WO2024067641A1 - Procédé et appareil de communication, support de stockage lisible par ordinateur et système de communication - Google Patents

Procédé et appareil de communication, support de stockage lisible par ordinateur et système de communication Download PDF

Info

Publication number
WO2024067641A1
WO2024067641A1 PCT/CN2023/121753 CN2023121753W WO2024067641A1 WO 2024067641 A1 WO2024067641 A1 WO 2024067641A1 CN 2023121753 W CN2023121753 W CN 2023121753W WO 2024067641 A1 WO2024067641 A1 WO 2024067641A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal device
credential
network element
identifier
message
Prior art date
Application number
PCT/CN2023/121753
Other languages
English (en)
Chinese (zh)
Inventor
李论
吴义壮
徐艺珊
孙陶然
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2024067641A1 publication Critical patent/WO2024067641A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/084—Access security using delegated authorisation, e.g. open authorisation [OAuth] protocol
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/16—Central resource management; Negotiation of resources or communication parameters, e.g. negotiating bandwidth or QoS [Quality of Service]
    • H04W28/24—Negotiating SLA [Service Level Agreement]; Negotiating QoS [Quality of Service]

Definitions

  • the embodiments of the present application relate to the field of wireless communications, and in particular, to a communication method and apparatus, a computer-readable storage medium, and a communication system.
  • IoT Internet of Things
  • IoT devices have a trusted terminal device (userequipment, UE) or a UE that provides services to the same user. This UE is called the host UE. IoT devices are often offline and can access the network side to request services through the guest terminal device (Guest UE). However, the Guest UE is untrustworthy and may launch attacks. For example, the IoT device and the Host UE belong to the same user, and the Guest UE does not belong to the user. When the IoT device requests network services through the Guest UE, if the Guest UE is a malicious device, the Guest UE may forge the IoT device's request to launch an attack.
  • the guest UE may forge the IoT device's request to launch an attack.
  • the Guest UE may be subject to the following attacks:
  • Guest UE may forge requests from IoT devices and request business data from network-side devices.
  • business data may include the location information or contract information of the Host UE corresponding to the IoT device.
  • the Guest UE may forge the request of the IoT device, triggering the network-side device to send a notification message to the Host UE, causing harassment to the Host UE.
  • the present application provides a communication method and device, a computer-readable storage medium and a communication system, which are used to prevent Guest UE from launching attacks and improve network security.
  • the present application provides a communication method, the method comprising:
  • the first network element receives a service request message from a first terminal device, the service request message includes an identifier and a credential of a second terminal device, the second terminal device requests a service through the first terminal device, and the credential is generated by a third terminal device; the first network element determines whether the credential is valid; if the first network element determines that the credential is valid, the first network element responds to the service request message;
  • the second terminal device can request a service from the first network element through the first terminal device, wherein the service request message includes the identification and credentials of the second terminal device, and the first network element can verify the validity of the credentials and decide whether to respond to the service request message based on whether the credentials are valid. Since the first network element needs to verify the credentials, the first network element can identify the service request message that does not carry the credentials as a forged service request message, thereby improving network security and helping to reduce attack scenarios.
  • the first network element determines whether the credential is valid based on a mapping relationship between an acquired identifier of the credential and an identifier of the third terminal device.
  • the first network element determines that the credential is valid
  • the first network element verifies that the identifier of the credential matches the identifier of the third terminal device according to the mapping relationship, and then determines that the credential is valid.
  • the first network element can determine that the credential is valid based on the mapping relationship, which means that the credential has been registered before, thereby determining that the credential is valid.
  • the first network element when the first network element obtains the mapping relationship between the identifier of the credential and the identifier of the third terminal device, the first network element stores the mapping relationship between the identifier of the credential and the identifier of the third terminal device; or, the first network element sends a mapping relationship between the identifier of the credential and the identifier of the third terminal device to the second network element.
  • the network element sends a query message, which is used to query the mapping relationship between the identifier of the credential and the identifier of the third terminal device; the first network element receives a query response message from the second network element, and the query response message includes the mapping relationship between the identifier of the credential and the identifier of the third terminal device.
  • the first network element can store the mapping relationship, or the first network element can obtain the mapping relationship through the second network element.
  • the first network element when the first network element determines that the credential is valid, it can also determine that the credential is valid based on at least one of the following items; the at least one item includes: the number of times the credential has been used is less than the maximum number of times the credential is used; the usage time of the credential does not exceed the expiration timestamp of the credential; or the identifier of the second terminal device matches the identifier of the credential.
  • the above design can effectively mitigate attacks initiated by malicious first terminal devices that forge service requests.
  • the first network element after the first network element determines that the number of times the credential has been used is less than the maximum number of times the credential has been used, the first network element sends an update message to the second network element, where the update message is used to update the number of times the credential has been used.
  • the second network element can save and update the number of times the voucher has been used.
  • the first network element receives binding information from the third terminal device, and the binding information is used to indicate that the identifier of the credential and the identifier of the second terminal device have a binding relationship.
  • the first network element can obtain in advance that the identifier of the credential and the identifier of the second terminal device have a binding relationship.
  • the first network element before the first network element receives a service request message from the first terminal device, the first network element receives a first message from the third terminal device, the first message including an identifier of the third terminal device and the credential.
  • the first network element stores a mapping relationship between the identifier of the credential and the identifier of the third terminal device.
  • a third terminal device can generate a credential and register it with the first network element.
  • the first network element can store a mapping relationship between the identifier of the credential and the identifier of the third terminal device to verify the validity of the credential when receiving a service request message including the credential.
  • the first message also includes at least one of the business type of the credential, the service description information of the credential, and the identifier of the credential.
  • the first network element after the first network element receives the first message from the third terminal device, the first network element performs at least one of the following: determining that the identity authentication of the third terminal device is passed; determining that the third terminal device has the ability to generate credentials; determining that the number of credentials registered by the third terminal device within a preset time period plus 1 does not reach a quantity threshold.
  • the third terminal device can register multiple credentials at one time, or the third terminal device can register multiple credentials in multiple times, and this application does not limit this.
  • the first network element can count the number of credentials registered by the third terminal device within a preset time, that is, the total number of registered credentials.
  • the first network element can pre-configure the maximum number of credentials that can be registered by the third terminal device within a preset time, that is, the number threshold. Or the first network element can obtain the number threshold from the second network element or other network elements.
  • the first network element can determine whether the total number of currently registered credentials plus 1 is less than or equal to the quantity threshold. If so, the first network element can store the mapping relationship between the identifier of the credential and the identifier of the third terminal device or send an indication message to the second network element, and the indication message is used to indicate the mapping relationship between the identifier of the credential and the identifier of the third terminal device, that is, the credential is successfully registered. Otherwise, the first network element can refuse to register the credential, that is, the credential registration fails.
  • the first network element after the first network element receives the first message from the third terminal device, the first network element can verify the third terminal device.
  • the first network element sends a request message to the second network element, where the request message is used to request configuration information of the first terminal device; the configuration information of the first terminal device is used to indicate whether the first terminal device has the ability to generate credentials, and/or the quantity threshold; the first network element receives the configuration information of the first terminal device from the second network element.
  • the first network element can obtain the configuration information of the terminal device through other network elements (such as the second network element), and then verify the third terminal device based on the obtained configuration information.
  • the first network element sends indication information to the second network element, where the indication information is used to indicate a mapping relationship between the identifier of the credential and the identifier of the third terminal device.
  • the first network element can save the mapping relationship between the identifier of the credential and the identifier of the third terminal device to other network elements.
  • the indication information also includes an expiration timestamp of the credential and/or a maximum number of uses of the credential.
  • the first message is used to request registration of the credential; the second network element sends a second message to the third terminal device, and the second message is used to indicate that the credential is successfully registered.
  • the second message includes at least one of the trust credentials of the credential, the expiration timestamp of the credential, the maximum number of uses of the credential, and the identifier of the credential.
  • the first network element before the first network element receives a service request message from the first terminal device, the first network element receives a third message from the third terminal device, the third message includes an identifier of the first terminal device, and the third message is used to request the credential; the first network element generates the credential; the first network element sends a fourth message to the third terminal device, the fourth message includes the credential.
  • the first network element stores a mapping relationship between the identifier of the credential and the identifier of the third terminal device.
  • the first network element can generate a credential based on the request of the third terminal device and send it to the third terminal device. It can further store the mapping relationship between the credential identifier and the identifier of the third terminal device to verify the validity of the credential when receiving a service request message including the credential.
  • the third message also includes the business type of the certificate or service description information of the certificate.
  • the first network element before the first network element sends the fourth message to the third terminal device, performs at least one of the following: determining that the identity authentication of the third terminal device is passed; determining that the third terminal device has the ability to generate credentials; determining that the number of credentials registered by the third terminal device within a preset time period plus 1 does not reach a quantity threshold.
  • the first network element sends a request message to the second network element, where the request message is used to request configuration information of the first terminal device; the configuration information of the first terminal device is used to indicate whether the first terminal device has the ability to generate credentials, and/or the quantity threshold; the first network element receives the configuration information of the first terminal device from the second network element.
  • the fourth message includes at least one of a trust credential of the credential, an expiration timestamp of the credential, a maximum number of uses of the credential, and an identifier of the credential.
  • the first network element after the first network element receives a service request message from a first terminal device, the first network element sends a first notification message to the third terminal device, where the first notification message includes location information of the first terminal device.
  • triggering the first network element to send a message to the third terminal device also requires valid credentials as a prerequisite, thereby alleviating the harassment of the third terminal device by the untrusted first terminal device.
  • the service request message indicates the release of the binding relationship between the second terminal device and the third terminal device; after the first network element receives the service request message from the first terminal device, the first network element sends a second notification message to the third terminal device, and the second notification message is used to indicate the release of the binding relationship between the second terminal device and the third terminal device.
  • triggering the first network element to send a message to the third terminal device also requires valid credentials as a prerequisite, thereby alleviating the harassment of the third terminal device by the untrusted first terminal device.
  • the first network element modifies the QoS parameters of the second terminal device based on the service request message.
  • the first network element when the first network element determines that the credential is invalid, the first network element sends a third notification message to the third terminal device, and the third notification message indicates the reason why the credential is invalid.
  • the credential is a ticket, a certificate, a token, or a preconfigured hash value.
  • the present application provides a communication method, the method comprising: a first terminal device receives a service request message from a second terminal device, the service request message comprising a credential and an identifier of the second terminal device, the second terminal device requests a service through the first terminal device; the first terminal device sends the service request message to a first network element.
  • the first terminal device can receive a service request message from the second terminal device and send it to the first network element, and receive a service response message from the first network element and send it to the second terminal device.
  • the first terminal device receives a service response message from the first network element; and the first terminal device sends the service response message to the second terminal device.
  • the first terminal device before the first terminal device receives a service request message from the second terminal device, the first terminal device receives a broadcast message from a third terminal device, where the broadcast message includes the credential or an identifier of the credential.
  • the credential is a ticket, a certificate, a token, or a preconfigured hash value.
  • the present application provides a communication method, which includes: a third terminal device generates a credential; the third terminal device sends a first message to a first network element, the first message including an identifier of the third terminal device and the credential; and the third terminal device sends the credential to a second terminal device.
  • the third terminal device can generate a credential and register with the first network element, and the third terminal device can also send the credential to the second terminal device. It is understandable that the third terminal device can send the credential to the second terminal device before or after sending the first message to the first network element, and this application does not limit this.
  • the second message is used to request registration of the credential; the third terminal device receives the second message from the first network element, and the second message is used to indicate that registration of the credential is successful.
  • the third terminal device may send the credential to the second terminal device before or after the second message.
  • the third terminal device before the third terminal device sends the credential to the second terminal device, the third terminal device receives a registration request message or a service request message from the second terminal device.
  • the first message also includes at least one of the business type of the credential, the service description information of the credential, and the identifier of the credential.
