WO2024092826A1 - 身份验证方法及装置 - Google Patents

身份验证方法及装置 Download PDF

Info

Publication number
WO2024092826A1
WO2024092826A1 PCT/CN2022/130134 CN2022130134W WO2024092826A1 WO 2024092826 A1 WO2024092826 A1 WO 2024092826A1 CN 2022130134 W CN2022130134 W CN 2022130134W WO 2024092826 A1 WO2024092826 A1 WO 2024092826A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal device
network device
network
npn
request message
Prior art date
Application number
PCT/CN2022/130134
Other languages
English (en)
French (fr)
Inventor
梁浩然
陆伟
Original Assignee
北京小米移动软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京小米移动软件有限公司 filed Critical 北京小米移动软件有限公司
Priority to PCT/CN2022/130134 priority Critical patent/WO2024092826A1/zh
Publication of WO2024092826A1 publication Critical patent/WO2024092826A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L27/00—Modulated-carrier systems

Definitions

  • the present application relates to the field of communication technology, and in particular to an identity authentication method and device.
  • NPN Non-Public Network
  • the first aspect of the present application provides an identity authentication method, which is executed by a terminal device and includes:
  • the second aspect of the present application provides an identity authentication method, which is performed by a first core network device, and includes:
  • a first response message is sent to the terminal device through the access network device, where the first response message is used to indicate whether the identity authentication of the terminal device is successful.
  • the third aspect of the present application provides an identity authentication method, which is performed by a second core network device, and includes:
  • the result of the terminal device identity authentication is sent to the first network device, and the result of the terminal device identity authentication is used to determine a first response message, and the first response message is used to indicate whether the terminal device identity authentication is successful.
  • a fourth aspect of the present application provides an identity authentication device, which is applied to a terminal device and includes:
  • a transceiver unit configured to send a first request message to a first network device in a non-public network NPN through an access network device, wherein the first request message is used by the first network device to determine a second request message, and the second request message is used to request a second network device corresponding to the NPN to authenticate the device;
  • the transceiver unit is further used to receive a first response message sent by the first network device through the access network device, and the first response message is used to indicate whether the device identity authentication is successful.
  • a fifth aspect of the present application provides an identity authentication device, which is applied to a first core network device, and includes:
  • a transceiver unit configured to receive a first request message sent by a terminal device through an access network device
  • a processing unit configured to send a second request message to a second network device corresponding to the non-public network NPN where the device is located according to the first request message, wherein the second request message is used to request the second network device to authenticate the terminal device;
  • the transceiver unit is further configured to receive a result of the identity authentication of the terminal device sent by the second network device;
  • the processing unit is further used to send a first response message to the terminal device through the access network device according to the result of the identity authentication of the terminal device, and the first response message is used to indicate whether the identity authentication of the terminal device is successful.
  • a sixth aspect of the present application provides an identity authentication device, which is applied to a second core network device, and includes:
  • a transceiver unit configured to receive a second request message sent by a first network device, wherein the second request message is determined by the first network device according to the first request message sent by the terminal device, and the second request message is used to request the device corresponding to the non-public network NPN where the first network device is located to authenticate the terminal device;
  • the transceiver unit is further used to send the result of the terminal device identity authentication to the first network device, and the result of the terminal device identity authentication is used to determine a first response message, and the first response message is used to indicate whether the terminal device identity authentication is successful.
  • the seventh aspect embodiment of the present application proposes a communication device, which includes a processor and a memory, wherein the memory stores a computer program, and the processor executes the computer program stored in the memory so that the device performs the identity authentication method described in the first aspect embodiment above.
  • An eighth aspect embodiment of the present application proposes a communication device, which includes a processor and a memory, wherein the memory stores a computer program, and the processor executes the computer program stored in the memory so that the device performs the identity authentication method described in the second aspect embodiment, or performs the identity authentication method described in the third aspect embodiment.
  • the ninth aspect embodiment of the present application proposes a communication device, which includes a processor and an interface circuit, the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to enable the device to execute the identity authentication method described in the first aspect embodiment above.
  • the tenth aspect embodiment of the present application proposes a communication device, which includes a processor and an interface circuit, the interface circuit is used to receive code instructions and transmit them to the processor, the processor is used to run the code instructions to enable the device to execute the identity authentication method described in the second aspect embodiment, or execute the identity authentication method described in the third aspect embodiment.
  • the eleventh embodiment of the present application proposes a computer-readable storage medium for storing instructions, which, when executed, enables the identity authentication method described in the first embodiment to be implemented.
  • the twelfth aspect embodiment of the present application proposes a computer-readable storage medium for storing instructions. When the instructions are executed, the identity authentication method described in the above-mentioned second aspect embodiment is implemented, or the identity authentication method described in the above-mentioned third aspect embodiment is implemented.
  • the thirteenth aspect embodiment of the present application proposes a computer program, which, when executed on a computer, enables the computer to execute the identity authentication method described in the first aspect embodiment.
  • the fourteenth aspect embodiment of the present application proposes a computer program, which, when running on a computer, enables the computer to execute the identity authentication method described in the second aspect embodiment, or execute the identity authentication method described in the third aspect embodiment.
  • An identity authentication method and apparatus sends a first request message to a first network device in a non-public network NPN, the first request message is used by the first network device to determine a second request message, the second request message is used to request a second network device corresponding to the NPN to authenticate the terminal device, receives a first response message sent by the first network device through the access network device, the first response message is used to indicate whether the identity authentication of the terminal device is successful, so that the terminal device and the accessed network can authenticate each other, the terminal device can securely access the network, and obtain services provided by the network, thereby effectively protecting the security of information interaction between the terminal device and the accessed network, and improving the security and privacy of the system.
  • FIG1 is a schematic diagram of the architecture of a communication system provided in an embodiment of the present application.
  • FIG2 is a flow chart of an identity authentication method provided in an embodiment of the present application.
  • FIG3 is a flow chart of an identity authentication method provided in an embodiment of the present application.
  • FIG4 is a flow chart of an identity authentication method provided in an embodiment of the present application.
  • FIG5 is a flow chart of an identity authentication method provided in an embodiment of the present application.
  • FIG6 is a flow chart of an identity authentication method provided in an embodiment of the present application.
  • FIG7 is a flow chart of an identity authentication method provided in an embodiment of the present application.
  • FIG8 is a flow chart of an identity authentication method provided in an embodiment of the present application.
  • FIG9 is a flow chart of an identity authentication method provided in an embodiment of the present application.
  • FIG10 is a flow chart of an identity authentication method provided in an embodiment of the present application.
  • FIG11 is a flow chart of an identity authentication method provided in an embodiment of the present application.
  • FIG12 is a schematic diagram of the structure of an identity authentication device provided in an embodiment of the present application.
  • FIG13 is a schematic diagram of the structure of an identity authentication device provided in an embodiment of the present application.
  • FIG14 is a schematic diagram of the structure of an identity authentication device provided in an embodiment of the present application.
  • FIG15 is a schematic diagram of a communication system provided in an embodiment of the present application.
  • FIG16 is a schematic diagram of the structure of another identity authentication device provided in an embodiment of the present application.
  • FIG. 17 is a schematic diagram of the structure of a chip provided in an embodiment of the present application.
  • first, second, third, etc. may be used to describe various information in the embodiments of the present application, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information.
  • the words "if” and “if” as used herein may be interpreted as "at" or "when" or "in response to determination".
  • Figure 1 is a schematic diagram of the architecture of a communication system provided in an embodiment of the present application.
  • the communication system may include but is not limited to a terminal device and a core network device.
  • the number and form of devices shown in Figure 1 are only used for example and do not constitute a limitation on the embodiment of the present application. In actual applications, two or more network devices and two or more terminal devices may be included.
  • the communication system shown in Figure 1 takes a terminal device 101, a first network device 102 and a second network device 103 as an example.
  • LTE Long Term Evolution
  • 5G new air interface system 5G new air interface system
  • other future new mobile communication systems 5G new air interface system
  • the terminal device 101 in the embodiment of the present application is an entity on the user side for receiving or transmitting signals, such as a mobile phone.
  • the terminal device may also be referred to as a terminal device (terminal), a user equipment (UE), a mobile station (MS), a mobile terminal device (MT), etc.
  • the terminal device may be a car with communication function, a smart car, a mobile phone (Mobile Phone), a wearable device, a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (Virtual Reality, VR) terminal device, an augmented reality (Augmented Reality, AR) terminal device, a wireless terminal device in industrial control (Industrial Control), a wireless terminal device in self-driving, a wireless terminal device in remote medical surgery, a wireless terminal device in smart grid (Smart Grid), a wireless terminal device in transportation safety (Transportation Safety), a wireless terminal device in smart city (Smart City), a wireless terminal device in smart home (Smart Home), etc.
  • the embodiments of the present application do not limit the specific technology and specific device form adopted by the terminal device.
  • the first network device 102 is a core network device in a non-public network NPN.
  • the first network device 102 can be an authentication service function (Authentication Server Function, AUSF).
  • AUSF Authentication Server Function
  • core network devices in the non-public network NPN such as Access and Mobility Management Function (Access and Mobility Management Function, AMF), Security Anchor Function (Security Anchor Fuction, SEAF), Unified Data Management (Unified Data Management, UDM), Network Slice-Specific Authentication and Authorization Function (Network Slice-Specific Authentication and Authorization Function, NSSAAF), etc.
  • AMF Access and Mobility Management Function
  • SEAF Security Anchor Function
  • UDM Unified Data Management
  • UDM Network Slice-Specific Authentication and Authorization Function
  • NSSAAF Network Slice-Specific Authentication and Authorization Function
  • the second network device 103 is an entity on the network side, which can provide services for the non-public network NPN where the first network device is located.
  • the second network device can be a server, which can provide authentication services for the NPN, etc.
  • the second network device can be an authentication, authorization, accounting (AAA) server, etc.
  • the non-public network NPN can be an independent non-public network (Stand-alone Non-Public Network, SNPN).
  • NPN Non-Public Network
  • the terminal device there is no mutual authentication mechanism between the terminal device and the managed network, which results in the possibility that both the terminal and the network may be impersonated. If the terminal device is not authenticated to the network, the terminal device may be impersonated; if the network is not authenticated to the terminal device, the network may also be impersonated.
  • the information interaction between the terminal device and the managed network that are not mutually authenticated may lead to security issues such as information leakage and malicious tampering.
  • the information interaction between the terminal device and each core network device is completed through transparent transmission of the access network device.
  • the communication system described in the embodiment of the present application is for more clearly illustrating the technical solution of the embodiment of the present application, and does not constitute a limitation on the technical solution provided in the embodiment of the present application.
  • Ordinary technicians in this field can know that with the evolution of the system architecture and the emergence of new business scenarios, the technical solution provided in the embodiment of the present application is also applicable to similar technical problems.
  • FIG 2 is a flow chart of an identity authentication method provided in an embodiment of the present application. It should be noted that the identity authentication method in the embodiment of the present application is executed by a terminal device. The method can be executed independently or in combination with any other embodiment of the present application. As shown in Figure 2, the method may include the following steps:
  • Step 201 sending a first request message to a first network device in the NPN through an access network device, the first request message is used by the first network device to determine a second request message, the second request message is used to request a second network device corresponding to the NPN to authenticate the terminal device.
  • a terminal device can send a first request message to a first network device in the NPN through an access network device. After receiving the first request message, the first network device can determine a second request message based on the first request message. The second request message is used to request a second network device corresponding to the NPN to authenticate the terminal device.
  • the first network device may be an authentication service function AUSF.
  • the second network device that performs identity authentication on the terminal device corresponds to the NPN where the first network device is located, and a second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.
  • the service provided by the second network device for the NPN includes at least one of authentication, authorization and billing.
  • the second network device may be an AAA server.
  • the first request message may include an identifier of the terminal device and/or an identifier of a hosted network that the terminal device requests to access, wherein the hosted network is constructed based on the NPN.
  • the first request message includes the identifier of the terminal device and the identifier of the managed network that the terminal device requests to access.
  • the first request message includes an identifier of the terminal device.
  • the identifier of the terminal device may be at least one of the following: Subscription Permanent Identifier (SUPI), Subscription Concealed Identifier (SUCI), anonymous SUPI, anonymous SUCI, onboarding SUCI, onboarding SUPI.
  • SUPI Subscription Permanent Identifier
  • SUCI Subscription Concealed Identifier
  • anonymous SUPI anonymous SUPI
  • onboarding SUCI onboarding SUPI.
  • the network side can build multiple hosted networks based on the NPN to provide access to localized services, and each hosted network built has its own hosted network identifier.
  • the terminal device may be accessing the NPN and the NPN does not have the subscription data of the terminal device, or the terminal device is only signing up (onboarding) online at the NPN to obtain identity authentication credentials without the need for the NPN to provide services (the NPN also does not have the subscription information of the terminal device).
  • the terminal device can also send a first indication information to the first network device, and the first indication information is used by the first network device to determine to omit sending a message to the unified data management function UDM.
  • the first network device sends a message to the UDM to request the UDM to determine to perform identity authentication with the terminal device based on the subscription data of the terminal device.
  • the first network device can receive the response message sent by the UDM to determine to perform identity authentication with the terminal device, and send the second request message to the second network device through the Network Slice-Specific Authentication and Authorization Function (NSSAAF) in the NPN.
  • NSSAAF Network Slice-Specific Authentication and Authorization Function
  • the first network device starts a Nudm_UEAuthentication_Get service operation, the first network device sends a Nudm_UEAuthentication_Get request message to the UDM, and the UDM sends a Nudm_UEAuthentication_Get response message to the first network device.
  • the first indication information sent by the terminal device to the first network device can be used by the first network device to determine to omit sending a message to the UDM. After receiving the first indication information, the first network device may not send a message to the UDM, but directly send the second request message to the second network device through the NSSAAF in the NPN.
  • the first indication information may be an identifier of the terminal device, or the first indication information is indication information used to indicate that the NPN does not include subscription data of the terminal device.
  • the identifier of the terminal device may be at least one of the following: SUPI, SUCI, anonymous SUPI, anonymous SUCI, online contract SUCI, and online contract SUPI.
  • the first indication information is an identifier of the terminal device. After receiving the first indication information, the first network device can determine to omit sending a message to the UDM according to a local policy of the first network device.
  • the local policy may decide to ignore interaction with the UDM based on the realm portion in the identifier of the terminal device, and directly select an NSSAAF, and send the second request message to the second network device through the NSSAAF.
  • the local policy may be determined based on the identifier of the terminal device, and ignores querying the UDM to determine whether the identifier of the terminal device has corresponding subscription information.
  • the first indication information is used to indicate that the NPN does not include subscription data of the terminal device, and the first network device can determine to omit sending a message to the UDM according to the received first indication information.
  • the first network device may determine, based on the first indication information, to ignore interaction with the UDM, and directly select an NSSAAF, and send the second request message to the second network device through the NSSAAF.
  • the first network device may determine, based on the first indication information, to ignore querying the UDM whether the identifier of the terminal device has corresponding subscription information.
  • the NPN may not include the subscription data of the terminal device, and the first network device may not omit sending a message to the UDM.
  • the first network device may still send a message to the UDM, initiate a Nudm_UEAuthentication_Get service operation, and receive a response that the subscription information of the terminal device is not found.
  • the first network device does not reject the first request of the terminal device, and still sends the second request message to the second network device through the NSSAAF in the NPN.
  • the second request message includes the SUPI or anonymous SUPI of the terminal device.
  • the first request message is sent by the terminal device to the first network device through the access and mobility management function AMF in the NPN.
  • the terminal device can perform mutual authentication with the second network device, and the mutual authentication method can be authentication based on the Extensible Authentication Protocol (EAP).
  • EAP Extensible Authentication Protocol
  • the mutual authentication between the terminal device and the second network device can also adopt other identity authentication methods, and the embodiments of the present application do not specifically limit the mutual authentication method between the terminal device and the second network device.
  • Step 202 Receive a first response message sent by the first network device through the access network device, where the first response message is used to indicate whether the identity authentication of the terminal device is successful.
  • the terminal device can receive a first response message sent by the first network device through the access network device, and the first response message can indicate whether the identity authentication of the terminal device is successful.
  • the first network device can send the first response message to the terminal device based on the identity authentication result received from the second network device.
  • the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN.
  • the first response message indicates that the identity authentication of the terminal device is successful, and the terminal device can determine the master session key (MSK), and can determine the first security key K AUSF according to the MSK.
  • the terminal device can determine the second security key K SEAF based on a key derivation function (KDF) according to the first security key K AUSF and the service network name, and the second security key K SEAF is used for the terminal device to access the NPN and to interact with the security anchor function SEAF in the NPN.
  • KDF key derivation function
  • the MSK is determined through negotiation between the successfully authenticated terminal device and the second network device, that is, the terminal device and the second network device can determine the same MSK.
  • the first security key K AUSF may be determined according to the MSK by using 128 bits or 256 bits of the MSK as the first security key K AUSF .
  • the service network name is the managed network identifier. If the first request message does not include a managed network identifier, the service network name is the identifier of the NPN.
  • the second security key K SEAF stored in the SEAF is sent to the SEAF by the first network device.
  • the terminal device is denied access to the NPN and cannot obtain the credential of successful identity authentication provided by the second network device.
  • the first request message is used by the first network device to determine a second request message
  • the second request message is used to request the second network device corresponding to the NPN to authenticate the terminal device
  • a first response message sent by the first network device through the access network device is received
  • the first response message is used to indicate whether the identity authentication of the terminal device is successful, so that the terminal device and the accessed network can authenticate each other, the terminal device can securely access the network, and obtain the services provided by the network, which effectively protects the security of information interaction between the terminal device and the accessed network, and improves the security and privacy of the system.
  • FIG 3 is a flowchart of an identity authentication method provided in an embodiment of the present application. It should be noted that the identity authentication method in the embodiment of the present application is executed by a terminal device. The method can be executed independently or in combination with any other embodiment of the present application. As shown in Figure 3, the method may include the following steps:
  • Step 301 sending a first request message to a first network device in the NPN through an access network device, the first request message is used by the first network device to determine a second request message, the second request message is used to request a second network device corresponding to the NPN to authenticate the terminal device.
  • a terminal device can send a first request message to a first network device in the NPN through an access network device. After receiving the first request message, the first network device can determine a second request message based on the first request message. The second request message is used to request a second network device corresponding to the NPN to authenticate the terminal device.
  • the first network device may be an authentication service function AUSF.
  • the second network device that performs identity authentication on the terminal device corresponds to the NPN where the first network device is located, and a second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.
  • the service provided by the second network device for the NPN includes at least one of authentication, authorization and billing.
  • the second network device may be an AAA server.
  • the first request message may include an identifier of the terminal device and/or an identifier of a hosted network that the terminal device requests to access, wherein the hosted network is constructed based on the NPN.
  • the first request message includes the identifier of the terminal device and the identifier of the managed network that the terminal device requests to access.
  • the first request message includes an identifier of the terminal device.
  • the identifier of the terminal device may be at least one of the following: SUPI, SUCI, anonymous SUPI, anonymous SUCI, online contract SUCI, online contract SUPI.
  • the network side can build multiple hosted networks based on the NPN to provide access to localized services, and each hosted network built has its own hosted network identifier.
  • the first request message is sent by the terminal device to the first network device through the access and mobility management function AMF in the NPN.
  • the NPN includes subscription data of the terminal device
  • the first network device sends a message to the UDM to request the UDM to determine to perform identity authentication with the terminal device based on the subscription data of the terminal device.
  • the first network device can receive a response message sent by the UDM to determine to perform identity authentication with the terminal device, and send the second request message to the second network device through the NSSAAF in the NPN.
  • the first network device starts the Nudm_UEAuthentication_Get service operation, the first network device sends a Nudm_UEAuthentication_Get request message to the UDM, and the UDM sends a Nudm_UEAuthentication_Get response message to the first network device.
  • the second request message includes the SUPI or anonymous SUPI of the terminal device.
  • the NPN may not include the subscription data of the terminal device (for example, the terminal device may be accessing the NPN and the NPN does not have the subscription data of the terminal device, or the terminal device is only signing up online (onboarding) the NPN to obtain the identity authentication credential without the need for the NPN to provide services, etc.), and the first network device may not omit sending a message to the UDM.
  • the first network device can still send a message to the UDM, initiate the Nudm_UEAuthentication_Get service operation, and receive a response that the subscription information of the terminal device is not queried.
  • the first network device does not reject the first request of the terminal device, and still sends the second request message to the second network device through the NSSAAF in the NPN.
  • the terminal device can perform mutual authentication with the second network device, and the mutual authentication method can be an EAP-based authentication.
  • the mutual authentication between the terminal device and the second network device can also use other identity authentication methods, and the embodiments of the present application do not specifically limit the mutual authentication method between the terminal device and the second network device.
  • Step 302 Receive a first response message sent by the first network device through the access network device, where the first response message is used to indicate that the identity authentication of the terminal device is successful.
  • the terminal device can receive a first response message sent by the first network device through the access network device, and the first response message can indicate that the identity authentication of the terminal device is successful.
  • the first network device can send the first response message to the terminal device based on the identity authentication result received from the second network device.
  • the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN.
  • Step 303 determine the master session key MSK.
  • the first response message indicates that the identity authentication of the terminal device is successful
  • the terminal device can determine the master session key MSK, and can determine the first security key K AUSF according to the MSK.
  • the MSK is determined through negotiation between the successfully authenticated terminal device and the second network device, that is, the terminal device and the second network device can determine the same MSK.
  • Step 304 Determine a first security key K AUSF according to the MSK.
  • the terminal device can determine the first security key K AUSF according to the MSK.
  • the first security key K AUSF may be determined according to the MSK by using 128 bits or 256 bits of the MSK as the first security key K AUSF .
  • Step 305 Determine a second security key K SEAF according to the first security key K AUSF and the service network name, where the second security key K SEAF is used for the terminal device to access the NPN.
  • the terminal device can determine the second security key K SEAF based on a key derivation function KDF according to the first security key K AUSF and the service network name, and the second security key K SEAF is used by the terminal device to access the NPN.
  • the service network name is the managed network identifier. If the first request message does not include a managed network identifier, the service network name is the identifier of the NPN.
  • the input parameter KEY of the key derivation function KDF is the first security key K AUSF .
  • the input parameter S of the key derivation function KDF may include:
  • the code number FC of the key derivation function is 0x6C;
  • Parameter P0 is the service network name
  • Parameter L0 is the length of the data included in parameter P0, that is, the length of the data of the service network name.
  • the second security key K SEAF can be used for information exchange between the terminal device and the security anchor function SEAF in the NPN, and the second security key K SEAF stored in the SEAF is sent by the first network device to the SEAF.
  • the first request message is used by the first network device to determine the second request message
  • the second request message is used to request the second network device corresponding to the NPN to authenticate the terminal device
  • receive the first response message sent by the first network device through the access network device the first response message is used to indicate that the identity authentication of the terminal device is successful, and the master session key MSK is determined.
  • the second security key K SEAF is determined, and the second security key K SEAF is used for the terminal device to access the NPN, so that the terminal device and the accessed network can be mutually authenticated, the terminal device can securely access the network, and obtain the services provided by the network, which effectively protects the security of information interaction between the terminal device and the accessed network, and improves the security and privacy of the system.
  • FIG 4 is a flowchart of an identity authentication method provided in an embodiment of the present application. It should be noted that the identity authentication method in the embodiment of the present application is executed by a terminal device. The method can be executed independently or in combination with any other embodiment of the present application. As shown in Figure 4, the method may include the following steps:
  • Step 401 sending a first request message to a first network device in the NPN through an access network device, the first request message is used by the first network device to determine a second request message, the second request message is used to request a second network device corresponding to the NPN to authenticate the terminal device.
  • a terminal device can send a first request message to a first network device in the NPN through an access network device. After receiving the first request message, the first network device can determine a second request message based on the first request message. The second request message is used to request a second network device corresponding to the NPN to authenticate the terminal device.
  • the first network device may be an authentication service function AUSF.
  • the second network device that performs identity authentication on the terminal device corresponds to the NPN where the first network device is located, and a second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.
  • the service provided by the second network device for the NPN includes at least one of authentication, authorization and billing.
  • the second network device may be an AAA server.
  • the first request message may include an identifier of the terminal device and/or an identifier of a hosted network that the terminal device requests to access, wherein the hosted network is constructed based on the NPN.
  • the first request message includes the identifier of the terminal device and the identifier of the managed network that the terminal device requests to access.
  • the first request message includes an identifier of the terminal device.
  • the identifier of the terminal device may be at least one of the following: SUPI, SUCI, anonymous SUPI, anonymous SUCI, online contract SUCI, and online contract SUPI.
  • the network side can build multiple hosted networks based on the NPN to provide access to localized services, and each hosted network built has its own hosted network identifier.
  • the first request message is sent by the terminal device to the first network device through the access and mobility management function AMF in the NPN.
  • Step 402 Send first indication information to the first network device, where the first indication information is used by the first network device to determine to omit sending a message to the UDM in the NPN.
  • the terminal device may be accessing the NPN and the NPN does not have the subscription data of the terminal device, or the terminal device is signing up (onboarding) online at the NPN to obtain identity authentication credentials without the need for the NPN to provide services (there is no subscription information of the terminal device in the NPN).
  • the terminal device can also send a first indication information to the first network device, and the first indication information is used by the first network device to determine to omit sending a message to the unified data management function UDM.
  • the first network device sends a message to the UDM to request the UDM to decide to perform identity authentication with the terminal device based on the subscription data of the terminal device.
  • the first network device can receive the response message sent by the UDM to determine to perform identity authentication with the terminal device, and send the second request message to the second network device through the NSSAAF in the NPN.
  • the NPN does not have subscription data of the terminal device, and the first indication information sent by the terminal device to the first network device can be used by the first network device to determine to omit sending a message to the UDM.
  • the first network device may not send a message to the UDM, but directly send the second request message to the second network device through the NSSAAF in the NPN.
  • the first indication information may be an identifier of the terminal device, or the first indication information is indication information used to indicate that the NPN does not include subscription data of the terminal device.
  • the identifier of the terminal device may be at least one of the following: SUPI, SUCI, anonymous SUPI, anonymous SUCI, online contract SUCI, and online contract SUPI.
  • the first indication information is an identifier of the terminal device. After receiving the first indication information, the first network device can determine to omit sending a message to the UDM according to a local policy of the first network device.
  • the local policy may decide to ignore interaction with the UDM based on the realm portion in the identifier of the terminal device, and directly select an NSSAAF, and send the second request message to the second network device through the NSSAAF.
  • the local policy may be determined based on the identifier of the terminal device, ignoring querying the UDM to see whether the identifier of the terminal device has corresponding subscription information.
  • the first indication information is used to indicate that the subscription data of the terminal device is not included in the NPN, and the first network device can determine to omit sending a message to the UDM based on the received first indication information.
  • the first network device may determine, based on the first indication information, to ignore interaction with the UDM, and directly select an NSSAAF, and send the second request message to the second network device through the NSSAAF.
  • the first network device may determine, based on the first indication information, to ignore querying the UDM whether the identifier of the terminal device has corresponding subscription information.
  • the second request message includes the SUPI or anonymous SUPI of the terminal device.
  • the terminal device can perform mutual authentication with the second network device, and the mutual authentication method can be an EAP-based authentication.
  • the mutual authentication between the terminal device and the second network device can also use other identity authentication methods, and the embodiments of the present application do not specifically limit the mutual authentication method between the terminal device and the second network device.
  • Step 403 Receive a first response message sent by the first network device through the access network device, where the first response message is used to indicate that the identity authentication of the terminal device is successful.
  • the terminal device can receive a first response message sent by the first network device through the access network device, and the first response message can indicate that the identity authentication of the terminal device is successful.
  • the first network device can send the first response message to the terminal device based on the identity authentication result received from the second network device.
  • the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN.
  • Step 404 determine the master session key MSK.
  • the first response message indicates that the identity authentication of the terminal device is successful
  • the terminal device can determine the master session key MSK, and can determine the first security key K AUSF according to the MSK.
  • the MSK is determined through negotiation between the successfully authenticated terminal device and the second network device, that is, the terminal device and the second network device can determine the same MSK.
  • Step 405 Determine a first security key K AUSF according to the MSK.
  • the terminal device can determine the first security key K AUSF according to the MSK.
  • the first security key K AUSF is determined according to the MSK by using 128 bits or 256 bits of the MSK as the first security key K AUSF .
  • Step 406 Determine a second security key K SEAF according to the first security key K AUSF and the service network name, where the second security key K SEAF is used for the terminal device to access the NPN.
  • the terminal device can determine the second security key K SEAF based on a key derivation function KDF according to the first security key K AUSF and the service network name, and the second security key K SEAF is used by the terminal device to access the NPN.
  • the service network name is the managed network identifier. If the first request message does not include a managed network identifier, the service network name is the identifier of the NPN.
  • the input parameter KEY of the key derivation function KDF is the first security key K AUSF .
  • the input parameter S of the key derivation function KDF may include:
  • the code number FC of the key derivation function is 0x6C;
  • Parameter P0 is the service network name
  • Parameter L0 is the length of the data included in parameter P0, that is, the length of the data of the service network name.
  • the second security key K SEAF can be used for information exchange between the terminal device and the security anchor function SEAF in the NPN, and the second security key K SEAF stored in the SEAF is sent by the first network device to the SEAF.
  • the first request message is used by the first network device to determine a second request message
  • the second request message is used to request the second network device corresponding to the NPN to authenticate the terminal device
  • sending a first indication message to the first network device the first indication message is used by the first network device to determine to omit sending a message to the UDM in the NPN
  • receiving a first response message sent by the first network device through the access network device the first response message is used to indicate that the identity authentication of the terminal device is successful, determining the master session key MSK, and determining the second security key K SEAF according to the first security key K AUSF and the service network name.
