获取所述第一终端对应的认证方式。
在一种示例中，所述处理模块710，具体用于获取所述请求方的第二上下文信息、或第二策略信息、或第二业务配置、或第二签约数据；其中，所述第二上下文信息、或所述第二策略信息、或所述第二业务配置、或所述第二签约数据包括所述请求方管理的一个或多个终端各自对应的认证方式，所述请求方管理的一个或多个终端包括所述第一终端；基于所述第二上下文信息、或所述第二策略信息、或所述第二业务配置、或所述第二签约数据，获取所述第一终端对应的认证方式。
在一种示例中，所述发送模块720b，还用于向所述第一终端发送所述认证方式的信息。
在一种示例中，所述接收模块720a，用于接收来自请求方的第一信息，所述第一信息用于指示第一终端；所述处理模块710，用于获取所述第一终端对应的认证方式，其中，所述第一终端对应的认证方式为不执行认证；确定所述第一终端的位置属于预设位置范围内；允许所述请求方或所述核心网设备对应的第一网络跳过所述第一终端的认证流程。
在一种示例中，所述处理模块710，还用于确定所述第一终端的位置在预设位置范围外；执行与配置的认证方式对应的流程，所述配置的认证方式用于认证接入所述核心网设备所在的网络的终端。
在一种示例中，所述第一终端的位置包括以下的一项或多项：第一终端的地理位置、对所述第一终端执行随机接入的第二终端的地理位置；所述预设位置范围为预设地理位置范围。
在一种示例中，所述第一终端的位置由第一标识表征，所述预设位置范围为预设标识范围；其中，第一标识包括以下的一项或多项：第一终端接入的接入网设备的标识、第一终端所在的小区的标识、第一终端所在的跟踪区的标识、第一终端接入的网络的标识、第一终端接入的切片的标识、第一终端接入的封闭接入组的标识、第二终端接入的接入网设备的标识、第二终端所在的小区的标识、第二终端所在的跟踪区的标识、第二终端接入的网络的标识、第二终端接入的切片的标识、第二终端接入的封闭接入组的标识，其中，所述第二终端为对所述第一终端执行随机接入的终端。
在一种示例中，所述发送模块720b，还用于向所述第一终端发送所述第一终端接入成功的指示信息。
在一种示例中，所述存储模块730，可以存储核心网设备执行的方法的计算机执行指令，以使处理模块710和接收模块720a和发送模块720b执行上述示例中核心网设备执行的方法。
示例的，存储模块可以包括一个或者多个存储器，存储器可以是一个或者多个设备、电路中用于存储程序或者数据的器件。存储模块可以是寄存器、缓存或者RAM等，存储模块可以和处理模块集成在一起。存储模块可以是ROM或者可存储静态信息和指令的其他类型的静态存储设备，存储模块可以与处理模块相独立。
所述收发模块可以是输入或者输出接口、管脚或者电路等。
作为一种可能的产品形态，装置可以由一般性的总线体系结构来实现。
如图8所示，提供了一种通信装置800的示意性框图。
该通信装置800可以包括以下的一项或多项：处理器810、收发器820、存储器830。该收发器820，可以用于接收程序或指令并传输至所述处理器810，或者，该收发器820可以用于该通信装置800与其他通信设备进行通信交互，比如交互控制信令和/或业务数据等。该收发器820可以为代码和/或数据读写收发器，或者，该收发器820可以为处理器与收发机之间的信号传输收发器。所述处理器810和所述存储器830之间电耦合。
一种示例中，该通信装置800可以为核心网设备，也可以为应用于核心网设备中的芯片。应理解，该装置具有上述方法中核心网设备的任意功能，例如，所述通信装置800能够执行上述图2、图3a、图3b、图3c、图3d、图3e、图3f、图4、图5、图6的方法中由核心网设备执行的各个步骤。示例的，所述存储器830，用于存储计算机程序；所述处理器810，可以用于调用所述存储器830中存储的计算 机程序或指令，执行上述示例中核心网设备执行的方法，或者通过所述收发器820执行上述示例中核心网设备执行的方法。
图7中的处理模块710可以通过所述处理器810来实现。
图7中的接收模块720a和发送模块720b可以通过所述收发器820来实现。或者，收发器820分为接收器和发送器，接收器执行接收模块的功能，发送器执行发送模块的功能。
图7中的存储模块730可以通过所述存储器830来实现。
作为一种可能的产品形态，装置可以由通用处理器(通用处理器也可以称为芯片或芯片系统)来实现。