  • the second message includes at least one of a trust credential of the credential, an expiration timestamp of the credential, a maximum number of uses of the credential, and an identifier of the credential.
  • the third terminal device after the third terminal device receives the first message from the first network element, the third terminal device broadcasts the credential or an identifier of the credential.
  • a terminal device eg, a first terminal device that receives the credential or the identifier of the credential can save the credential.
  • the third terminal device after the third terminal device sends the credential to the second terminal device, the third terminal device sends binding information to the first network element, where the binding information is used to indicate that the identifier of the credential and the identifier of the second terminal device have a binding relationship.
  • the credential is a ticket, a certificate, a token, or a preconfigured hash value.
  • the present application provides a communication method, which includes: a third terminal device generates a credential; the third terminal device sends the credential to a second terminal device; the second terminal device sends a service request message to a first terminal device based on the received credential, the service request message including an identifier of the second terminal device and the credential, and the second terminal device requests a service through the first terminal device; the first terminal device sends the service request message to a first network element; the first network element determines whether the credential is valid; if the first network element determines that the credential is valid, the first network element responds to the service request message.
  • the present application provides a communication method, which includes: a third terminal device sends a third message to a first network element, the third message including an identifier of the third terminal device, and the third message is used to request a credential; the first network element sends a fourth message to the third terminal device, and the fourth message indicates the credential; the third terminal device sends the credential to a second terminal device; the second terminal device sends a service request message to the first terminal device based on the received credential, the service request message including an identifier of the second terminal device and an identifier of the credential, and the second terminal device requests a service through the first terminal device; the first terminal device sends the service request message to the first network element; the first network element determines whether the credential is valid; if the first network element determines that the credential is valid, the first network element responds to the service request message.
  • the present application provides a communication method, the method comprising: a third terminal device sends a third message to a first network element, the third message including an identifier of the third terminal device, and the third message is used to request a credential; the third terminal device receives a fourth message from the first network element, the fourth message indicating that the credential is successfully registered; the third terminal device sends the credential to a second terminal device.
  • the third terminal device can request the first network element to generate credentials for it.
  • the third terminal device before the third terminal device sends the credential to the second terminal device, the third terminal device receives a registration request message or a service request message from the second terminal device.
  • the third message also includes the business type of the bill or service description information of the bill.
  • the fourth message includes at least one of a trust credential of the credential, an expiration timestamp of the credential, a maximum number of uses of the credential, and an identifier of the credential.
  • the third terminal device after the third terminal device receives the second message from the first network element, the third terminal device broadcasts the credential or an identifier of the credential.
  • the third terminal device after the third terminal device sends the credential to the second terminal device, the third terminal device sends binding information to the first network element, where the binding information is used to indicate that the identifier of the credential and the identifier of the second terminal device have a binding relationship.
  • the credential is a ticket, a certificate, a token, or a preconfigured hash value.
  • the present application further provides a device.
  • the device can execute the above method design.
  • the device can be a chip or circuit capable of executing the function corresponding to the above method, or a device including the chip or circuit.
  • the device includes: a memory for storing computer executable program code; and a processor coupled to the memory.
  • the program code stored in the memory includes instructions, and when the processor executes the instructions, the device or a device equipped with the device executes the method in any of the above possible designs.
  • the device may further include a communication interface, which may be a transceiver, or, if the device is a chip or a circuit, the communication interface may be an input/output interface of the chip, such as an input/output pin.
  • a communication interface which may be a transceiver, or, if the device is a chip or a circuit, the communication interface may be an input/output interface of the chip, such as an input/output pin.
  • the device includes corresponding functional units, which are respectively used to implement the steps in the above method.
  • the functions can be implemented by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more units corresponding to the above functions.
  • the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program runs on a device, executes the method in any one of the possible designs described above.
  • the present application provides a computer program product, comprising a computer program, which executes the method in any one of the possible designs described above when the computer program runs on a device.
  • the present application provides a communication system, the system comprising a first terminal device, a second terminal device, a third terminal device and a first network element, the first network element being used to implement the method in any possible design of the first aspect, the first terminal device being used to implement the method in any possible design of the second aspect, and the third terminal device being used to implement the method in any possible design of the third aspect or the sixth aspect.
  • Figure 1 is a schematic diagram of the Guest UE attack scenario in this application
  • FIG2 is a schematic diagram of the architecture of a mobile communication system used in the present application.
  • FIG3 is a flow chart of administrator identity authentication and authorization execution management and orchestration functions in this application.
  • FIG4 is a flow chart of the network side communicating with the IoT device by pre-configuring and allocating public and private keys or symmetric keys to the IoT device in the present application;
  • FIG5 is one of the flow charts of the second terminal device obtaining the credential provided by the present application.
  • FIG6 is a second flowchart of the second terminal device obtaining a credential provided by the present application.
  • FIG7 is a flow chart of an overview of a communication method provided by the present application.
  • FIG8A is one of the specific flow charts of the IoT device requesting services from the network side through the Guest UE provided in this application;
  • FIG8B is one of the specific flow charts of the IoT device requesting services from the network side through the Guest UE provided in this application;
  • FIG9 is a second specific flow chart of the IoT device provided in this application requesting services from the network side through the Guest UE;
  • FIG10 is a third specific flow chart of the IoT device requesting services from the network side through the Guest UE provided by this application;
  • FIG11 is a schematic diagram of a structure of a communication device provided by the present application.
  • FIG. 12 is a second schematic diagram of the structure of a communication device provided in the present application.
  • At least one of a, b, or c can mean: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c can be single or multiple.
  • the technical solution provided in the embodiment of the present application can be applied to various communication systems. For example, it can be applied to 4G system or 5G system, and it can also be applied to other new systems facing the future.
  • the embodiment of the present application does not specifically limit this.
  • the term "system” can be interchangeable with "network”.
  • FIG2 is a schematic diagram of the architecture of a mobile communication system used in an embodiment of the present application.
  • the communication system includes a terminal device (e.g., user equipment (UE)), a network device (e.g., access network (AN) device or radio access network (AN) device, hereinafter, RAN is used as an example for explanation), a core network (CN), a data network (CN), and a data Logically, the network elements of the core network can be divided into two parts: the user plane and the control plane.
  • the control plane is responsible for the management of the mobile network
  • the user plane is responsible for the transmission of service data.
  • the terminal device is the entrance for mobile users to interact with the network. It can provide basic computing power, storage capacity, display service windows to users, and receive user operation input.
  • the next generation of terminal equipment (NextGen UE) can use new air interface technology to establish signal connection and data connection with RAN, thereby transmitting control signals and service data to the mobile network.
  • Terminal equipment can include various handheld devices with wireless communication functions, vehicle-mounted devices, wearable devices, computing devices or other processing devices connected to wireless modems, as well as various forms of terminals, mobile stations (MS), terminals, soft terminals, etc., such as water meters, electricity meters, sensors, etc.
  • RAN Deployed near the terminal device, it provides network access for authorized users in a specific area and can determine transmission tunnels of different qualities to transmit user data according to the user level and business requirements. RAN can manage its own resources, use them reasonably, provide access services to terminal devices on demand, and is responsible for forwarding control signals and user data between terminal devices and the core network.
  • Core network responsible for maintaining the subscription data of the mobile network, managing the network elements of the mobile network, and providing functions such as session management, mobility management, policy management, and security authentication for terminal devices.
  • the terminal device When the terminal device is attached, it provides network access authentication for the terminal device; when the terminal device has a service request, it allocates network resources for the terminal device; when the terminal device moves, it updates network resources for the terminal device; when the terminal device is idle, it provides a fast recovery mechanism for the terminal device; when the terminal device detaches, it releases network resources for the terminal device; when the terminal device has service data, it provides data routing functions for the terminal device, such as forwarding uplink data to the data network; or receiving downlink data of the terminal device from the data network and forwarding it to the RAN, which is then sent to the terminal device by the RAN.
  • Data network A data network that provides business services to users.
  • the client is located in the terminal device and the server is located in the data network.
  • the data network can be a private network, such as a local area network, or an external network that is not controlled by the operator, such as the Internet. It can also be a proprietary network jointly deployed by operators, such as a network that provides IP multimedia core network subsystem (IMS) services.
  • IMS IP multimedia core network subsystem
  • the core network user plane includes user plane function (UPF); the core network control plane includes access and mobility management function (AMF), session management function (SMF), unified data management (UDM), policy control function (PCF), application function (AF), network exposure function (NEF), network slice specific authentication and authorization function (NSSAAF), authentication server function (AUSF), network slice selection function (NSSF), network function repository function (NF repository function (NRF), and network slice selection function (NSSF).
  • UPF user plane function
  • the core network control plane includes access and mobility management function (AMF), session management function (SMF), unified data management (UDM), policy control function (PCF), application function (AF), network exposure function (NEF), network slice specific authentication and authorization function (NSSAAF), authentication server function (AUSF), network slice selection function (NSSF), network function repository function (NF repository function (NRF), and network slice selection function (NSSF).
  • UPF user plane function
  • AMF access and mobility management function
  • SMF session management function
  • UDM unified data management
  • PCF policy control function
  • the core network control plane adopts a service-oriented architecture, and the interaction between control plane network elements adopts the service call method to replace the point-to-point communication method in the traditional architecture.
  • the control plane network elements will open services to other control plane network elements for other control plane network elements to call; in point-to-point communication, the communication interface between control plane network elements will store a set of specific messages, which can only be used by the control plane network elements at both ends of the interface when communicating.
  • Session management network element mainly used for session management, IP address allocation and management of terminal devices, selection of endpoints for manageable user equipment plane functions, policy control, or charging function interfaces, and downlink data notification.
  • the session management network element can be an SMF network element.
  • the session management function network element can still be an SMF network element, or have other names, which is not limited in this application.
  • Nsmf is a service-based interface provided by SMF, and SMF can communicate with other network functions through Nsmf.
  • Access management network element mainly used for mobility management and access management, etc.
  • it can be the mobility management entity (MME) function in the 4G communication network or the AMF network element in the 5G network.
  • MME mobility management entity
  • the access management network element can still be the AMF network element, or have other names, which is not limited in this application.
  • Namf is a service-based interface provided by AMF, and AMF can communicate with other network functions through Namf.
  • Policy control network element A unified policy framework for guiding network behavior, providing policy rule information for control plane functional network elements (such as AMF, SMF, etc.).
  • the policy control network element can be a PCF network element.
  • future communications such as 6G communication, the policy control network element can still be a PCF network element, or have other names, which are not limited in this application.
  • Npcf is a service-based interface provided by PCF, and PCF can communicate with other network functions through Npcf.
  • Data management network element used to process user identification, contract signing, access authentication, registration, or mobility management.
  • the data management network element may be a UDM network element.
  • future communications such as 6G communications, the data management network element may still be a UDM network element or have other names, which are not limited in this application.
  • Nudm is a service-based interface provided by UDM, and UDM can communicate with other network functions through Nudm.
  • Application network element used for data routing affected by applications, access to network open functions, or interacting with the policy framework for policy control, etc.
  • application network elements can be AF network elements.
  • future communications such as 6G communications, application network elements can still be AF network elements, or have other names, which are not limited in this application.
  • Naf is a service-based interface provided by AF, and AF can communicate with other network functions through Naf.
  • User plane network element used for packet routing and forwarding, or quality of service (QoS) processing of user plane data.
  • the user plane network element may be a user plane function network element.
  • the user plane network element may still be a UPF network element, or have other names, which is not limited in this application.
  • Network open function network element used to securely open the services and capabilities provided by 3GPP network functions to the outside.
  • the network capability open network element can be a NEF network element.
  • future communications such as 6G communication, the network capability open network element can still be a NEF network element, or have other names, which are not limited in this application.
  • Nnef is a service-based interface provided by NEF, and NEF can communicate with other network functions through Nnef.
  • Network slice authentication and authorization network element used for authentication and authorization of network slices, which can interact with the authentication, authorization, and accounting server (AAA-S) through the authentication, authorization, and accounting proxy (AAA-P).
  • AAA-S authentication, authorization, and accounting server
  • AAA-P authentication, authorization, and accounting proxy
  • the network slice authentication and authorization network element can still be an NSSAAF network element, or have other names, which is not limited in this application.
  • Nnssaaf is a service-based interface provided by NSSAAF, and NSSAAF can communicate with other network functions through Nnssaaf.
  • Network storage network element used to provide service registration, discovery and authorization, and maintain available network function (NF) instance information, which can realize on-demand configuration of network functions and services and interconnection between NFs.
  • the network storage network element can be an NRF network element.