  • the second security key K SEAF is used for the terminal device to access the NPN, so that the terminal device and the accessed network can authenticate each other, the terminal device can securely access the network, and obtain the services provided by the network, which effectively protects the security of information interaction between the terminal device and the accessed network, and improves the security and privacy of the system.
  • FIG 5 is a flow chart of an identity authentication method provided in an embodiment of the present application. It should be noted that the identity authentication method in the embodiment of the present application is performed by the first network device. The method can be performed independently or in combination with any other embodiment of the present application. As shown in Figure 5, the method may include the following steps:
  • Step 501 Receive a first request message sent by a terminal device through an access network device.
  • a first network device can receive a first request message sent by a terminal device through an access network device. After receiving the first request message, the first network device can determine a second request message based on the first request message. The second request message is used to request a second network device corresponding to the NPN where the first network device is located to authenticate the terminal device.
  • the first network device may be an authentication service function AUSF.
  • the second network device that performs identity authentication on the terminal device corresponds to the NPN where the first network device is located, and a second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.
  • the service provided by the second network device for the NPN includes at least one of authentication, authorization and billing.
  • the second network device may be an AAA server.
  • the first request message may include an identifier of the terminal device and/or an identifier of a hosted network that the terminal device requests to access, wherein the hosted network is constructed based on the NPN.
  • the first request message includes the identifier of the terminal device and the identifier of the managed network that the terminal device requests to access.
  • the first request message includes an identifier of the terminal device.
  • the identifier of the terminal device may be at least one of the following: a user permanent identifier SUPI, a user hidden identifier SUCI, an anonymous SUPI, an anonymous SUCI, an online contract SUCI, and an online contract SUPI.
  • the network side can build multiple hosted networks based on the NPN to provide access to localized services, and each hosted network built has its own hosted network identifier.
  • the first request message is sent by the terminal device to the first network device through the access and mobility management function AMF in the NPN.
  • Step 502 According to the first request message, a second request message is sent to a second network device corresponding to the NPN where the first network device is located, wherein the second request message is used to request the second network device to authenticate the terminal device.
  • the first network device can send a second request to the second network device corresponding to the NPN where the first network device is located according to the first request message, requesting the second network device to authenticate the terminal device.
  • the second network device that performs identity authentication on the terminal device corresponds to the NPN where the first network device is located, and a second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.
  • the terminal device may be accessing the NPN and the NPN does not have the subscription data of the terminal device, or the terminal device is only signing up online (onboarding) with the NPN to obtain identity authentication credentials without the need for the NPN to provide services (the NPN does not have the subscription information of the terminal device).
  • the first network device can also receive first indication information sent by the terminal device, and the first indication information is used by the first network device to determine to omit sending a message to the unified data management function UDM.
  • the first network device sends a message to the UDM to request the UDM to decide to perform identity authentication with the terminal device based on the subscription data of the terminal device.
  • the first network device is able to receive the response message sent by the UDM to determine to perform identity authentication with the terminal device, and send the second request message to the second network device through the network slice specific authentication and authorization function NSSAAF in the NPN.
  • the first network device starts a Nudm_UEAuthentication_Get service operation, the first network device sends a Nudm_UEAuthentication_Get request message to the UDM, and the UDM sends a Nudm_UEAuthentication_Get response message to the first network device.
  • the first indication information sent by the terminal device to the first network device can be used by the first network device to determine to omit sending a message to the UDM. After receiving the first indication information, the first network device may not send a message to the UDM, but directly send the second request message to the second network device through the NSSAAF in the NPN.
  • the first indication information may be an identifier of the terminal device, or the first indication information is indication information used to indicate that the NPN does not include subscription data of the terminal device.
  • the identifier of the terminal device may be at least one of the following: SUPI, SUCI, anonymous SUPI, anonymous SUCI, online contract SUCI, and online contract SUPI.
  • the first indication information is an identifier of the terminal device. After receiving the first indication information, the first network device can determine to omit sending a message to the UDM according to a local policy of the first network device.
  • the local policy may decide to ignore interaction with the UDM based on the realm portion in the identifier of the terminal device, and directly select an NSSAAF, and send the second request message to the second network device through the NSSAAF.
  • the local policy may be determined based on the identifier of the terminal device, and ignores querying the UDM to determine whether the identifier of the terminal device has corresponding subscription information.
  • the first indication information is used to indicate that the NPN does not include subscription data of the terminal device, and the first network device can determine to omit sending a message to the UDM according to the received first indication information.
  • the first network device may determine, based on the first indication information, to ignore interaction with the UDM, and directly select an NSSAAF, and send the second request message to the second network device through the NSSAAF.
  • the first network device may determine, based on the first indication information, to ignore querying the UDM whether the identifier of the terminal device has corresponding subscription information.
  • the NPN may not include the subscription data of the terminal device, and the first network device may not omit sending a message to the UDM.
  • the first network device may still send a message to the UDM, initiate the Nudm_UEAuthentication_Get service operation, and receive a response that the subscription information of the terminal device is not found.
  • the first network device does not reject the first request of the terminal device, and still sends the second request message to the second network device through the NSSAAF in the NPN.
  • the second request message includes the SUPI or anonymous SUPI of the terminal device.
  • the terminal device can perform mutual authentication with the second network device, and the mutual authentication method can be authentication based on the extensible authentication protocol EAP.
  • the mutual authentication between the terminal device and the second network device can also adopt other identity authentication methods, and the embodiments of the present application do not specifically limit the mutual authentication method between the terminal device and the second network device.
  • Step 503 Receive the result of the terminal device identity authentication sent by the second network device.
  • the first network device is capable of receiving the identity authentication result sent by the second network device, and is capable of sending a first response message to the terminal device based on the identity authentication result.
  • the first network device can receive the verification result sent by the second network device through the NSSAAF.
  • the verification result may include the SUPI of the terminal device.
  • Step 504 According to the result of the identity authentication of the terminal device, a first response message is sent to the terminal device through the access network device.
  • the first response message is used to indicate whether the identity authentication of the terminal device is successful.
  • the first network device can send a first response message to the terminal device through the access network device, and the first response message can indicate whether the identity authentication of the terminal device is successful.
  • the first network device can send the first response message to the terminal device according to the identity authentication result received from the second network device.
  • the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN.
  • the identity authentication result sent by the second network device is a successful authentication
  • the first response message indicates that the identity authentication of the terminal device is successful
  • the first network device can receive the master session key MSK sent by the second network device, and can determine the first security key K AUSF according to the MSK.
  • the first network device can determine the second security key K SEAF based on a key derivation function KDF, according to the first security key K AUSF and the service network name, and the second security key K SEAF is used for the terminal device to access the NPN and to interact with the security anchor function SEAF in the NPN.
  • the MSK is determined through negotiation between the successfully authenticated terminal device and the second network device, that is, the terminal device and the second network device can determine the same MSK.
  • the first security key K AUSF may be determined according to the MSK by using 128 bits or 256 bits of the MSK as the first security key K AUSF .
  • the service network name is the managed network identifier. If the first request message does not include a managed network identifier, the service network name is the identifier of the NPN.
  • the first network device can send the second security key K SEAF to a security anchor function SEAF in the NPN, and the second security key K SEAF is used for information interaction between the terminal device and the SEAF.
  • the terminal device is denied access to the NPN and cannot obtain the credential of successful identity authentication provided by the second network device.
  • the first network device if the subscription data of the terminal device is not included in the NPN, the first network device omits sending a message to the UDM, or the first network device receives a response from the UDM that the subscription information of the terminal device is not found, the first network device can omit notifying the UDM of the identity authentication result of the terminal device after receiving the verification result sent by the second network device to verify whether the terminal device has a valid subscription in the UDM.
  • a second request message is sent to a second network device corresponding to the NPN where the first network device is located, the second request message is used to request the second network device to authenticate the terminal device, and the result of the terminal device identity authentication sent by the second network device is received.
  • a first response message is sent to the terminal device through the access network device, and the first response message is used to indicate whether the terminal device identity authentication is successful, so that the terminal device and the accessed network can authenticate each other, the terminal device can securely access the network, and obtain the services provided by the network, which effectively protects the security of information interaction between the terminal device and the accessed network, and improves the security and privacy of the system.
  • FIG 6 is a flowchart of an identity authentication method provided in an embodiment of the present application. It should be noted that the identity authentication method in the embodiment of the present application is performed by the first network device. The method can be performed independently or in combination with any other embodiment of the present application. As shown in Figure 6, the method may include the following steps:
  • Step 601 Receive a first request message sent by a terminal device through an access network device.
  • a first network device can receive a first request message sent by a terminal device through an access network device. After receiving the first request message, the first network device can determine a second request message based on the first request message. The second request message is used to request a second network device corresponding to the NPN where the first network device is located to authenticate the terminal device.
  • the first network device may be an authentication service function AUSF.
  • the second network device that performs identity authentication on the terminal device corresponds to the NPN where the first network device is located, and a second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.
  • the service provided by the second network device for the NPN includes at least one of authentication, authorization and billing.
  • the second network device may be an AAA server.
  • the first request message may include an identifier of the terminal device and/or an identifier of a hosted network that the terminal device requests to access, wherein the hosted network is constructed based on the NPN.
  • the first request message includes the identifier of the terminal device and the identifier of the managed network that the terminal device requests to access.
  • the first request message includes an identifier of the terminal device.
  • the identifier of the terminal device may be at least one of the following: a user permanent identifier SUPI, a user hidden identifier SUCI, an anonymous SUPI, an anonymous SUCI, an online contract SUCI, and an online contract SUPI.
  • the network side can build multiple hosted networks based on the NPN to provide access to localized services, and each hosted network built has its own hosted network identifier.
  • the first request message is sent by the terminal device to the first network device through the access and mobility management function AMF in the NPN.
  • Step 602 According to the first request message, a second request message is sent to a second network device corresponding to the NPN where the first network device is located, wherein the second request message is used to request the second network device to authenticate the terminal device.
  • the first network device can send a second request to the second network device corresponding to the NPN where the first network device is located according to the first request message, requesting the second network device to authenticate the terminal device.
  • the second network device that performs identity authentication on the terminal device corresponds to the NPN where the first network device is located, and a second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.
  • the NPN includes subscription data of the terminal device
  • the first network device sends a message to the UDM to request the UDM to determine to perform identity authentication with the terminal device based on the subscription data of the terminal device.
  • the first network device can receive a response message sent by the UDM to determine to perform identity authentication with the terminal device, and send the second request message to the second network device through the network slice specific authentication and authorization function NSSAAF in the NPN.
  • the first network device starts a Nudm_UEAuthentication_Get service operation, the first network device sends a Nudm_UEAuthentication_Get request message to the UDM, and the UDM sends a Nudm_UEAuthentication_Get response message to the first network device.
  • the NPN may not include the subscription data of the terminal device (for example, the terminal device may be accessing the NPN and the NPN does not have the subscription data of the terminal device, or the terminal device is only signing up online (onboarding) at the NPN to obtain the identity authentication credential without the need for the NPN to provide services, etc.), and the first network device may not omit sending a message to the UDM.
  • the first network device may still send a message to the UDM, initiate the Nudm_UEAuthentication_Get service operation, and receive a response that the subscription information of the terminal device is not queried.
  • the first network device does not reject the first request of the terminal device, and still sends the second request message to the second network device through the NSSAAF in the NPN.
  • the second request message includes the SUPI or anonymous SUPI of the terminal device.
  • the NSSAAF can determine the type of identifier to be sent to the second network device (such as an AAA server/application server, etc.) based on a local policy. For example, based on the realm part of the identifier of the terminal device, it is determined whether to send a SUPI or an external terminal device identifier (such as a Generic Public Subscription Identifier (GPSI), an IP Multimedia Subsystem (IMS) private user identifier (IP Multimedia Private Identity, IMPI), etc.) to the second network device.
  • a SUPI or an external terminal device identifier such as a Generic Public Subscription Identifier (GPSI), an IP Multimedia Subsystem (IMS) private user identifier (IP Multimedia Private Identity, IMPI), etc.
  • the terminal device can perform mutual authentication with the second network device, and the mutual authentication method can be authentication based on the extensible authentication protocol EAP.
  • the mutual authentication between the terminal device and the second network device can also adopt other identity authentication methods, and the embodiments of the present application do not specifically limit the mutual authentication method between the terminal device and the second network device.
  • Step 603 Receive the result of the terminal device identity authentication sent by the second network device, where the result is that the identity authentication is successful.
  • the first network device is capable of receiving the identity authentication result sent by the second network device, and is capable of sending a first response message to the terminal device based on the identity authentication result.
  • the first network device can receive the verification result sent by the second network device through the NSSAAF.
  • the verification result may include the SUPI of the terminal device.
  • the first network device can also notify the UDM of the identity authentication result of the terminal device after receiving the verification result sent by the second network device to verify whether the terminal device has a valid subscription in the UDM.
  • the first network device receives a response from the UDM that the subscription information of the terminal device is not found, and after receiving the verification result sent by the second network device, the first network device can omit notifying the UDM of the identity authentication result of the terminal device to verify whether the terminal device has a valid subscription in the UDM.
  • Step 604 Receive the master session key MSK sent by the second network device.
  • the first network device can receive the master session key MSK sent by the second network device, and can determine the first security key K AUSF according to the MSK.
  • the MSK is determined through negotiation between the successfully authenticated terminal device and the second network device, that is, the terminal device and the second network device can determine the same MSK.
  • the MSK may be included in the verification result sent by the second network device.
  • Step 605 Determine a first security key K AUSF according to the MSK.
  • the first network device can determine the first security key K AUSF according to the MSK.
  • determining the first security key K AUSF according to the MSK may be to use 128 bits or 256 bits of the MSK as the first security key K AUSF .
  • Step 606 Determine a second security key K SEAF according to the first security key K AUSF and the service network name, where the second security key K SEAF is used for the terminal device to access the NPN.
  • the first network device can determine the second security key K SEAF based on a key derivation function KDF according to the first security key K AUSF and the service network name, and the second security key K SEAF is used for the terminal device to access the NPN.
  • the first network device and the terminal device derive the second security key K SEAF from the first security key K AUSF based on the same key derivation function.
  • the service network name is the managed network identifier. If the first request message does not include a managed network identifier, the service network name is the identifier of the NPN.
  • the input parameter KEY of the key derivation function KDF is the first security key K AUSF .
  • the input parameter S of the key derivation function KDF may include:
  • the code number FC of the key derivation function is 0x6C;
  • Parameter P0 is the service network name
  • Parameter L0 is the length of the data included in parameter P0, that is, the length of the data of the service network name.
  • Step 607 Send the second security key K SEAF to the security anchor function SEAF in the NPN.
  • the first network device can also send the second security key K SEAF to the SEAF in the NPN, and the second security key K SEAF can be used for the terminal device to perform information interaction with the security anchor function SEAF in the NPN.
  • Step 608 According to the result of the identity authentication of the terminal device, a first response message is sent to the terminal device through the access network device, and the first response message is used to indicate that the identity authentication of the terminal device is successful.
  • the first network device can send a first response message to the terminal device through the access network device, and the first response message can indicate whether the identity authentication of the terminal device is successful.
  • the first network device can send the first response message to the terminal device according to the identity authentication result received from the second network device.
  • the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN.
  • a second request message is sent to a second network device corresponding to the NPN where the first network device is located, the second request message is used to request the second network device to authenticate the terminal device, and the result of the terminal device identity authentication sent by the second network device is received, the result is that the identity authentication is successful, and the master session key MSK sent by the second network device is received.
  • a first security key K AUSF is determined, and according to the first security key K AUSF and the service network name, a second security key K SEAF is determined, and the second security key K SEAF is used for the terminal device to access the NPN, and the second security key K SEAF is sent to the security anchor function SEAF in the NPN.
  • a first response message is sent to the terminal device through the access network device, and the first response message is used to indicate that the terminal device identity authentication is successful, so that the terminal device and the accessed network can be mutually authenticated, and the terminal device can securely access the network and obtain the services provided by the network, which effectively protects the information interaction security between the terminal device and the accessed network, and improves the security and privacy of the system.
  • FIG 7 is a flow chart of an identity authentication method provided in an embodiment of the present application. It should be noted that the identity authentication method in the embodiment of the present application is performed by the first network device. The method can be performed independently or in combination with any other embodiment of the present application. As shown in Figure 7, the method may include the following steps:
  • Step 701 Receive a first request message sent by a terminal device through an access network device.
  • a first network device can receive a first request message sent by a terminal device through an access network device. After receiving the first request message, the first network device can determine a second request message based on the first request message. The second request message is used to request a second network device corresponding to the NPN where the first network device is located to authenticate the terminal device.
  • the first network device may be an authentication service function AUSF.
  • the second network device that performs identity authentication on the terminal device corresponds to the NPN where the first network device is located, and a second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.
  • the service provided by the second network device for the NPN includes at least one of authentication, authorization and billing.
  • the second network device may be an AAA server.
  • the first request message may include an identifier of the terminal device and/or an identifier of a hosted network that the terminal device requests to access, wherein the hosted network is constructed based on the NPN.
  • the first request message includes the identifier of the terminal device and the identifier of the managed network that the terminal device requests to access.
  • the first request message includes an identifier of the terminal device.
  • the identifier of the terminal device may be at least one of the following: a user permanent identifier SUPI, a user hidden identifier SUCI, an anonymous SUPI, an anonymous SUCI, an online contract SUCI, and an online contract SUPI.
  • the network side can build multiple hosted networks based on the NPN to provide access to localized services, and each hosted network built has its own hosted network identifier.
  • the first request message is sent by the terminal device to the first network device through the access and mobility management function AMF in the NPN.
  • Step 702 Receive first indication information sent by the terminal device, where the first indication information is used by the first network device to determine to omit sending a message to the UDM in the NPN.
  • the terminal device may be accessing the NPN and the NPN does not have the subscription data of the terminal device, or the terminal device is only signing up (onboarding) online at the NPN to obtain identity authentication credentials without the need for the NPN to provide services (there is no subscription information of the terminal device in the NPN), and the first network device can also receive first indication information sent by the terminal device, and the first indication information is used by the first network device to determine to omit sending a message to the unified data management function UDM.
  • the first network device sends a message to the UDM to request the UDM to decide to perform identity authentication with the terminal device based on the subscription data of the terminal device.
  • the first network device can receive the response message sent by the UDM to determine to perform identity authentication with the terminal device, and send the second request message to the second network device through the NSSAAF in the NPN.
  • the NPN does not have subscription data of the terminal device, and the first indication information sent by the terminal device to the first network device can be used by the first network device to determine to omit sending a message to the UDM.
  • the first network device may not send a message to the UDM, but directly send the second request message to the second network device through the NSSAAF in the NPN.
  • the first indication information may be an identifier of the terminal device, or the first indication information is indication information used to indicate that the NPN does not include subscription data of the terminal device.
  • the identifier of the terminal device may be at least one of the following: SUPI, SUCI, anonymous SUPI, anonymous SUCI, online contract SUCI, and online contract SUPI.
  • the first indication information is an identifier of the terminal device. After receiving the first indication information, the first network device can determine to omit sending a message to the UDM according to a local policy of the first network device.
  • the local policy may decide to ignore interaction with the UDM based on the realm portion in the identifier of the terminal device, and directly select an NSSAAF, and send the second request message to the second network device through the NSSAAF.
  • the local policy may be determined based on the identifier of the terminal device, ignoring querying the UDM to see whether the identifier of the terminal device has corresponding subscription information.
  • the first indication information is used to indicate that the subscription data of the terminal device is not included in the NPN, and the first network device can determine to omit sending a message to the UDM based on the received first indication information.
  • the first network device may determine, based on the first indication information, to ignore interaction with the UDM, and directly select an NSSAAF, and send the second request message to the second network device through the NSSAAF.
  • the first network device may determine, based on the first indication information, to ignore querying the UDM whether the identifier of the terminal device has corresponding subscription information.
  • the second request message includes the SUPI or anonymous SUPI of the terminal device.
  • the NSSAAF can determine the type of identifier to be sent to the second network device (such as an AAA server/application server, etc.) based on a local policy. For example, based on the realm part of the identifier of the terminal device, determine whether to send a SUPI or an external terminal device identifier (such as a general public user identifier GPSI, an IMS private user identifier IMPI, etc.) to the second network device.
  • the second network device such as an AAA server/application server, etc.
  • Step 703 According to the first request message, a second request message is sent to a second network device corresponding to the NPN where the first network device is located, wherein the second request message is used to request the second network device to authenticate the terminal device.
  • the first network device can send a second request to the second network device corresponding to the NPN where the first network device is located according to the first request message, requesting the second network device to authenticate the terminal device.
  • the second network device that performs identity authentication on the terminal device corresponds to the NPN where the first network device is located, and a second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.
  • the second request message includes the SUPI or anonymous SUPI of the terminal device.
  • the terminal device can perform mutual authentication with the second network device, and the mutual authentication method can be authentication based on the extensible authentication protocol EAP.
  • the mutual authentication between the terminal device and the second network device can also adopt other identity authentication methods, and the embodiments of the present application do not specifically limit the mutual authentication method between the terminal device and the second network device.
  • Step 704 Receive the result of the terminal device identity authentication sent by the second network device, where the result is that the identity authentication is successful.
  • the first network device is capable of receiving the identity authentication result sent by the second network device, and is capable of sending a first response message to the terminal device based on the identity authentication result.
  • the first network device can receive the verification result sent by the second network device through the NSSAAF.
  • the verification result may include the SUPI of the terminal device.
  • the first network device can also notify the UDM of the identity authentication result of the terminal device after receiving the verification result sent by the second network device to verify whether the terminal device has a valid subscription in the UDM.
  • the first network device receives the first indication information sent by the terminal device and determines to omit sending the message to the UDM. After receiving the verification result sent by the second network device, the first network device can omit notifying the UDM of the identity authentication result of the terminal device to verify whether the terminal device has a valid subscription in the UDM.
  • Step 705 Receive the master session key MSK sent by the second network device.
  • the first network device can receive the master session key MSK sent by the second network device, and can determine the first security key K AUSF according to the MSK.
  • the MSK is determined through negotiation between the successfully authenticated terminal device and the second network device, that is, the terminal device and the second network device can determine the same MSK.
  • the MSK may be included in the verification result sent by the second network device.
  • Step 706 Determine a first security key K AUSF according to the MSK.
  • the first network device can determine the first security key K AUSF according to the MSK.
  • determining the first security key K AUSF according to the MSK may be to use 128 bits or 256 bits of the MSK as the first security key K AUSF .
  • Step 707 Determine a second security key K SEAF according to the first security key K AUSF and the service network name, where the second security key K SEAF is used for the terminal device to access the NPN.
  • the first network device can determine the second security key K SEAF based on a key derivation function KDF according to the first security key K AUSF and the service network name, and the second security key K SEAF is used for the terminal device to access the NPN.
  • the first network device and the terminal device derive the second security key K SEAF from the first security key K AUSF based on the same key derivation function.
  • the service network name is the managed network identifier. If the first request message does not include a managed network identifier, the service network name is the identifier of the NPN.
  • the input parameter KEY of the key derivation function KDF is the first security key K AUSF .
  • the input parameter S of the key derivation function KDF may include:
  • the code number FC of the key derivation function is 0x6C;
  • Parameter P0 is the service network name
  • Parameter L0 is the length of the data included in parameter P0, that is, the length of the data of the service network name.
  • Step 708 Send the second security key K SEAF to the security anchor function SEAF in the NPN.
  • the first network device can also send the second security key K SEAF to the SEAF in the NPN, and the second security key K SEAF can be used for the terminal device to perform information interaction with the security anchor function SEAF in the NPN.
  • Step 709 According to the result of the identity authentication of the terminal device, a first response message is sent to the terminal device through the access network device, and the first response message is used to indicate that the identity authentication of the terminal device is successful.
  • the first network device can send a first response message to the terminal device through the access network device, and the first response message can indicate whether the identity authentication of the terminal device is successful.
  • the first network device can send the first response message to the terminal device according to the identity authentication result received from the second network device.
  • the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN.
  • the first indication information is used by the first network device to determine to omit sending a message to the UDM in the NPN, sending a second request message to a second network device corresponding to the NPN where the first network device is located, the second request message is used to request the second network device to authenticate the terminal device, receiving a result of the terminal device authentication sent by the second network device, the result is that the authentication is successful, receiving a master session key MSK sent by the second network device, determining a first security key K AUSF according to the MSK, determining a second security key K SEAF according to the first security key K AUSF and the service network name, the second security key K SEAF is used by the terminal device to access the NPN, and sending the second security key K SEAF to the security anchor function SEAF in the NPN.
  • a first response message is sent to the terminal device through the access network device.
  • the first response message is used to indicate that the identity authentication of the terminal device is successful, so that the terminal device and the accessed network can authenticate each other, and the terminal device can securely access the network and obtain the services provided by the network, which effectively protects the security of information interaction between the terminal device and the accessed network and improves the security and privacy of the system.
  • FIG 8 is a flow chart of an identity authentication method provided in an embodiment of the present application. It should be noted that the identity authentication method in the embodiment of the present application is performed by the second network device. The method can be performed independently or in combination with any other embodiment of the present application. As shown in Figure 8, the method may include the following steps:
  • Step 801 receiving a second request message sent by a first network device, wherein the second request message is determined by the first network device according to the first request message sent by a terminal device, and is used to request the second network device corresponding to the NPN where the first network device is located to authenticate the terminal device.
  • the second network device is capable of receiving a second request message sent by the first network device, where the second request message is used to request the second network device corresponding to the NPN where the first network device is located to authenticate the terminal device.
  • the second request message is determined by the first network device based on the first request message received from the terminal device through the access network device. After receiving the first request message, the first network device can determine the second request message based on the first request message.
  • the first network device may be an authentication service function AUSF.
  • the second network device that performs identity authentication on the terminal device corresponds to the NPN where the first network device is located, and a second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.
  • the service provided by the second network device for the NPN includes at least one of authentication, authorization and billing.
  • the second network device may be an AAA server.
  • the first request message may include an identifier of the terminal device and/or an identifier of a hosted network that the terminal device requests to access, wherein the hosted network is constructed based on the NPN.
  • the first request message includes the identifier of the terminal device and the identifier of the managed network that the terminal device requests to access.
  • the first request message includes an identifier of the terminal device.
  • the identifier of the terminal device may be at least one of the following: a user permanent identifier SUPI, a user hidden identifier SUCI, an anonymous SUPI, an anonymous SUCI, an online contract SUCI, and an online contract SUPI.
  • the network side can build multiple hosted networks based on the NPN to provide access to localized services, and each hosted network built has its own hosted network identifier.
  • the first request message is sent by the terminal device to the first network device through the access and mobility management function AMF in the NPN.
  • the first network device can send the second request message to the second network device through the network slice specific authentication and authorization function NSSAAF in the NPN.
  • the second request message includes the SUPI or anonymous SUPI of the terminal device.
  • the terminal device can perform mutual authentication with the second network device, and the mutual authentication method can be authentication based on the extensible authentication protocol EAP.
  • the mutual authentication between the terminal device and the second network device can also adopt other identity authentication methods, and the embodiments of the present application do not specifically limit the mutual authentication method between the terminal device and the second network device.
  • Step 802 Send the result of the terminal device identity authentication to the first network device, where the result of the terminal device identity authentication is used to determine a first response message, where the first response message is used to indicate whether the terminal device identity authentication is successful.
  • the first network device is capable of receiving the identity authentication result sent by the second network device, and is capable of sending a first response message to the terminal device based on the identity authentication result.
  • the second network device can send the verification result to the first network device through the NSSAAF.
  • the verification result may include the SUPI of the terminal device.
  • the result of the identity authentication can be used by the first network device to determine the first response information.
  • the first network device can send a first response message to the terminal device through the access network device, and the first response message can indicate whether the identity authentication of the terminal device is successful.
  • the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN.
  • the identity authentication result sent by the second network device is a successful authentication
  • the first response message indicates that the identity authentication of the terminal device is successful
  • the second network device can send the master session key MSK to the first network device
  • the first network device can determine the first security key K AUSF according to the MSK.
  • the first network device can determine the second security key K SEAF based on a key derivation function KDF, according to the first security key K AUSF and the service network name, and the second security key K SEAF is used for the terminal device to access the NPN and to interact with the security anchor function SEAF in the NPN.
  • the MSK is determined through negotiation between the successfully authenticated terminal device and the second network device, that is, the terminal device and the second network device can determine the same MSK.
  • the first security key K AUSF may be determined according to the MSK by using 128 bits or 256 bits of the MSK as the first security key K AUSF .
  • the service network name is the managed network identifier. If the first request message does not include a managed network identifier, the service network name is the identifier of the NPN.
  • the second security key K SEAF is used for information exchange between the terminal device and the security anchor function SEAF in the NPN, and the second security key K SEAF stored in the SEAF is sent by the first network device to the SEAF.
