CN110366178A - An authentication method and network element - Google Patents

Abstract

The present application discloses an authentication method and a network element, including: the first network element receives a request from a SEAF network element carrying first indication information; wherein, the first indication information is used to indicate that the second network element is capable of performing fast authentication capability; the first network element performs fast authentication with the second network element according to the first indication information. It can be seen from the embodiment of the present invention that when the first network element needs to perform fast authentication on the second network element, the first network element directly performs fast authentication with the second network element according to the first indication information, thus ensuring the flexibility of fast authentication sex.

Description

An authentication method and network element

technical field

The embodiment of the present invention relates to the technical field of communication, in particular to an authentication method and a network element.

Background technique

The 3rd Generation Partnership Project (3rd Generation Partnership Project, 3GPP) proposed a certification framework under the architecture of the 5th-Generation mobile communication technology (5G), as shown in Figure 1, the framework includes the requirements Access to the network UE (User Equipment, UE), security anchor function (Security Anchor Function, SEAF) network element, authentication service function (AuthenticationSevericeFunction, AUSF) network element, and authentication subscription storage function (Authentication Repository Function, ARPF) network element . Among them, the SEAF network element is responsible for authenticating the UE's visited site and maintaining the access key during the authentication process. The UE will also generate an access key during the authentication process. Through the same access key, the UE can access the services provided by the visited network. ; The AUSF network element is responsible for authenticating the UE's home location to confirm whether the authentication of the visiting location is successful. The home key generated during the authentication process is stored locally by the UE and the AUSF network element respectively; the ARPF network element is responsible for storing the contract information and The information generates an authentication vector, and the authentication vector is used in the authentication process for the UE to confirm the legitimacy of the network, and for the network to confirm the legitimacy of the UE.

In related technologies, when receiving a quick authentication instruction, the network side will assign a quick authentication identifier to the UE during the current authentication process to instruct the UE to initiate a quick authentication request in the next authentication.

However, in this method, the network side can only send a quick authentication identifier to the UE to make the UE initiate a quick authentication request, and when performing quick authentication, the network side and the UE can only follow the authentication method specified in the quick authentication identifier. Fast authentication is done, so less flexibility.

Contents of the invention

In order to solve the above technical problems, the embodiments of the present invention provide an authentication method and a network element, which can flexibly perform fast authentication.

In order to achieve the purpose of the present invention, an embodiment of the present invention provides an authentication method, including:

The first network element receives a request carrying first indication information from a security anchor function SEAF network element; wherein the first indication information is used to indicate that the second network element has the ability to perform fast authentication;

The first network element performs fast authentication with the second network element according to the first indication information.

The embodiment of the present invention also provides an authentication method, including:

The UE sends a registration request carrying the first indication information to the SEAF network element; or, the UE receives a message carrying the first indication information sent by the SEAF network element; wherein the first indication information is used to indicate sending Party has the ability to perform fast certification;

The UE receives the derived parameters from the SEAF network element, and sends an authentication response to the SEAF network element; wherein the authentication response is at least generated based on the derived parameters and the stored home key. The embodiment of the present invention also provides an AUSF network element, including:

The first receiving module is configured to receive an authentication request carrying first indication information and a permanent user ID from a SEAF network element; wherein the first indication information is used to identify that the UE corresponding to the permanent user ID is capable of performing fast Ability to certify;

A first processing module, configured to perform fast authentication with the second network element according to the first indication information.

The embodiment of the present invention also provides a UE, including:

The second processing module is configured to send a registration request carrying the first indication information to the SEAF network element, or receive a message carrying the first indication information sent by the SEAF network element; wherein the first indication information is used To indicate that the UE is capable of performing fast authentication;

The second receiving module is configured to receive derived parameters from the SEAF network element, and send an authentication response to the SEAF network element; wherein the authentication response is at least generated based on the derived parameters and a stored home key.

Compared with the prior art, since the first network element determines that the second network element has the ability to perform fast authentication according to the obtained first indication information, when the first network element needs to perform fast authentication on the second network element, the first network element The network element directly performs fast authentication with the second network element according to the first indication information, thus ensuring the flexibility of fast authentication.

Additional features and advantages of the invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention may be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

Description of drawings

The accompanying drawings are used to provide a further understanding of the technical solution of the present invention, and constitute a part of the description, and are used together with the embodiments of the application to explain the technical solution of the present invention, and do not constitute a limitation to the technical solution of the present invention.