  • the network storage function network element can still be an NRF network element, or have other names, which is not limited in this application.
  • Nnrf is a service-based interface provided by NRF, and NRF can communicate with other network functions through Nnrf.
  • Authentication service network element mainly used for user authentication, etc.
  • the authentication service network element can be an AUSF network element.
  • future communications such as 6G communication, the authentication service network element can still be an AUSF network element, or have other names, which are not limited in this application.
  • Nausf is a service-based interface provided by AUSF, and AUSF can communicate with other network functions through Nausf.
  • Network slice selection function network element used to select network slices for terminal devices.
  • the network slice selection function network element may be an NSSF network element.
  • future communications such as 6G communication, the network slice selection function network element may still be an NSSF network element, or have other names, which are not limited in this application.
  • Nnssf is a service-based interface provided by NSSF, and NSSF can communicate with other network functions through Nnssf.
  • Figure 2 is only an example, and the core network may also include more or fewer network elements, which is not limited in this application.
  • Ticket-based access control is a type of access control that uses tickets to authenticate the connection between a client and a server, and uses shared key cryptography to provide a secure connection between the client, key distribution center (KDC), and server.
  • KDC key distribution center
  • Ticket-based NFV administrator access control was proposed in 3GPP 33.848. It is used to authenticate administrators who attempt to access NFV (or virtualized network function (VNF) or network function virtualization infrastructure (NFV infrastructure, NFVI)) resources. It can solve the problem of untrustworthy NFV administrators. After one authentication, the administrator needs to consume a ticket to perform management operations and cannot operate at will. The above process can be shown in Figure 3.
  • VNF virtualized network function
  • NFV infrastructure network function virtualization infrastructure
  • FIG. 3 shows a flowchart of administrator authentication and authorization to perform management and orchestration (MANO) functions.
  • MEO management and orchestration
  • S301 The administrator sends an identity verification request to the KDC.
  • the credential here may be a ticket granting ticket (TGT).
  • TGT ticket granting ticket
  • S303 The administrator sends a credential usage request to the KDC.
  • the KDC After verifying the credentials, the KDC generates a session key and sends the session key to the administrator.
  • S305 The administrator establishes a secure link with the virtualization layer based on the session key.
  • S306 The virtualization layer and the attribute based access control (ABAC) policy server confirm the MANO capabilities of the authorized administrator.
  • ABAC attribute based access control
  • the ABAC server is a policy server for each virtualization layer (e.g., NFV or VNF or NFVI), which is used to authorize the administrator's MANO function.
  • the administrator can perform the MANO function only after identity authentication and authorization of the MANO capability.
  • the virtualization layer sends an authorization response message to the administrator, where the authorization response message is used to authorize the administrator's MANO capability.
  • S308 The administrator executes the function of MANO.
  • the administrator can access virtualization layer resources or communicate with the virtualization layer within the usage period of the credential.
  • the usage period of the credential is reached, the virtualization layer no longer allows the administrator to perform MANO functions.
  • Some devices or network elements have the ability to transfer, so that two nodes that cannot establish a direct connection can establish a communication connection.
  • some low-cost IoT devices cannot be directly connected to the network side (base station), but can be connected to the network side through a relay terminal device.
  • the relay terminal device and the IoT device do not need to establish a connection through a base station.
  • the way in which the IoT device establishes a connection with the relay terminal device is an existing technology.
  • the two can use the direct cellular communication protocol (proximity communication-5, PC5) interface specified in 3GPPTS 23.501 to establish a connection, or can use wireless fidelity (wireless fidelity, WI-FI) technology to establish a connection, or use Bluetooth network (Bluetooth) technology to establish a connection, or use two or more of the above methods to establish a connection.
  • the IoT device and the relay terminal device may also establish a connection through other methods, which is not limited in this application.
  • the network side needs to pre-configure and allocate public and private keys or symmetric keys to the IoT device so that the network side can establish a secure connection pair through the key and provide services to the IoT device.
  • the network side device preconfigures the information of the IoT device in the network side device by means of preconfiguration, and distributes the public and private keys or symmetric keys to the IoT device by means of a negotiated key mechanism.
  • the IoT device determines the service request message, and signs the service request message using a private key, or encrypts the service request message using a symmetric key.
  • the IoT device sends a service request message to the relay UE.
  • the relay UE sends a service request message to the network side device.
  • S405 The network-side device compares the service request message with the identifier of the pre-configured IoT device and verifies whether the signature is valid, or decrypts it with the negotiated symmetric key.
  • keys can be configured for each IoT device when it signs or registers.
  • network-side services for example, including but not limited to: loading the user's usage habit model, pairing information, turning on the lost mode to obtain the user's location, updating the user plane data control parameters, etc.
  • some IoT devices may not need to obtain network-side services.
  • IoT devices have contract data but do not have the ability to directly connect to the network side (for example, they cannot directly connect to the base station of the 5G core network through the Uu port of 3GPP) and need to access the network side through relay terminal devices.
  • Network-side devices can provide some services for IoT devices, such as: IoT devices requesting the location of a specified host terminal device (Host UE), or the artificial intelligence (AI) model of a contracted user, or the context required for pairing UEs other than Host UE with IoT devices, or when an IoT device establishes a session with other IoT devices, it is necessary to request trusted credentials of other IoT devices through the network side.
  • IoT devices requesting the location of a specified host terminal device (Host UE), or the artificial intelligence (AI) model of a contracted user, or the context required for pairing UEs other than Host UE with IoT devices, or when an IoT device establishes a session with other IoT devices, it is necessary to request trusted credentials of other IoT devices through the network side.
  • Host UE host terminal device
  • AI artificial intelligence
  • IoT devices requesting services is an occasional behavior, such as initiating a service request during the initialization process, initiating a service request once a month, or initiating a service request in lost mode.
  • IoT devices include but are not limited to: personal IoT network element (PINE), personal wearable devices, cars, scooters, industrial control elements, smart home devices, handheld phones, etc.
  • PINE personal IoT network element
  • PINE personal wearable devices
  • cars scooters
  • industrial control elements smart home devices
  • handheld phones etc.
  • the IoT device has a trusted UE or a UE that provides services to the same user, which is called the Host UE.
  • the Host UE is the management UE of the IoT device.
  • the IoT device is initially registered or authorized for service, it must access the network side through the Host UE.
  • the Host UE can be an ordinary user handheld terminal, or a dedicated IoT management device, such as a personal IoT network element with management capability (PEMC).
  • PEMC personal IoT network element with management capability
  • IoT devices are often offline and can access the network side through Guest UE to request services.
  • Guest UE may belong to the same user as Host UE, for example, they are both smart home gateways in a family, or Host UE belongs to an individual user and Guest UE is a public gateway, for example, Guest UE is a smart transportation city road side unit in a public place.
  • Guest UE is untrustworthy and may launch attacks.
  • Guest UE can be another person’s handheld terminal, or a smart home gateway, or a personal IoT network element with gateway capability (PEGC), etc.
  • PGC personal IoT network element with gateway capability
  • the IoT device, Host UE and Guest UE belong to the same user, where the IoT device is a smart home device, and Host UE and Guest UE are smart home gateways.
  • the IoT device and Host UE belong to one user, where the IoT device is a personal IoT device such as a remote-controlled drone, the Host UE is an ordinary mobile phone, and the Guest UE is a gateway node for public use on the roadside.
  • the IoT device is a personal IoT device such as a remote-controlled drone
  • the Host UE is an ordinary mobile phone
  • the Guest UE is a gateway node for public use on the roadside.
  • the IoT device is an industrial control device, such as a tag
  • the Host UE is a terminal device used for initialization registration
  • the Guest UE is a relay device on a conveyor belt.
  • the first network element may be a core network element or an access network device, for example, the first network element is an AF, or an SMF, etc.
  • the first terminal device and the third terminal device can directly access the network, the second terminal device cannot directly access the network, and needs to access the network through a relay terminal device.
  • the second terminal device can access the network through the first terminal device, or the second terminal device can access the network through the third terminal device.
  • the third terminal device is equivalent to the above-mentioned Host UE, the second terminal device is equivalent to the IoT device, and the first terminal device is equivalent to the Guest UE.
  • Method 1 As shown in FIG5 , the third terminal device generates a credential and sends it to the second terminal device. Specifically, the following steps may be included:
  • Step 500 The third terminal device generates a credential.
  • the credential may be a ticket, a certificate, a token, or one of preconfigured hash values, for example, a preconfigured hexadecimal hash value, which is not limited in this application.
  • the third terminal device can also generate a signature of the third terminal device, wherein the signature of the third terminal device is used to protect the integrity of the credential, and can be a signature of the credential as a whole.
  • the third terminal device can use the key negotiated between the third terminal device and the network side to generate a signature, so that other terminal devices cannot forge or tamper with the signature.
  • Step 510 The third terminal device sends a first message to the first network element.
  • the first message includes an identifier and a credential of the first terminal device.
  • the first message is used to request a registration credential.
  • the first message also includes at least one of the business type of the credential, the service description information of the credential, the identification of the credential, and the signature of the third terminal device.
  • the third terminal device has established a secure connection with the network side, such as a secure connection based on the Internet protocol security (IPSec) or a secure connection based on the datagram transport layer security (DTLS), the first message may not include the signature of the third terminal device.
  • IPSec Internet protocol security
  • DTLS datagram transport layer security
  • the first message is used to request a registration credential, which may also be described as the first message is used to request an authentication credential, or the first message is used to request a verification credential.
  • Step 520 The first network element sends a second message to the third terminal device, where the second message is used to indicate that the credential registration is successful.
  • the second message includes at least one of a signed trusted credential of the credential, an expiration timestamp of the credential, a maximum number of uses of the credential, and an identifier of the credential.
  • the third terminal device can generate an identifier of the credential for the credential, or the first network element can generate an identifier of the credential for the credential, which is not limited in this application.
  • the signed trusted credential of a credential is used to approve the credential, indicating that the credential has been authenticated by the network side.
  • the signed trusted credential of a credential may include a certificate provided by the first network element to the credential, or a signature of the credential by the first network element using a key.
  • the above-mentioned signature or certificate may be generated by the first network element, or may be generated by the first network element through other network elements, which is not limited in this application.
  • the first network element may not authenticate the credential based on the result of a prior negotiation between the third terminal device and the first network element. Signing is also called empty signature. In this case, the signature trust credential can be empty.
  • the first network element needs to perform at least one of the following:
  • Option (1) Determine that the identity authentication of the third terminal device is successful.
  • the first network element verifies the signature of the third terminal device.
  • Option (2) Determine whether the third terminal device has the ability to generate a credential.
  • Option (3) Determine whether the number of credentials registered by the third terminal device plus 1 within a preset time period reaches a quantity threshold.
  • the first network element may send a query message to the second network element, where the query message is used to request to query the configuration information of the third terminal device.
  • the configuration information of the third terminal device is used to indicate whether the third terminal device has the ability to generate credentials, and/or the quantity threshold.
  • the quantity threshold can be described as the maximum number of credentials that can be registered by the third terminal device within a preset time.
  • the first network element can execute the above options (2) and/or (3) based on the obtained configuration information.
  • the subscription data of the third terminal device or the access policy of the third terminal device may include the configuration information of the third terminal device.
  • the first network element may be an AF and the second network element may be a PCF or a UDM
  • the first network element may send a query message to the second network element via the NEF
  • the second network element may send configuration information of the third terminal device to the first network element via the NEF.
  • the first network element may store a mapping relationship between the identifier of the third terminal device and the identifier of the credential, and the first network element may also send indication information to the second network element, where the indication information is used to indicate the storage of at least one of the mapping relationship between the identifier of the third terminal device and the identifier of the credential, the expiration timestamp of the credential, or the maximum number of uses of the credential.
  • Step 530 The third terminal device sends the credential to the second terminal device.
  • the second terminal device may send a registration request message or a service request message to the third terminal device.
  • the registration request message here is used by the second terminal device to request registration with the third terminal device.
  • the service request message here is sent by the second terminal device to the third terminal device when requesting a service of a certain business type for the first time.
  • the third terminal device can send the credential to the second terminal device.
  • the third terminal device may generate a credential through the above step 500 and send the credential to the second terminal device.
  • the third terminal device may notify the second terminal device that the credential has been successfully registered. That is, step 530 may be after step 500 and before step 510.
  • the third terminal device may generate multiple credentials and send a first message to the first network element. At this time, the first message may request to register multiple credentials.
  • the third terminal device may generate the credential through the above step 500, and after step 520, the third terminal device sends the credential to the second terminal device.
  • the third terminal device may also send at least one of the signed trusted credential of the credential, the business type of the credential, the service description information corresponding to the credential, the expiration timestamp of the credential, the maximum number of uses of the credential, and the credential identifier to the second terminal device.
  • the third terminal device may also broadcast the credential and/or the credential identifier. For example, if the local area network where the third terminal device is located is a trusted network, the third terminal device may send the credential to other terminal devices in the local area network. For example, if the first terminal device is a terminal device in the local area network, the first terminal device may save the credential. When the second terminal device subsequently requests a service from the network side device through the first terminal device, the second terminal device may only send the credential identifier. The first terminal device may determine the corresponding credential based on the credential identifier, thereby saving signaling overhead.
  • the third terminal device may also send binding information to the first network element, where the binding information is used to indicate that the identifier of the credential and the identifier of the second terminal device have a binding relationship, or the third terminal device may also send a binding request message to the first network element, where the binding request message is used to request the corresponding relationship between the identifier of the binding credential and the identifier of the second terminal device.