一种可能的实现方式中，实现应用于核心网设备的装置的通用处理器包括：处理电路(处理电路也可以称为处理器)；可选的，还包括：与所述处理电路内部连接通信的输入输出接口、存储介质(存储介质也可以称为存储器)，所述存储介质用于存储处理电路执行的指令，以执行上述示例中核心网设备执行的方法。
图7中的处理模块710可以通过处理电路来实现。
图7中的接收模块720a和发送模块720b可以通过输入输出接口来实现。或者，输入输出接口分为输入接口和输出接口，输入接口执行接收模块的功能，输出接口执行发送模块的功能。
图7中的存储模块730可以通过存储介质来实现。
作为一种可能的产品形态，本申请实施例的装置，还可以使用下述来实现：一个或多个FPGA(现场可编程门阵列)、PLD(可编程逻辑器件)、控制器、状态机、门逻辑、分立硬件部件、任何其它适合的电路、或者能够执行本申请通篇所描述的各种功能的电路的任意组合。
本申请实施例还提供了一种计算机可读存储介质，存储有计算机程序，该计算机程序被计算机执行时，可以使得所述计算机用于执行上述通信的方法。或者说：所述计算机程序包括用于实现上述通信的方法的指令。
本申请实施例还提供了一种计算机程序产品，包括：计算机程序代码，当所述计算机程序代码在计算机上运行时，使得计算机可以执行上述提供的通信的方法。
本申请实施例还提供了一种通信的系统，所述通信系统包括以下至少两项：执行上述通信的方法的核心网设备、第一终端、其他核心网设备、请求方。
另外，本申请实施例中提及的处理器可以是中央处理器(central processing unit，CPU)，基带处理器，基带处理器和CPU可以集成在一起，或者分开，还可以是网络处理器(network processor，NP)或者CPU和NP的组合。处理器还可以进一步包括硬件芯片或其他通用处理器。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic，GAL)及其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等或其任意组合。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
本申请实施例中提及的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。应注意，本申请描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
本申请实施例中提及的收发器中可以包括单独的发送器，和/或，单独的接收器，也可以是发送器和接收器集成一体。收发器可以在相应的处理器的指示下工作。可选的，发送器可以对应物理设备中发 射机，接收器可以对应物理设备中的接收机。
本领域普通技术人员可以意识到，结合本文中所公开的实施例中描述的各方法步骤和单元，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各实施例的步骤及组成。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。本领域普通技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口、装置或单元的间接耦合或通信连接，也可以是电的，机械的或其它的形式连接。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本申请实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以是两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分，或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
尽管已描述了本申请的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请范围的所有变更和修改。
显然，本领域的技术人员可以对本申请实施例进行各种改动和变型而不脱离本申请实施例的精神和范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包括这些改动和变型在内。