FIG. 1 is a schematic flow diagram of an authentication method provided by an embodiment of the present invention;

FIG. 2 is a schematic flowchart of another authentication method provided by an embodiment of the present invention;

FIG. 3 is a schematic flowchart of another authentication method provided by an embodiment of the present invention;

FIG. 4 is a schematic flowchart of another authentication method provided by an embodiment of the present invention;

FIG. 5 is a schematic flowchart of another authentication method provided by an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of a first network element provided by an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a UE provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solution and advantages of the present invention more clear, the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined arbitrarily with each other.

The steps shown in the flowcharts of the figures may be performed in a computer system, such as a set of computer-executable instructions. Also, although a logical order is shown in the flowcharts, in some cases the steps shown or described may be performed in an order different from that shown or described herein.

An embodiment of the present invention provides an authentication method, as shown in Figure 1, the method includes:

Step 101, the first network element receives a request carrying first indication information from a SEAF network element.

Wherein, the first indication information is used to indicate that the second network element is capable of performing fast authentication.

Step 102, the first network element performs fast authentication with the second network element according to the first indication information.

It should be noted that, in the mobile communication technology before 5G, when the UE needs to be quickly authenticated, the authentication server will assign a fast authentication ID to the UE, so that the UE can perform fast authentication in the next authentication. However, the mobile communication technology before 5G Different from the architecture of 5G, in the mobile communication technology before 5G, the network element between the authentication server and the authenticated end is only used as a channel to transmit the information that can be interacted between the two, while in 5G, the AUSF network element and UE The SEAF network element between them is not a pure pipeline, so it is necessary to use the identification to route the information between the AUSF network element and the UE, and the fast authentication identification assigned by the authentication server in the prior art cannot be used by the SEAF network element to route the AUSF network Therefore, the fast authentication method in the prior art cannot be used in 5G, and there is no feasible authentication method capable of fast authentication in 5G.

In the authentication method provided by the embodiment of the present invention, since the first network element determines that the second network element has the ability to perform fast authentication according to the obtained first indication information, when the first network element needs to perform fast authentication on the second network element, The first network element directly performs quick authentication with the second network element according to the first indication information, thus ensuring the flexibility of quick authentication.

Optionally, the first network element is an AUSF network element, and the second network element is a user terminal UE.

or;

The first network element is a UE, and the second network element is an AUSF network element.

Optionally, when the first network element is a UE and the second network element is an AUSF network element, the first network element performs fast authentication with the second network element according to the first indication information, including:

The UE sends a registration request carrying second indication information to the SEAF network element; wherein the second indication information is used to instruct the AUSF network element to perform fast authentication.

The UE receives the derived parameter sent by the AUSF network element through the SEAF network element; wherein, the derived parameter is generated by the AUSF network element.

It should be noted that since the AUSF network element determines that the UE has the ability to perform fast authentication according to the obtained first indication information, when the AUSF network element needs to perform fast authentication on the UE, the SEAF unit directly sends the derived parameters to the UE for fast authentication. Certification, thus ensuring the timeliness and flexibility of rapid certification.

Optionally, when the first network element is an AUSF network element and the second network element is a UE, the first network element performs fast authentication with the second network element according to the first indication information, including:

The AUSF network element sends the derived parameter to the UE through the SEAF network element; wherein, the derived parameter is generated by the AUSF network element.

Optionally, the first indication information further includes: information about the fast authentication method that the first network element can use.

Optionally, also include:

The AUSF network element determines to send the derived parameter message according to the first indication information.

Optionally, also include:

The AUSF network element sends the network hash and the expected hash to the SEAF network element; wherein, the network hash is generated based at least on the derived parameters and the attribution key stored in the AUSF network element; the expected hash is generated based on at least the derived parameters and the expected response; the expected The response is generated based on at least the derived parameters and the attributed key.

Specifically, assuming that the derived parameter is parameter A, and the network hash is generated based on parameter A and the attribution key, then the expected hash may be generated based on parameter A, parameter B and the attribution key; assuming the derived parameter is parameter A, The network hash is generated according to parameter A, parameter C and the attribution key, then the expected hash may be generated according to the parameter A and the attribution key, or it may be generated according to the parameter A, parameter D and the attribution key.