  • the first network element saves the binding relationship.
  • the first network element may verify whether the identifier of the second terminal device and the identifier of the credential have a binding relationship.
  • the third terminal device generates a credential and registers with the first network element.
  • the third terminal device provides the credential to the second terminal device that needs to request a service, and the second terminal device that does not need to request a service does not need to obtain the credential. Therefore, the second terminal device obtains the credential in a flexible and efficient manner, and can save network-side overhead.
  • the third terminal device requests the first network element to generate a credential and sends it to the third terminal device, and then the third terminal device sends the credential to the second terminal device. Specifically, the following steps may be included:
  • Step 600 The third terminal device sends a third message to the first network element, where the third message includes an identifier of the third terminal device and is used to request credentials.
  • the third message also includes at least one of the service type of the voucher or the service description information corresponding to the voucher.
  • the service type of the voucher at this time refers to the service type of the voucher to be requested.
  • the service description information corresponding to the voucher refers to the service description information of the voucher to be requested.
  • Step 610 The first network element sends a fourth message to the third terminal device, where the fourth message includes a credential.
  • the fourth message may also include at least one of a signed trusted credential of the credential, an expiration timestamp of the credential, a maximum number of uses of the credential, and an identifier of the credential.
  • the credential identifier and the credential are generated by the first network element.
  • the first network element before the first network element executes step 610, the first network element also needs to execute at least one of the above options: option (1), option (2) or option (3), and please refer to the above related description for details.
  • Step 630 The third terminal device sends the credential to the second terminal device.
  • step 630 can refer to the description of the above step 530.
  • the third terminal device obtains the credential from the first network element and provides the credential to the second terminal device that needs to request the service.
  • the second terminal device that does not need to request the service does not need to obtain the credential. Therefore, the way in which the second terminal device obtains the credential is flexible and efficient, and can save network-side overhead.
  • the second terminal device can request a service from the network side through the following steps:
  • Step 700 The second terminal device sends a service request message to the first terminal device.
  • the service request message includes the identification and credentials of the second terminal device, and the second terminal device requests a service through the first terminal device.
  • the service request message may also include a signed trusted credential of the credential.
  • the service request message may also indicate the business type or service description information of the requested service.
  • the credential may also be replaced by an identifier of the credential.
  • Step 710 The first terminal device sends a service request message to the first network element.
  • the first terminal device can determine whether it can provide relay service for the second terminal device, such as verifying the network parameters of the credential, such as the public land mobile network ID (PLMNID) or the serving network name (SNNAME).
  • the first terminal device can also verify the expiration timestamp of the credential and/or the maximum number of uses of the credential.
  • the first terminal device can be an independent verification of the second terminal device and the credential, or it can be a non-independent verification of the second terminal device and the credential.
  • the first terminal device can send a request message to the network side, requesting the network side to assist in the verification of the credential. This application does not limit this.
  • Step 720 When the first network element determines that the credential is valid, the first network element responds to the service request message.
  • the first network element first obtains a mapping relationship between the identifier of the credential and the identifier of the third terminal device, determines whether the credential is valid based on the obtained mapping relationship, and verifies that the identifier of the credential matches the identifier of the third terminal device, and then determines that the credential is valid. For example, if the credential or service request message also includes the identifier of the third terminal device, the first network element can verify whether the identifier of the credential matches the identifier of the third terminal device based on the obtained mapping relationship, that is, whether they are consistent with the mapping relationship.
  • the first network element determines that there is a mapping relationship between the identifier of the credential and the identifier of the third terminal device, that is, determines that there is a mapping relationship about the identifier of the credential, which indicates that the credential has been registered, and then determines that the credential is valid. For example, if the credential or the service request message does not include the identifier of the third terminal device, the first network element only needs to determine that there is a mapping relationship about the identifier of the credential, which indicates that the credential has been registered, and then determines that the credential is valid.
  • This application does not limit whether the credential or service request message includes the identifier of the third terminal device.
  • mapping relationship between the identifier of the credential obtained by the first network element and the identifier of the third terminal device may be in the following manner but is not limited to:
  • the first network element determines that there is a mapping relationship between the identifier of the credential, and then determines that the credential is valid.
  • the first network element sends a query message to the second network element, where the query message is used to query the mapping relationship between the identifier of the credential and the identifier of the third terminal device; the first network element receives a query response message from the second network element, where the query response message includes the mapping relationship between the identifier of the credential and the identifier of the third terminal device.
  • the first network element sends a query message to the second network element, where the query message includes the identifier of the credential; the first network element receives a query response message from the second network element, where the query response message includes the mapping relationship between the identifier of the credential and the identifier of the third terminal device.
  • the first network element sends a query message to the second network element, the query message including the identifier of the credential; the first network element receives a query response message from the second network element, the query response message indicating that there is a mapping relationship regarding the identifier of the credential.
  • the first network element in addition to determining that there is a mapping relationship between the identifier of the credential and the identifier of the third terminal device, the first network element also determines at least one of the following items when determining that the credential is valid.
  • the first network element may further determine at least one of the following:
  • Option A The number of times the voucher has been used is less than the maximum number of times the voucher can be used
  • the first network element determines that the number of times the credential has been used is less than the maximum number of times the credential has been used, the first network element sends an update message to the second network element, where the update message is used to update the number of times the credential has been used.
  • Option B The usage time of the credential does not exceed the expiration timestamp of the credential
  • each credential has a corresponding expiration timestamp and/or maximum number of uses, even if the first terminal device is untrustworthy or is a malicious terminal device, it is possible to weaken the attack of the first terminal device on the network side, thereby improving the security of the communication system.
  • Option C The identification of the second terminal device matches the identification of the credential.
  • the matching of the identifier of the second terminal device and the identifier of the credential can be understood as a mapping relationship, a corresponding relationship, or a binding relationship between the identifier of the second terminal device and the identifier of the credential.
  • the first network element stores the binding relationship between the identifier of the credential and the identifier of the second terminal device, or the first network element sends a query message to the second network element, the query message is used to query whether there is a binding relationship between the identifier of the credential and the identifier of the second terminal device; the first network element receives a query response message from the second network element, and the query response message indicates that there is a binding relationship between the identifier of the credential and the identifier of the second terminal device.
  • Option D Confirm that the signature of the credential has been verified.
  • the first network element when the first network element determines that the credential is invalid, the first network element sends a third notification message to the first terminal device, and the third notification message indicates the reason why the credential is invalid.
  • the first network element may send a third notification message to the first terminal device, and the third notification message may indicate an option that has not been verified, for example, the credential has expired or the credential has reached the maximum number of times it has been used.
  • the third notification message may also indicate that the first terminal device no longer responds to the request of the second terminal device.
  • the first network element may indicate that the first terminal device no longer responds to the service request message of the second terminal device.
  • the first network element responds to the service request message, which may include the first network element sending a service response message to the first terminal device, and the first terminal device may then send a service response message to the second terminal device.
  • the service response message may include business data, etc.
  • the service request message may also trigger the first network element to send a message to the third terminal device.
  • the first network element sending a message to the third terminal device can also be understood as an implementation mode of the first network element responding to the service request message.
  • the second terminal device automatically turns on the search mode, on the one hand to establish a connection with the first terminal, and on the other hand to notify the third terminal device that the second terminal device has been found and the location of the second terminal device.
  • the service request message indicates that the second terminal device is in search mode, it is unable to communicate with the third terminal device.
  • the first network element After the first network element receives the service request message from the first terminal device, the first network element also sends a first notification message to the third terminal device, and the first notification message includes the location information of the first terminal device.
  • the third terminal device transfers the second terminal device and re-pairs it with the first terminal device. Then the network side sends a message to the first terminal device and notifies the third terminal device that the binding relationship is cancelled.
  • the first network element after the first network element receives the service request message from the first terminal device, the first network element also sends a second notification message to the third terminal device, and the second notification message is used to indicate the release of the binding relationship between the second terminal device and the third terminal device.
  • triggering the first network element to send a message to the third terminal device also requires the validity of the credential as a prerequisite, thereby alleviating the harassment behavior of the untrustworthy first terminal device on the third terminal device.
  • the first network element may also modify the QoS parameters of the second terminal device according to the service request message.
  • the first network element modifying the QoS parameters of the second terminal device according to the service request message may also be understood as an implementation mode in which the first network element responds to the service request message.
  • the first network element determines the QoS parameters that need to be modified according to the service type indicated by the service request message.
  • the service type can be: “Modify QoS priority”, “Modify transmission content importance”, etc.
  • the first network element determines the QoS parameters that need to be modified based on an implicit service request message, for example, the service request message is directly: "Modify the QoS priority request for transmission of the second terminal device, or "Modify the QoS concurrency request for user plane data of the second terminal device".
  • the first network element may initiate a process of modifying QoS parameters, and request other network elements (such as PCF) to modify the QoS parameters.
  • PCF network elements
  • the first network element is AF.
  • AF verifies the validity of the credential.
  • AF can initiate a modification request for the QoS parameters of the second terminal device to PCF through NEF, and the request is used to modify the QoS parameters of the second terminal device.
  • PCF modifies the QoS parameters of the second terminal device according to the request from AF.
  • the network side device continues to communicate with the second terminal device according to the modified QoS parameters.
  • the second terminal device can request a service from the first network element through the first terminal device, wherein the service request message includes the identification and credentials of the second terminal device, and the first network element can verify the validity of the credentials and decide whether to respond to the service request message based on whether the credentials are valid. Therefore, since the first network element needs to verify the credentials, the first network element can identify the service request message that does not carry the credentials as a forged service request message, thereby improving network security. Before the first terminal device receives the service request message from the second terminal device, since the first terminal device fails to obtain the credentials, it cannot forge the service request message to launch an attack, thereby improving network security and helping to reduce attack scenarios.
  • FIG. 8A and 8B it is one of the specific processes for the IoT device to request services from the network side through the Guest UE, which is a specific flow chart of the embodiment shown in Figure 5 above, wherein, exemplarily, the third terminal device is the Host UE, the second terminal device is the Guest UE, the third terminal device is the IoT device, and the first network element is the NF.
  • Step 801 Host UE generates credentials.
  • the Host UE may use an external certification authority (CA) to assist in signing, or bind the certificate of an external CA to ensure the validity of the credential.
  • the credential generated by the Host UE may imply or be accompanied by the signature or certificate of the external CA.
  • the external CA may refer to a non-network-side CA, for example, a CA of a public organization.
  • the external CA may also be a CA of the home network, such as a CA serving a visited public land mobile network (VPLMN).
  • VPN visited public land mobile network
  • Host UE can also generate a credential identifier (i.e., credential ID).
  • credential ID is a unique identifier of the credential and can be the credential itself.
  • step 801 corresponds to the above step 500.
  • Step 802 Host UE sends the first message to NF.
  • the first message includes Host UE ID and credentials.
  • NF can be a base station of an access network or a functional network element of a core network, and this application does not limit it.
  • Host UE ID refers to the identity of Host UE, such as subscription permanent identifier (SUPI) or globally unique temporary UE identity (GUTI) or other identifiers that can identify Host UE.
  • SUPI subscription permanent identifier
  • GUI globally unique temporary UE identity
  • the first request message may also include a credential ID, and/or the business type or service description information of the credential, and at least one of the signatures of the Host UE, wherein the signature of the Host UE is a signature generated by the Host UE using a shared key between the Host UE and the network side.
  • step 802 corresponds to the above step 510.
  • step 803 the NF sends a query message to the UDM or PCF.
  • the query message includes Host UE ID.
  • the query message is used to request configuration information of Host UE.
  • UDM or PCF saves the configuration information of Host UE.
  • the configuration information of Host UE can also be called the credential policy of Host UE.
  • the configuration information of Host UE can be carried by the subscription data of Host UE or the access policy of Host UE.
  • the configuration information of Host UE can indicate whether Host UE has the ability to generate credentials, or the maximum number of credentials that Host UE can register within a preset time, that is, the quantity threshold.
  • the query message may also include the service type or service description information of the credential.