  • the terminal device is denied access to the NPN and cannot obtain the credential of successful identity authentication provided by the second network device.
  • the second request message is determined by the first network device according to the first request message sent by the terminal device, the second request message is used to request the second network device corresponding to the NPN where the first network device is located to authenticate the terminal device, and send the result of the terminal device identity authentication to the first network device, and the result of the terminal device identity authentication is used to determine the first response message, and the first response message is used to indicate whether the terminal device identity authentication is successful, so that the terminal device and the accessed network can authenticate each other, the terminal device can securely access the network, and obtain the services provided by the network, which effectively protects the security of information interaction between the terminal device and the accessed network, and improves the security and privacy of the system.
  • FIG 9 is a flowchart of an identity authentication method provided in an embodiment of the present application. It should be noted that the identity authentication method in the embodiment of the present application is performed by the second network device. The method can be performed independently or in combination with any other embodiment of the present application. As shown in Figure 9, the method may include the following steps:
  • Step 901 receiving a second request message sent by a first network device, wherein the second request message is determined by the first network device according to the first request message sent by a terminal device, and is used to request the second network device corresponding to the NPN where the first network device is located to authenticate the terminal device.
  • the second network device is capable of receiving a second request message sent by the first network device, where the second request message is used to request the second network device corresponding to the NPN where the first network device is located to authenticate the terminal device.
  • the second request message is determined by the first network device based on the first request message received from the terminal device through the access network device. After receiving the first request message, the first network device can determine the second request message based on the first request message.
  • the first network device may be an authentication service function AUSF.
  • the second network device that performs identity authentication on the terminal device corresponds to the NPN where the first network device is located, and a second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.
  • the service provided by the second network device for the NPN includes at least one of authentication, authorization and billing.
  • the second network device may be an AAA server.
  • the first request message may include an identifier of the terminal device and/or an identifier of a hosted network that the terminal device requests to access, wherein the hosted network is constructed based on the NPN.
  • the first request message includes the identifier of the terminal device and the identifier of the managed network that the terminal device requests to access.
  • the first request message includes an identifier of the terminal device.
  • the identifier of the terminal device may be at least one of the following: a user permanent identifier SUPI, a user hidden identifier SUCI, an anonymous SUPI, an anonymous SUCI, an online contract SUCI, and an online contract SUPI.
  • the network side can build multiple hosted networks based on the NPN to provide access to localized services, and each hosted network built has its own hosted network identifier.
  • the first request message is sent by the terminal device to the first network device through the access and mobility management function AMF in the NPN.
  • the first network device can send the second request message to the second network device through the network slice specific authentication and authorization function NSSAAF in the NPN.
  • the second request message includes the SUPI or anonymous SUPI of the terminal device.
  • the terminal device can perform mutual authentication with the second network device, and the mutual authentication method can be authentication based on the extensible authentication protocol EAP.
  • the mutual authentication between the terminal device and the second network device can also adopt other identity authentication methods, and the embodiments of the present application do not specifically limit the mutual authentication method between the terminal device and the second network device.
  • Step 902 Send the result of the identity authentication of the terminal device to the first network device, where the result of the identity authentication of the terminal device is used to determine a first response message, where the first response message is used to indicate that the identity authentication of the terminal device is successful.
  • the first network device is capable of receiving the identity authentication result sent by the second network device, and is capable of sending a first response message to the terminal device based on the identity authentication result.
  • the second network device can send the verification result to the first network device through the NSSAAF.
  • the verification result may include the SUPI of the terminal device.
  • the result of the identity authentication can be used by the first network device to determine the first response information.
  • the first network device can send a first response message to the terminal device through the access network device, and the first response message can indicate whether the identity authentication of the terminal device is successful.
  • the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN.
  • Step 903 Send the master session key MSK to the first network device.
  • the identity authentication result sent by the second network device is a successful authentication
  • the first response message indicates that the identity authentication of the terminal device is successful
  • the second network device can send the master session key MSK to the first network device
  • the first network device can determine the first security key K AUSF according to the MSK.
  • the first network device can determine the second security key K SEAF based on a key derivation function KDF, according to the first security key K AUSF and the service network name, and the second security key K SEAF is used for the terminal device to access the NPN and to interact with the security anchor function SEAF in the NPN.
  • the MSK is determined through negotiation between the successfully authenticated terminal device and the second network device, that is, the terminal device and the second network device can determine the same MSK.
  • the first security key K AUSF may be determined according to the MSK by using 128 bits or 256 bits of the MSK as the first security key K AUSF .
  • the service network name is the managed network identifier. If the first request message does not include a managed network identifier, the service network name is the identifier of the NPN.
  • the input parameter KEY of the key derivation function KDF is the first security key K AUSF .
  • the input parameter S of the key derivation function KDF may include:
  • the code number FC of the key derivation function is 0x6C;
  • Parameter P0 is the service network name
  • Parameter L0 is the length of the data included in parameter P0, that is, the length of the data of the service network name.
  • the second security key K SEAF is used for information exchange between the terminal device and the security anchor function SEAF in the NPN, and the second security key K SEAF stored in the SEAF is sent by the first network device to the SEAF.
  • the second request message is determined by the first network device according to the first request message sent by the terminal device, the second request message is used to request the second network device corresponding to the NPN where the first network device is located to authenticate the terminal device, and send the result of the terminal device identity authentication to the first network device.
  • the result of the terminal device identity authentication is used to determine the first response message, and the first response message is used to indicate that the terminal device identity authentication is successful, and send the master session key MSK to the first network device, so that the terminal device and the accessed network can authenticate each other, the terminal device can securely access the network, and obtain the services provided by the network, which effectively protects the security of information interaction between the terminal device and the accessed network, and improves the security and privacy of the system.
  • Figure 10 is a flow chart of an identity authentication method provided in an embodiment of the present application. The method can be executed independently or in combination with any other embodiment of the present application. As shown in Figure 10, the method may include the following steps:
  • the terminal device can select an NPN and initiate terminal device registration in the NPN.
  • the registration message may include the terminal device's identifier and/or the identifier of the managed network that the terminal device requests to access.
  • the managed network is built based on the NPN.
  • the AMF in the NPN shall send a Nausf_UEAuthentication_Authenticate request to the AUSF (first network device) to request identity authentication of the terminal device.
  • the request message includes the identity of the terminal device and/or the identity of the hosted network that the terminal device requests to access.
  • the AMF can discover and select the AUSF according to the standards specified in 3GPP technical specification TS 23.501.
  • AUSF (first network device) can initiate Nudm_UEAuthentication_Get service operation, and AUSF sends Nudm_UEAuthentication_Get request to UDM. AUSF can discover and select UDM according to the standards specified in 3GPP technical specification TS 23.501.
  • UDM can decide to authenticate the terminal device entity based on the subscription information, or can decide to authenticate the terminal device entity based on the SUPI realm part in the Network Access Identifier (NAI) format.
  • NAI Network Access Identifier
  • the UDM shall provide the SUPI or anonymous SUPI to the AUSF (first network device) and shall instruct the AUSF to perform authentication using the second network device corresponding to the NPN.
  • AUSF can receive the response sent by the UDM, and UDM and AUSF do not terminate the process.
  • AUSF first network device
  • Nnssaaf_AIWF_Authenticate service operation can initiate Nnssaaf_AIWF_Authenticate request to NSSAAF according to the provisions in 3GPP technical specification TS 23.501.
  • the definition of NSSAAF can be referred to in 3GPP technical specification TS 23.501.
  • AUSF can receive the response sent by the UDM. UDM and AUSF do not terminate the process. AUSF can still initiate the Nnssaaf_AIWF_Authenticate service operation and send a Nnssaaf_AIWF_Authenticate request to NSSAAF.
  • the Nnssaaf_AIWF_Authenticate request includes the identifier of the terminal device (SUPI or anonymous SUPI).
  • the NSSAAF can select a second network device according to the domain name corresponding to the realm part of the SUPI.
  • the NSSAAF can perform relevant protocol conversion and relay the EAP message to the second network device.
  • the terminal device and the second network device can perform mutual authentication.
  • the second network device can act as a network device providing authentication services (e.g., as an EAP server) for identity authentication.
  • the EAP identity received by the second network device in the EAP response/identity message in step 7 may include an anonymous SUPI.
  • the second network device uses an EAP method-specific EAP identity request/response message to obtain the identity of the terminal device as part of the EAP authentication between the terminal device and the second network device.
  • the second network device can provide the MSK and SUPI (i.e., the identifier of the terminal device used for successful EAP authentication) to the NSSAAF.
  • MSK and SUPI i.e., the identifier of the terminal device used for successful EAP authentication
  • NSSAAF returns the MSK and SUPI to AUSF (first network device) using the Nnssaaf_AIWF_Authenticate response message.
  • the AUSF (first network device) notifies the UDM of the authentication result of the received SUPI by initiating a Nudm_ueIdentification_ResultConfirmation service operation, i.e. sending a Nudm_ueIdentification_ResultConfirmation request to the UDM, to verify whether the SUPI corresponds to a valid subscription in the NPN.
  • UDM stores the authentication status of SUPI.
  • UDM sends a Nudm_ueIdentification_ResultConfirmation response to AUSF (first network device). If there is no subscription corresponding to the SUPI, UDM shall return an error.
  • the UDM and AUSF do not terminate the process in step 3-5, and the AUSF can still initiate the Nnssaaf_AIWF_Authenticate service operation.
  • the AUSF may not notify the UDM of the authentication result of the received SUPI to verify whether the SUPI corresponds to a valid subscription in the NPN, that is, the above steps 11-13 may be omitted.
  • AUSF can use 256 bits or 128 bits of MSK as the first security key K AUSF .
  • AUSF can also derive the second security key K SEAF from the first security key K AUSF according to a key derivation function KDF.
  • the key derivation function is as described in the previous embodiments and will not be repeated here.
  • AUSF can send an indication of successful authentication of the terminal device (first response message) together with the SUPI of the terminal device and the second security key K SEAF calculated in step 14 to AMF/SEAF.
  • AMF/SEAF can send an indication of successful authentication to the terminal device in a non-access stratum (NAS) message (first response message).
  • NAS non-access stratum
  • the terminal device can determine the master session key MSK and use 256 bits or 128 bits of the MSK as the first security key K AUSF .
  • the terminal device can also derive the second security key K SEAF from the first security key K AUSF according to the same key derivation function KDF.
  • the key derivation function is as described in the previous embodiments and will not be repeated here.
  • the identity authentication method provided in the embodiment of the present application can provide a mutual authentication mechanism between a terminal device and an access network, so that the terminal device and the accessed network can be mutually authenticated, the terminal device can securely access the network and obtain the services provided by the network, effectively protecting the security of information interaction between the terminal device and the accessed network, and improving the security and privacy of the system.
  • Figure 11 is a flow chart of an identity authentication method provided in an embodiment of the present application. The method can be executed independently or in combination with any other embodiment of the present application. As shown in Figure 11, the method may include the following steps:
  • the terminal device can select an NPN and initiate terminal device registration in the NPN.
  • the registration message may include the identifier of the terminal device and/or the identifier of the managed network that the terminal device requests to access.
  • the managed network is built based on the NPN.
  • the AMF in the NPN shall send a Nausf_UEAuthentication_Authenticate request to the AUSF (first network device) to request identity authentication of the terminal device.
  • the request message includes the identity of the terminal device and/or the identity of the hosted network that the terminal device requests to access.
  • the AMF can discover and select the AUSF according to the standards specified in 3GPP technical specification TS 23.501.
  • the first indication information sent by the terminal device to the AUSF can be used by the AUSF to determine to omit sending a message to the UDM (that is, to omit steps 3-5 in the embodiment shown in Figure 10).
  • the AUSF may not send a message to the UDM, but directly send the second request message to the second network device through the NSSAAF in the NPN.
  • AUSF first network device
  • Nnssaaf_AIWF_Authenticate service operation may initiate Nnssaaf_AIWF_Authenticate service operation and send Nnssaaf_AIWF_Authenticate request to NSSAAF according to the provisions in 3GPP technical specification TS 23.501.
  • the definition of NSSAAF may refer to 3GPP technical specification TS 23.501.
  • the Nnssaaf_AIWF_Authenticate request includes the identifier of the terminal device (SUPI or anonymous SUPI).
  • the NSSAAF can select a second network device according to the domain name corresponding to the realm part of the SUPI.
  • the NSSAAF can perform relevant protocol conversion and relay the EAP message to the second network device.
  • the terminal device and the second network device can perform mutual authentication.
  • the second network device can act as a network device providing authentication services (e.g., as an EAP server) for identity authentication.
  • the EAP identity received by the second network device in the EAP response/identity message in step 7 may include an anonymous SUPI.
  • the second network device uses an EAP method-specific EAP identity request/response message to obtain the identity of the terminal device as part of the EAP authentication between the terminal device and the second network device.
  • the second network device can provide the MSK and SUPI (i.e., the identifier of the terminal device used for successful EAP authentication) to the NSSAAF.
  • MSK and SUPI i.e., the identifier of the terminal device used for successful EAP authentication
  • NSSAAF returns the MSK and SUPI to AUSF (first network device) using the Nnssaaf_AIWF_Authenticate response message.
  • the AUSF first network device may not notify the UDM of the authentication result regarding the received SUPI to verify whether the SUPI corresponds to a valid subscription in the NPN (that is, steps 11-13 in the embodiment shown in FIG. 10 are omitted).
  • AUSF can use 256 bits or 128 bits of MSK as the first security key K AUSF .
  • AUSF can also derive the second security key K SEAF from the first security key K AUSF according to a key derivation function KDF.
  • the key derivation function is as described in the previous embodiments and will not be repeated here.
  • AUSF can send an indication of successful authentication of the terminal device (first response message) together with the SUPI of the terminal device and the second security key K SEAF calculated in step 8 to AMF/SEAF.
  • AMF/SEAF can send an indication of successful authentication to the terminal device in a non-access stratum (NAS) message (first response message).
  • NAS non-access stratum
  • the terminal device can determine the master session key MSK and use 256 bits or 128 bits of the MSK as the first security key K AUSF .
  • the terminal device can also derive the second security key K SEAF from the first security key K AUSF according to the same key derivation function KDF.
  • the key derivation function is as described in the previous embodiments and will not be repeated here.
  • the identity authentication method provided in the embodiment of the present application can provide a mutual authentication mechanism between a terminal device and an access network, so that the terminal device and the accessed network can be mutually authenticated, the terminal device can securely access the network and obtain the services provided by the network, effectively protecting the security of information interaction between the terminal device and the accessed network, and improving the security and privacy of the system.
  • the present application also provides an identity authentication device. Since the identity authentication device provided in the embodiments of the present application corresponds to the methods provided in the above-mentioned embodiments, the implementation method of the identity authentication method is also applicable to the identity authentication device provided in the following embodiments and will not be described in detail in the following embodiments.
  • Figure 12 is a structural diagram of an identity authentication device provided in an embodiment of the present application.
  • the identity authentication device 1200 includes a transceiver unit 1210 , wherein:
  • the transceiver unit 1210 is used to send a first request message to a first network device in a non-public network NPN through an access network device, where the first request message is used by the first network device to determine a second request message, where the second request message is used to request a second network device corresponding to the NPN to authenticate the device;
  • the transceiver unit 1210 is further configured to receive a first response message sent by the first network device through the access network device, where the first response message is used to indicate whether the identity authentication of the device is successful.
  • the second network device is used to provide services for only one NPN corresponding to the second network device.
  • the first request message includes an identifier of the terminal device and/or an identifier of a hosted network that the terminal device requests to access; the hosted network is constructed based on the NPN.
  • the terminal device is accessing the NPN and the NPN does not include the subscription information of the terminal device.
  • the transceiver unit 1210 is also used to: send first indication information to the first network device, and the first indication information is used by the first network device to determine to omit sending messages to the unified data management function UDM in the NPN.
  • the first indication information is an identifier of the terminal device; or, the first indication information is used to indicate that the NPN does not include subscription information of the terminal device.
  • the first response message is used to indicate that the identity authentication of the terminal device is successful.
  • the device also includes a processing unit (not shown in the figure), which is used to: determine the master session key MSK; determine the first security key KAUSF based on the MSK; determine the second security key KSEAF based on the first security key KAUSF and the service network name, and the second security key KSEAF is used for the terminal device to access the NPN.
  • the first request message includes an identifier of the hosted network, and the service network name is the identifier of the hosted network.
  • the first request message does not include the identifier of the hosted network, and the service network name is the identifier of the NPN.
  • the second security key KSEAF is used by the terminal device to interact with the security anchor function SEAF in the NPN through the access network device, and the second security key KSEAF stored in the SEAF is sent to the SEAF by the first network device.
  • the service provided by the second network device to the NPN includes at least one of authentication, authorization and billing.
  • the first request message is sent by the terminal device to the first network device through the access network device and the access and mobility management function AMF in the NPN; the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN and the access network device.
  • the identity authentication device of this embodiment can send a first request message to a first network device in a non-public network NPN, where the first request message is used by the first network device to determine a second request message, where the second request message is used to request a second network device corresponding to the NPN to authenticate the terminal device, and receive a first response message sent by the first network device through the access network device, where the first response message is used to indicate whether the identity authentication of the terminal device is successful, so that the terminal device and the accessed network can authenticate each other, securely access the network, and obtain services provided by the network, thereby effectively protecting the security of information interaction between the terminal device and the accessed network and improving the security and privacy of the system.
  • Figure 13 is a structural diagram of an identity authentication device provided in an embodiment of the present application.
  • the identity authentication device 1300 includes: a transceiver unit 1310 and a processing unit 1320, wherein:
  • the transceiver unit 1310 is configured to receive a first request message sent by a terminal device through an access network device;
  • the processing unit 1320 is configured to send a second request message to a second network device corresponding to the non-public network NPN where the device is located according to the first request message, wherein the second request message is used to request the second network device to authenticate the terminal device;
  • the transceiver unit 1310 is further configured to receive a result of the identity authentication of the terminal device sent by the second network device;
  • the processing unit 1320 is further configured to send a first response message to the terminal device through the access network device according to the result of the identity authentication of the terminal device, wherein the first response message is used to indicate whether the identity authentication of the terminal device is successful.
  • the second network device is used to provide services for only one NPN corresponding to the second network device.
  • the first request message includes an identifier of the terminal device and/or an identifier of a hosted network that the terminal device requests to access; the hosted network is constructed based on the NPN.
  • the terminal device is accessing the NPN and the NPN does not include the subscription information of the terminal device
  • the transceiver unit 1310 is also used to: receive first indication information sent by the terminal device, the first indication information is used by the first network device to determine to omit sending messages to the unified data management function UDM in the NPN; send the second request message to the second network device through the network slice specific authentication and authorization function NSSAAF in the NPN.
  • the first indication information is an identifier of the terminal device; or, the first indication information is used to indicate that the NPN does not include subscription information of the terminal device.
  • the first indication information is an identifier of the terminal device, and the first indication information is used to instruct the first network device to omit sending a message to the UDM according to a local policy of the first network device.
  • the first indication information is used to indicate that the NPN does not include subscription information of the terminal device, and the first indication information is used to instruct the first network device to omit sending a message to the UDM according to the first indication information.
  • the terminal device is accessing the NPN and the NPN does not include the subscription information of the terminal device.
  • the transceiver unit 1310 is further used to: query the unified data management function UDM in the NPN for the subscription information of the terminal device, and no subscription information of the terminal device is found; and send the second request message to the second network device through the network slice-specific authentication and authorization function NSSAAF in the NPN.
  • the first response message is used to indicate that the identity authentication of the terminal device is successful
  • the processing unit 1320 is also used to: receive the master session key MSK sent by the second network device; determine the first security key KAUSF based on the MSK; determine the second security key KSEAF based on the first security key KAUSF and the service network name, and the second security key KSEAF is used for the terminal device to access the NPN.
  • the first request message includes an identifier of the hosted network, and the service network name is the identifier of the hosted network.
  • the first request message does not include the identifier of the hosted network, and the service network name is the identifier of the NPN.
  • the transceiver unit 1310 is further used to: send the second security key KSEAF to the security anchor function SEAF in the NPN, and the second security key KSEAF is used by the terminal device to interact with the security anchor function SEAF in the NPN through the access network device.
  • the service provided by the second network device to the NPN includes at least one of authentication, authorization and billing.
  • the first request message is sent by the terminal device to the first network device through the access network device and the access and mobility management function AMF in the NPN; the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN and the access network device.
  • the identity authentication device of this embodiment can receive a first request message sent by a terminal device through an access network device, and based on the first request message, send a second request message to a second network device corresponding to the NPN where the first network device is located, wherein the second request message is used to request the second network device to authenticate the terminal device, receive a result of the terminal device identity authentication sent by the second network device, and based on the result of the terminal device identity authentication, send a first response message to the terminal device through the access network device, wherein the first response message is used to indicate whether the terminal device identity authentication is successful, so that the terminal device and the accessed network can authenticate each other, securely access the network, and obtain services provided by the network, thereby effectively protecting the security of information interaction between the terminal device and the accessed network and improving the security and privacy of the system.
  • Figure 14 is a structural diagram of an identity authentication device provided in an embodiment of the present application.
  • the identity authentication device 1400 includes a transceiver unit 1410 , wherein:
  • the transceiver unit 1410 is used to receive a second request message sent by the first network device, where the second request message is determined by the first network device according to the first request message sent by the terminal device, and the second request message is used to request the device corresponding to the non-public network NPN where the first network device is located to authenticate the terminal device;
  • the transceiver unit 1410 is further configured to send a result of the terminal device identity authentication to the first network device, wherein the result of the terminal device identity authentication is used to determine a first response message, and the first response message is used to indicate whether the terminal device identity authentication is successful.
  • the second network device is used to provide services for only one NPN corresponding to the second network device.
  • the first request message includes an identifier of the terminal device and/or an identifier of a hosted network that the terminal device requests to access; the hosted network is constructed based on the NPN.
  • the transceiver unit 1410 is also used to: receive the second request message sent by the first network device through the network slice specific authentication and authorization function NSSAAF in the NPN.
  • the first response message is used to indicate that the identity authentication of the terminal device is successful, and the transceiver unit 1410 is also used to: send the master session key MSK to the first network device; the MSK is used by the first network device to determine the first security key KAUSF, and the first security key KAUSF and the service network name are used by the first network device to determine the second security key KSEAF.
  • the first request message includes an identifier of the hosted network, and the service network name is the identifier of the hosted network.
  • the first request message does not include the identifier of the hosted network, and the service network name is the identifier of the NPN.
  • the service provided by the second network device to the NPN includes at least one of authentication, authorization and billing.
  • the identity authentication device of this embodiment can receive a second request message sent by a first network device, where the second request message is determined by the first network device based on the first request message sent by the terminal device, and the second request message is used to request the second network device corresponding to the NPN where the first network device is located to authenticate the terminal device, and send the result of the terminal device identity authentication to the first network device, and the result of the terminal device identity authentication is used to determine a first response message, and the first response message is used to indicate whether the terminal device identity authentication is successful, so that the terminal device and the accessed network can authenticate each other, the terminal device can securely access the network, and obtain the services provided by the network, which effectively protects the security of information interaction between the terminal device and the accessed network and improves the security and privacy of the system.
  • Figure 15 is a schematic diagram of a communication system provided in an embodiment of the present application.
  • the communication system includes: a terminal device, a first network device and a second network device, wherein:
  • Terminal device used to execute the method shown in the embodiments of Figures 2 to 4
  • a first network device configured to execute the method shown in the embodiments of FIG. 5 to FIG. 7;
  • the second network device is used to execute the method shown in the embodiments of Figures 8 to 9.
  • the embodiments of the present application also propose a communication device, including: a processor and a memory, wherein a computer program is stored in the memory, and the processor executes the computer program stored in the memory so that the device executes the method shown in the embodiments of Figures 2 to 4.
  • the embodiments of the present application also propose a communication device, including: a processor and a memory, wherein a computer program is stored in the memory, and the processor executes the computer program stored in the memory so that the device executes the method shown in the embodiments of Figures 5 to 7, or executes the method shown in the embodiments of Figures 8 to 9.
  • the embodiments of the present application also propose a communication device, including: a processor and an interface circuit, the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to execute the methods shown in the embodiments of Figures 2 to 4.
  • the embodiments of the present application also propose a communication device, including: a processor and an interface circuit, the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to execute the method shown in the embodiments of Figures 5 to 7, or execute the method shown in the embodiments of Figures 8 to 9.
  • Identity authentication device 1600 can be a network device, or a terminal device, or a chip, chip system, or processor that supports the network device to implement the above method, or a chip, chip system, or processor that supports the terminal device to implement the above method.
  • the device can be used to implement the method described in the above method embodiment, and the details can be referred to the description in the above method embodiment.
  • the identity authentication device 1600 may include one or more processors 1601.
  • the processor 1601 may be a general-purpose processor or a dedicated processor, etc. For example, it may be a baseband processor or a central processing unit.
  • the baseband processor may be used to process the communication protocol and the communication data
  • the central processing unit may be used to control the identity authentication device (such as a base station, a baseband chip, a terminal device, a terminal device chip, a DU or a CU, etc.), execute a computer program, and process the data of the computer program.
  • the identity authentication device 1600 may further include one or more memories 1602, on which a computer program 1603 may be stored, and the processor 1601 executes the computer program 1603, so that the identity authentication device 1600 performs the method described in the above method embodiment.
  • the computer program 1603 may be solidified in the processor 1601, in which case the processor 1601 may be implemented by hardware.
  • data may also be stored in the memory 1602.
  • the identity verification device 1600 and the memory 1602 may be provided separately or integrated together.
  • the identity authentication device 1600 may further include a transceiver 1605 and an antenna 1606.
  • the transceiver 1605 may be referred to as a transceiver unit, a transceiver, or a transceiver circuit, etc., and is used to implement a transceiver function.
  • the transceiver 1605 may include a receiver and a transmitter, the receiver may be referred to as a receiver or a receiving circuit, etc., and is used to implement a receiving function; the transmitter may be referred to as a transmitter or a transmitting circuit, etc., and is used to implement a transmitting function.
  • the identity verification device 1600 may further include one or more interface circuits 1607.
  • the interface circuit 1607 is used to receive code instructions and transmit them to the processor 1601.
  • the processor 1601 executes the code instructions to enable the identity verification device 1600 to execute the method described in the above method embodiment.
  • the processor 1601 may include a transceiver for implementing the receiving and sending functions.
  • the transceiver may be a transceiver circuit, an interface, or an interface circuit.
  • the transceiver circuit, interface, or interface circuit for implementing the receiving and sending functions may be separate or integrated.
  • the above-mentioned transceiver circuit, interface, or interface circuit may be used for reading and writing code/data, or the above-mentioned transceiver circuit, interface, or interface circuit may be used for transmitting or delivering signals.
  • the identity verification device 1600 may include a circuit, and the circuit may implement the functions of sending or receiving or communicating in the aforementioned method embodiment.
  • the processor and transceiver described in the present application may be implemented in an integrated circuit (IC), an analog IC, a radio frequency integrated circuit RFIC, a mixed signal IC, an application specific integrated circuit (ASIC), a printed circuit board (PCB), an electronic device, etc.
  • the processor and transceiver may also be manufactured using various IC process technologies, such as complementary metal oxide semiconductor (CMOS), N-type metal oxide semiconductor (NMOS), P-type metal oxide semiconductor (positive channel metal oxide semiconductor, PMOS), bipolar junction transistor (BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.
  • CMOS complementary metal oxide semiconductor
  • NMOS N-type metal oxide semiconductor
  • PMOS P-type metal oxide semiconductor
  • BJT bipolar junction transistor
  • BiCMOS bipolar CMOS
  • SiGe silicon germanium
  • GaAs gallium arsenide
  • the identity authentication device described in the above embodiments may be a network device or a terminal device, but the scope of the identity authentication device described in this application is not limited thereto, and the structure of the identity authentication device may not be limited by Figures 12-14.
  • the identity authentication device may be an independent device or may be part of a larger device.
  • the identity authentication device may be:
  • the IC set may also include a storage component for storing data and computer programs;
  • ASIC such as modem
  • the identity authentication device can be a chip or a chip system
  • the chip shown in Figure 17 includes a processor 1701 and an interface 1702.
  • the number of processors 1701 can be one or more, and the number of interfaces 1702 can be multiple.
  • Interface 1702 used for code instructions and transmission to the processor
  • the processor 1701 is used to run code instructions to execute the method shown in Figures 5 to 7, or to execute the method shown in Figures 8 to 9.
  • Interface 1702 used for code instructions and transmission to the processor
  • the processor 1701 is used to run code instructions to execute the methods shown in FIG. 2 to FIG. 4 .
  • the chip further includes a memory 1703, and the memory 1703 is used to store necessary computer programs and data.
  • An embodiment of the present application also provides a communication system, which includes the identity authentication device as a terminal device in the embodiments of Figures 12 to 14 above, or the system includes the identity authentication device as a terminal device in the embodiment of Figure 16 above.
  • the present application also provides a readable storage medium having instructions stored thereon, which implement the functions of any of the above method embodiments when executed by a computer.
  • the present application also provides a computer program product, which implements the functions of any of the above method embodiments when executed by a computer.
  • the computer program product includes one or more computer programs.
  • the computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.
  • the computer program can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer program can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media integrated.
  • Available media can be magnetic media (e.g., floppy disks, hard disks, tapes), optical media (e.g., high-density digital video discs (DVD)), or semiconductor media (e.g., solid state disks (SSD)), etc.
  • magnetic media e.g., floppy disks, hard disks, tapes
  • optical media e.g., high-density digital video discs (DVD)
  • DVD digital video discs
  • semiconductor media e.g., solid state disks (SSD)
  • At least one in the present application can also be described as one or more, and a plurality can be two, three, four or more, which is not limited in the present application.
  • the technical features in the technical feature are distinguished by “first”, “second”, “third”, “A”, “B”, “C” and “D”, etc., and there is no order of precedence or size between the technical features described by the "first”, “second”, “third”, “A”, “B”, “C” and “D”.
  • the corresponding relationships shown in each table in the present application can be configured or predefined.
  • the values of the information in each table are only examples and can be configured as other values, which are not limited by the present application.
  • the corresponding relationships shown in some rows may not be configured.
  • appropriate deformation adjustments can be made based on the above table, such as splitting, merging, etc.
  • the names of the parameters shown in the titles of the above tables can also use other names that can be understood by the communication device, and the values or representations of the parameters can also be other values or representations that can be understood by the communication device.
  • other data structures can also be used, such as arrays, queues, containers, stacks, linear lists, pointers, linked lists, trees, graphs, structures, classes, heaps, hash tables or hash tables.
  • the predefined in the present application may be understood as defined, predefined, stored, pre-stored, pre-negotiated, pre-configured, solidified, or pre-burned.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请实施例公开了一种身份验证方法及装置，通过向NPN中的第一网络设备发送第一请求消息，该第一请求消息用于该第一网络设备确定第二请求消息，该第二请求消息用于请求与该NPN对应的第二网络设备对该终端设备进行身份验证，接收该第一网络设备通过该接入网设备发送的第一响应消息，该第一响应消息用于指示该终端设备身份验证是否成功，使得终端设备与访问的网络之间能够相互认证，安全地访问该网络，获取该网络提供的服务，有效保护了终端设备与访问网络之间的信息交互安全，提高系统的安全性、私密性。