Optionally, also include:

The AUSF network element sends the second indication information to the UE through the SEAF network element; wherein, the second indication information is used to instruct the UE to perform quick authentication.

The embodiment of the present invention also provides an authentication method, as shown in Figure 2, the method includes:

In step 201, the UE sends a registration request carrying the first indication information to the SEAF network element; or, the UE receives the message carrying the first indication information sent by the SEAF network element.

Wherein, the first indication information is used to indicate that the sender has the ability to perform fast authentication.

Step 202, the UE receives the derived parameters from the SEAF network element, and sends an authentication response to the SEAF network element.

Wherein, the authentication response is generated based at least on the derived parameters and the stored attribution key.

In the authentication method provided by the embodiment of the present invention, since the UE sends to the SEAF unit a registration request carrying the first indication information indicating that the UE has the ability to perform fast authentication, the SEAF network element can send the first indication information to the AUSF network element , so that when the AUSF network element needs to quickly authenticate the UE, the SEAF unit directly sends the derived parameters to the UE for fast authentication, thus ensuring the timeliness and flexibility of the fast authentication.

Optionally, the first indication information further includes: information about a fast authentication method that the sender can use.

Optionally, before sending the authentication response to the SEAF network element, it also includes:

The UE receives second indication information from the SEAF network element; wherein, the second indication information is used to instruct the UE to perform quick authentication.

Optionally, also include:

The UE receives the network hash from the SEAF network element.

The UE generates a desired network hash based on at least the derived parameters and the stored home key.

When the expected Network Hash is the same as the Network Hash, the UE sends an Authentication Response.

The embodiment of the present invention also provides an authentication method, which is a fast authentication based on an Enhanced Authentication Protocol-Authentication and Key Agreement (Enhanced Authentication Protocol-Authentication and Key Agreement, EAP-AKA'), as shown in Figure 3 , the method includes:

Step 301: UE registers with the network. During the registration process, the SEAF network element notifies the AUSF network element to perform the authentication process. The AUSF network element requests the authentication vector from the ARPF network element. The ARPF network element selects the authentication method and notifies the AUSF network element of the authentication vector and the authentication method. , the AUSF network element uses the authentication method and authentication vector to authenticate the UE through the SEAF network element.

If the SEAF network element has participated in the authentication of the UE before, the UE's permanent identity will be saved in the SEAF network element. If the SEAF network element has not authenticated the UE before, the ARPF network element will also notify the AUSF network element of the UE's permanent identity, and the AUSF The network element will send the UE's permanent identity to the SEAF network element. After the authentication is completed, the SEAF network element will assign a temporary ID to the UE and send the temporary ID to the UE. During the authentication process, the AUSF network element and the UE will use the same method to derive the attribution key and store it respectively. The AUSF network element will generate an access key and send it to the SEAF network element to protect the communication between the UE and the network. The UE will use The access key is generated in the same way.

Step 302: After a period of time, the UE initiates a registration request to the network again, such as sending a RegisterRequest message, carrying the temporary user ID and indication information allocated by the network. The indication information indicates that the UE is capable of performing fast authentication. The indication information may include that the UE can The authentication method used, such as EAP-AKA' and/or 5G AKA.

Step 303: The SEAF network element receives the registration request, sends an authentication request message to the AUSF network element, such as sending a 5G-AIR message, the SEAF network element finds the matching permanent user ID through the temporary user representation, and carries the permanent user ID and Instructions.

Step 304: The AUSF network element judges that there is instruction information in the authentication request, and the authentication method can be selected according to the authentication method used when authenticating the UE before, or according to the authentication method information contained in the instruction information, for example, if the AUSF network element previously used EAP-AKA 'Authenticating the UE, you can choose EAP-AKA' or 5G AKA, if the AUSF network element used 5G AKA to authenticate the UE before, you can choose 5G AKA. The AUSF network element chooses to use EAP-AKA', so it sends an AKA re-authentication request to SEAF, such as sending an EAP-Request/AKA-Reauthentication message. The message carries derived parameters, such as NONCE and COUNTER. The derived parameters are generated by AUSF, and the message also carries a message Authentication code 1 (MAC1), the message authentication code 1 is generated based on the security key generated in the last authentication process and the content of the message, such as using Hash Message Authentication Code-Secure Hash Algorithm-256 (Hash-based Message Authentication Code-Secure Hash Algorithm-256, HMAC-SHA-256) algorithm.