  • the service type or service description information of the credential may be carried implicitly or explicitly. If the query message carries the service type or service description information of the credential, the UDM or PCF returns the configuration information of the Host UE corresponding to the service type or service description information to the NF. For example, if the service type of the credential carried by the query message is service type A, the UDM or PCF returns the maximum number of credentials that can be registered for service type A within a preset time period. Otherwise, the configuration information of the Host UE returned by the UDM or PCF to the NF may include the configuration information of the Host UE corresponding to all service types or service description information.
  • step 804 the UDM or PCF sends a query response message to the NF.
  • the query response message includes configuration information of the Host UE.
  • the query response message may also include an NF ID. If the NF is a functional network of a core network, the NF ID may be an ID, an IP address or an instance ID of the core network; if the NF is a base station of an access network, the NF ID may be an identifier of the base station.
  • Step 805 NF verifies Host UE.
  • NF performs one or more of the following:
  • step 802 carries the signature of Host UE, verify the signature of Host UE.
  • NF uses the shared key of Host UE and NF to verify whether the signature of Host UE is valid.
  • step 803 and step 804 are executed, determine whether the Host UE has the ability to generate credentials based on the configuration information of the Host UE, or determine whether the number of credentials registered by the Host UE plus 1 within the preset time period reaches the quantity threshold.
  • the NF may further verify whether service type A is consistent with the service type carried in step 802.
  • the NF determines that the credential registration fails, and the NF sends a notification message to the Host, which may include the reason for the credential registration failure.
  • the above verification content is only for example and is not intended to limit the present application.
  • step 806 NF sends indication information to UDM or PCF, the indication information instructing the network side to record the mapping relationship between the voucher ID and the Host UE ID.
  • the indication information includes the voucher ID and the Host UE ID.
  • the indication information may also include the service type or service description information of the voucher, and/or the expiration timestamp or maximum number of uses of the voucher.
  • UDM or PCF is used as an example here, and it may also be other network elements, which is not limited in this application.
  • the credential ID here can be the credential ID carried in step 802, or, when step 802 does not carry the credential ID or the credential ID carried in step 802 does not meet the requirements of the network side, the NF can generate a credential ID as an identifier for the credential on the network side.
  • the expiration timestamp or the maximum number of uses can be used as a criterion for determining whether the voucher is valid in the subsequent use of the voucher.
  • the expiration timestamp can be an identifier of expiration at a certain time point, such as a timestamp indicating that the voucher is invalid at xx:xx:xx on xx/xx/xxxx.
  • the maximum number of uses can indicate that the voucher is invalid after being used K times, where K is a positive integer.
  • the NF may determine the expiration timestamp or the maximum number of uses of the credential in the following manner but not limited thereto.
  • Method 1 NF determines the expiration timestamp or maximum number of uses of the credential based on the business type of the credential. For example, when the business type of the credential is when the IoT device turns on lost mode, NF determines the maximum number of uses of the credential to be 1.
  • Method 2 NF can determine the expiration timestamp or maximum number of uses of the voucher based on the contract data of Host UE. For example, NF determines the expiration timestamp or maximum number of uses of the voucher based on the billing package, user contract type and other information included in the contract data of Host UE.
  • step 807 the UDM or PCF sends a response message to the NF with respect to the indication information.
  • the response message to the indication information indicates that the credential registration is successful.
  • the response message includes the NF ID.
  • the response message may also include the credential ID and/or Host UE ID.
  • Step 808 NF sends a second message to Host UE.
  • step 808 corresponds to the above step 520.
  • the second message includes at least one of a signed trusted credential of the credential, an expiration timestamp or a maximum number of uses of the credential, or a credential ID, or a business type or service description information of the credential.
  • step 809 Host UE broadcasts credentials or credential ID.
  • the Host UE can also broadcast the business type and service description information of the credential, or the expiration timestamp or maximum number of uses of the credential.
  • the Host UE informs other Guest UEs in the same IoT network of the credentials or credential IDs through broadcast messages.
  • the IoT network may be a network connected by multiple UEs, including the Guest UE and the Host UE.
  • the Host UE may send the credential or credential ID to other UEs in the network.
  • Host UE can broadcast credentials in a trusted IoT network, such as a smart home scenario. Then, when the IoT device sends a service request message to the Guest UE, the service request message can only carry the credential ID. The Guest UE can determine the credential corresponding to the credential ID based on the credential ID, thereby saving the signaling overhead of the IoT device.
  • Step 810 When the IoT device needs to initiate initial registration or apply for certain services for the first time, the IoT device sends a request message to the Host UE. interest.
  • the request message may include an IoT ID.
  • the IoT ID can be a pre-configured identifier negotiated with the network side, or an identifier set independently by the device manufacturer. It is understandable that the request message does not necessarily carry data.
  • step 810 may be before step 801 , or after any step from step 801 to step 809 .
  • Step 811 Host UE sends a response message to IoT.
  • the response message includes the credential, the signed trusted credential of the credential, and optionally, the response message may also include at least one of the credential ID, the business type and/or service description information of the credential, the expiration timestamp of the credential and/or the maximum number of uses.
  • step 811 corresponds to the above-mentioned step 530.
  • step 812 Host UE sends a binding request message to NF.
  • the binding request message is used to request the binding of the correspondence between the IoT ID and the credential ID.
  • the binding request message may include the IoT ID and the Host UE ID.
  • the binding request message may also include at least one of the IoT network ID and the credential ID.
  • IoT Network ID refers to the identifier of the IoT network where the IoT device is located.
  • the NF may be pre-configured with the IoT Network ID. Therefore, the Host UE can send the IoT network ID to indicate which IoT network the IoT device is in.
  • the NF can infer the credential to be bound only based on the IoT Network ID and the Host UE ID. In this case, the credential ID may not be carried.
  • UDM or PCF may record the identifier of the IoT network (IoT Network) where the Host UE is located, for example, the IoT Network ID. If the IoT network has only registered one credential before, the credential to be bound can be determined based on the IoT Network ID and the Host UE ID.
  • IoT Network IoT Network
  • the credential to be bound can be determined based on the IoT Network ID and the Host UE ID.
  • step 813 NF sends a binding response message to Host UE, and the binding response message indicates that the binding is successful.
  • the NF may further notify the UDM or PCF to store the binding relationship.
  • the NF here may be the same as or different from the NF in step 802 to step 808, and this application does not limit this.
  • the NF in step 802 to step 808 may be SMF1, but the NF in step 813 is SMF2, or, the NF in step 802 to step 808 may be AMF, but the NF in step 813 is SMF.
  • the two being the same is used for illustration.
  • Step 814 The IoT device sends a service request message to the Guest UE.
  • the service request message includes a credential and an IoT ID.
  • the service request message may also include at least one of a request credential ID, a signature trusted credential of the credential, a service type, and/or service description information.
  • step 814 corresponds to the above step 700.
  • step 815 Guest UE verifies credentials.
  • the Guest UE can verify the maximum number of uses or the expiration timestamp of the credential, for example, the Guest UE can find the broadcast record of the Host UE in the IoT network. Alternatively, the Guest UE can query the maximum number of uses or the expiration timestamp of the credential on the network side according to the credential ID.
  • the Guest UE may also verify the network attribute parameters of the IoT device, wherein the network attribute parameters of the IoT device may include the SN name or PLMN ID corresponding to the IoT device, to determine whether services can be provided for the IoT device, wherein the network attribute parameters of the IoT device may be included in the credential, or the Guest UE may also request the network attribute parameters of the IoT device from the IoT device.
  • the network attribute parameters of the IoT device may include the SN name or PLMN ID corresponding to the IoT device, to determine whether services can be provided for the IoT device, wherein the network attribute parameters of the IoT device may be included in the credential, or the Guest UE may also request the network attribute parameters of the IoT device from the IoT device.
  • the Guest UE verifies the credentials corresponding to the received credential ID.
  • the Guest UE can query the network side for the credential corresponding to the credential ID based on the credential ID, or request the IoT device to resend the credential corresponding to the credential ID.
  • Step 816 Guest UE sends a service request message to NF.
  • step 816 corresponds to the above step 710.
  • Step 817 NF verifies the validity of the credential.
  • the NF verifies the validity of the credentials and then decides whether to respond to the service requested by the service request message and how to charge.
  • the validity of the NF verification credential may specifically include, but is not limited to, at least one of the following:
  • (1) NF verifies whether there is a mapping relationship between the credential identifier and the Host UE identifier.
  • the NF may send a query message to the UDM or PCF, where the query message is used to query whether there is an identifier of the UE corresponding to the identifier of the credential.
  • the NF verifies whether the signature credential of the credential is valid
  • steps 812 and 813 are executed, the NF verifies whether the IoT ID is consistent with the identifier of the terminal device corresponding to the credential ID.
  • Step 818 When the NF determines that the credentials are valid, it sends a service response message to the Guest UE.
  • the NF determines the service data according to the service type of the credential request, and sends a service response message to the Guest, where the service response message includes the service data.
  • the service response message may also include the Guest UE ID or IoT ID, where IoT ID is used to indicate that the service response message received by the Guest UE is for the device corresponding to the IoT ID.
  • step 818 corresponds to the above step 720.
  • step 819 the NF sends an update request message to the UDM or PCF.
  • the update request message is used to request to update the credential information, for example, to update the number of times the credential has been used, or to delete the credential information when it is determined that the credential is used for the last time.
  • step 820 UDM or PCF sends an update response message to NF.
  • Step 821 Guest UE sends a service response message to the IoT device.
  • this is the second specific process of the IoT device requesting services from the network side through the Guest UE, which is a specific flow chart for the embodiment shown in FIG6 above, wherein, exemplarily, the third terminal device is the Host UE, the second terminal device is the Guest UE, the third terminal device is the IoT device, and the first network element is the NF.
  • Step 901 Host UE sends the third message to NF.
  • the third message is used to request a credential and a signed trusted credential of the credential.
  • the third message includes the Host UE ID, and optionally, the third message also includes the signature of the Host UE, the service type or service description information of the credential to be requested.
  • triggering the Host UE to send the third message to the NF may include but is not limited to the following scenarios:
  • Scenario 1 Host UE can send a third message after the main authentication process is completed as a reserve for future IoT device applications.
  • Scenario 2 After the IoT device establishes a connection with the Host UE, the IoT device sends a request message to the Host UE. For details, please refer to the above step 810.
  • Scenario 3 Host UE periodically applies for credentials and their signed trusted credentials based on pre-configured information.
  • step 902 the NF sends a query message to the UDM or PCF.
  • step 903 the UDM or PCF sends a query response message to the NF.
  • steps 902 and 903 may be specifically referred to the above steps 803 and 804, which will not be described in detail here.
  • Step 904 NF verifies Host UE.
  • NF performs one or more of the following:
  • step 901 carries the signature of Host UE, verify the signature of Host UE.
  • NF uses the shared key of Host UE and NF to verify whether the signature of Host UE is valid.
  • step 902 and step 903 are executed, determine whether the Host UE has the ability to generate credentials based on the configuration information of the Host UE, or determine whether the number of credentials registered by the Host UE plus 1 within the preset time period reaches the quantity threshold.
  • the NF determines that the credential registration fails, and the NF sends a notification message to the Host, which may include the reason for the credential registration failure.
  • the above verification content is only for example and is not intended to limit the present application.
  • Step 905 NF generates a credential.
  • NF can also generate signed trusted credentials for the credentials.
  • step 906 NF sends an indication message to UDM or PCF, the indication message instructing UDM to record the mapping relationship between the voucher ID and the Host UE ID.
  • the indication message includes the voucher ID and the Host UE ID, and the indication message is used to register the voucher.
  • the indication message may also include the service type or service description information of the voucher, and/or the expiration timestamp or maximum number of uses of the voucher.
  • step 907 the UDM or PCF sends a response message to the NF with respect to the indication information.
  • the response message to the indication information indicates that the credential registration is successful.
  • the response message to the indication information includes the NF ID.
  • the response message may also include the credential ID and/or Host UE ID.
  • Step 908 NF sends a fourth message to Host UE, and the fourth message includes credentials.
  • the fourth message may also include a signature credential of the credential, an expiration timestamp of the credential, a maximum number of times the credential is used, and a At least one of the certificate ID, the business type of the certificate, and the service description information of the certificate.
  • the subsequent steps may refer to the above steps 809 to 821 and will not be repeated here.
  • Figure 10 shows the third specific process of the IoT device requesting services from the network side through the Guest UE.
  • IoT After IoT obtains the certificate and the signature of the certificate, it performs the following steps:
  • Step 1001 The IoT device sends a service request message to the Guest UE.
  • the service request message includes Ticket or Ticket ID, IoT ID, and optionally, the service request message also includes business type or service description information.
  • Step 1002 Guest UE verifies credentials.
  • step 815 For details, please refer to the above step 815.
  • Step 1003 Guest UE sends a service request message to NF.
  • Step 1004 NF verifies the validity of the credential.
  • step 817 For details, please refer to the above step 817.
  • Step 1005 When determining that the credentials are valid, NF sends a service response message to Guest UE.
  • step 1006 the NF sends an update request message to the UDM or PCF.
  • the update request message is used to request to update the credential information, for example, to update the number of times the credential has been used, or to delete the credential information when it is determined that the credential is used for the last time.
  • step 1007 UDM or PCF sends an update response message to NF.
  • the update response message indicates that the credential information was updated successfully.
  • Step 1008 NF sends a notification message to Host UE.
  • the notification message may include Host UE ID, notification description, and optionally, the notification message may also include service information.
  • the NF may send a notification message to the Host UE directly or indirectly.
  • the NF may directly sends a notification message to the Host UE.
  • the NF may send a notification message to the Host UE through multiple network elements such as an AMF and a base station.
  • the notification description may imply the message type, such as a name indication for sending signaling, or directly include the notification content.
  • the service information may include the location coordinates of the Guest UE, etc.
  • the NF is an SMF
  • LMF location management function
  • the business information may include information for indicating the release of the binding relationship between the Host UE and the IoT device.
  • the business information may include a one-time verification code required for the user to release the binding.
  • the service information may be generated by the NF itself, or may be generated by other NFs at the request of the NF.
  • FIG. 11 shows a possible exemplary block diagram of a communication device involved in an embodiment of the present application, wherein the device 1100 includes: a transceiver module 1120 and a processing module 1110, wherein the transceiver module 1120 may include a receiving unit and a sending unit.
  • the processing module 1110 is used to control and manage the actions of the device 1100.