Description

身份验证方法及装置 技术领域
本申请涉及通信技术领域，特别涉及一种身份验证方法及装置。
背景技术
在3GPP技术报告TR 23.700中研究了，“非公共网络(Non-Public Network，NPN)作为托管网络(hostingnetwork)以提供对本地化服务的访问”以及“终端发现、选择和访问作为托管网络的NPN并接收本地化服务”的关键问题。具体来说，也就是NPN可以充当托管网络来提供本地化服务。
然而，在相关技术中，终端设备和托管网络之间没有相互认证的机制，这导致该终端和该网络都有可能被冒充，进而导致信息泄露、恶意篡改等安全问题。
发明内容
本申请第一方面实施例提出了一种身份验证方法，所述方法由终端设备执行，所述方法包括：
通过接入网设备向非公共网络NPN中的第一网络设备发送第一请求消息，所述第一请求消息用于所述第一网络设备确定第二请求消息，所述第二请求消息用于请求与所述NPN对应的第二网络设备对所述终端设备进行身份验证；
接收所述第一网络设备通过所述接入网设备发送的第一响应消息，所述第一响应消息用于指示所述终端设备身份验证是否成功。
本申请第二方面实施例提出了一种身份验证方法，所述方法由第一核心网设备执行，所述方法包括：
接收终端设备通过接入网设备发送的第一请求消息；
根据所述第一请求消息，向与所述第一网络设备所在的非公共网络NPN对应的第二网络设备发送第二请求消息，所述第二请求消息用于请求所述第二网络设备对所述终端设备进行身份验证；
接收所述第二网络设备发送的所述终端设备身份验证的结果；
根据所述终端设备身份验证的结果，通过所述接入网设备向所述终端设备发送第一响应消息，所述第一响应消息用于指示所述终端设备身份验证是否成功。
本申请第三方面实施例提出了一种身份验证方法，所述方法由第二核心网设备执行，所述方法包括：
接收第一网络设备发送的第二请求消息，所述第二请求消息是所述第一网络设备根据终端设备发送的第一请求消息确定的，所述第二请求消息用于请求与所述第一网络设备所在的非公共网络NPN对应的所述第二网络设备对所述终端设备进行身份验证；
向所述第一网络设备发送所述终端设备身份验证的结果，所述终端设备身份验证的结果，用于确定第一响应消息，所述第一响应消息用于指示所述终端设备身份验证是否成功。
本申请第四方面实施例提出了一种身份验证装置，所述装置应用于终端设备，所述装置包括：
收发单元，用于通过接入网设备向非公共网络NPN中的第一网络设备发送第一请求消息，所述第一请求消息用于所述第一网络设备确定第二请求消息，所述第二请求消息用于请求与所述NPN对应的第二网络设备对所述装置进行身份验证；
所述收发单元，还用于接收所述第一网络设备通过所述接入网设备发送的第一响应消息，所述第一响应消息用于指示所述装置身份验证是否成功。
本申请第五方面实施例提出了一种身份验证装置，所述装置应用于第一核心网设备，所述装置包括：
收发单元，用于接收终端设备通过接入网设备发送的第一请求消息；
处理单元，用于根据所述第一请求消息，向与所述装置所在的非公共网络NPN对应的第二网络设备发送第二请求消息，所述第二请求消息用于请求所述第二网络设备对所述终端设备进行身份验证；
所述收发单元，还用于接收所述第二网络设备发送的所述终端设备身份验证的结果；
所述处理单元，还用于根据所述终端设备身份验证的结果，通过所述接入网设备向所述终端设备发送第一响应消息，所述第一响应消息用于指示所述终端设备身份验证是否成功。
本申请第六方面实施例提出了一种身份验证装置，所述装置应用于第二核心网设备，所述装置包括：
收发单元，用于接收第一网络设备发送的第二请求消息，所述第二请求消息是所述第一网络设备根据终端设备发送的第一请求消息确定的，所述第二请求消息用于请求与所述第一网络设备所在的非公共网络NPN对应的所述装置对所述终端设备进行身份验证；
所述收发单元，还用于向所述第一网络设备发送所述终端设备身份验证的结果，所述终端设备身份验证的结果，用于确定第一响应消息，所述第一响应消息用于指示所述终端设备身份验证是否成功。
本申请第七方面实施例提出了一种通信装置，所述装置包括处理器和存储器，所述存储器中存储有计算机程序，所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行上述第一方面实施例所述的身份验证方法。
本申请第八方面实施例提出了一种通信装置，所述装置包括处理器和存储器，所述存储器中存储有计算机程序，所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行上述第二方面实施例所述的身份验证方法，或者执行上述第三方面实施例所述的身份验证方法。
本申请第九方面实施例提出了一种通信装置，该装置包括处理器和接口电路，该接口电路用于接收代码指令并传输至该处理器，该处理器用于运行所述代码指令以使该装置执行上述第一方面实施例所述的身份验证方法。
本申请第十方面实施例提出了一种通信装置，该装置包括处理器和接口电路，该接口电路用于接收代码指令并传输至该处理器，该处理器用于运行所述代码指令以使该装置执行上述第二方面实施例所述的身份验证方法，或者执行上述第三方面实施例所述的身份验证方法。
本申请第十一方面实施例提出了一种计算机可读存储介质，用于存储有指令，当所述指令被执行时，使上述第一方面实施例所述的身份验证方法被实现。
本申请第十二方面实施例提出了一种计算机可读存储介质，用于存储有指令，当所述指令被执行时，使上述第二方面实施例所述的身份验证方法被实现，或者使上述第三方面实施例所述的身份验证方法被实现。
本申请第十三方面实施例提出了一种计算机程序，当其在计算机上运行时，使得计算机执行第一方面实施例所述的身份验证方法。
本申请第十四方面实施例提出了一种计算机程序，当其在计算机上运行时，使得计算机执行第二方面实施例所述的身份验证方法，或者执行上述第三方面实施例所述的身份验证方法。
本申请实施例提供的一种身份验证方法及装置，通过向非公共网络NPN中的第一网络设备发送第一请求消息，该第一请求消息用于该第一网络设备确定第二请求消息，该第二请求消息用于请求与该NPN对应的第二网络设备对该终端设备进行身份验证，接收该第一网络设备通过该接入网设备发送的第一响应消息，该第一响应消息用于指示该终端设备身份验证是否成功，使得终端设备与访问的网络之间能够相互认证，终端设备能够安全地访问该网络，获取该网络提供的服务，有效保护了终端设备与访问网络之间的信息交互安全，提高系统的安全性、私密性。
本申请附加的方面和优点将在下面的描述中部分给出，部分将从下面的描述中变得明显，或通过本申请的实践了解到。
附图说明
为了更清楚地说明本申请实施例或背景技术中的技术方案，下面将对本申请实施例或背景技术中所需要使用的附图进行说明。
图1为本申请实施例提供的一种通信系统的架构示意图；
图2是本申请实施例提供的一种身份验证方法的流程示意图；
图3是本申请实施例提供的一种身份验证方法的流程示意图；
图4是本申请实施例提供的一种身份验证方法的流程示意图；
图5是本申请实施例提供的一种身份验证方法的流程示意图；
图6是本申请实施例提供的一种身份验证方法的流程示意图；
图7是本申请实施例提供的一种身份验证方法的流程示意图；
图8是本申请实施例提供的一种身份验证方法的流程示意图；
图9是本申请实施例提供的一种身份验证方法的流程示意图；
图10是本申请实施例提供的一种身份验证方法的流程示意图；
图11是本申请实施例提供的一种身份验证方法的流程示意图；
图12是本申请实施例提供的一种身份验证装置的结构示意图；
图13是本申请实施例提供的一种身份验证装置的结构示意图；
图14是本申请实施例提供的一种身份验证装置的结构示意图；
图15为本申请实施例提供的一种通信系统示意图；
图16是本申请实施例提供的另一种身份验证装置的结构示意图；
图17是本申请实施例提供的一种芯片的结构示意图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本申请实施例相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本申请实施例的一些方面相一致的装置和方法的例子。
在本申请实施例使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本申请实施例。在本申请实施例和所附权利要求书中所使用的单数形式的“一种”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本申请实施例可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本申请实施例范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”及“若”可以被解释成为“在……时”或“当……时”或“响应于确定”。
下面详细描述本申请的实施例，所述实施例的示例在附图中示出，其中自始至终相同或类似的标号表示相同或类似的要素。下面通过参考附图描述的实施例是示例性的，旨在用于解释本申请，而不能理解为对本申请的限制。
为了更好的理解本申请实施例公开的一种身份验证方法，下面首先对本申请实施例适用的通信系统进行描述。
请参见图1，图1为本申请实施例提供的一种通信系统的架构示意图。该通信系统可包括但不限 于一个终端设备和一个核心网设备，图1所示的设备数量和形态仅用于举例并不构成对本申请实施例的限定，实际应用中可以包括两个或两个以上的网络设备和两个或两个以上的终端设备。图1所示的通信系统以包括一个终端设备101，一个第一网络设备102和一个第二网络设备103为例。
需要说明的是，本申请实施例的技术方案可以应用于各种通信系统。例如：长期演进(Long Term Evolution，LTE)系统、第五代移动通信系统、5G新空口系统，或者其他未来的新型移动通信系统等。
本申请实施例中的终端设备101是用户侧的一种用于接收或发射信号的实体，如手机。终端设备也可以称为终端设备(terminal)、用户设备(user equipment，UE)、移动台(Mobile Station，MS)、移动终端设备(Mobile Terminal，MT)等。终端设备可以是具备通信功能的汽车、智能汽车、手机(Mobile Phone)、穿戴式设备、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(Virtual Reality，VR)终端设备、增强现实(Augmented Reality，AR)终端设备、工业控制(Industrial Control)中的无线终端设备、无人驾驶(Self-Driving)中的无线终端设备、远程手术(Remote Medical Surgery)中的无线终端设备、智能电网(Smart Grid)中的无线终端设备、运输安全(Transportation Safety)中的无线终端设备、智慧城市(Smart City)中的无线终端设备、智慧家庭(Smart Home)中的无线终端设备等等。本申请的实施例对终端设备所采用的具体技术和具体设备形态不做限定。
在本申请实施例中，第一网络设备102是非公共网络NPN中的核心网设备。其中，第一网络设备102可以为鉴权服务功能(Authentication Server Function，AUSF)。可以理解的是，非公共网络NPN中中还可以有其他核心网设备，比如接入和移动性管理功能(Access and Mobility Management Function，AMF)，安全锚点功能(Security Anchor Fuction，SEAF)，统一数据管理(Unified Data Management，UDM)，网络切片特定的认证和授权功能(Network Slice-Specific Authentication and Authorization Function，NSSAAF)等等。
在本申请实施例中，第二网络设备103是网络侧的一种实体，能够为第一网络设备所在的非公共网络NPN提供服务。比如，该第二网络设备可以一个服务器，能够为该NPN提供认证服务等等。举例而言，该第二网络设备可以为认证授权计费(Authentication、Authorization、Accounting，AAA)服务器等等。
在本申请各实施例中，该非公共网络NPN可以为独立的非公共网络(Stand-aloneNon-Public Network，SNPN)。
在3GPP技术报告TR 23.700中研究了，“非公共网络(Non-Public Network，NPN)作为托管网络(hostingnetwork)以提供对本地化服务的访问”以及“终端发现、选择和访问作为托管网络的NPN并接收本地化服务”的关键问题。具体来说，也就是NPN可以充当托管网络来提供本地化服务。
然而，在相关技术中，终端设备和托管网络之间没有相互认证的机制，这导致该终端和该网络都有可能被冒充。如果终端设备未向网络认证，则该终端设备可能是冒充的；如果网络未向终端设备认证，则该网络也可能是冒充的。未相互认证的终端设备和托管网络之间的信息交互，可能导致信息泄露、恶意篡改等安全问题。
可以理解的是，在本申请各实施例中，终端设备和各核心网设备之间的信息交互是通过接入网设备的透传完成的。
可以理解的是，本申请实施例描述的通信系统是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着系统架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
下面结合附图对本申请所提供的身份验证方法及其装置进行详细地介绍。
请参见图2，图2是本申请实施例提供的一种身份验证方法的流程示意图。需要说明的是，本申请实施例的身份验证方法由终端设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实 施例一起被执行。如图2所示，该方法可以包括如下步骤：
步骤201，通过接入网设备向NPN中的第一网络设备发送第一请求消息，该第一请求消息用于该第一网络设备确定第二请求消息，该第二请求消息用于请求与该NPN对应的第二网络设备对该终端设备进行身份验证。
在本申请实施例中，终端设备可以通过接入网设备，向NPN中的第一网络设备发送第一请求消息，第一网络设备在接收到该第一请求消息后，能够根据该第一请求消息确定第二请求消息，该第二请求消息用于请求与该NPN对应的第二网络设备对该终端设备进行身份验证。
在本申请实施例中，该第一网络设备可以为鉴权服务功能AUSF。
在本申请实施例中，对该终端设备进行身份验证的第二网络设备是与该第一网络设备所在的NPN对应的，一个第二网络设备仅为一个NPN提供服务，也就是该第二网络设备仅为该第一网络设备所在的NPN提供服务，而不为其他网络提供服务。
可选地，该第二网络设备为该NPN提供的服务包括认证、授权和计费中的至少一种。
可选地，该第二网络设备可以为AAA服务器。
在本申请实施例中，该第一请求消息可以包括该终端设备的标识和/或该终端设备请求访问的托管网络的标识，其中，该托管网络是基于该NPN构建的。
也就是，作为一种可能的实现，该第一请求消息中包括该终端设备的标识和该终端设备请求访问的托管网络的标识。
作为另一种可能的实现，该第一请求消息中包括该终端设备的标识。
可选地，该终端设备的标识可以为以下至少一种：用户永久标识符(Subscription Permanent Identifier，SUPI)，用户隐藏标识符(Subscription Concealed Identifier，SUCI)，匿名SUPI(anonymous SUPI)，匿名SUCI(anonymous SUCI)，在线签约SUCI(onboardingSUCI)，在线签约SUPI(onboardingSUPI)。
可以理解，在本申请实施例中，网络侧能够基于该NPN构建多个托管网络以提供对本地化服务的访问，构建的每个托管网络有自己的托管网络标识。
在一些实施方式中，该终端设备可能正在访问该NPN且该NPN中没有该终端设备的订阅数据，或者该终端设备是仅在该NPN在线签约(onboarding)以获取身份验证的凭证而不需要该NPN提供服务(该NPN中也就没有该终端设备的订阅信息)，该终端设备还能够向第一网络设备发送第一指示信息，该第一指示信息用于该第一网络设备确定省略向统一数据管理功能UDM发送消息。
需要说明的是，如果该NPN中包括该终端设备的订阅数据，第一网络设备向该UDM发送消息以请求UDM基于该终端设备的订阅数据决定与该终端设备执行身份验证。第一网络设备能够接收UDM发送的响应消息来确定与该终端设备执行身份验证，并通过NPN中的网络切片特定的认证和授权功能(Network Slice-Specific Authentication and Authorization Function，NSSAAF)，向第二网络设备发送该第二请求消息。
可选地，该第一网络设备启动Nudm_UEAuthentication_Get服务操作，第一网络设备向UDM发送Nudm_UEAuthentication_Get请求消息，该UDM向第一网络设备发送Nudm_UEAuthentication_Get响应消息。
如果该NPN中没有该终端设备的订阅数据，该终端设备向该第一网络设备发送的第一指示信息可以用于该第一网络设备确定省略向UDM发送消息。第一网络设备接收到该第一指示信息之后，可以不向UDM发送消息，而是直接通过NPN中的NSSAAF，向第二网络设备发送该第二请求消息。
可选地，该第一指示信息可以为该终端设备的标识，或者，该第一指示信息为用于指示该NPN中不包括该终端设备的订阅数据的指示信息。
其中，该终端设备的标识可以为以下至少一种：SUPI，SUCI，匿名SUPI，匿名SUCI，在线签约 SUCI，在线签约SUPI。
作为一种可能的实现，该第一指示信息为该终端设备的标识，第一网络设备接收到该第一指示信息之后，能够根据该第一网络设备的本地策略，确定省略向UDM发送消息。
可选地，该本地策略可以为基于该终端设备的标识中的区域(realm)部分决定忽略与UDM进行交互，而直接选择一个NSSAAF，并通过该NSSAAF向第二网络设备发送该第二请求消息。
可选地，该本地策略可以为基于该终端设备的标识决定，忽略向UDM查询该终端设备的标识是否有对应的订阅信息(subscriptioninformation)。
作为另一种可能的实现，该第一指示信息用于指示该NPN中不包括该终端设备的订阅数据，第一网络设备能够根据接收到的该第一指示信息，确定省略向UDM发送消息。
类似地，可选地，该第一网络设备可以根据该第一指示信息确定忽略与UDM进行交互，而直接选择一个NSSAAF，并通过该NSSAAF向第二网络设备发送该第二请求消息。
可选地，该第一网络设备可以根据该第一指示信息确定，忽略向UDM查询该终端设备的标识是否有对应的订阅信息(subscriptioninformation)。
在一些实施方式中，该NPN中可能不包括该终端设备的订阅数据，第一网络设备也可以不省略向UDM发送消息。第一网络设备依然可以向UDM发送消息，发起Nudm_UEAuthentication_Get服务操作，并接收到未查询到该终端设备的订阅信息的响应，该第一网络设备不拒绝该终端设备的第一请求，依然通过NPN中的NSSAAF，向第二网络设备发送该第二请求消息。
在本申请实施例中，该第二请求消息中包括该终端设备的SUPI或者匿名SUPI。
另外需要说明的是，在本申请实施例中，该第一请求消息是该终端设备通过该NPN中的接入和移动性管理功能AMF向该第一网络设备发送的。
在本申请实施例中，该终端设备能够和该第二网络设备执行相互认证，该相互认证方法可以是基于可扩展的身份验证协议(Extensible Authentication Protocol，EAP)的认证。终端设备与第二网络设备之间的相互认证还可以采用其他身份认证方法，本申请各实施例对该终端设备与第二网络设备之间的相互认证的方法不进行具体限定。
步骤202，接收该第一网络设备通过该接入网设备发送的第一响应消息，该第一响应消息用于指示该终端设备身份验证是否成功。
在本申请实施例中，终端设备能够接收第一网络设备通过接入网设备发送的第一响应消息，该第一响应消息能够指示该终端设备的身份验证是否成功。第一网络设备能够根据接收到的第二网络设备发送的身份认证结果，向该终端设备发送该第一响应消息。
需要说明的是，在本申请实施例中，该第一响应消息是该第一网络设备通过该NPN中的接入和移动性管理功能AMF向该终端设备发送的。
在一些实施方式中，该第一响应消息指示该终端设备身份验证成功，该终端设备能够确定主会话密钥(Master Session Key，MSK)，并能够根据该MSK确定第一安全密钥K AUSF。终端设备能够基于一个密钥导出函数(key derivation function，KDF)，根据该第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，该第二安全密钥K SEAF用于该终端设备访问该NPN，与该NPN中的安全锚点功能SEAF进行信息交互。
其中，需要说明的是，该MSK是由认证成功的该终端设备和该第二网络设备协商确定的，也就是终端设备和第二网络设备能够确定相同的MSK。
另外需要说明的是，根据该MSK确定该第一安全密钥K AUSF可以是，将该MSK的128位或者256位作为该第一安全密钥K AUSF。
可选地，如果该第一请求消息中包括托管网络标识，则该服务网络名称为该托管网络标识。如果该第一请求消息中不包括托管网络标识，则该服务网络名称为该NPN的标识。
可选地，该SEAF中存储的第二安全密钥K SEAF是由该第一网络设备发送给该SEAF的。
可以理解，如果该第一响应消息指示该终端设备的身份验证失败，则该终端设备被拒绝访问该NPN，无法获取该第二网络设备提供的身份认证成功的凭证。
综上，通过向非公共网络NPN中的第一网络设备发送第一请求消息，该第一请求消息用于该第一网络设备确定第二请求消息，该第二请求消息用于请求与该NPN对应的第二网络设备对该终端设备进行身份验证，接收该第一网络设备通过该接入网设备发送的第一响应消息，该第一响应消息用于指示该终端设备身份验证是否成功，使得终端设备与访问的网络之间能够相互认证，终端设备能够安全地访问该网络，获取该网络提供的服务，有效保护了终端设备与访问网络之间的信息交互安全，提高系统的安全性、私密性。
请参见图3，图3是本申请实施例提供的一种身份验证方法的流程示意图。需要说明的是，本申请实施例的身份验证方法由终端设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图3所示，该方法可以包括如下步骤：
步骤301，通过接入网设备向NPN中的第一网络设备发送第一请求消息，该第一请求消息用于该第一网络设备确定第二请求消息，该第二请求消息用于请求与该NPN对应的第二网络设备对该终端设备进行身份验证。
在本申请实施例中，终端设备可以通过接入网设备，向NPN中的第一网络设备发送第一请求消息，第一网络设备在接收到该第一请求消息后，能够根据该第一请求消息确定第二请求消息，该第二请求消息用于请求与该NPN对应的第二网络设备对该终端设备进行身份验证。
在本申请实施例中，该第一网络设备可以为鉴权服务功能AUSF。
在本申请实施例中，对该终端设备进行身份验证的第二网络设备是与该第一网络设备所在的NPN对应的，一个第二网络设备仅为一个NPN提供服务，也就是该第二网络设备仅为该第一网络设备所在的NPN提供服务，而不为其他网络提供服务。
可选地，该第二网络设备为该NPN提供的服务包括认证、授权和计费中的至少一种。
可选地，该第二网络设备可以为AAA服务器。
在本申请实施例中，该第一请求消息可以包括该终端设备的标识和/或该终端设备请求访问的托管网络的标识，其中，该托管网络是基于该NPN构建的。
也就是，作为一种可能的实现，该第一请求消息中包括该终端设备的标识和该终端设备请求访问的托管网络的标识。
作为另一种可能的实现，该第一请求消息中包括该终端设备的标识。
可选地，该终端设备的标识可以为以下至少一种：SUPI，SUCI，匿名SUPI，匿名SUCI，在线签约SUCI，在线签约SUPI。
可以理解，在本申请实施例中，网络侧能够基于该NPN构建多个托管网络以提供对本地化服务的访问，构建的每个托管网络有自己的托管网络标识。
另外需要说明的是，在本申请实施例中，该第一请求消息是该终端设备通过该NPN中的接入和移动性管理功能AMF向该第一网络设备发送的。
在一些实施方式中，该NPN中包括该终端设备的订阅数据，第一网络设备向该UDM发送消息以请求UDM基于该终端设备的订阅数据决定与该终端设备执行身份验证。第一网络设备能够接收UDM发送的响应消息来确定与该终端设备执行身份验证，并通过NPN中的NSSAAF，向第二网络设备发送该第二请求消息。
可选地，该第一网络设备启动Nudm_UEAuthentication_Get服务操作，第一网络设备向UDM发送Nudm_UEAuthentication_Get请求消息，该UDM向第一网络设备发送Nudm_UEAuthentication_Get响 应消息。
在本申请实施例中，该第二请求消息中包括该终端设备的SUPI或者匿名SUPI。
在一些实施方式中，该NPN中可能不包括该终端设备的订阅数据(比如该终端设备可能正在访问该NPN且该NPN中没有该终端设备的订阅数据，或者该终端设备是仅进行在线签约(onboarding)该NPN以获取身份验证的凭证而不需要该NPN提供服务等等)，第一网络设备也可以不省略向UDM发送消息。第一网络设备依然可以向UDM发送消息，发起Nudm_UEAuthentication_Get服务操作，并接收到未查询到该终端设备的订阅信息的响应，该第一网络设备不拒绝该终端设备的第一请求，依然通过NPN中的NSSAAF，向第二网络设备发送该第二请求消息。
在本申请实施例中，该终端设备能够和该第二网络设备执行相互认证，该相互认证方法可以是基于EAP的认证。终端设备与第二网络设备之间的相互认证还可以采用其他身份认证方法，本申请各实施例对该终端设备与第二网络设备之间的相互认证的方法不进行具体限定。
步骤302，接收该第一网络设备通过该接入网设备发送的第一响应消息，该第一响应消息用于指示该终端设备身份验证成功。
在本申请实施例中，终端设备能够接收第一网络设备通过接入网设备发送的第一响应消息，该第一响应消息能够指示该终端设备的身份验证成功。第一网络设备能够根据接收到的第二网络设备发送的身份认证结果，向该终端设备发送该第一响应消息。
需要说明的是，在本申请实施例中，该第一响应消息是该第一网络设备通过该NPN中的接入和移动性管理功能AMF向该终端设备发送的。
步骤303，确定主会话密钥MSK。
在本申请实施例中，该第一响应消息指示该终端设备身份验证成功，该终端设备能够确定主会话密钥MSK，并能够根据该MSK确定第一安全密钥K AUSF。
其中，需要说明的是，该MSK是由认证成功的该终端设备和该第二网络设备协商确定的，也就是终端设备和第二网络设备能够确定相同的MSK。
步骤304，根据该MSK，确定第一安全密钥K AUSF。
在本申请实施例中，终端设备能够根据该MSK确定第一安全密钥K AUSF。