Step 305: The SEAF network element forwards the AKA re-authentication request to the UE.

Step 306: The UE derives a new home key based on the key derivation parameters and the stored home key, and then sends an AKA re-authentication response to the SEAF network element, carrying a message authentication code 2 (MAC2), which is based on the last The secure key generated during the authentication process and the content of the message are generated, for example, using the HMAC-SHA-256 algorithm.

Step 307: The SEAF network element forwards the key agreement agreement (Authentication and Key Agreement, AKA) re-authentication response to the AUSF network element, and the AUSF network element verifies the MAC2.

Step 308: If the AUSF network element verifies MAC2 successfully, then the authentication is successful. The AUSF network element generates a new attribution key based on the stored attribution key and derived parameters. key to derive a new access key.

Step 309: The AUSF network element sends an authentication success message, such as an EAP-Success message, to the SEAF network element, and the message carries a new access key.

Step 310: The SEAF network element stores the new access key, and sends a registration success message, such as a Register Accept message, to the UE.

The embodiment of the present invention also provides an authentication method, which is a fast authentication according to the 5th-Generation mobile communication technology Authentication and Key Agreement (the 5th-Generation mobile communication technology Authentication and Key Agreement, 5G AKA), as shown in Figure 4 , the method includes:

Step 401: UE registers with the network. During the registration process, the SEAF network element notifies the AUSF network element to perform the authentication process. The AUSF network element requests the authentication vector from the ARPF network element. The ARPF network element selects the authentication method and notifies the AUSF network element of the authentication vector and the authentication method. , the AUSF network element uses the authentication method and authentication vector to authenticate the UE through the SEAF network element.

If the SEAF NE has authenticated the UE before, the SEAF NE will save the UE’s permanent ID. If the SEAF NE has not authenticated the UE before, the ARPF NE will also notify the AUSF NE of the UE’s permanent ID, and the AUSF NE will The permanent identity of the UE will be sent to the SEAF network element. After the authentication is completed, the SEAF network element will assign a temporary ID to the UE and send the temporary ID to the UE. During the authentication process, the AUSF network element and the UE will use the same method to derive the attribution key and store it respectively. The AUSF network element will generate an access key and send it to the SEAF network element to protect the communication between the UE and the network. The UE will use The access key is generated in the same way.

Step 402: After a period of time, the UE initiates a registration request to the network again, such as sending a RegisterRequest message, carrying a temporary user ID assigned by the network and indication information 1. The indication information 1 indicates that the UE is capable of performing fast authentication, and the indication information may include Authentication methods that the UE can use, such as EAP-AKA' and/or 5G AKA.

Step 403: The SEAF network element receives the registration request, sends an authentication request message to the AUSF network element, such as sending a 5-AIR message, the SEAF network element finds a matching permanent user ID through the temporary user representation, and carries the permanent user ID and Instructions.

Step 404: The AUSF network element judges that there is instruction information in the authentication request, and can select the authentication method according to the authentication method used to authenticate the UE before, or according to the authentication method information contained in the instruction information, for example, if the AUSF network element used EAP-AKA before 'Authenticating the UE, you can choose EAP-AKA' or 5G AKA, if the AUSF network element used 5G AKA to authenticate the UE before, you can choose 5G AKA. The AUSF network element chooses to use 5G AKA, so it generates derived parameters, such as NONCE, and generates network hash Hash based on the derived parameters and the stored attribution key, such as using the HMAC-SHA-256 algorithm, based on the derived parameters and the stored attribution key. The expected response Hash, such as using the HMAC-SHA-256 algorithm, generates the expected Hash based on the derived parameters and the expected response, such as using the Secure Hash Algorithm-256 (Secure Hash Algorithm-256, SHA-256) algorithm, based on the derived parameters and stored The attribution key generates a new attribution key, such as using the HMAC-SHA-256 algorithm, and generates a new access key based on the new attribution key.

Step 405: The AUSF network element sends an authentication response to the SEAF network element, such as sending a 5G-AIA message, the message carries an authentication vector, the authentication vector includes derived parameters, network Hash, expected Hash and new access key, and the message also carries instruction information 2 , used to instruct the UE to use fast authentication.

Step 406: The SEAF network element sends a user authentication request to the UE, such as sending a User AuthenticationRequest message, the message carries the derived parameters and the network Hash in the authentication vector, and also carries instruction information 2.