  • the transceiver module 1120 is used to support the communication between the device 1100 and other network entities.
  • the device 1100 may also include a storage unit, wherein the storage unit is used to store program codes and data of the device 1100.
  • each module in the device 1100 may be implemented by software.
  • the processing module 1110 may be a processor or a controller, for example, a general-purpose central processing unit (CPU), a general-purpose processor, a digital signal processing (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of the embodiments of the present application.
  • the processor may also be a combination that implements a computing function, for example, including a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.
  • the transceiver module 1120 may be a communication interface, a transceiver or a transceiver circuit, etc., wherein the communication interface is a general term.
  • the communication interface may include multiple interfaces, and the storage unit may be a memory.
  • the processing module 1110 in the device 1100 may support the device 1100 to execute actions of the first network element in each method example above.
  • the transceiver module 1120 can support the apparatus 1100 to communicate with the first terminal device or the third terminal device.
  • the transceiver module 1120 The device 1100 may be supported to execute step 510 and step 520 in FIG. 5 , step 600 and step 610 in FIG. 6 , and step 710 and step 720 in FIG. 7 .
  • the transceiver module 1120 is configured to receive a service request message from a first terminal device, wherein the service request message includes a credential and an identifier of a second terminal device, and the second terminal device requests a service through the first terminal device; the credential is generated by a third terminal device (HostUE);
  • HostUE third terminal device
  • a processing module 1110 is used to determine whether the credential is valid
  • the transceiver module 1120 is configured to send a service response message to the first terminal device when the first network element determines that the credential is valid;
  • the processing module 1110 is used to determine whether the credential is valid based on a mapping relationship between an acquired identifier of the credential and an identifier of the third terminal device when determining whether the credential is valid.
  • the processing module 1110 is used to verify that the identifier of the credential matches the identifier of the third terminal device according to the mapping relationship when the first network element determines that the credential is valid, and then determine that the credential is valid.
  • the processing module 1110 is used to store the mapping relationship between the identifier of the credential and the identifier of the third terminal device when acquiring the mapping relationship between the identifier of the credential and the identifier of the third terminal device;
  • a query message is sent to the second network element through the transceiver module 1120, and the query message is used to query the mapping relationship between the credential and the third terminal device;
  • a query response message is received from the second network element through the transceiver module 1120, and the query response message includes the mapping relationship between the identifier of the credential and the identifier of the third terminal device.
  • the processing module 1110 is used to determine that the credential is valid based on at least one of the following items when determining that the credential is valid; the at least one item includes: the number of times the credential has been used is less than the maximum number of times the credential is used; the usage time of the credential does not exceed the expiration timestamp of the credential; the identifier of the second terminal device matches the identifier of the credential.
  • the transceiver module 1120 is used to send an update message to the second network element after determining that the number of times the credential has been used is less than the maximum number of times the credential has been used, and the update message is used to update the number of times the credential has been used.
  • the transceiver module 1120 is used to receive binding information from the third terminal device, and the binding information is used to indicate that the identifier of the credential and the identifier of the second terminal device have a binding relationship.
  • the transceiver module 1120 is used to receive a first message from the third terminal device before receiving a service request message from the first terminal device, the first message including an identifier of the third terminal device and the credential, and the processing module 1110 is used to store a mapping relationship between the identifier of the credential and the identifier of the third terminal device.
  • the first message also includes at least one of the business type of the credential, the service description information of the credential, and the identifier of the credential.
  • the processing module 1110 is used to perform at least one of the following before sending the second message to the third terminal device: determining that the identity authentication of the third terminal device is passed; determining that the third terminal device has the ability to generate credentials; determining that the number of credentials registered by the third terminal device within a preset time period plus 1 does not reach a quantity threshold.
  • the transceiver module 1120 is used to send a request message to a second network element, wherein the request message is used to request configuration information of the first terminal device; the configuration information of the first terminal device is used to indicate whether the first terminal device has the ability to generate credentials, and/or the quantity threshold; and receive the configuration information of the first terminal device from the second network element.
  • the transceiver module 1120 is used to send indication information to the second network element, where the indication information is used to indicate a mapping relationship between an identifier storing the credential and an identifier of the third terminal device.
  • the indication information also includes an expiration timestamp of the credential and/or a maximum number of uses of the credential.
  • the second message includes at least one of a trust credential of the credential, an expiration timestamp of the credential, a maximum number of uses of the credential, and an identifier of the credential.
  • the transceiver module 1120 is used to send a first notification message to the third terminal device after receiving a service request message from the first terminal device, where the first notification message includes the location information of the first terminal device.
  • the service request message indicates the release of the binding relationship between the second terminal device and the third terminal device; the transceiver module 1120 is used to send a second notification message to the third terminal device after receiving the service request message from the first terminal device, and the second notification message is used to indicate the release of the binding relationship between the second terminal device and the third terminal device.
  • the processing module 1110 is used to modify the QoS parameters of the second terminal device according to the service request message.
  • the transceiver module 1120 is used to send a third notification message to the third terminal device when it is determined that the credential is invalid, and the third notification message indicates the reason why the credential is invalid.
  • the device 1100 may correspond to the first network element in the aforementioned method embodiment, and the operations and/or functions of the various modules in the device 1100 are respectively for implementing the corresponding steps of the method of the first network element in the aforementioned method embodiment, and therefore the beneficial effects in the aforementioned method embodiment can also be achieved.
  • the beneficial effects in the aforementioned method embodiment can also be achieved.
  • they are not elaborated here.
  • the processing module 1110 in the apparatus 1100 may support the apparatus 1100 to execute the actions of the first terminal device in the above method examples.
  • the transceiver module 1120 can support the apparatus 1100 to communicate with the first network element or the second terminal device.
  • the transceiver module 1120 can support the apparatus 1100 to execute step 700 and step 710 in FIG. 7 .
  • the processing module 1110 calls the transceiver module 1120 to execute: receiving a service request message from a second terminal device, the service request message including an identifier of a credential and an identifier of a second terminal device, the second terminal device requesting a service through the first terminal device; sending the service request message to the first network element;
  • the transceiver module 1120 is used to receive a service response message from the first network element; and send the service response message to the second terminal device.
  • the transceiver module 1120 is used to receive a broadcast message from a third terminal device before receiving a service request message from a second terminal device, wherein the broadcast message includes the credential or an identifier of the credential.
  • the device 1100 may correspond to the first terminal device in the aforementioned method embodiment, and the operations and/or functions of the various modules in the device 1100 are respectively for implementing the corresponding steps of the method for the first terminal device in the aforementioned method embodiment, and therefore the beneficial effects in the aforementioned method embodiment can also be achieved.
  • the beneficial effects in the aforementioned method embodiment can also be achieved.
  • they are not elaborated here.
  • the processing module 1110 in the apparatus 1100 can support the apparatus 1100 to execute the actions of the third terminal device in the above method examples, for example, it can support the apparatus 1100 to execute step 500 in FIG. 5 .
  • the transceiver module 1120 can support the device 1100 to communicate with the second terminal device or the first network element.
  • the transceiver module 1120 can support the device 1100 to execute steps 510, 520 and 530 in Figure 5, and steps 600, 610 and 620 in Figure 6.
  • Processing module 1110 for generating a credential
  • the transceiver module 1120 is used to send a first message to the first network element, where the first message includes the identifier of the third terminal device and the credential, and send the credential to the second terminal device.
  • the transceiver module 1120 is used to receive a second message from the first network element, where the second message is used to indicate that the credential is successfully registered.
  • the first message is used to request registration of the credential.
  • the transceiver module 1120 is used to receive a registration request message or a service request message from the second terminal device before sending the credential to the second terminal device.
  • the first message also includes at least one of the business type of the credential, the service description information of the credential, and the identifier of the credential.
  • the second message includes at least one of a trust credential of the credential, an expiration timestamp of the credential, a maximum number of uses of the credential, and an identifier of the credential.
  • the transceiver module 1120 is used to broadcast the credential or the identifier of the credential after receiving the first message from the first network element.
  • the transceiver module 1120 is used to send binding information to the first network element after sending the credential to the second terminal device, and the binding information is used to indicate that the identifier of the credential and the identifier of the second terminal device have a binding relationship.
  • the device 1100 may correspond to the third terminal device in the aforementioned method embodiment, and the operations and/or functions of the various modules in the device 1100 are respectively for implementing the corresponding steps of the method of the third terminal device in the aforementioned method embodiment, and therefore the beneficial effects in the aforementioned method embodiment can also be achieved.
  • the beneficial effects in the aforementioned method embodiment can also be achieved.
  • they are not elaborated here.
  • Fig. 12 shows a schematic structural diagram of a communication device 1200 according to an embodiment of the present application.
  • the device 1200 includes: a processor 1201 .
  • the apparatus 1200 is a first network element or a chip in the first network element
  • the processor 1201 when the processor 1201 is used to call an interface to perform the following actions: receiving a service request message from a first terminal device, the service request message includes a credential and an identifier of a second terminal device, and the second terminal device requests a service through the first terminal device; the credential is generated by a third terminal device; determining whether the credential is valid; and sending a service response message to the first terminal device when the first network element determines that the credential is valid;
  • the device 1200 can also be used to execute other steps and/or operations on the first network element side in the previous embodiments, which are not described here for the sake of brevity.
  • the apparatus 1200 is a first terminal device or a chip in the first terminal device, in a possible implementation, when the processor 1201 is used to call an interface to perform the following actions:
  • the device 1200 can also be used to execute other steps and/or operations on the first terminal device side in the previous embodiments, which are not described here for the sake of brevity.
  • the apparatus 1200 is a third terminal device or a chip in the third terminal device, in a possible implementation, when the processor 1201 is used to call an interface to perform the following actions:
  • Generate a credential send a first message to a first network element, wherein the first message includes an identifier of the third terminal device and the credential; and send the credential to a second terminal device.
  • the device 1200 can also be used to execute other steps and/or operations on the third terminal device side in the above embodiments, which are not described here for the sake of brevity.
  • the processor 1201 can call an interface to perform the above-mentioned transceiver action, wherein the called interface can be a logical interface or a physical interface, which is not limited.
  • the physical interface can be implemented by a transceiver.
  • the device 1200 also includes a transceiver 1203.
  • the device 1200 further includes a memory 1202 , in which the program code in the above method embodiment can be stored, so as to be called by the processor 1201 .
  • the device 1200 includes a processor 1201, a memory 1202, and a transceiver 1203, the processor 1201, the memory 1202, and the transceiver 1203 communicate with each other through an internal connection path to transmit control and/or data signals.
  • the processor 1201, the memory 1202, and the transceiver 1203 can be implemented by a chip, and the processor 1201, the memory 1202, and the transceiver 1203 can be implemented in the same chip, or they can be implemented in different chips, or any two of the functions can be combined and implemented in one chip.
  • the memory 1202 can store program code, and the processor 1201 calls the program code stored in the memory 1202 to implement the corresponding function of the device 1200.
  • the method disclosed in the above embodiment of the present application can be applied to a processor or implemented by a processor.
  • the processor may be an integrated circuit chip with signal processing capabilities.
  • each step of the above method embodiment can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software.
  • the above processor can be a general processor, a digital signal processor (digital signal processor, DSP), an application specific integrated circuit (application specific integrated circuit, ASIC), a field programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, and can also be a system chip (system on chip, SoC), a central processing unit (central processor unit, CPU), a network processor (network processor, NP), a digital signal processing circuit (digital signal processor, DSP), a microcontroller (micro controller unit, MCU), a programmable controller (programmable logic device, PLD) or other integrated chips.
  • SoC system on chip
  • SoC system on chip
  • CPU central processing unit
  • CPU central processor unit, CPU
  • network processor network processor
  • NP digital signal processing circuit
  • microcontroller micro controller unit, MCU
  • programmable controller programmable logic device, PLD
  • the general processor may be a microprocessor or the processor may be any conventional processor, etc.
  • the steps of the method disclosed in the embodiment of the present application may be directly embodied as being executed by a hardware decoding processor, or may be executed by a combination of hardware and software modules in the decoding processor.
  • the software module may be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc.
  • the storage medium is located in a memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.
  • the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories.
  • the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM) or a flash memory.
  • the volatile memory may be a random access memory (RAM), which is used as an external cache.
  • RAM static random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • DDR SDRAM double data rate synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous connection dynamic random access memory
  • DRAM dynamic random access memory
  • DR RAM direct memory bus random access memory
  • the size of the sequence number of each process does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic.
  • the various digital numbers or sequence numbers involved in the above-mentioned processes are only for the convenience of description and should not constitute any limitation on the implementation process of the embodiments of the present application.
  • the above is an example of three elements, A, B and C, to illustrate the optional items of the project.
  • the project includes at least one of the following: A, B, ..., and X"
  • the items that can be applied to the project can also be obtained according to the above rules.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only schematic.
  • the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.
  • Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Quality & Reliability (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