可选地，根据该MSK确定该第一安全密钥K AUSF可以是，将该MSK中的128位或者256位作为该第一安全密钥K AUSF。
步骤305，根据该第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，该第二安全密钥K SEAF用于该终端设备访问该NPN。
在本申请实施例中，终端设备能够基于一个密钥导出函数KDF，根据该第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，该第二安全密钥K SEAF用于该终端设备访问该NPN。
可选地，如果该第一请求消息中包括托管网络标识，则该服务网络名称为该托管网络标识。如果该第一请求消息中不包括托管网络标识，则该服务网络名称为该NPN的标识。
作为一种示例，该密钥导出函数KDF的输入参数KEY为该第一安全密钥K AUSF。该密钥导出函数KDF的输入参数S可以包括：
该密钥导出函数的编码号FC为0x6C；
参数P0为服务网络名称；
参数L0为参数P0中包括的数据的长度，也就是该服务网络名称的数据的长度。
可选地，该第二安全密钥K SEAF能够用于该终端设备与该NPN中的安全锚点功能SEAF进行信息交互，该SEAF中存储的第二安全密钥K SEAF是由该第一网络设备发送给该SEAF的。
综上，通过向NPN中的第一网络设备发送第一请求消息，该第一请求消息用于该第一网络设备确定第二请求消息，该第二请求消息用于请求与该NPN对应的第二网络设备对该终端设备进行身份验证， 接收该第一网络设备通过该接入网设备发送的第一响应消息，该第一响应消息用于指示该终端设备身份验证成功，确定主会话密钥MSK，根据该第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，该第二安全密钥K SEAF用于该终端设备访问该NPN，使得终端设备与访问的网络之间能够相互认证，终端设备能够安全地访问该网络，获取该网络提供的服务，有效保护了终端设备与访问网络之间的信息交互安全，提高系统的安全性、私密性。
请参见图4，图4是本申请实施例提供的一种身份验证方法的流程示意图。需要说明的是，本申请实施例的身份验证方法由终端设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图4所示，该方法可以包括如下步骤：
步骤401，通过接入网设备向NPN中的第一网络设备发送第一请求消息，该第一请求消息用于该第一网络设备确定第二请求消息，该第二请求消息用于请求与该NPN对应的第二网络设备对该终端设备进行身份验证。
在本申请实施例中，终端设备可以通过接入网设备，向NPN中的第一网络设备发送第一请求消息，第一网络设备在接收到该第一请求消息后，能够根据该第一请求消息确定第二请求消息，该第二请求消息用于请求与该NPN对应的第二网络设备对该终端设备进行身份验证。
在本申请实施例中，该第一网络设备可以为鉴权服务功能AUSF。
在本申请实施例中，对该终端设备进行身份验证的第二网络设备是与该第一网络设备所在的NPN对应的，一个第二网络设备仅为一个NPN提供服务，也就是该第二网络设备仅为该第一网络设备所在的NPN提供服务，而不为其他网络提供服务。
可选地，该第二网络设备为该NPN提供的服务包括认证、授权和计费中的至少一种。
可选地，该第二网络设备可以为AAA服务器。
在本申请实施例中，该第一请求消息可以包括该终端设备的标识和/或该终端设备请求访问的托管网络的标识，其中，该托管网络是基于该NPN构建的。
也就是，作为一种可能的实现，该第一请求消息中包括该终端设备的标识和该终端设备请求访问的托管网络的标识。
作为另一种可能的实现，该第一请求消息中包括该终端设备的标识。
可选地，该终端设备的标识可以为以下至少一种：SUPI，SUCI，匿名SUPI，匿名SUCI，在线签约SUCI，在线签约SUPI。
可以理解，在本申请实施例中，网络侧能够基于该NPN构建多个托管网络以提供对本地化服务的访问，构建的每个托管网络有自己的托管网络标识。
另外需要说明的是，在本申请实施例中，该第一请求消息是该终端设备通过该NPN中的接入和移动性管理功能AMF向该第一网络设备发送的。
步骤402，向该第一网络设备发送第一指示信息，该第一指示信息用于该第一网络设备确定省略向该NPN中的UDM发送消息。
在本申请实施例中，该终端设备可能正在访问该NPN且该NPN中没有该终端设备的订阅数据，或者该终端设备是在该NPN在线签约(onboarding)以获取身份验证的凭证而不需要该NPN提供服务(该NPN中也就没有该终端设备的订阅信息)，该终端设备还能够向第一网络设备发送第一指示信息，该第一指示信息用于该第一网络设备确定省略向统一数据管理功能UDM发送消息。
需要说明的是，如前所述，如果该NPN中包括该终端设备的订阅数据，第一网络设备向该UDM发送消息以请求UDM基于该终端设备的订阅数据决定与该终端设备执行身份验证。第一网络设备能够接收UDM发送的响应消息来确定与该终端设备执行身份验证，并通过NPN中的NSSAAF，向第二网络设备发送该第二请求消息。
在本申请实施例中，该NPN中没有该终端设备的订阅数据，该终端设备向该第一网络设备发送的第一指示信息可以用于该第一网络设备确定省略向UDM发送消息。第一网络设备接收到该第一指示信息之后，可以不向UDM发送消息，而是直接通过NPN中的NSSAAF，向第二网络设备发送该第二请求消息。
可选地，该第一指示信息可以为该终端设备的标识，或者，该第一指示信息为用于指示该NPN中不包括该终端设备的订阅数据的指示信息。
其中，该终端设备的标识可以为以下至少一种：SUPI，SUCI，匿名SUPI，匿名SUCI，在线签约SUCI，在线签约SUPI。
作为一种可能的实现，该第一指示信息为该终端设备的标识，第一网络设备接收到该第一指示信息之后，能够根据该第一网络设备的本地策略，确定省略向UDM发送消息。
可选地，该本地策略可以为基于该终端设备的标识中的区域(realm)部分决定忽略与UDM进行交互，而直接选择一个NSSAAF，并通过该NSSAAF向第二网络设备发送该第二请求消息。
可选地，该本地策略可以为基于该终端设备的标识决定，忽略向UDM查询该终端设备的标识是否有对应的订阅信息(subscriptioninformation)。作为另一种可能的实现，该第一指示信息用于指示该NPN中不包括该终端设备的订阅数据，第一网络设备能够根据接收到的该第一指示信息，确定省略向UDM发送消息。
类似地，可选地，该第一网络设备可以根据该第一指示信息确定忽略与UDM进行交互，而直接选择一个NSSAAF，并通过该NSSAAF向第二网络设备发送该第二请求消息。
可选地，该第一网络设备可以根据该第一指示信息确定，忽略向UDM查询该终端设备的标识是否有对应的订阅信息(subscriptioninformation)。
在本申请实施例中，该第二请求消息中包括该终端设备的SUPI或者匿名SUPI。
在本申请实施例中，该终端设备能够和该第二网络设备执行相互认证，该相互认证方法可以是基于EAP的认证。终端设备与第二网络设备之间的相互认证还可以采用其他身份认证方法，本申请各实施例对该终端设备与第二网络设备之间的相互认证的方法不进行具体限定。
步骤403，接收该第一网络设备通过该接入网设备发送的第一响应消息，该第一响应消息用于指示该终端设备身份验证成功。
在本申请实施例中，终端设备能够接收第一网络设备通过接入网设备发送的第一响应消息，该第一响应消息能够指示该终端设备的身份验证成功。第一网络设备能够根据接收到的第二网络设备发送的身份认证结果，向该终端设备发送该第一响应消息。
需要说明的是，在本申请实施例中，该第一响应消息是该第一网络设备通过该NPN中的接入和移动性管理功能AMF向该终端设备发送的。
步骤404，确定主会话密钥MSK。
在本申请实施例中，该第一响应消息指示该终端设备身份验证成功，该终端设备能够确定主会话密钥MSK，并能够根据该MSK确定第一安全密钥K AUSF。
其中，需要说明的是，该MSK是由认证成功的该终端设备和该第二网络设备协商确定的，也就是终端设备和第二网络设备能够确定相同的MSK。
步骤405，根据该MSK，确定第一安全密钥K AUSF。
在本申请实施例中，终端设备能够根据该MSK确定第一安全密钥K AUSF。
可选地，根据该MSK确定该第一安全密钥K AUSF可以是，将该MSK的128位或者256位作为该第一安全密钥K AUSF。
步骤406，根据该第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，该第二安全密钥K SEAF用于该终端设备访问该NPN。
在本申请实施例中，终端设备能够基于一个密钥导出函数KDF，根据该第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，该第二安全密钥K SEAF用于该终端设备访问该NPN。
可选地，如果该第一请求消息中包括托管网络标识，则该服务网络名称为该托管网络标识。如果该第一请求消息中不包括托管网络标识，则该服务网络名称为该NPN的标识。
作为一种示例，该密钥导出函数KDF的输入参数KEY为该第一安全密钥K AUSF。该密钥导出函数KDF的输入参数S可以包括：
该密钥导出函数的编码号FC为0x6C；
参数P0为服务网络名称；
参数L0为参数P0中包括的数据的长度，也就是该服务网络名称的数据的长度。
可选地，该第二安全密钥K SEAF能够用于该终端设备与该NPN中的安全锚点功能SEAF进行信息交互，该SEAF中存储的第二安全密钥K SEAF是由该第一网络设备发送给该SEAF的。
综上，通过向NPN中的第一网络设备发送第一请求消息，该第一请求消息用于该第一网络设备确定第二请求消息，该第二请求消息用于请求与该NPN对应的第二网络设备对该终端设备进行身份验证，向该第一网络设备发送第一指示信息，该第一指示信息用于该第一网络设备确定省略向该NPN中的UDM发送消息，接收该第一网络设备通过该接入网设备发送的第一响应消息，该第一响应消息用于指示该终端设备身份验证成功，确定主会话密钥MSK，根据该第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，该第二安全密钥K SEAF用于该终端设备访问该NPN，使得终端设备与访问的网络之间能够相互认证，终端设备能够安全地访问该网络，获取该网络提供的服务，有效保护了终端设备与访问网络之间的信息交互安全，提高系统的安全性、私密性。
请参见图5，图5是本申请实施例提供的一种身份验证方法的流程示意图。需要说明的是，本申请实施例的身份验证方法由第一网络设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图5所示，该方法可以包括如下步骤：
步骤501，接收终端设备通过接入网设备发送的第一请求消息。
在本申请实施例中，第一网络设备可以接收终端设备通过接入网设备发送的第一请求消息，第一网络设备在接收到该第一请求消息后，能够根据该第一请求消息确定第二请求消息，该第二请求消息用于请求与该第一网络设备所在的NPN对应的第二网络设备对该终端设备进行身份验证。
在本申请实施例中，该第一网络设备可以为鉴权服务功能AUSF。
在本申请实施例中，对该终端设备进行身份验证的第二网络设备是与该第一网络设备所在的NPN对应的，一个第二网络设备仅为一个NPN提供服务，也就是该第二网络设备仅为该第一网络设备所在的NPN提供服务，而不为其他网络提供服务。
可选地，该第二网络设备为该NPN提供的服务包括认证、授权和计费中的至少一种。
可选地，该第二网络设备可以为AAA服务器。
在本申请实施例中，该第一请求消息可以包括该终端设备的标识和/或该终端设备请求访问的托管网络的标识，其中，该托管网络是基于该NPN构建的。
也就是，作为一种可能的实现，该第一请求消息中包括该终端设备的标识和该终端设备请求访问的托管网络的标识。
作为另一种可能的实现，该第一请求消息中包括该终端设备的标识。
可选地，该终端设备的标识可以为以下至少一种：用户永久标识符SUPI，用户隐藏标识符SUCI，匿名SUPI，匿名SUCI，在线签约SUCI，在线签约SUPI。
可以理解，在本申请实施例中，网络侧能够基于该NPN构建多个托管网络以提供对本地化服务的访问，构建的每个托管网络有自己的托管网络标识。
另外需要说明的是，在本申请实施例中，该第一请求消息是该终端设备通过该NPN中的接入和移动性管理功能AMF向该第一网络设备发送的。
步骤502，根据该第一请求消息，向与该第一网络设备所在的NPN对应的第二网络设备发送第二请求消息，该第二请求消息用于请求该第二网络设备对该终端设备进行身份验证。
在本申请实施例中，第一网络设备能够根据该第一请求消息，向与该第一网络设备所在的NPN对应的第二网络设备发送第二请求，请求该第二网络设备对该终端设备进行身份验证。
如前所述，在本申请实施例中，对该终端设备进行身份验证的第二网络设备是与该第一网络设备所在的NPN对应的，一个第二网络设备仅为一个NPN提供服务，也就是该第二网络设备仅为该第一网络设备所在的NPN提供服务，而不为其他网络提供服务。
在一些实施方式中，该终端设备可能正在访问该NPN且该NPN中没有该终端设备的订阅数据，或者该终端设备是仅在(onboarding)该NPN在线签约以获取身份验证的凭证而不需要该NPN提供服务(该NPN中也就没有该终端设备的订阅信息)，该第一网络设备还能够接收终端设备发送的第一指示信息，该第一指示信息用于该第一网络设备确定省略向统一数据管理功能UDM发送消息。
需要说明的是，如果该NPN中包括该终端设备的订阅数据，第一网络设备向该UDM发送消息以请求UDM基于该终端设备的订阅数据决定与该终端设备执行身份验证。第一网络设备能够接收UDM发送的响应消息来确定与该终端设备执行身份验证，并通过NPN中的网络切片特定的认证和授权功能NSSAAF，向第二网络设备发送该第二请求消息。
可选地，该第一网络设备启动Nudm_UEAuthentication_Get服务操作，第一网络设备向UDM发送Nudm_UEAuthentication_Get请求消息，该UDM向第一网络设备发送Nudm_UEAuthentication_Get响应消息。
如果该NPN中没有该终端设备的订阅数据，该终端设备向该第一网络设备发送的第一指示信息可以用于该第一网络设备确定省略向UDM发送消息。第一网络设备接收到该第一指示信息之后，可以不向UDM发送消息，而是直接通过NPN中的NSSAAF，向第二网络设备发送该第二请求消息。
可选地，该第一指示信息可以为该终端设备的标识，或者，该第一指示信息为用于指示该NPN中不包括该终端设备的订阅数据的指示信息。
其中，该终端设备的标识可以为以下至少一种：SUPI，SUCI，匿名SUPI，匿名SUCI，在线签约SUCI，在线签约SUPI。
作为一种可能的实现，该第一指示信息为该终端设备的标识，第一网络设备接收到该第一指示信息之后，能够根据该第一网络设备的本地策略，确定省略向UDM发送消息。
可选地，该本地策略可以为基于该终端设备的标识中的区域(realm)部分决定忽略与UDM进行交互，而直接选择一个NSSAAF，并通过该NSSAAF向第二网络设备发送该第二请求消息。
可选地，该本地策略可以为基于该终端设备的标识决定，忽略向UDM查询该终端设备的标识是否有对应的订阅信息(subscriptioninformation)。
作为另一种可能的实现，该第一指示信息用于指示该NPN中不包括该终端设备的订阅数据，第一网络设备能够根据接收到的该第一指示信息，确定省略向UDM发送消息。
类似地，可选地，该第一网络设备可以根据该第一指示信息确定忽略与UDM进行交互，而直接选择一个NSSAAF，并通过该NSSAAF向第二网络设备发送该第二请求消息。
可选地，该第一网络设备可以根据该第一指示信息确定，忽略向UDM查询该终端设备的标识是否有对应的订阅信息(subscriptioninformation)。
在一些实施方式中，该NPN中可能不包括该终端设备的订阅数据，第一网络设备也可以不省略向UDM发送消息。第一网络设备依然可以向UDM发送消息，发起Nudm_UEAuthentication_Get服务操作，并接收到未查询到该终端设备的订阅信息的响应，该第一网络设备不拒绝该终端设备的第一请求， 依然通过NPN中的NSSAAF，向第二网络设备发送该第二请求消息。
在本申请实施例中，该第二请求消息中包括该终端设备的SUPI或者匿名SUPI。
在本申请实施例中，该终端设备能够和该第二网络设备执行相互认证，该相互认证方法可以是基于可扩展的身份验证协议EAP的认证。终端设备与第二网络设备之间的相互认证还可以采用其他身份认证方法，本申请各实施例对该终端设备与第二网络设备之间的相互认证的方法不进行具体限定。
步骤503，接收该第二网络设备发送的终端设备身份验证的结果。
在本申请实施例中，第一网络设备能够接收第二网络设备发送的身份验证结果，并能够根据该身份验证结果，向该终端设备发送第一响应消息。
该第一网络设备能够通过该NSSAAF接收第二网络设备发送的验证结果。
可选地，该验证结果中可以包括该终端设备的SUPI。
步骤504，根据该终端设备身份验证的结果，通过该接入网设备向该终端设备发送第一响应消息，该第一响应消息用于指示该终端设备身份验证是否成功。
在本申请实施例中，第一网络设备能够通过接入网设备向终端设备发送第一响应消息，该第一响应消息能够指示该终端设备的身份验证是否成功。第一网络设备能够根据接收到的第二网络设备发送的身份认证结果，向该终端设备发送该第一响应消息。
需要说明的是，在本申请实施例中，该第一响应消息是该第一网络设备通过该NPN中的接入和移动性管理功能AMF向该终端设备发送的。
在一些实施方式中，该第二网络设备发送的身份验证结果为验证成功，该第一响应消息指示该终端设备身份验证成功，该第一网络设备能够接收该第二网络设备发送的主会话密钥MSK，并能够根据该MSK确定第一安全密钥K AUSF。第一网络设备能够基于一个密钥导出函数KDF，根据该第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，该第二安全密钥K SEAF用于该终端设备访问该NPN，与该NPN中的安全锚点功能SEAF进行信息交互。
其中，需要说明的是，该MSK是由认证成功的该终端设备和该第二网络设备协商确定的，也就是终端设备和第二网络设备能够确定相同的MSK。
另外需要说明的是，根据该MSK确定该第一安全密钥K AUSF可以是，将该MSK的128位或者256位作为该第一安全密钥K AUSF。
可选地，如果该第一请求消息中包括托管网络标识，则该服务网络名称为该托管网络标识。如果该第一请求消息中不包括托管网络标识，则该服务网络名称为该NPN的标识。
可选地，该第一网络设备能够向该NPN中的安全锚点功能SEAF发送该第二安全密钥K SEAF，该第二安全密钥K SEAF用于该终端设备与该SEAF进行信息交互。
可以理解，如果该第一响应消息指示该终端设备的身份验证失败，则该终端设备被拒绝访问该NPN，无法获取该第二网络设备提供的身份认证成功的凭证。
另外可以理解的是，如果该NPN中不包括该终端设备的订阅数据，第一网络设备省略向UDM发送消息，或者该第一网络设备接收到UDM发送的未查询到该终端设备的订阅信息的响应，第一网络设备在接收到第二网络设备发送的验证结果后，可以省略向UDM通知该终端设备的身份验证结果，以验证该终端设备在该UDM中是否存在有效订阅。
综上，通过接收终端设备通过接入网设备发送的第一请求消息，根据该第一请求消息，向与该第一网络设备所在的NPN对应的第二网络设备发送第二请求消息，该第二请求消息用于请求该第二网络设备对该终端设备进行身份验证，接收该第二网络设备发送的终端设备身份验证的结果，根据该终端设备身份验证的结果，通过该接入网设备向该终端设备发送第一响应消息，该第一响应消息用于指示该终端设备身份验证是否成功，使得终端设备与访问的网络之间能够相互认证，终端设备能够安全地访问该网络，获取该网络提供的服务，有效保护了终端设备与访问网络之间的信息交互安全，提高系 统的安全性、私密性。
请参见图6，图6是本申请实施例提供的一种身份验证方法的流程示意图。需要说明的是，本申请实施例的身份验证方法由第一网络设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图6所示，该方法可以包括如下步骤：
步骤601，接收终端设备通过接入网设备发送的第一请求消息。
在本申请实施例中，第一网络设备可以接收终端设备通过接入网设备发送的第一请求消息，第一网络设备在接收到该第一请求消息后，能够根据该第一请求消息确定第二请求消息，该第二请求消息用于请求与该第一网络设备所在的NPN对应的第二网络设备对该终端设备进行身份验证。
在本申请实施例中，该第一网络设备可以为鉴权服务功能AUSF。
在本申请实施例中，对该终端设备进行身份验证的第二网络设备是与该第一网络设备所在的NPN对应的，一个第二网络设备仅为一个NPN提供服务，也就是该第二网络设备仅为该第一网络设备所在的NPN提供服务，而不为其他网络提供服务。
可选地，该第二网络设备为该NPN提供的服务包括认证、授权和计费中的至少一种。
可选地，该第二网络设备可以为AAA服务器。
在本申请实施例中，该第一请求消息可以包括该终端设备的标识和/或该终端设备请求访问的托管网络的标识，其中，该托管网络是基于该NPN构建的。
也就是，作为一种可能的实现，该第一请求消息中包括该终端设备的标识和该终端设备请求访问的托管网络的标识。
作为另一种可能的实现，该第一请求消息中包括该终端设备的标识。
可选地，该终端设备的标识可以为以下至少一种：用户永久标识符SUPI，用户隐藏标识符SUCI，匿名SUPI，匿名SUCI，在线签约SUCI，在线签约SUPI。
可以理解，在本申请实施例中，网络侧能够基于该NPN构建多个托管网络以提供对本地化服务的访问，构建的每个托管网络有自己的托管网络标识。
另外需要说明的是，在本申请实施例中，该第一请求消息是该终端设备通过该NPN中的接入和移动性管理功能AMF向该第一网络设备发送的。
步骤602，根据该第一请求消息，向与该第一网络设备所在的NPN对应的第二网络设备发送第二请求消息，该第二请求消息用于请求该第二网络设备对该终端设备进行身份验证。
在本申请实施例中，第一网络设备能够根据该第一请求消息，向与该第一网络设备所在的NPN对应的第二网络设备发送第二请求，请求该第二网络设备对该终端设备进行身份验证。
如前所述，在本申请实施例中，对该终端设备进行身份验证的第二网络设备是与该第一网络设备所在的NPN对应的，一个第二网络设备仅为一个NPN提供服务，也就是该第二网络设备仅为该第一网络设备所在的NPN提供服务，而不为其他网络提供服务。
在一些实施方式中，该NPN中包括该终端设备的订阅数据，第一网络设备向该UDM发送消息以请求UDM基于该终端设备的订阅数据决定与该终端设备执行身份验证。第一网络设备能够接收UDM发送的响应消息来确定与该终端设备执行身份验证，并通过NPN中的网络切片特定的认证和授权功能NSSAAF，向第二网络设备发送该第二请求消息。
可选地，该第一网络设备启动Nudm_UEAuthentication_Get服务操作，第一网络设备向UDM发送Nudm_UEAuthentication_Get请求消息，该UDM向第一网络设备发送Nudm_UEAuthentication_Get响应消息。
在一些实施方式中，该NPN中可能不包括该终端设备的订阅数据(比如该终端设备可能正在访问该NPN且该NPN中没有该终端设备的订阅数据，或者该终端设备是仅在该NPN在线签约 (onboarding)以获取身份验证的凭证而不需要该NPN提供服务等等)，第一网络设备也可以不省略向UDM发送消息。第一网络设备依然可以向UDM发送消息，发起Nudm_UEAuthentication_Get服务操作，并接收到未查询到该终端设备的订阅信息的响应，该第一网络设备不拒绝该终端设备的第一请求，依然通过NPN中的NSSAAF，向第二网络设备发送该第二请求消息。
在本申请实施例中，该第二请求消息中包括该终端设备的SUPI或者匿名SUPI。
在本申请实施例中，该NSSAAF在收到第一网络设备发送的终端设备的标识后，可以基于本地策略判断向第二网络设备(比如AAA服务器/应用(Application)服务器等)发送的标识类型。例如，基于终端设备的标识的区域(realm)部分，判断向第二网络设备发送SUPI还是外部终端设备标识(比如通用公共用户标识(Generic Public Subscription Identifier，GPSI)，IP多媒体子系统(IP Multimedia Subsystem，IMS)私有用户标识(IP Multimedia Private Identity，IMPI)等)。
在本申请实施例中，该终端设备能够和该第二网络设备执行相互认证，该相互认证方法可以是基于可扩展的身份验证协议EAP的认证。终端设备与第二网络设备之间的相互认证还可以采用其他身份认证方法，本申请各实施例对该终端设备与第二网络设备之间的相互认证的方法不进行具体限定。
步骤603，接收该第二网络设备发送的终端设备身份验证的结果，该结果为身份验证成功。
在本申请实施例中，第一网络设备能够接收第二网络设备发送的身份验证结果，并能够根据该身份验证结果，向该终端设备发送第一响应消息。
该第一网络设备能够通过该NSSAAF接收第二网络设备发送的验证结果。
可选地，该验证结果中可以包括该终端设备的SUPI。
可以理解的是，如果该NPN中包括该终端设备的订阅数据，第一网络设备在接收到第二网络设备发送的验证结果后，还可以向UDM通知该终端设备的身份验证结果，以验证该终端设备在该UDM中是否存在有效订阅。
另外可以理解的是，如果该NPN中不包括该终端设备的订阅数据，该第一网络设备接收到UDM发送的未查询到该终端设备的订阅信息的响应，第一网络设备在接收到第二网络设备发送的验证结果后，可以省略向UDM通知该终端设备的身份验证结果，以验证该终端设备在该UDM中是否存在有效订阅。
步骤604，接收第二网络设备发送的主会话密钥MSK。
在本申请实施例中，该终端设备身份验证成功，第一网络设备能够接收第二网络设备发送的主会话密钥MSK，并能够根据该MSK确定第一安全密钥K AUSF。
其中，需要说明的是，该MSK是由认证成功的该终端设备和该第二网络设备协商确定的，也就是终端设备和第二网络设备能够确定相同的MSK。
可选地，该MSK可以包含在第二网络设备发送的该验证结果中。
步骤605，根据该MSK，确定第一安全密钥K AUSF。
在本申请实施例中，第一网络设备能够根据该MSK确定第一安全密钥K AUSF。
可选地，根据该MSK确定该第一安全密钥K AUSF可以是，将该MSK的128位或者256位作为该第一安全密钥K AUSF。
步骤606，根据该第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，该第二安全密钥K SEAF用于该终端设备访问该NPN。
在本申请实施例中，第一网络设备能够基于一个密钥导出函数KDF，根据该第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，该第二安全密钥K SEAF用于该终端设备访问该NPN。