Step 407: The UE receives the user authentication request carrying the indication information 2, uses the fast authentication, and the UE verifies the network Hash, for example, generates the expected network Hash based on the derived parameters and the stored attribution key, and compares whether the network Hash is the same as the expected network Hash, If they are the same, the verification succeeds, otherwise the verification fails; after the verification is successful, the UE generates an authentication response RES based on the derived parameters and the stored attribution key, for example, using the HMAC-SHA-256 algorithm, based on the derived parameters and the stored attribution key. The new attribution key, such as using the HMAC-SHA-256 algorithm, generates a new access key based on the new attribution key to derive a new attribution key, and then sends a user authentication response to the SEAF network element, such as sending a User AuthenticationResponse message, Carry authentication response RES.

Step 408: The SEAF network element verifies the expected Hash based on the authentication response RES, for example, generates a verification Hash based on the derived parameters and the authentication response RES, for example, uses the SHA-256 algorithm, compares the verification Hash and the expected Hash, if they are the same, the verification succeeds, otherwise Validation failed.

Step 409: After the SEAF network element verifies that the expected hash is successful, it sends an authentication confirmation to the AUSF network element, such as sending a 5G-AC message with an authentication response RES.

Step 410: The AUSF network element verifies the authentication response, such as comparing the expected response and the authentication response. If they are the same, the verification succeeds, otherwise the verification fails; after the verification is successful, the AUSF network element sends an authentication success message to the SEAF network element, such as sending a 5G - ACA message.

Step 411: The SEAF network element saves the new access key, and sends a registration success message, such as a Register Accept message, to the UE.

The embodiment of the present invention also provides an authentication method, which is a fast authentication based on 5G AKA, as shown in Figure 5, the method includes:

Step 501: UE registers with the network. During the registration process, the SEAF network element notifies the AUSF network element to perform the authentication process. The AUSF network element requests the authentication vector from the ARPF network element. The ARPF network element selects the authentication method and notifies the AUSF network element of the authentication vector and the authentication method. , the AUSF network element uses the authentication method and authentication vector to authenticate the UE through the SEAF network element.

If the SEAF NE has authenticated the UE before, the SEAF NE will save the UE’s permanent ID. If the SEAF NE has not authenticated the UE before, the ARPF NE will also notify the AUSF NE of the UE’s permanent ID, and the AUSF NE will The permanent identity of the UE will be sent to the SEAF network element. After the authentication is completed, the SEAF network element will assign a temporary ID to the UE and send the temporary ID to the UE. During the authentication process, the AUSF network element and the UE will use the same method to derive the attribution key and store it respectively. The AUSF network element will generate an access key and send it to the SEAF network element to protect the communication between the UE and the network. The UE will use The access key is generated in the same way.

Step 502: AUSF can select an authentication method that can be used for fast authentication according to the authentication method used to authenticate the UE before. For example, if the AUSF network element used EAP-AKA' to authenticate the UE before, you can choose EAP-AKA' or 5G AKA, If the AUSF network element used 5G AKA to authenticate UE before, you can choose 5G AKA. AUSF sends a message to SEAF, such as sending an Insert Subscribe Data message, carrying indication information 1, which indicates that AUSF is capable of performing fast authentication, and the indication information may include authentication methods that AUSF can use, such as EAP-AKA' and/or 5G AKA.

Step 503: SEAF forwards indication information 1 to UE.

The above steps 502 to 503 may be initiated by the AUSF after step 501 is completed, or may be triggered by a certain AUSF to send a message during the process of step 501 .

Step 504: After a period of time, the UE initiates a registration request to the network again, such as sending a RegisterRequest message, carrying the temporary user identification indication information 2 allocated by the network, which is used to instruct the AUSF to use fast authentication.

Step 505: The SEAF network element receives the registration request, sends an authentication request message to the AUSF network element, such as sending a 5-AIR message, the SEAF network element finds the matching permanent user ID through the temporary user representation, and carries the permanent user ID and Instructions 2.