Claims (21)

  1. 一种通信方法，其特征在于，应用于核心网设备，包括：
    接收来自请求方的第一信息，所述第一信息用于指示第一终端；
    获取所述第一终端对应的认证方式；
    执行与所述认证方式对应的流程。
  2. 如权利要求1所述的方法，其特征在于，在接收来自请求方的第一信息之后，还包括：
    获取所述第一终端的标识，向所述请求方发送所述第一终端的标识。
  3. 如权利要求1或2所述的方法，其特征在于，所述认证方式包括以下任一项：
    双向认证方式、单向认证方式。
  4. 如权利要求3所述的方法，其特征在于，所述双向认证方式包括以下任一项：
    所述第一终端与所述请求方的双向认证、所述第一终端与所述核心网设备对应的第一网络的双向认证；或者，
    所述单向认证方式包括以下任一项：
    所述请求方对所述第一终端执行的单向认证、所述核心网设备对应的第一网络对所述第一终端执行的单向认证、所述第一终端对所述请求方执行的单向认证、所述第一终端对所述核心网设备对应的第一网络执行的单向认证。
  5. 如权利要求4所述的方法，其特征在于，执行与所述认证方式对应的流程，包括：
    当所述认证方式为所述第一终端对所述请求方执行的单向认证时，接收来自所述第一终端的随机数，向所述请求方发送所述随机数；接收来自所述请求方的校验值或密文信息，向所述第一终端发送所述校验值或所述密文信息；或者，
    当所述认证方式为所述请求方对所述第一终端执行的单向认证时，接收来自所述请求方的随机数，向所述第一终端发送所述随机数；接收来自所述第一终端的校验值或密文信息，向所述请求方发送所述校验值或所述密文信息；或者，
    当所述认证方式为所述请求方对所述第一终端执行的单向认证时，获取随机数，向所述第一终端发送所述随机数；接收来自所述第一终端的校验值或密文信息，向所述请求方发送所述随机数、以及向请求方发送所述校验值或所述密文信息；或者，
    当所述认证方式为所述第一终端与所述请求方的双向认证时，接收来自所述第一终端的随机数，向所述请求方发送所述随机数；接收来自所述请求方的第一校验值或第一密文信息，向所述第一终端发送所述第一校验值或所述第一密文信息；接收来自所述第一终端的第二校验值或第二密文信息，向所述请求方发送所述第二校验值或所述第二密文信息；或者，
    当所述认证方式为所述第一终端对所述核心网设备对应的第一网络执行的单向认证时，接收来自所述第一终端的第一随机数；获取第二随机数；并基于所述第一随机和所述第二随机数获取校验值或密文信息，向所述第一终端发送所述校验值或所述密文信息；或者，
    当所述认证方式为所述第一终端对所述核心网设备对应的第一网络执行的单向认证时，接收来自所述第一终端的第一随机数；并基于所述第一随机获取校验值或密文信息，向所述第一终端发送所述校验值或所述密文信息；或者，
    当所述认证方式为所述核心网设备对应的第一网络对所述第一终端执行的单向认证时，获取随机数，向所述第一终端发送所述随机数；接收来自所述第一终端的校验值或密文信息，并基于所述随机数校验所述校验值或所述密文信息；或者，
    当所述认证方式为所述核心网设备对应的第一网络对所述第一终端执行的单向认证时，获取随机数，向所述第一终端发送所述随机数；接收来自所述第一终端的校验值或密文信息，向其它核心网设备发送所述随机数、以及其它核心网设备发送所述校验值或所述密文信息，以使所述其它核心网设备基于所述随机数校验所述校验值或所述密文信息；或者，
    当所述认证方式为所述第一终端与所述核心网设备对应的第一网络的双向认证时，接收来自所述第一终端的第一随机数；获取第二随机数；并基于所述第一随机数和所述第二随机数获取第一校验值或第一密文信息，向所述第一终端发送所述第一校验值或所述第一密文信息；接收来自所述第一终端的第二校验值或第二密文信息，并基于所述第二随机数校验所述第二校验值或所述第二密文信息；或者，
    当所述认证方式为所述第一终端与所述核心网设备对应的第一网络的双向认证时，接收来自所述第 一终端的第一随机数；并基于所述第一随机数获取第一校验值或第一密文信息，向所述第一终端发送所述第一校验值或所述第一密文信息，以及向第一终端发送第二随机数；接收来自所述第一终端的第二校验值或第二密文信息，并基于所述第二随机数校验所述第二校验值或所述第二密文信息。
  6. 如权利要求1-5任一项所述的方法，其特征在于，所述第一信息还用于指示所述第一终端对应的所述认证方式；所述获取所述第一终端对应的认证方式，包括：
    根据所述第一信息，获取所述第一终端对应的认证方式。
  7. 如权利要求1-5任一项所述的方法，其特征在于，所述获取所述第一终端对应的认证方式，包括：
    获取所述第一终端的第一上下文信息、或第一策略信息、或第一业务配置、或第一签约数据；其中，所述第一上下文信息、或所述第一策略信息、或所述第一业务配置、或所述第一签约数据包括所述第一终端的认证方式；