可以理解的是，第一网络设备和终端设备是基于相同的密钥导出函数，从第一安全密钥K AUSF导出该第二安全密钥K SEAF。
可选地，如果该第一请求消息中包括托管网络标识，则该服务网络名称为该托管网络标识。如果 该第一请求消息中不包括托管网络标识，则该服务网络名称为该NPN的标识。
作为一种示例，该密钥导出函数KDF的输入参数KEY为该第一安全密钥K AUSF。该密钥导出函数KDF的输入参数S可以包括：
该密钥导出函数的编码号FC为0x6C；
参数P0为服务网络名称；
参数L0为参数P0中包括的数据的长度，也就是该服务网络名称的数据的长度。
步骤607，向该NPN中的安全锚点功能SEAF发送该第二安全密钥K SEAF。
在本申请实施例中，第一网络设备还能够向该NPN中的SEAF发送该第二安全密钥K SEAF，该第二安全密钥K SEAF能够用于该终端设备与该NPN中的安全锚点功能SEAF进行信息交互。
步骤608，根据该终端设备身份验证的结果，通过该接入网设备向该终端设备发送第一响应消息，该第一响应消息用于指示该终端设备身份验证成功。
在本申请实施例中，第一网络设备能够通过接入网设备向终端设备发送第一响应消息，该第一响应消息能够指示该终端设备的身份验证是否成功。第一网络设备能够根据接收到的第二网络设备发送的身份认证结果，向该终端设备发送该第一响应消息。
需要说明的是，在本申请实施例中，该第一响应消息是该第一网络设备通过该NPN中的接入和移动性管理功能AMF向该终端设备发送的。
综上，通过接收终端设备通过接入网设备发送的第一请求消息，根据该第一请求消息，向与该第一网络设备所在的NPN对应的第二网络设备发送第二请求消息，该第二请求消息用于请求该第二网络设备对该终端设备进行身份验证，接收该第二网络设备发送的终端设备身份验证的结果，该结果为身份验证成功，接收第二网络设备发送的主会话密钥MSK，根据该MSK，确定第一安全密钥K AUSF，根据该第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，该第二安全密钥K SEAF用于该终端设备访问该NPN，向该NPN中的安全锚点功能SEAF发送该第二安全密钥K SEAF，根据该终端设备身份验证的结果，通过该接入网设备向该终端设备发送第一响应消息，该第一响应消息用于指示该终端设备身份验证成功，使得终端设备与访问的网络之间能够相互认证，终端设备能够安全地访问该网络，获取该网络提供的服务，有效保护了终端设备与访问网络之间的信息交互安全，提高系统的安全性、私密性。
请参见图7，图7是本申请实施例提供的一种身份验证方法的流程示意图。需要说明的是，本申请实施例的身份验证方法由第一网络设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图7所示，该方法可以包括如下步骤：
步骤701，接收终端设备通过接入网设备发送的第一请求消息。
在本申请实施例中，第一网络设备可以接收终端设备通过接入网设备发送的第一请求消息，第一网络设备在接收到该第一请求消息后，能够根据该第一请求消息确定第二请求消息，该第二请求消息用于请求与该第一网络设备所在的NPN对应的第二网络设备对该终端设备进行身份验证。
在本申请实施例中，该第一网络设备可以为鉴权服务功能AUSF。
在本申请实施例中，对该终端设备进行身份验证的第二网络设备是与该第一网络设备所在的NPN对应的，一个第二网络设备仅为一个NPN提供服务，也就是该第二网络设备仅为该第一网络设备所在的NPN提供服务，而不为其他网络提供服务。
可选地，该第二网络设备为该NPN提供的服务包括认证、授权和计费中的至少一种。
可选地，该第二网络设备可以为AAA服务器。
在本申请实施例中，该第一请求消息可以包括该终端设备的标识和/或该终端设备请求访问的托管网络的标识，其中，该托管网络是基于该NPN构建的。
也就是，作为一种可能的实现，该第一请求消息中包括该终端设备的标识和该终端设备请求访问的托管网络的标识。
作为另一种可能的实现，该第一请求消息中包括该终端设备的标识。
可选地，该终端设备的标识可以为以下至少一种：用户永久标识符SUPI，用户隐藏标识符SUCI，匿名SUPI，匿名SUCI，在线签约SUCI，在线签约SUPI。
可以理解，在本申请实施例中，网络侧能够基于该NPN构建多个托管网络以提供对本地化服务的访问，构建的每个托管网络有自己的托管网络标识。
另外需要说明的是，在本申请实施例中，该第一请求消息是该终端设备通过该NPN中的接入和移动性管理功能AMF向该第一网络设备发送的。
步骤702，接收该终端设备发送的第一指示信息，该第一指示信息用于该第一网络设备确定省略向该NPN中的UDM发送消息。
在本申请实施例中，该终端设备可能正在访问该NPN且该NPN中没有该终端设备的订阅数据，或者该终端设备是仅在该NPN在线签约(onboarding)以获取身份验证的凭证而不需要该NPN提供服务(该NPN中也就没有该终端设备的订阅信息)，该第一网络设备还能够接收终端设备发送的第一指示信息，该第一指示信息用于该第一网络设备确定省略向统一数据管理功能UDM发送消息。
需要说明的是，如前所述，如果该NPN中包括该终端设备的订阅数据，第一网络设备向该UDM发送消息以请求UDM基于该终端设备的订阅数据决定与该终端设备执行身份验证。第一网络设备能够接收UDM发送的响应消息来确定与该终端设备执行身份验证，并通过NPN中的NSSAAF，向第二网络设备发送该第二请求消息。
在本申请实施例中，该NPN中没有该终端设备的订阅数据，该终端设备向该第一网络设备发送的第一指示信息可以用于该第一网络设备确定省略向UDM发送消息。第一网络设备接收到该第一指示信息之后，可以不向UDM发送消息，而是直接通过NPN中的NSSAAF，向第二网络设备发送该第二请求消息。
可选地，该第一指示信息可以为该终端设备的标识，或者，该第一指示信息为用于指示该NPN中不包括该终端设备的订阅数据的指示信息。
其中，该终端设备的标识可以为以下至少一种：SUPI，SUCI，匿名SUPI，匿名SUCI，在线签约SUCI，在线签约SUPI。
作为一种可能的实现，该第一指示信息为该终端设备的标识，第一网络设备接收到该第一指示信息之后，能够根据该第一网络设备的本地策略，确定省略向UDM发送消息。
可选地，该本地策略可以为基于该终端设备的标识中的区域(realm)部分决定忽略与UDM进行交互，而直接选择一个NSSAAF，并通过该NSSAAF向第二网络设备发送该第二请求消息。
可选地，该本地策略可以为基于该终端设备的标识决定，忽略向UDM查询该终端设备的标识是否有对应的订阅信息(subscriptioninformation)。作为另一种可能的实现，该第一指示信息用于指示该NPN中不包括该终端设备的订阅数据，第一网络设备能够根据接收到的该第一指示信息，确定省略向UDM发送消息。
类似地，可选地，该第一网络设备可以根据该第一指示信息确定忽略与UDM进行交互，而直接选择一个NSSAAF，并通过该NSSAAF向第二网络设备发送该第二请求消息。
可选地，该第一网络设备可以根据该第一指示信息确定，忽略向UDM查询该终端设备的标识是否有对应的订阅信息(subscriptioninformation)。
在本申请实施例中，该第二请求消息中包括该终端设备的SUPI或者匿名SUPI。
在本申请实施例中，该NSSAAF在收到第一网络设备发送的终端设备的标识后，可以基于本地策略判断向第二网络设备(比如AAA服务器/应用(Application)服务器等)发送的标识类型。例如， 基于终端设备的标识的区域(realm)部分，判断向第二网络设备发送SUPI还是外部终端设备标识(比如通用公共用户标识GPSI，IMS私有用户标识IMPI等)。
步骤703，根据该第一请求消息，向与该第一网络设备所在的NPN对应的第二网络设备发送第二请求消息，该第二请求消息用于请求该第二网络设备对该终端设备进行身份验证。
在本申请实施例中，第一网络设备能够根据该第一请求消息，向与该第一网络设备所在的NPN对应的第二网络设备发送第二请求，请求该第二网络设备对该终端设备进行身份验证。
如前所述，在本申请实施例中，对该终端设备进行身份验证的第二网络设备是与该第一网络设备所在的NPN对应的，一个第二网络设备仅为一个NPN提供服务，也就是该第二网络设备仅为该第一网络设备所在的NPN提供服务，而不为其他网络提供服务。
在本申请实施例中，该第二请求消息中包括该终端设备的SUPI或者匿名SUPI。
在本申请实施例中，该终端设备能够和该第二网络设备执行相互认证，该相互认证方法可以是基于可扩展的身份验证协议EAP的认证。终端设备与第二网络设备之间的相互认证还可以采用其他身份认证方法，本申请各实施例对该终端设备与第二网络设备之间的相互认证的方法不进行具体限定。
步骤704，接收该第二网络设备发送的终端设备身份验证的结果，该结果为身份验证成功。
在本申请实施例中，第一网络设备能够接收第二网络设备发送的身份验证结果，并能够根据该身份验证结果，向该终端设备发送第一响应消息。
该第一网络设备能够通过该NSSAAF接收第二网络设备发送的验证结果。
可选地，该验证结果中可以包括该终端设备的SUPI。
可以理解的是，如果该NPN中包括该终端设备的订阅数据，第一网络设备在接收到第二网络设备发送的验证结果后，还可以向UDM通知该终端设备的身份验证结果，以验证该终端设备在该UDM中是否存在有效订阅。
另外可以理解的是，如果该NPN中不包括该终端设备的订阅数据，该第一网络设备接收到该终端设备发送的第一指示信息，并确定省略向UDM发送消息，第一网络设备在接收到第二网络设备发送的验证结果后，可以省略向UDM通知该终端设备的身份验证结果，以验证该终端设备在该UDM中是否存在有效订阅。
步骤705，接收第二网络设备发送的主会话密钥MSK。
在本申请实施例中，该终端设备身份验证成功，第一网络设备能够接收第二网络设备发送的主会话密钥MSK，并能够根据该MSK确定第一安全密钥K AUSF。
其中，需要说明的是，该MSK是由认证成功的该终端设备和该第二网络设备协商确定的，也就是终端设备和第二网络设备能够确定相同的MSK。
可选地，该MSK可以包含在第二网络设备发送的该验证结果中。
步骤706，根据该MSK，确定第一安全密钥K AUSF。
在本申请实施例中，第一网络设备能够根据该MSK确定第一安全密钥K AUSF。
可选地，根据该MSK确定该第一安全密钥K AUSF可以是，将该MSK的128位或者256位作为该第一安全密钥K AUSF。
步骤707，根据该第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，该第二安全密钥K SEAF用于该终端设备访问该NPN。
在本申请实施例中，第一网络设备能够基于一个密钥导出函数KDF，根据该第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，该第二安全密钥K SEAF用于该终端设备访问该NPN。
可以理解的是，第一网络设备和终端设备是基于相同的密钥导出函数，从第一安全密钥K AUSF导出该第二安全密钥K SEAF。
可选地，如果该第一请求消息中包括托管网络标识，则该服务网络名称为该托管网络标识。如果 该第一请求消息中不包括托管网络标识，则该服务网络名称为该NPN的标识。
作为一种示例，该密钥导出函数KDF的输入参数KEY为该第一安全密钥K AUSF。该密钥导出函数KDF的输入参数S可以包括：
该密钥导出函数的编码号FC为0x6C；
参数P0为服务网络名称；
参数L0为参数P0中包括的数据的长度，也就是该服务网络名称的数据的长度。
步骤708，向该NPN中的安全锚点功能SEAF发送该第二安全密钥K SEAF。
在本申请实施例中，第一网络设备还能够向该NPN中的SEAF发送该第二安全密钥K SEAF，该第二安全密钥K SEAF能够用于该终端设备与该NPN中的安全锚点功能SEAF进行信息交互。
步骤709，根据该终端设备身份验证的结果，通过该接入网设备向该终端设备发送第一响应消息，该第一响应消息用于指示该终端设备身份验证成功。
在本申请实施例中，第一网络设备能够通过接入网设备向终端设备发送第一响应消息，该第一响应消息能够指示该终端设备的身份验证是否成功。第一网络设备能够根据接收到的第二网络设备发送的身份认证结果，向该终端设备发送该第一响应消息。
需要说明的是，在本申请实施例中，该第一响应消息是该第一网络设备通过该NPN中的接入和移动性管理功能AMF向该终端设备发送的。
综上，通过接收终端设备通过接入网设备发送的第一请求消息，根据该第一请求消息，接收该终端设备发送的第一指示信息，该第一指示信息用于该第一网络设备确定省略向该NPN中的UDM发送消息，向与该第一网络设备所在的NPN对应的第二网络设备发送第二请求消息，该第二请求消息用于请求该第二网络设备对该终端设备进行身份验证，接收该第二网络设备发送的终端设备身份验证的结果，该结果为身份验证成功，接收第二网络设备发送的主会话密钥MSK，根据该MSK，确定第一安全密钥K AUSF，根据该第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，该第二安全密钥K SEAF用于该终端设备访问该NPN，向该NPN中的安全锚点功能SEAF发送该第二安全密钥K SEAF，根据该终端设备身份验证的结果，通过该接入网设备向该终端设备发送第一响应消息，该第一响应消息用于指示该终端设备身份验证成功，使得终端设备与访问的网络之间能够相互认证，终端设备能够安全地访问该网络，获取该网络提供的服务，有效保护了终端设备与访问网络之间的信息交互安全，提高系统的安全性、私密性。
请参见图8，图8是本申请实施例提供的一种身份验证方法的流程示意图。需要说明的是，本申请实施例的身份验证方法由第二网络设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图8所示，该方法可以包括如下步骤：
步骤801，接收第一网络设备发送的第二请求消息，该第二请求消息是该第一网络设备根据终端设备发送的第一请求消息确定的，该第二请求消息用于请求与该第一网络设备所在的NPN对应的该第二网络设备对该终端设备进行身份验证。
在本申请实施例中，第二网络设备能够接收第一网络设备发送的第二请求消息，该第二请求消息用于请求与该第一网络设备所在的NPN对应的第二网络设备对该终端设备进行身份验证，该第二请求消息是第一网络设备根据接收到的终端设备通过接入网设备发送的第一请求消息确定的，第一网络设备在接收到该第一请求消息后，能够根据该第一请求消息确定第二请求消息。
在本申请实施例中，该第一网络设备可以为鉴权服务功能AUSF。
在本申请实施例中，对该终端设备进行身份验证的第二网络设备是与该第一网络设备所在的NPN对应的，一个第二网络设备仅为一个NPN提供服务，也就是该第二网络设备仅为该第一网络设备所在的NPN提供服务，而不为其他网络提供服务。
可选地，该第二网络设备为该NPN提供的服务包括认证、授权和计费中的至少一种。
可选地，该第二网络设备可以为AAA服务器。
在本申请实施例中，该第一请求消息可以包括该终端设备的标识和/或该终端设备请求访问的托管网络的标识，其中，该托管网络是基于该NPN构建的。
也就是，作为一种可能的实现，该第一请求消息中包括该终端设备的标识和该终端设备请求访问的托管网络的标识。
作为另一种可能的实现，该第一请求消息中包括该终端设备的标识。
可选地，该终端设备的标识可以为以下至少一种：用户永久标识符SUPI，用户隐藏标识符SUCI，匿名SUPI，匿名SUCI，在线签约SUCI，在线签约SUPI。
可以理解，在本申请实施例中，网络侧能够基于该NPN构建多个托管网络以提供对本地化服务的访问，构建的每个托管网络有自己的托管网络标识。
另外需要说明的是，在本申请实施例中，该第一请求消息是该终端设备通过该NPN中的接入和移动性管理功能AMF向该第一网络设备发送的。
在本申请实施例中，第一网络设备能够通过NPN中的网络切片特定的认证和授权功能NSSAAF，向第二网络设备发送该第二请求消息。
在本申请实施例中，该第二请求消息中包括该终端设备的SUPI或者匿名SUPI。
在本申请实施例中，该终端设备能够和该第二网络设备执行相互认证，该相互认证方法可以是基于可扩展的身份验证协议EAP的认证。终端设备与第二网络设备之间的相互认证还可以采用其他身份认证方法，本申请各实施例对该终端设备与第二网络设备之间的相互认证的方法不进行具体限定。
步骤802，向该第一网络设备发送该终端设备身份验证的结果，该终端设备身份验证的结果，用于确定第一响应消息，该第一响应消息用于指示该终端设备身份验证是否成功。
在本申请实施例中，第一网络设备能够接收第二网络设备发送的身份验证结果，并能够根据该身份验证结果，向该终端设备发送第一响应消息。
在本申请实施例中，该第二网络设备能够通过该NSSAAF向该第一网络设备发送该验证结果。
可选地，该验证结果中可以包括该终端设备的SUPI。
在本申请实施例中，该身份验证的结果能够用于第一网络设备确定第一响应信息。第一网络设备能够通过接入网设备向终端设备发送第一响应消息，该第一响应消息能够指示该终端设备的身份验证是否成功。
需要说明的是，在本申请实施例中，该第一响应消息是该第一网络设备通过该NPN中的接入和移动性管理功能AMF向该终端设备发送的。
在一些实施方式中，该第二网络设备发送的身份验证结果为验证成功，该第一响应消息指示该终端设备身份验证成功，该第二网络设备能够向该第一网络设备发送主会话密钥MSK，第一网络设备能够根据该MSK确定第一安全密钥K AUSF。第一网络设备能够基于一个密钥导出函数KDF，根据该第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，该第二安全密钥K SEAF用于该终端设备访问该NPN，与该NPN中的安全锚点功能SEAF进行信息交互。
其中，需要说明的是，该MSK是由认证成功的该终端设备和该第二网络设备协商确定的，也就是终端设备和第二网络设备能够确定相同的MSK。
另外需要说明的是，根据该MSK确定该第一安全密钥K AUSF可以是，将该MSK的128位或者256位作为该第一安全密钥K AUSF。
可选地，如果该第一请求消息中包括托管网络标识，则该服务网络名称为该托管网络标识。如果该第一请求消息中不包括托管网络标识，则该服务网络名称为该NPN的标识。
可选地，该第二安全密钥K SEAF用于该终端设备与该NPN中的安全锚点功能SEAF进行信息交互， 该SEAF中存储的第二安全密钥K SEAF是由该第一网络设备发送给该SEAF的。
可以理解，如果该第一响应消息指示该终端设备的身份验证失败，则该终端设备被拒绝访问该NPN，无法获取该第二网络设备提供的身份认证成功的凭证。
综上，通过接收第一网络设备发送的第二请求消息，该第二请求消息是该第一网络设备根据终端设备发送的第一请求消息确定的，该第二请求消息用于请求与该第一网络设备所在的NPN对应的该第二网络设备对该终端设备进行身份验证，向该第一网络设备发送该终端设备身份验证的结果，该终端设备身份验证的结果，用于确定第一响应消息，该第一响应消息用于指示该终端设备身份验证是否成功，使得终端设备与访问的网络之间能够相互认证，终端设备能够安全地访问该网络，获取该网络提供的服务，有效保护了终端设备与访问网络之间的信息交互安全，提高系统的安全性、私密性。
请参见图9，图9是本申请实施例提供的一种身份验证方法的流程示意图。需要说明的是，本申请实施例的身份验证方法由第二网络设备执行。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图9所示，该方法可以包括如下步骤：
步骤901，接收第一网络设备发送的第二请求消息，该第二请求消息是该第一网络设备根据终端设备发送的第一请求消息确定的，该第二请求消息用于请求与该第一网络设备所在的NPN对应的该第二网络设备对该终端设备进行身份验证。
在本申请实施例中，第二网络设备能够接收第一网络设备发送的第二请求消息，该第二请求消息用于请求与该第一网络设备所在的NPN对应的第二网络设备对该终端设备进行身份验证，该第二请求消息是第一网络设备根据接收到的终端设备通过接入网设备发送的第一请求消息确定的，第一网络设备在接收到该第一请求消息后，能够根据该第一请求消息确定第二请求消息。
在本申请实施例中，该第一网络设备可以为鉴权服务功能AUSF。
在本申请实施例中，对该终端设备进行身份验证的第二网络设备是与该第一网络设备所在的NPN对应的，一个第二网络设备仅为一个NPN提供服务，也就是该第二网络设备仅为该第一网络设备所在的NPN提供服务，而不为其他网络提供服务。
可选地，该第二网络设备为该NPN提供的服务包括认证、授权和计费中的至少一种。
可选地，该第二网络设备可以为AAA服务器。
在本申请实施例中，该第一请求消息可以包括该终端设备的标识和/或该终端设备请求访问的托管网络的标识，其中，该托管网络是基于该NPN构建的。
也就是，作为一种可能的实现，该第一请求消息中包括该终端设备的标识和该终端设备请求访问的托管网络的标识。
作为另一种可能的实现，该第一请求消息中包括该终端设备的标识。
可选地，该终端设备的标识可以为以下至少一种：用户永久标识符SUPI，用户隐藏标识符SUCI，匿名SUPI，匿名SUCI，在线签约SUCI，在线签约SUPI。
可以理解，在本申请实施例中，网络侧能够基于该NPN构建多个托管网络以提供对本地化服务的访问，构建的每个托管网络有自己的托管网络标识。
另外需要说明的是，在本申请实施例中，该第一请求消息是该终端设备通过该NPN中的接入和移动性管理功能AMF向该第一网络设备发送的。
在本申请实施例中，第一网络设备能够通过NPN中的网络切片特定的认证和授权功能NSSAAF，向第二网络设备发送该第二请求消息。
在本申请实施例中，该第二请求消息中包括该终端设备的SUPI或者匿名SUPI。
在本申请实施例中，该终端设备能够和该第二网络设备执行相互认证，该相互认证方法可以是基于可扩展的身份验证协议EAP的认证。终端设备与第二网络设备之间的相互认证还可以采用其他身份 认证方法，本申请各实施例对该终端设备与第二网络设备之间的相互认证的方法不进行具体限定。
步骤902，向该第一网络设备发送该终端设备身份验证的结果，该终端设备身份验证的结果，用于确定第一响应消息，该第一响应消息用于指示该终端设备身份验证成功。
在本申请实施例中，第一网络设备能够接收第二网络设备发送的身份验证结果，并能够根据该身份验证结果，向该终端设备发送第一响应消息。
在本申请实施例中，该第二网络设备能够通过该NSSAAF向该第一网络设备发送该验证结果。
可选地，该验证结果中可以包括该终端设备的SUPI。
在本申请实施例中，该身份验证的结果能够用于第一网络设备确定第一响应信息。第一网络设备能够通过接入网设备向终端设备发送第一响应消息，该第一响应消息能够指示该终端设备的身份验证是否成功。
需要说明的是，在本申请实施例中，该第一响应消息是该第一网络设备通过该NPN中的接入和移动性管理功能AMF向该终端设备发送的。
步骤903，向该第一网络设备发送主会话密钥MSK。
在本申请实施例中，该第二网络设备发送的身份验证结果为验证成功，该第一响应消息指示该终端设备身份验证成功，该第二网络设备能够向该第一网络设备发送主会话密钥MSK，第一网络设备能够根据该MSK确定第一安全密钥K AUSF。第一网络设备能够基于一个密钥导出函数KDF，根据该第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，该第二安全密钥K SEAF用于该终端设备访问该NPN，与该NPN中的安全锚点功能SEAF进行信息交互。
其中，需要说明的是，该MSK是由认证成功的该终端设备和该第二网络设备协商确定的，也就是终端设备和第二网络设备能够确定相同的MSK。
另外需要说明的是，根据该MSK确定该第一安全密钥K AUSF可以是，将该MSK的128位或者256位作为该第一安全密钥K AUSF。
可选地，如果该第一请求消息中包括托管网络标识，则该服务网络名称为该托管网络标识。如果该第一请求消息中不包括托管网络标识，则该服务网络名称为该NPN的标识。
作为一种示例，该密钥导出函数KDF的输入参数KEY为该第一安全密钥K AUSF。该密钥导出函数KDF的输入参数S可以包括：
该密钥导出函数的编码号FC为0x6C；
参数P0为服务网络名称；
参数L0为参数P0中包括的数据的长度，也就是该服务网络名称的数据的长度。
可选地，该第二安全密钥K SEAF用于该终端设备与该NPN中的安全锚点功能SEAF进行信息交互，该SEAF中存储的第二安全密钥K SEAF是由该第一网络设备发送给该SEAF的。
综上，通过接收第一网络设备发送的第二请求消息，该第二请求消息是该第一网络设备根据终端设备发送的第一请求消息确定的，该第二请求消息用于请求与该第一网络设备所在的NPN对应的该第二网络设备对该终端设备进行身份验证，向该第一网络设备发送该终端设备身份验证的结果，该终端设备身份验证的结果，用于确定第一响应消息，该第一响应消息用于指示该终端设备身份验证成功，向该第一网络设备发送主会话密钥MSK，使得终端设备与访问的网络之间能够相互认证，终端设备能够安全地访问该网络，获取该网络提供的服务，有效保护了终端设备与访问网络之间的信息交互安全，提高系统的安全性、私密性。
请参见图10，图10是本申请实施例提供的一种身份验证方法的流程示意图。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图10所示，该方法可以包括如下步骤：
1、终端设备能够选择一个NPN，并在该NPN中发起终端设备注册。该注册消息中可以包括该终 端设备的标识和/或该终端设备请求访问的托管网络的标识。其中，该托管网络是基于该NPN构建的。
2、该NPN中的AMF应该向AUSF(第一网络设备)发送Nausf_UEAuthentication_Authenticate请求，来请求对该终端设备进行身份认证。该请求消息中包括该终端设备的标识和/或该终端设备请求访问的托管网络的标识。AMF可以根据3GPP技术规范TS 23.501中规定的标准发现并选择AUSF。
3、AUSF(第一网络设备)能够发起Nudm_UEAuthentication_Get服务操作，AUSF向UDM发送Nudm_UEAuthentication_Get请求。AUSF可以根据3GPP技术规范TS 23.501中规定的标准发现并选择UDM。
4、UDM能够基于订阅信息决定对该终端设备实体执行身份验证，或者能够基于网络访问标识符(Network Access Identifier，NAI)格式中的SUPI区域(realm)部分决定对该终端设备实体执行身份验证。
5、UDM应向AUSF(第一网络设备)提供SUPI或匿名SUPI，并应向AUSF指示使用与该NPN对应的第二网络设备执行身份验证。
如果该NPN中没有该终端设备的订阅信息，AUSF能够接收到该UDM发送的响应，UDM和AUSF不中止该过程。