La présente invention concerne un procédé et un appareil de communication, un support de stockage lisible par ordinateur et un système de communication. Le procédé comprend les étapes suivantes : un premier élément de réseau reçoit un message de demande de service provenant d'un premier dispositif terminal, le message de demande de service comprenant une identification et un certificat d'un deuxième dispositif terminal, le deuxième dispositif terminal demandant un service au moyen du premier dispositif terminal, et le certificat étant généré par un troisième dispositif terminal ; le premier élément de réseau détermine si le certificat est valide ; et lorsque le premier élément de réseau détermine que le certificat est valide, le premier élément de réseau répond au message de demande de service. En utilisant la conception, le premier élément de réseau doit effectuer une vérification de certificat, et dans le cas où un message de demande de service ne transporte pas de certificat, le premier élément de réseau peut identifier le message de demande de service comme étant un message de demande de service contrefait, de telle sorte que la sécurité de réseau peut être améliorée et le scénario d'attaque peut être minimisé.
PCT/CN2023/121753 2022-09-30 2023-09-26 Procédé et appareil de communication, support de stockage lisible par ordinateur et système de communication WO2024067641A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211231766.1 2022-09-30
CN202211231766.1A CN117812590A (zh) 2022-09-30 2022-09-30 一种通信方法及装置、计算机可读存储介质和通信系统