    基于所述第一上下文信息、或所述第一策略信息、或所述第一业务配置、或所述第一签约数据，获取所述第一终端对应的认证方式。
  8. 如权利要求1-5任一项所述的方法，其特征在于，所述获取所述第一终端对应的认证方式，包括：
    获取所述请求方的第二上下文信息、或第二策略信息、或第二业务配置、或第二签约数据；其中，所述第二上下文信息、或所述第二策略信息、或所述第二业务配置、或所述第二签约数据包括所述请求方管理的一个或多个终端各自对应的认证方式，所述请求方管理的一个或多个终端包括所述第一终端；
    基于所述第二上下文信息、或所述第二策略信息、或所述第二业务配置、或所述第二签约数据，获取所述第一终端对应的认证方式。
  9. 如权利要求1-8任一项所述的方法，其特征在于，获取所述第一终端对应的认证方式之后，还包括：
    向所述第一终端发送所述认证方式的信息。
  10. 一种通信方法，其特征在于，应用于核心网设备，包括：
    接收来自请求方的第一信息，所述第一信息用于指示第一终端；
    获取所述第一终端对应的认证方式，其中，所述第一终端对应的认证方式为不执行认证；
    确定所述第一终端的位置属于预设位置范围内；
    允许所述请求方或所述核心网设备对应的第一网络跳过所述第一终端的认证流程。
  11. 如权利要求10所述的方法，其特征在于，接收来自请求方的第一信息之后，还包括：
    获取所述第一终端的标识，向所述请求方发送所述第一终端的标识。
  12. 如权利要求10或11所述的方法，其特征在于，还包括：
    确定所述第一终端的位置在预设位置范围外；
    执行与配置的认证方式对应的流程，所述配置的认证方式用于认证接入所述核心网设备所在的网络的终端。
  13. 如权利要求10-12任一项所述的方法，其特征在于，所述第一终端的位置包括以下的一项或多项：
    第一终端的地理位置、对所述第一终端执行随机接入的第二终端的地理位置；
    所述预设位置范围为预设地理位置范围。
  14. 如权利要求10-12任一项所述的方法，其特征在于，所述第一终端的位置由第一标识表征，所述预设位置范围为预设标识范围；其中，
    第一标识包括以下的一项或多项：
    第一终端接入的接入网设备的标识、第一终端所在的小区的标识、第一终端所在的跟踪区的标识、第一终端接入的网络的标识、第一终端接入的切片的标识、第一终端接入的封闭接入组的标识、第二终端接入的接入网设备的标识、第二终端所在的小区的标识、第二终端所在的跟踪区的标识、第二终端接入的网络的标识、第二终端接入的切片的标识、第二终端接入的封闭接入组的标识，其中，所述第二终端为对所述第一终端执行随机接入的终端。
  15. 如权利要求11-14任一项所述的方法，其特征在于，向所述请求方发送所述第一终端的标识之前，还包括：
    向所述第一终端发送所述第一终端接入成功的指示信息。
  16. 一种通信装置，其特征在于，包括：实现如权利要求1-15任一项所述的方法的功能模块。
  17. 一种通信装置，其特征在于，包括处理器，所述处理器与存储器耦合；
    所述存储器，用于存储计算机程序或指令；
    所述处理器，用于执行所述存储器中的部分或者全部计算机程序或指令，当所述部分或者全部计算机程序或指令被执行时，用于实现如权利要求1-15任一项所述的方法。
  18. 一种通信装置，其特征在于，包括处理器和存储器；
    所述存储器，用于存储计算机程序或指令；
    所述处理器，用于执行所述存储器中的部分或者全部计算机程序或指令，当所述部分或者全部计算机程序或指令被执行时，用于实现如权利要求1-15任一项所述的方法。
  19. 一种芯片系统，其特征在于，所述芯片系统包括：处理电路；所述处理电路与存储介质耦合；
    所述处理电路，用于执行所述存储介质中的部分或者全部计算机程序或指令，当所述部分或者全部计算机程序或指令被执行时，用于实现如权利要求1-15任一项所述的方法。
  20. 一种计算机可读存储介质，其特征在于，用于存储计算机程序，所述计算机程序包括用于实现权利要求1-15任一项所述的方法的指令。
  21. 一种计算机程序产品，其特征在于，所述计算机程序产品包括：计算机程序代码，当所述计算机程序代码在计算机上运行时，使得计算机执行如权利要求1-15任一项所述的方法。
PCT/CN2023/118059 2022-09-26 2023-09-11 一种通信方法及装置 WO2024067046A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211174577.5A CN117768889A (zh) 2022-09-26 2022-09-26 一种通信方法及装置
CN202211174577.5 2022-09-26