6、根据UDM的指示，AUSF(第一网络设备)可以根据3GPP技术规范TS 23.501中的规定，发起Nnssaaf_AIWF_Authenticate服务操作，向NSSAAF发送Nnssaaf_AIWF_Authenticate请求。其中，NSSAAF的定义可以参考在3GPP技术规范TS 23.501。
如果该NPN中没有该终端设备的订阅信息，AUSF能够接收到该UDM发送的响应，UDM和AUSF不中止该过程，AUSF依然可以发起Nnssaaf_AIWF_Authenticate服务操作，向NSSAAF发送Nnssaaf_AIWF_Authenticate请求。
该Nnssaaf_AIWF_Authenticate请求中包括该终端设备的标识(SUPI或匿名SUPI)。
7、NSSAAF能够根据与SUPI的区域(realm)部分对应的域名选择第二网络设备。NSSAAF能够执行相关协议转换，并将EAP消息中继到第二网络设备。
8、终端设备和第二网络设备能够执行相互认证。第二网络设备能够作为提供认证服务的网络设备(比如作为EAP服务器)，用于身份验证。第二网络设备在步骤7中的EAP响应/标识消息中接收的EAP标识可以包含匿名的SUPI。在这种情况下，第二网络设备使用EAP方法特定的EAP身份请求/响应消息来获取终端设备的标识，作为终端设备和第二网络设备之间的EAP认证的一部分。
9、认证成功后，第二网络设备能够向NSSAAF提供MSK和SUPI(即用于成功EAP认证的终端设备的标识)。
10、NSSAAF使用Nnssaaf_AIWF_Authenticate响应消息将MSK和SUPI返回给AUSF(第一网络设备)。
11、AUSF(第一网络设备)通过发起Nudm_ueIdentification_ResultConfirmation服务操作，也就是向UDM发送Nudm_ueIdentification_ResultConfirmation请求，来向UDM通知有关接收到的SUPI的身份验证结果，以验证该SUPI是否对应于NPN中的有效订阅。
12、UDM存储SUPI的身份验证状态。
13、UDM向AUSF(第一网络设备)发送Nudm_ueIdentification_ResultConfirmation响应。如果没有对应于SUPI的订阅，则UDM应返回错误。
可以理解的是，如果该NPN中没有该终端设备的订阅信息，在步骤3-5中UDM和AUSF不中止该过程，AUSF依然可以发起Nnssaaf_AIWF_Authenticate服务操作。但在步骤11-13中，AUSF可以不向UDM通知有关接收到的SUPI的身份验证结果，以验证该SUPI是否对应于NPN中的有效订阅，也就是可以省略上述步骤11-13。
14、AUSF能够将MSK的256位或128位作为第一安全密钥K AUSF。AUSF还能够根据一个密钥 导出函数KDF从第一安全密钥K AUSF中推导出第二安全密钥K SEAF。该密钥导出函数如前各实施例所述，在此不再赘述。
15、AUSF能够将该终端设备身份验证成功的指示(第一响应消息)与该终端设备的SUPI，以及步骤14中计算出的第二安全密钥K SEAF一起发送给AMF/SEAF。
16、AMF/SEAF能够在非接入层(non-access stratum，NAS)消息中向终端设备发送身份验证成功的指示(第一响应消息)。
17、终端设备在接收到验证成功的指示(第一响应消息)之后，能够确定主会话密钥MSK，并将MSK的256位或128位作为第一安全密钥K AUSF。该终端设备还能够据一个同样的密钥导出函数KDF从第一安全密钥K AUSF中推导出第二安全密钥K SEAF。该密钥导出函数如前各实施例所述，在此不再赘述。
综上，本申请实施例提供的身份验证方法，能够提供一种终端设备与访问网络之间的相互认证机制，使得终端设备与访问的网络之间能够相互认证，终端设备能够安全地访问该网络，获取该网络提供的服务，有效保护了终端设备与访问网络之间的信息交互安全，提高系统的安全性、私密性。
请参见图11，图11是本申请实施例提供的一种身份验证方法的流程示意图。该方法可以独立执行，也可以结合本申请任意一个其他实施例一起被执行。如图11所示，该方法可以包括如下步骤：
1、终端设备能够选择一个NPN，并在该NPN中发起终端设备注册。该注册消息中可以包括该终端设备的标识和/或该终端设备请求访问的托管网络的标识。其中，该托管网络是基于该NPN构建的。
2、该NPN中的AMF应该向AUSF(第一网络设备)发送Nausf_UEAuthentication_Authenticate请求，来请求对该终端设备进行身份认证。该请求消息中包括该终端设备的标识和/或该终端设备请求访问的托管网络的标识。AMF可以根据3GPP技术规范TS 23.501中规定的标准发现并选择AUSF。
如果该NPN中没有该终端设备的订阅信息(比如该终端设备可能正在访问该NPN且该NPN中没有该终端设备的订阅数据，或者该终端设备是仅在该NPN在线签约(onboarding)以获取身份验证的凭证而不需要该NPN提供服务等等)，该终端设备向该AUSF发送的第一指示信息可以用于该AUSF确定省略向UDM发送消息(也就是省略图10所示的实施例中的步骤3-5)。AUSF接收到该第一指示信息之后，可以不向UDM发送消息，而是直接通过NPN中的NSSAAF，向第二网络设备发送该第二请求消息。
3、AUSF(第一网络设备)可以根据3GPP技术规范TS 23.501中的规定，发起Nnssaaf_AIWF_Authenticate服务操作，向NSSAAF发送Nnssaaf_AIWF_Authenticate请求。其中，NSSAAF的定义可以参考在3GPP技术规范TS 23.501。
该Nnssaaf_AIWF_Authenticate请求中包括该终端设备的标识(SUPI或匿名SUPI)。
4、NSSAAF能够根据与SUPI的区域(realm)部分对应的域名选择第二网络设备。NSSAAF能够执行相关协议转换，并将EAP消息中继到第二网络设备。
5、终端设备和第二网络设备能够执行相互认证。第二网络设备能够作为提供认证服务的网络设备(比如作为EAP服务器)，用于身份验证。第二网络设备在步骤7中的EAP响应/标识消息中接收的EAP标识可以包含匿名的SUPI。在这种情况下，第二网络设备使用EAP方法特定的EAP身份请求/响应消息来获取终端设备的标识，作为终端设备和第二网络设备之间的EAP认证的一部分。
6、认证成功后，第二网络设备能够向NSSAAF提供MSK和SUPI(即用于成功EAP认证的终端设备的标识)。
7、NSSAAF使用Nnssaaf_AIWF_Authenticate响应消息将MSK和SUPI返回给AUSF(第一网络设备)。
如果该NPN中没有该终端设备的订阅信息(比如该终端设备可能正在访问该NPN且该NPN中没 有该终端设备的订阅数据，或者该终端设备是仅在该NPN在线签约(onboarding)以获取身份验证的凭证而不需要该NPN提供服务等等)，AUSF(第一网络设备)可以不向UDM通知有关接收到的SUPI的身份验证结果，以验证该SUPI是否对应于NPN中的有效订阅(也就是省略图10所示的实施例中的步骤11-13)。
8、AUSF能够将MSK的256位或128位作为第一安全密钥K AUSF。AUSF还能够根据一个密钥导出函数KDF从第一安全密钥K AUSF中推导出第二安全密钥K SEAF。该密钥导出函数如前各实施例所述，在此不再赘述。
9、AUSF能够将该终端设备身份验证成功的指示(第一响应消息)与该终端设备的SUPI，以及步骤8中计算出的第二安全密钥K SEAF一起发送给AMF/SEAF。
10、AMF/SEAF能够在非接入层(non-access stratum，NAS)消息中向终端设备发送身份验证成功的指示(第一响应消息)。
11、终端设备在接收到验证成功的指示(第一响应消息)之后，能够确定主会话密钥MSK，并将MSK的256位或128位作为第一安全密钥K AUSF。该终端设备还能够据一个同样的密钥导出函数KDF从第一安全密钥K AUSF中推导出第二安全密钥K SEAF。该密钥导出函数如前各实施例所述，在此不再赘述。
综上，本申请实施例提供的身份验证方法，能够提供一种终端设备与访问网络之间的相互认证机制，使得终端设备与访问的网络之间能够相互认证，终端设备能够安全地访问该网络，获取该网络提供的服务，有效保护了终端设备与访问网络之间的信息交互安全，提高系统的安全性、私密性。
与上述几种实施例提供的身份验证方法相对应，本申请还提供一种身份验证装置，由于本申请实施例提供的身份验证装置与上述几种实施例提供的方法相对应，因此在身份验证方法的实施方式也适用于下述实施例提供的身份验证装置，在下述实施例中不再详细描述。
请参见图12，图12为本申请实施例提供的一种身份验证装置的结构示意图。
如图12所示，该身份验证装置1200包括：收发单元1210，其中：
收发单元1210，用于通过接入网设备向非公共网络NPN中的第一网络设备发送第一请求消息，该第一请求消息用于该第一网络设备确定第二请求消息，该第二请求消息用于请求与该NPN对应的第二网络设备对该装置进行身份验证；
该收发单元1210，还用于接收该第一网络设备通过该接入网设备发送的第一响应消息，该第一响应消息用于指示该装置身份验证是否成功。
可选地，该第二网络设备用于为与该第二网络设备对应的唯一一个NPN提供服务。
可选地，该第一请求消息包括该终端设备的标识和/或该终端设备请求访问的托管网络的标识；该托管网络是基于该NPN构建的。
可选地，该终端设备正在访问该NPN且该NPN中不包括该终端设备的订阅信息，该收发单元1210还用于：向该第一网络设备发送第一指示信息，该第一指示信息用于该第一网络设备确定省略向该NPN中的统一数据管理功能UDM发送消息。
可选地，该第一指示信息为该终端设备的标识；或者，该第一指示信息用于指示该NPN中不包括该终端设备的订阅信息。
可选地，该第一响应消息用于指示该终端设备身份验证成功，该装置还包括处理单元(图中未示出)，该处理单元用于：确定主会话密钥MSK；根据该MSK，确定第一安全密钥KAUSF；根据该第一安全密钥KAUSF和服务网络名称，确定第二安全密钥KSEAF，该第二安全密钥KSEAF用于该终端设备访问该NPN。
可选地，该第一请求消息中包括该托管网络的标识，该服务网络名称为该托管网络的标识。
可选地，该第一请求消息中不包括该托管网络的标识，该服务网络名称为该NPN的标识。
可选地，该第二安全密钥KSEAF用于该终端设备通过接入网设备与该NPN中的安全锚点功能SEAF进行交互，该SEAF中存储的该第二安全密钥KSEAF是由该第一网络设备发送给该SEAF的。
可选地，该第二网络设备为该NPN提供的服务包括：认证，授权和计费中的至少一种。
可选地，该第一请求消息是，该终端设备通过该接入网设备和该NPN中的接入和移动性管理功能AMF向该第一网络设备发送的；该第一响应消息是，该第一网络设备通过该NPN中的接入和移动性管理功能AMF和该接入网设备向该终端设备发送的。
本实施例的身份验证装置，可以通过向非公共网络NPN中的第一网络设备发送第一请求消息，该第一请求消息用于该第一网络设备确定第二请求消息，该第二请求消息用于请求与该NPN对应的第二网络设备对该终端设备进行身份验证，接收该第一网络设备通过该接入网设备发送的第一响应消息，该第一响应消息用于指示该终端设备身份验证是否成功，使得终端设备与访问的网络之间能够相互认证，安全地访问该网络，获取该网络提供的服务，有效保护了终端设备与访问网络之间的信息交互安全，提高系统的安全性、私密性。
请参见图13，图13为本申请实施例提供的一种身份验证装置的结构示意图。
如图13所示，该身份验证装置1300包括：收发单元1310和处理单元1320，其中：
收发单元1310，用于接收终端设备通过接入网设备发送的第一请求消息；
处理单元1320，用于根据该第一请求消息，向与该装置所在的非公共网络NPN对应的第二网络设备发送第二请求消息，该第二请求消息用于请求该第二网络设备对该终端设备进行身份验证；
该收发单元1310，还用于接收该第二网络设备发送的该终端设备身份验证的结果；
该处理单元1320，还用于根据该终端设备身份验证的结果，通过该接入网设备向该终端设备发送第一响应消息，该第一响应消息用于指示该终端设备身份验证是否成功。
可选地，该第二网络设备用于为与该第二网络设备对应的唯一一个NPN提供服务。
可选地，该第一请求消息包括该终端设备的标识和/或该终端设备请求访问的托管网络的标识；该托管网络是基于该NPN构建的。
可选地，该终端设备正在访问该NPN且该NPN中不包括该终端设备的订阅信息，该收发单元1310还用于：接收该终端设备发送的第一指示信息，该第一指示信息用于该第一网络设备确定省略向该NPN中的统一数据管理功能UDM发送消息；通过该NPN中的网络切片特定的认证和授权功能NSSAAF，向该第二网络设备发送该第二请求消息。
可选地，该第一指示信息为该终端设备的标识；或者，该第一指示信息用于指示该NPN中不包括该终端设备的订阅信息。
可选地，该第一指示信息为该终端设备的标识，该第一指示信息用于指示该第一网络设备根据该第一网络设备的本地策略，省略向该UDM发送消息。
可选地，该第一指示信息用于指示该NPN中不包括该终端设备的订阅信息，该第一指示信息用于指示该第一网络设备根据该第一指示信息，省略向该UDM发送消息。
可选地，该终端设备正在访问该NPN且该NPN中不包括该终端设备的订阅信息，该收发单元1310还用于：向该NPN中的统一数据管理功能UDM查询该终端设备的订阅信息，且未查询到该终端设备的订阅信息；通过该NPN中的网络切片特定的认证和授权功能NSSAAF，向该第二网络设备发送该第二请求消息。
可选地，该第一响应消息用于指示该终端设备身份验证成功，该处理单元1320还用于：接收该第二网络设备发送的主会话密钥MSK；根据该MSK，确定第一安全密钥KAUSF；根据该第一安全密钥KAUSF和服务网络名称，确定第二安全密钥KSEAF，该第二安全密钥KSEAF用于该终端设备访问该 NPN。
可选地，该第一请求消息中包括该托管网络的标识，该服务网络名称为该托管网络的标识。
可选地，该第一请求消息中不包括该托管网络的标识，该服务网络名称为该NPN的标识。
可选地，该收发单元1310还用于：向该NPN中的安全锚点功能SEAF发送该第二安全密钥KSEAF，该第二安全密钥KSEAF用于该终端设备通过接入网设备与该NPN中的安全锚点功能SEAF进行交互。
可选地，该第二网络设备为该NPN提供的服务包括：认证，授权和计费中的至少一种。
可选地，该第一请求消息是，该终端设备通过该接入网设备和该NPN中的接入和移动性管理功能AMF向该第一网络设备发送的；该第一响应消息是，该第一网络设备通过该NPN中的接入和移动性管理功能AMF和该接入网设备向该终端设备发送的。
本实施例的身份验证装置，可以通过接收终端设备通过接入网设备发送的第一请求消息，根据该第一请求消息，向与该第一网络设备所在的NPN对应的第二网络设备发送第二请求消息，该第二请求消息用于请求该第二网络设备对该终端设备进行身份验证，接收该第二网络设备发送的终端设备身份验证的结果，根据该终端设备身份验证的结果，通过该接入网设备向该终端设备发送第一响应消息，该第一响应消息用于指示该终端设备身份验证是否成功，使得终端设备与访问的网络之间能够相互认证，安全地访问该网络，获取该网络提供的服务，有效保护了终端设备与访问网络之间的信息交互安全，提高系统的安全性、私密性。
请参见图14，图14为本申请实施例提供的一种身份验证装置的结构示意图。
如图14所示，该身份验证装置1400包括：收发单元1410，其中：
收发单元1410，用于接收第一网络设备发送的第二请求消息，该第二请求消息是该第一网络设备根据终端设备发送的第一请求消息确定的，该第二请求消息用于请求与该第一网络设备所在的非公共网络NPN对应的该装置对该终端设备进行身份验证；
该收发单元1410，还用于向该第一网络设备发送该终端设备身份验证的结果，该终端设备身份验证的结果，用于确定第一响应消息，该第一响应消息用于指示该终端设备身份验证是否成功。
可选地，该第二网络设备用于为与该第二网络设备对应的唯一一个NPN提供服务。
可选地，该第一请求消息包括该终端设备的标识和/或该终端设备请求访问的托管网络的标识；该托管网络是基于该NPN构建的。
可选地，该收发单元1410还用于：接收该第一网络设备通过该NPN中的网络切片特定的认证和授权功能NSSAAF，发送的该第二请求消息。
可选地，该第一响应消息用于指示该终端设备身份验证成功，该收发单元1410还用于：向该第一网络设备发送主会话密钥MSK；该MSK用于该第一网络设备确定第一安全密钥KAUSF，该第一安全密钥KAUSF和服务网络名称用于该第一网络设备确定第二安全密钥KSEAF。
可选地，该第一请求消息中包括该托管网络的标识，该服务网络名称为该托管网络的标识。
可选地，该第一请求消息中不包括该托管网络的标识，该服务网络名称为该NPN的标识。
可选地，该第二网络设备为该NPN提供的服务包括：认证，授权和计费中的至少一种。
本实施例的身份验证装置，可以通过接收第一网络设备发送的第二请求消息，该第二请求消息是该第一网络设备根据终端设备发送的第一请求消息确定的，该第二请求消息用于请求与该第一网络设备所在的NPN对应的该第二网络设备对该终端设备进行身份验证，向该第一网络设备发送该终端设备身份验证的结果，该终端设备身份验证的结果，用于确定第一响应消息，该第一响应消息用于指示该终端设备身份验证是否成功，使得终端设备与访问的网络之间能够相互认证，终端设备能够安全地访问该网络，获取该网络提供的服务，有效保护了终端设备与访问网络之间的信息交互安全，提高系统 的安全性、私密性。
请参见图15，图15为本申请实施例提供的一种通信系统示意图。
如图15所示，该通信系统包括：终端设备，第一网络设备和第二网络设备，其中：
终端设备，用于执行图2至图4实施例所示的方法
第一网络设备，用于执行图5至图7实施例所示的方法；
第二网络设备，用于执行图8至图9实施例所示的方法。
为了实现上述实施例，本申请实施例还提出一种通信装置，包括：处理器和存储器，存储器中存储有计算机程序，处理器执行所述存储器中存储的计算机程序，以使装置执行图2至图4实施例所示的方法。
为了实现上述实施例，本申请实施例还提出一种通信装置，包括：处理器和存储器，存储器中存储有计算机程序，处理器执行所述存储器中存储的计算机程序，以使装置执行图5至图7实施例所示的方法，或者执行图8至图9实施例所示的方法。
为了实现上述实施例，本申请实施例还提出一种通信装置，包括：处理器和接口电路，接口电路，用于接收代码指令并传输至处理器，处理器，用于运行所述代码指令以执行图2至图4实施例所示的方法。
为了实现上述实施例，本申请实施例还提出一种通信装置，包括：处理器和接口电路，接口电路，用于接收代码指令并传输至处理器，处理器，用于运行所述代码指令以执行图5至图7实施例所示的方法，或者执行图8至图9实施例所示的方法。
请参见图16，图16是本申请实施例提供的另一种身份验证装置的结构示意图。身份验证装置1600可以是网络设备，也可以是终端设备，也可以是支持网络设备实现上述方法的芯片、芯片系统、或处理器等，还可以是支持终端设备实现上述方法的芯片、芯片系统、或处理器等。该装置可用于实现上述方法实施例中描述的方法，具体可以参见上述方法实施例中的说明。
身份验证装置1600可以包括一个或多个处理器1601。处理器1601可以是通用处理器或者专用处理器等。例如可以是基带处理器或中央处理器。基带处理器可以用于对通信协议以及通信数据进行处理，中央处理器可以用于对身份验证装置(如，基站、基带芯片，终端设备、终端设备芯片，DU或CU等)进行控制，执行计算机程序，处理计算机程序的数据。
可选的，身份验证装置1600中还可以包括一个或多个存储器1602，其上可以存有计算机程序1603，处理器1601执行计算机程序1603，以使得身份验证装置1600执行上述方法实施例中描述的方法。计算机程序1603可能固化在处理器1601中，该种情况下，处理器1601可能由硬件实现。
可选的，存储器1602中还可以存储有数据。身份验证装置1600和存储器1602可以单独设置，也可以集成在一起。
可选的，身份验证装置1600还可以包括收发器1605、天线1606。收发器1605可以称为收发单元、收发机、或收发电路等，用于实现收发功能。收发器1605可以包括接收器和发送器，接收器可以称为接收机或接收电路等，用于实现接收功能；发送器可以称为发送机或发送电路等，用于实现发送功能。
可选的，身份验证装置1600中还可以包括一个或多个接口电路1607。接口电路1607用于接收代码指令并传输至处理器1601。处理器1601运行代码指令以使身份验证装置1600执行上述方法实施例中描述的方法。
在一种实现方式中，处理器1601中可以包括用于实现接收和发送功能的收发器。例如该收发器可以是收发电路，或者是接口，或者是接口电路。用于实现接收和发送功能的收发电路、接口或接口电 路可以是分开的，也可以集成在一起。上述收发电路、接口或接口电路可以用于代码/数据的读写，或者，上述收发电路、接口或接口电路可以用于信号的传输或传递。
在一种实现方式中，身份验证装置1600可以包括电路，电路可以实现前述方法实施例中发送或接收或者通信的功能。本申请中描述的处理器和收发器可实现在集成电路(integrated circuit，IC)、模拟IC、射频集成电路RFIC、混合信号IC、专用集成电路(application specific integrated circuit，ASIC)、印刷电路板(printed circuit board，PCB)、电子设备等上。该处理器和收发器也可以用各种IC工艺技术来制造，例如互补金属氧化物半导体(complementary metal oxide semiconductor，CMOS)、N型金属氧化物半导体(nMetal-oxide-semiconductor，NMOS)、P型金属氧化物半导体(positive channel metal oxide semiconductor，PMOS)、双极结型晶体管(bipolar junction transistor，BJT)、双极CMOS(BiCMOS)、硅锗(SiGe)、砷化镓(GaAs)等。
以上实施例描述中的身份验证装置可以是网络设备或者终端设备，但本申请中描述的身份验证装置的范围并不限于此，而且身份验证装置的结构可以不受图12-图14的限制。身份验证装置可以是独立的设备或者可以是较大设备的一部分。例如身份验证装置可以是：
(1)独立的集成电路IC，或芯片，或，芯片系统或子系统；
(2)具有一个或多个IC的集合，可选的，该IC集合也可以包括用于存储数据，计算机程序的存储部件；
(3)ASIC，例如调制解调器(Modem)；
(4)可嵌入在其他设备内的模块；
(5)接收机、终端设备、智能终端设备、蜂窝电话、无线设备、手持机、移动单元、车载设备、网络设备、云设备、人工智能设备等等；
(6)其他等等。
对于身份验证装置可以是芯片或芯片系统的情况，可参见图17所示的芯片的结构示意图。图17所示的芯片包括处理器1701和接口1702。其中，处理器1701的数量可以是一个或多个，接口1702的数量可以是多个。
对于芯片用于实现本申请实施例中网络设备的功能的情况：
接口1702，用于代码指令并传输至处理器；
处理器1701，用于运行代码指令以执行如图5至图7的方法，或者执行如图8至图9的方法。
对于芯片用于实现本申请实施例中终端设备的功能的情况：
接口1702，用于代码指令并传输至处理器；
处理器1701，用于运行代码指令以执行如图2至图4的方法。
可选的，芯片还包括存储器1703，存储器1703用于存储必要的计算机程序和数据。
本领域技术人员还可以了解到本申请实施例列出的各种说明性逻辑块(illustrative logical block)和步骤(step)可以通过电子硬件、电脑软件，或两者的结合进行实现。这样的功能是通过硬件还是软件来实现取决于特定的应用和整个系统的设计要求。本领域技术人员可以对于每种特定的应用，可以使用各种方法实现的功能，但这种实现不应被理解为超出本申请实施例保护的范围。
本申请实施例还提供一种通信系统，该系统包括前述图12-图14实施例中作为终端设备的身份验证装置，或者，该系统包括前述图16实施例中作为终端设备的身份验证装置。
本申请还提供一种可读存储介质，其上存储有指令，该指令被计算机执行时实现上述任一方法实施例的功能。
本申请还提供一种计算机程序产品，该计算机程序产品被计算机执行时实现上述任一方法实施例的功能。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件 实现时，可以全部或部分地以计算机程序产品的形式实现。计算机程序产品包括一个或多个计算机程序。在计算机上加载和执行计算机程序时，全部或部分地产生按照本申请实施例的流程或功能。计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。计算机程序可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，计算机程序可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disk，SSD))等。
本领域普通技术人员可以理解：本申请中涉及的第一、第二等各种数字编号仅为描述方便进行的区分，并不用来限制本申请实施例的范围，也表示先后顺序。
本申请中的至少一个还可以描述为一个或多个，多个可以是两个、三个、四个或者更多个，本申请不做限制。在本申请实施例中，对于一种技术特征，通过“第一”、“第二”、“第三”、“A”、“B”、“C”和“D”等区分该种技术特征中的技术特征，该“第一”、“第二”、“第三”、“A”、“B”、“C”和“D”描述的技术特征间无先后顺序或者大小顺序。
本申请中各表所示的对应关系可以被配置，也可以是预定义的。各表中的信息的取值仅仅是举例，可以配置为其他值，本申请并不限定。在配置信息与各参数的对应关系时，并不一定要求必须配置各表中示意出的所有对应关系。例如，本申请中的表格中，某些行示出的对应关系也可以不配置。又例如，可以基于上述表格做适当的变形调整，例如，拆分，合并等等。上述各表中标题示出参数的名称也可以采用通信装置可理解的其他名称，其参数的取值或表示方式也可以通信装置可理解的其他取值或表示方式。上述各表在实现时，也可以采用其他的数据结构，例如可以采用数组、队列、容器、栈、线性表、指针、链表、树、图、结构体、类、堆、散列表或哈希表等。
本申请中的预定义可以理解为定义、预先定义、存储、预存储、预协商、预配置、固化、或预烧制。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
应当理解，可以使用上面所示的各种形式的流程，重新排序、增加或删除步骤。例如，本申请实施例中记载的各步骤可以并行地执行也可以顺序地执行也可以不同的次序执行，只要能够实现本发明公开的技术方案所期望的结果，本文在此不进行限制。
上述具体实施方式，并不构成对本发明保护范围的限制。本领域技术人员应该明白的是，根据设计要求和其他因素，可以进行各种修改、组合、子组合和替代。任何在本发明的精神和原则之内所作的修改、等同替换和改进等，均应包含在本发明保护范围之内。