Publications (1)

Publication Number Publication Date
WO2024067641A1 true WO2024067641A1 (fr) 2024-04-04

Family

ID=90432183

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/121753 WO2024067641A1 (fr) 2022-09-30 2023-09-26 Procédé et appareil de communication, support de stockage lisible par ordinateur et système de communication

Country Status (2)

Country Link
CN (1) CN117812590A (fr)
WO (1) WO2024067641A1 (fr)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018126452A1 (fr) * 2017-01-06 2018-07-12 华为技术有限公司 Procédé et dispositif de vérification d'autorisation
US20200145409A1 (en) * 2017-06-16 2020-05-07 Cryptography Research, Inc. Internet of things (iot) device management
CN113938879A (zh) * 2020-06-29 2022-01-14 华为技术有限公司 一种通信方法及通信装置
CN114025352A (zh) * 2020-07-17 2022-02-08 华为技术有限公司 终端设备的鉴权方法及其装置
CN114424650A (zh) * 2019-09-30 2022-04-29 华为技术有限公司 获取侧行链路资源的方法和装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018126452A1 (fr) * 2017-01-06 2018-07-12 华为技术有限公司 Procédé et dispositif de vérification d'autorisation
US20200145409A1 (en) * 2017-06-16 2020-05-07 Cryptography Research, Inc. Internet of things (iot) device management
CN114424650A (zh) * 2019-09-30 2022-04-29 华为技术有限公司 获取侧行链路资源的方法和装置
CN113938879A (zh) * 2020-06-29 2022-01-14 华为技术有限公司 一种通信方法及通信装置
CN114025352A (zh) * 2020-07-17 2022-02-08 华为技术有限公司 终端设备的鉴权方法及其装置

Also Published As

Publication number Publication date
CN117812590A (zh) 2024-04-02

Similar Documents

Publication Publication Date Title
US20220385446A1 (en) EMBEDDED UNIVERSAL INTEGRATED CIRCUIT CARD (eUICC) PROFILE CONTENT MANAGEMENT
EP3657894B1 (fr) Procédé de gestion de sécurité de réseau et appareil
KR100813295B1 (ko) 무선 휴대 인터넷 시스템에서 ｅａｐ를 이용한 보안 관계협상 방법
US11533610B2 (en) Key generation method and related apparatus
TWI713614B (zh) 用於使用支援多個連線性和服務上下文的安全模型的無線通訊的方法和裝置
WO2021037175A1 (fr) Procédé de gestion de tranche de réseau et dispositif associé
CN107835204B (zh) 配置文件策略规则的安全控制
KR102164823B1 (ko) 통합 코어 망 서비스 이용방법과 이를 위한 통합 제어장치 및 그 시스템
WO2019041802A1 (fr) Procédé et appareil de découverte basés sur une architecture orientée service
CN104956638A (zh) 用于在热点网络中未知设备的受限证书注册
CN108781110B (zh) 用于通过通信网络中继数据的系统和方法
WO2022134089A1 (fr) Procédé et appareil de génération de contexte de sécurite, et support de stockage lisible par ordinateur
CN116723507B (zh) 针对边缘网络的终端安全方法及装置
WO2023246942A1 (fr) Procédé et appareil de communication
WO2019196963A1 (fr) Procédé et dispositif d'accès à une tranche de réseau, support de stockage, et dispositif électronique
WO2024067641A1 (fr) Procédé et appareil de communication, support de stockage lisible par ordinateur et système de communication
WO2018222133A2 (fr) Procédé, appareil, et système de protection de données
KR101790192B1 (ko) 애플리케이션 관리 방법 및 장치
WO2022237741A1 (fr) Procédé et appareil de communication
WO2024093923A1 (fr) Procédé et appareil de communication
WO2024067619A1 (fr) Procédé de communication et appareil de communication
WO2022237794A1 (fr) Procédé et appareil de transmission de paquets
WO2024094108A1 (fr) Procédé de communication et appareil de communication
WO2023246457A1 (fr) Procédé de négociation de décision de sécurité et élément de réseau
WO2022237838A1 (fr) Procédé de communication et dispositif de communication

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23870868

Country of ref document: EP

Kind code of ref document: A1