Step 506: The AUSF network element judges that there is indication information 2 in the authentication request, and can select an authentication method according to the indication information 1 previously sent to the UE. In this embodiment, the AUSF network element chooses to use 5G AKA, so it generates derived parameters, such as NONCE, and generates a network hash Hash based on the derived parameters and the stored attribution key, such as using the HMAC-SHA-256 algorithm, based on the derived parameters and the stored attribution The key generates the expected response Hash, such as using the HMAC-SHA-256 algorithm, based on the derived parameters and the expected response to generate the expected Hash, such as using the Secure Hash Algorithm-256 (Secure Hash Algorithm-256, SHA-256) algorithm, based on the derived parameters Generate a new attribution key with the stored attribution key, for example, use the HMAC-SHA-256 algorithm to generate a new access key based on the new attribution key.

Step 507: The AUSF network element sends an authentication response to the SEAF network element, such as sending a 5G-AIA message, the message carries an authentication vector, and the authentication vector includes derived parameters, network hash, expected hash and new access key.

Step 508: The SEAF network element sends a user authentication request to the UE, such as sending a User AuthenticationRequest message, the message carries the derived parameters in the authentication vector and the network Hash.

Step 509: The UE uses fast authentication, and the UE verifies the network Hash, for example, generates the expected network Hash based on the derived parameter and the stored attribution key, and compares whether the network Hash is the same as the expected network Hash. If they are the same, the verification succeeds; otherwise, the verification fails; After the verification is successful, the UE generates an authentication response RES based on the derived parameters and the stored home key, such as using the HMAC-SHA-256 algorithm, and generates a new home key based on the derived parameters and the stored home key, such as using HMAC-SHA -256 algorithm, generate a new access key based on the new home key to derive a new home key, and then send a user authentication response to the SEAF network element, such as sending a User Authentication Response message, carrying the authentication response RES.

Step 510: The SEAF network element verifies the expected Hash based on the authentication response RES, for example, generates a verification Hash based on the derived parameters and the authentication response RES, for example, uses the SHA-256 algorithm, compares the verification Hash and the expected Hash, if they are the same, the verification succeeds, otherwise Validation failed.

Step 511: After the SEAF network element verifies that the expected hash is successful, it sends an authentication confirmation to the AUSF network element, such as sending a 5G-AC message with an authentication response RES.

Step 512: The AUSF network element verifies the authentication response, such as comparing the expected response and the authentication response. If they are the same, the verification succeeds, otherwise the verification fails; after the verification is successful, the AUSF network element sends an authentication success message to the SEAF network element, such as sending a 5G - ACA message.

Step 513: The SEAF network element stores the new access key, and sends a registration success message, such as a Register Accept message, to the UE.

It should be noted that the above process can also be used in the fast authentication process of EAP-AKA'.

An embodiment of the present invention also provides a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are used to execute any one of the above authentication methods.

An embodiment of the present invention provides a first network element. As shown in FIG. 6, the first network element 6 includes:

The first receiving module 601 is configured to receive an authentication request carrying first indication information and a permanent user ID from a SEAF network element; wherein the first indication information is used to identify that the UE corresponding to the permanent user ID has the ability to perform fast authentication .

The first processing module 602 is configured to perform fast authentication with the second network element according to the first indication information.

Optionally, the first network element is an AUSF network element, and the second network element is a UE.

or

The first network element is a UE, and the second network element is an AUSF network element.

Optionally, when the first network element is a UE, and the second network element is an AUSF network element, the first processing module 602 is specifically configured to:

Receive the derived parameters sent by the AUSF network element through the SEAF network element; wherein, the derived parameters are generated by the AUSF network element.

The derived parameter is sent to the UE through the SEAF network element; wherein, the derived parameter is generated by the AUSF network element.

Optionally, when the first network element is an AUSF network element and the second network element is a UE, the first processing module 602 is specifically configured to:

The derived parameter is sent to the UE through the SEAF network element; wherein, the derived parameter is generated by the AUSF network element.

Optionally, the first indication information further includes: information about the fast authentication method that the first network element can use.

Optionally, the first processing module 602 is further configured to determine to send a message of derived parameters according to the first indication information.

Optionally, the first processing module 602 is further configured to send the network hash and the expected hash to the SEAF network element; wherein the network hash is at least based on the derived parameter and the attribution key stored in the AUSF network element; the expected hash The generation is based on at least the derived parameters and the expected response; the expected response is generated based on at least the derived parameters and the home key.

Optionally, the first processing module 602 is further configured to send second indication information to the UE through the SEAF network element; where the second indication information is used to instruct the UE to perform quick authentication.