Claims (40)

  1. 一种身份验证方法，其特征在于，所述方法由终端设备执行，所述方法包括：
    通过接入网设备向非公共网络NPN中的第一网络设备发送第一请求消息，所述第一请求消息用于所述第一网络设备确定第二请求消息，所述第二请求消息用于请求与所述NPN对应的第二网络设备对所述终端设备进行身份验证；
    接收所述第一网络设备通过所述接入网设备发送的第一响应消息，所述第一响应消息用于指示所述终端设备身份验证是否成功。
  2. 根据权利要求1所述的方法，其特征在于，所述第二网络设备用于为与所述第二网络设备对应的唯一一个NPN提供服务。
  3. 根据权利要求1所述的方法，其特征在于，所述第一请求消息包括所述终端设备的标识和/或所述终端设备请求访问的托管网络的标识；所述托管网络是基于所述NPN构建的。
  4. 根据权利要求1所述的方法，其特征在于，所述终端设备正在访问所述NPN且所述NPN中不包括所述终端设备的订阅信息，所述方法还包括：
    向所述第一网络设备发送第一指示信息，所述第一指示信息用于所述第一网络设备确定省略向所述NPN中的统一数据管理功能UDM发送消息。
  5. 根据权利要求4所述的方法，其特征在于，所述第一指示信息为所述终端设备的标识；或者，所述第一指示信息用于指示所述NPN中不包括所述终端设备的订阅信息。
  6. 根据权利要求3所述的方法，其特征在于，所述第一响应消息用于指示所述终端设备身份验证成功，所述方法还包括：
    确定主会话密钥MSK；
    根据所述MSK，确定第一安全密钥K AUSF；
    根据所述第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，所述第二安全密钥K SEAF用于所述终端设备访问所述NPN。
  7. 根据权利要求6所述的方法，其特征在于，所述第一请求消息中包括所述托管网络的标识，所述服务网络名称为所述托管网络的标识。
  8. 根据权利要求6所述的方法，其特征在于，所述第一请求消息中不包括所述托管网络的标识，所述服务网络名称为所述NPN的标识。
  9. 根据权利要求6所述的方法，其特征在于，所述第二安全密钥K SEAF用于所述终端设备通过接入网设备与所述NPN中的安全锚点功能SEAF进行交互，所述SEAF中存储的所述第二安全密钥K SEAF是由所述第一网络设备发送给所述SEAF的。
  10. 根据权利要求2所述的方法，其特征在于，所述第二网络设备为所述NPN提供的服务包括：认证，授权和计费中的至少一种。
  11. 根据权利要求1-10任一项所述的方法，其特征在于，
    所述第一请求消息是，所述终端设备通过所述接入网设备和所述NPN中的接入和移动性管理功能AMF向所述第一网络设备发送的；
    所述第一响应消息是，所述第一网络设备通过所述NPN中的接入和移动性管理功能AMF和所述接入网设备向所述终端设备发送的。
  12. 一种身份验证方法，其特征在于，所述方法由第一网络设备执行，所述方法包括：
    接收终端设备通过接入网设备发送的第一请求消息；
    根据所述第一请求消息，向与所述第一网络设备所在的非公共网络NPN对应的第二网络设备发送 第二请求消息，所述第二请求消息用于请求所述第二网络设备对所述终端设备进行身份验证；
    接收所述第二网络设备发送的所述终端设备身份验证的结果；
    根据所述终端设备身份验证的结果，通过所述接入网设备向所述终端设备发送第一响应消息，所述第一响应消息用于指示所述终端设备身份验证是否成功。
  13. 根据权利要求12所述的方法，其特征在于，所述第二网络设备用于为与所述第二网络设备对应的唯一一个NPN提供服务。
  14. 根据权利要求12所述的方法，其特征在于，所述第一请求消息包括所述终端设备的标识和/或所述终端设备请求访问的托管网络的标识；所述托管网络是基于所述NPN构建的。
  15. 根据权利要求12所述的方法，其特征在于，所述终端设备正在访问所述NPN且所述NPN中不包括所述终端设备的订阅信息，所述方法还包括：
    接收所述终端设备发送的第一指示信息，所述第一指示信息用于所述第一网络设备确定省略向所述NPN中的统一数据管理功能UDM发送消息；
    通过所述NPN中的网络切片特定的认证和授权功能NSSAAF，向所述第二网络设备发送所述第二请求消息。
  16. 根据权利要求15所述的方法，其特征在于，所述第一指示信息为所述终端设备的标识；或者，所述第一指示信息用于指示所述NPN中不包括所述终端设备的订阅信息。
  17. 根据权利要求16所述的方法，其特征在于，所述第一指示信息为所述终端设备的标识，所述第一指示信息用于指示所述第一网络设备根据所述第一网络设备的本地策略，省略向所述UDM发送消息。
  18. 根据权利要求16所述的方法，其特征在于，所述第一指示信息用于指示所述NPN中不包括所述终端设备的订阅信息，所述第一指示信息用于指示所述第一网络设备根据所述第一指示信息，省略向所述UDM发送消息。
  19. 根据权利要求12所述的方法，其特征在于，所述终端设备正在访问所述NPN且所述NPN中不包括所述终端设备的订阅信息，所述方法还包括：
    向所述NPN中的统一数据管理功能UDM查询所述终端设备的订阅信息，且未查询到所述终端设备的订阅信息；
    通过所述NPN中的网络切片特定的认证和授权功能NSSAAF，向所述第二网络设备发送所述第二请求消息。
  20. 根据权利要求14所述的方法，其特征在于，所述第一响应消息用于指示所述终端设备身份验证成功，所述方法还包括：
    接收所述第二网络设备发送的主会话密钥MSK；
    根据所述MSK，确定第一安全密钥K AUSF；
    根据所述第一安全密钥K AUSF和服务网络名称，确定第二安全密钥K SEAF，所述第二安全密钥K SEAF用于所述终端设备访问所述NPN。
  21. 根据权利要求20所述的方法，其特征在于，所述第一请求消息中包括所述托管网络的标识，所述服务网络名称为所述托管网络的标识。
  22. 根据权利要求20所述的方法，其特征在于，所述第一请求消息中不包括所述托管网络的标识，所述服务网络名称为所述NPN的标识。
  23. 根据权利要求20所述的方法，其特征在于，所述方法还包括：
    向所述NPN中的安全锚点功能SEAF发送所述第二安全密钥K SEAF，所述第二安全密钥K SEAF用于所述终端设备通过接入网设备与所述NPN中的安全锚点功能SEAF进行交互。
  24. 根据权利要求13所述的方法，其特征在于，所述第二网络设备为所述NPN提供的服务包括： 认证，授权和计费中的至少一种。
  25. 根据权利要求12-24任一项所述的方法，其特征在于，
    所述第一请求消息是，所述终端设备通过所述接入网设备和所述NPN中的接入和移动性管理功能AMF向所述第一网络设备发送的；
    所述第一响应消息是，所述第一网络设备通过所述NPN中的接入和移动性管理功能AMF和所述接入网设备向所述终端设备发送的。
  26. 一种身份验证方法，其特征在于，所述方法由第二网络设备执行，所述方法包括：
    接收第一网络设备发送的第二请求消息，所述第二请求消息是所述第一网络设备根据终端设备发送的第一请求消息确定的，所述第二请求消息用于请求与所述第一网络设备所在的非公共网络NPN对应的所述第二网络设备对所述终端设备进行身份验证；
    向所述第一网络设备发送所述终端设备身份验证的结果，所述终端设备身份验证的结果，用于确定第一响应消息，所述第一响应消息用于指示所述终端设备身份验证是否成功。
  27. 根据权利要求26所述的方法，其特征在于，所述第二网络设备用于为与所述第二网络设备对应的唯一一个NPN提供服务。
  28. 根据权利要求26所述的方法，其特征在于，所述第一请求消息包括所述终端设备的标识和/或所述终端设备请求访问的托管网络的标识；所述托管网络是基于所述NPN构建的。
  29. 根据权利要求26所述的方法，其特征在于，所述方法还包括：
    接收所述第一网络设备通过所述NPN中的网络切片特定的认证和授权功能NSSAAF发送的所述第二请求消息。
  30. 根据权利要求28所述的方法，其特征在于，所述第一响应消息用于指示所述终端设备身份验证成功，所述方法还包括：
    向所述第一网络设备发送主会话密钥MSK；
    所述MSK用于所述第一网络设备确定第一安全密钥K AUSF，所述第一安全密钥K AUSF和服务网络名称用于所述第一网络设备确定第二安全密钥K SEAF。
  31. 根据权利要求30所述的方法，其特征在于，所述第一请求消息中包括所述托管网络的标识，所述服务网络名称为所述托管网络的标识。
  32. 根据权利要求30所述的方法，其特征在于，所述第一请求消息中不包括所述托管网络的标识，所述服务网络名称为所述NPN的标识。
  33. 根据权利要求27所述的方法，其特征在于，所述第二网络设备为所述NPN提供的服务包括：认证，授权和计费中的至少一种。
  34. 一种身份验证装置，其特征在于，所述装置包括：
    收发单元，用于通过接入网设备向非公共网络NPN中的第一网络设备发送第一请求消息，所述第一请求消息用于所述第一网络设备确定第二请求消息，所述第二请求消息用于请求与所述NPN对应的第二网络设备对所述装置进行身份验证；
    所述收发单元，还用于接收所述第一网络设备通过所述接入网设备发送的第一响应消息，所述第一响应消息用于指示所述装置身份验证是否成功。
  35. 一种身份验证装置，其特征在于，所述装置包括：
    收发单元，用于接收终端设备通过接入网设备发送的第一请求消息；
    处理单元，用于根据所述第一请求消息，向与所述装置所在的非公共网络NPN对应的第二网络设 备发送第二请求消息，所述第二请求消息用于请求所述第二网络设备对所述终端设备进行身份验证；
    所述收发单元，还用于接收所述第二网络设备发送的所述终端设备身份验证的结果；
    所述处理单元，还用于根据所述终端设备身份验证的结果，通过所述接入网设备向所述终端设备发送第一响应消息，所述第一响应消息用于指示所述终端设备身份验证是否成功。
  36. 一种身份验证装置，其特征在于，所述装置包括：
    收发单元，用于接收第一网络设备发送的第二请求消息，所述第二请求消息是所述第一网络设备根据终端设备发送的第一请求消息确定的，所述第二请求消息用于请求与所述第一网络设备所在的非公共网络NPN对应的所述装置对所述终端设备进行身份验证；
    所述处理单元，还用于向所述第一网络设备发送所述终端设备身份验证的结果，所述终端设备身份验证的结果，用于确定第一响应消息，所述第一响应消息用于指示所述终端设备身份验证是否成功。
  37. 一种通信装置，其特征在于，所述装置包括处理器和存储器，所述存储器中存储有计算机程序，所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行如权利要求1至11中任一项所述的方法，或者执行如权利要求12至25中任一项所述的方法，或者执行如权利要求26至33中任一项所述的方法。
  38. 一种通信装置，其特征在于，包括：处理器和接口电路；
    所述接口电路，用于接收代码指令并传输至所述处理器；
    所述处理器，用于运行所述代码指令以执行如权利要求1至11中任一项所述的方法，或者执行如权利要求12至25中任一项所述的方法，或者执行如权利要求26至33中任一项所述的方法。
  39. 一种计算机可读存储介质，用于存储有指令，当所述指令被执行时，使如权利要求1至11中任一项所述的方法被实现，或者使如权利要求11至25中任一项所述的方法被实现，或者使如权利要求26至33中任一项所述的方法被实现。
  40. 一种通信系统，其特征在于，所述通信系统包括：
    终端设备，用于执行如权利要求1至11中任一项所述的方法；
    第一网络设备，用于执行如权利要求12至25中任一项所述的方法；
    第二网络设备，用于执行如权利要求26至33中任一项所述的方法。
PCT/CN2022/130134 2022-11-04 2022-11-04 身份验证方法及装置 WO2024092826A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/130134 WO2024092826A1 (zh) 2022-11-04 2022-11-04 身份验证方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/130134 WO2024092826A1 (zh) 2022-11-04 2022-11-04 身份验证方法及装置

Publications (1)

Publication Number Publication Date
WO2024092826A1 true WO2024092826A1 (zh) 2024-05-10

Family

ID=90929502

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/130134 WO2024092826A1 (zh) 2022-11-04 2022-11-04 身份验证方法及装置

Country Status (1)

Country Link
WO (1) WO2024092826A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111465011A (zh) * 2019-01-18 2020-07-28 华为技术有限公司 跨网络接入方法、装置、存储介质及通信系统
CN112672336A (zh) * 2019-09-30 2021-04-16 华为技术有限公司 实现外部认证的方法、通信装置及通信系统
CN113709736A (zh) * 2020-05-09 2021-11-26 华为技术有限公司 网络认证方法及装置、系统
CN113766502A (zh) * 2020-05-18 2021-12-07 英特尔公司 用在ue、smf实体、以及预配置服务器中的装置
WO2021245629A1 (en) * 2020-06-05 2021-12-09 Lenovo (Singapore) Pte. Ltd. Authenticating a device not having a subscription in a network

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111465011A (zh) * 2019-01-18 2020-07-28 华为技术有限公司 跨网络接入方法、装置、存储介质及通信系统
CN112672336A (zh) * 2019-09-30 2021-04-16 华为技术有限公司 实现外部认证的方法、通信装置及通信系统
CN113709736A (zh) * 2020-05-09 2021-11-26 华为技术有限公司 网络认证方法及装置、系统
CN113766502A (zh) * 2020-05-18 2021-12-07 英特尔公司 用在ue、smf实体、以及预配置服务器中的装置
WO2021245629A1 (en) * 2020-06-05 2021-12-09 Lenovo (Singapore) Pte. Ltd. Authenticating a device not having a subscription in a network

Similar Documents

Publication Publication Date Title
US7917942B2 (en) System and method for configuring security in a plug-and-play architecture
JP6936393B2 (ja) パラメータ保護方法及びデバイス、並びに、システム
WO2007122577A1 (en) Methods, devices and modules for secure remote access to home networks
WO2021197347A1 (zh) 通信系统、方法及装置
TW201939987A (zh) 終端訊息的傳遞方法及相關產品
US20240073685A1 (en) Method for authentication for nswo service, device, and storage medium
WO2024092826A1 (zh) 身份验证方法及装置
WO2024065339A1 (zh) 一种网络卫星覆盖数据的授权方法、设备及存储介质
WO2024065564A1 (zh) 一种api的调用方法、装置、设备及存储介质
WO2024065706A1 (zh) 一种构建连接的方法及装置
WO2024065469A1 (zh) 一种直连链路建立方法、设备及存储介质
WO2024082143A1 (zh) 一种设备业务角色的验证方法/装置/设备及存储介质
WO2024065336A1 (zh) 一种侧行链路定位方法及装置
WO2024065335A1 (zh) 一种侧行链路定位方法及装置
WO2024065705A1 (zh) 应用功能授权方法及装置
WO2024031732A1 (zh) 终端设备能力指示方法及装置
WO2024031724A1 (zh) 终端设备能力指示方法及装置
WO2024098219A1 (zh) 一种密钥分发方法、装置、设备及存储介质
WO2024098323A1 (zh) 一种通过托管网络提供本地化服务的方法及其装置
WO2023245520A1 (zh) 一种定位服务的直接通信方法及装置
WO2023087191A1 (zh) 无线资源控制rrc拒绝消息的传输方法及装置
WO2023115487A1 (zh) 一种人工智能会话的创建方法及其装置
WO2021036627A1 (zh) 一种通信系统、方法及装置
WO2024065140A1 (zh) 一种用户设备ue的角色授权方法/装置/设备及存储介质
WO2024050778A1 (zh) 一种人工智能服务策略的更新方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22964127

Country of ref document: EP

Kind code of ref document: A1