Publications (1)

Publication Number Publication Date
WO2024067046A1 true WO2024067046A1 (zh) 2024-04-04

Family

ID=90317071

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/118059 WO2024067046A1 (zh) 2022-09-26 2023-09-11 一种通信方法及装置

Country Status (2)

Country Link
CN (1) CN117768889A (zh)
WO (1) WO2024067046A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150312041A1 (en) * 2009-11-17 2015-10-29 Unho Choi Authentication in ubiquitous environment
US20170244703A1 (en) * 2016-02-19 2017-08-24 Samsung Electronics Co., Ltd. Method and apparatus for connecting between electronic devices using authentication based on biometric information
CN111865569A (zh) * 2019-04-28 2020-10-30 华为技术有限公司 一种密钥协商方法及装置
CN113269624A (zh) * 2021-05-08 2021-08-17 深圳微众信用科技股份有限公司 一种认证授权方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150312041A1 (en) * 2009-11-17 2015-10-29 Unho Choi Authentication in ubiquitous environment
US20170244703A1 (en) * 2016-02-19 2017-08-24 Samsung Electronics Co., Ltd. Method and apparatus for connecting between electronic devices using authentication based on biometric information
CN111865569A (zh) * 2019-04-28 2020-10-30 华为技术有限公司 一种密钥协商方法及装置
CN113269624A (zh) * 2021-05-08 2021-08-17 深圳微众信用科技股份有限公司 一种认证授权方法及装置

Also Published As

Publication number Publication date
CN117768889A (zh) 2024-03-26

Similar Documents

Publication Publication Date Title
US20210084443A1 (en) Methods of joint registration and de-registration for proximity services and internet of things services
US11829774B2 (en) Machine-to-machine bootstrapping
US11134543B2 (en) Interworking LPWAN end nodes in mobile operator network
US10243954B2 (en) Access network assisted bootstrapping
US20230345243A1 (en) Authentication method and communication apparatus
KR20230011423A (ko) 통신 보호 방법 및 장치
EP3682619B1 (en) Service layer message templates in a communications network
US20230421663A1 (en) Efficient resource representation exchange between service layers
US20240098145A1 (en) Packet transmission method and related apparatus
WO2017101211A1 (zh) 无线通信系统接入方法、装置及终端
WO2023143244A1 (zh) 终端管理方法和核心网设备
WO2024067046A1 (zh) 一种通信方法及装置
JP7428265B2 (ja) 通信端末及びその方法
US20220225463A1 (en) Communications method, apparatus, and system
KR101643334B1 (ko) 결제 및 원격 모니터링을 통한 제어용 ｍ２ｍ 보안 게이트웨이 장치 및 통신 시스템
WO2024067047A1 (zh) 一种通信方法及装置
WO2023142569A1 (zh) 一种通信方法、装置、可读存储介质和芯片系统
WO2024021935A1 (zh) 一种通信方法及装置
WO2024067706A1 (zh) 一种通信方法及通信装置
WO2023138198A1 (zh) 一种通信方法、装置和系统
WO2023030077A1 (zh) 一种通信方法、通信装置及通信系统
WO2024066436A1 (zh) 一种通信方法及装置
Salkintzis et al. 5G Network Enhancements to Support Ambient IoT Devices
WO2023055342A1 (en) Enabling distributed non-access stratum terminations
CN117336714A (zh) 通信方法、通信装置及通信系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23870285

Country of ref document: EP

Kind code of ref document: A1