The first network element provided by the embodiment of the present invention determines that the second network element has the ability to perform fast authentication according to the obtained first indication information. When the first network element needs to perform fast authentication on the second network element, the first network element The network element directly performs fast authentication with the second network element according to the first indication information, thus ensuring the flexibility of fast authentication.

In practical applications, both the first receiving module 601 and the first processing module 602 can be composed of a central processing unit (Central Processing Unit, CPU), a microprocessor (Micro Processor Unit, MPU), a digital signal processing unit located in the first network element Realizations such as Digital Signal Processor (DSP) or Field Programmable Gate Array (Field Programmable Gate Array, FPGA).

The embodiment of the present invention also provides a UE. As shown in FIG. 7, the UE 7 includes:

The second processing module 701 is configured to send a registration request carrying the first indication information to the SEAF network element, or receive a message carrying the first indication information sent by the SEAF network element; wherein the first indication information is used to instruct the UE Ability to perform expedited certification.

The second receiving module 702 is configured to receive derived parameters from the SEAF network element, and send an authentication response to the SEAF network element; wherein, the authentication response is at least generated based on the derived parameters and the stored home key.

Optionally, the first indication information further includes: information about a fast authentication method that the sender can use.

Optionally, the second receiving module 702 is further configured to receive second indication information from the SEAF network element; wherein, the second indication information is used to instruct the UE to perform quick authentication.

Optionally, the second receiving module 702 is also configured to receive the network hash from the SEAF network element.

The second processing module 701 is configured to generate a desired network hash based on at least the derived parameter and the stored attribution key.

It also includes: a sending module 703, configured to send an authentication response when the expected network hash is the same as the network hash.

The UE provided in the embodiment of the present invention sends a registration request to the SEAF unit carrying the first indication information used to indicate that the UE has the ability to perform fast authentication, so that the SEAF network element can send the first indication information to the AUSF network element, so When the AUSF network element needs to quickly authenticate the UE, the SEAF unit directly sends the derived parameters to the UE for fast authentication, thus ensuring the timeliness and flexibility of the fast authentication.

In practical applications, the second processing module 701, the second receiving module 702, and the sending module 703 can all be implemented by a CPU, MPU, DSP, or FPGA located in the UE.

An embodiment of the present invention also provides a first network element, including a first memory and a first processor, wherein the first memory stores the following instructions executable by the first processor:

A request carrying first indication information from a SEAF network element is received; wherein, the first indication information is used to indicate that the second network element is capable of performing fast authentication.

Perform fast authentication with the second network element according to the first indication information.

Optionally, the first network element is an AUSF network element, and the second network element is a user terminal UE.

or;

The first network element is a UE, and the second network element is an AUSF network element.

Optionally, when the first network element is a UE and the second network element is an AUSF network element, the first memory specifically stores the following instructions executable by the first processor:

Sending a registration request carrying second indication information to the SEAF network element; wherein, the second indication information is used to instruct the AUSF network element to perform fast authentication.

Receive the derived parameters sent by the AUSF network element through the SEAF network element; wherein, the derived parameters are generated by the AUSF network element.

Optionally, when the first network element is an AUSF network element and the second network element is a UE, the first memory specifically stores the following instructions executable by the first processor:

The derived parameter is sent to the UE through the SEAF network element; wherein, the derived parameter is generated by the AUSF network element.

Optionally, the first indication information further includes: information about the fast authentication method that the first network element can use.

Optionally, the first memory also stores the following instructions executable by the first processor:

It is determined to send a message of derived parameters according to the first indication information.

Optionally, the first memory also stores the following instructions executable by the first processor:

Send a network hash and an expected hash to the SEAF network element; wherein the network hash is generated based at least on the derived parameters and the attribution key stored in the AUSF network element; the expected hash is generated based on at least the derived parameters and the expected response; the expected response is at least based on Derived parameters and attributed key generation.

Optionally, the first memory also stores the following instructions executable by the first processor:

The SEAF network element sends the second indication information to the UE; wherein, the second indication information is used to instruct the UE to perform quick authentication.

An embodiment of the present invention also provides a UE, including a second memory and a second processor, wherein the second memory stores the following instructions executable by the second processor:

Send a registration request carrying the first indication information to the SEAF network element; or, the UE receives a message carrying the first indication information sent by the SEAF network element; where the first indication information is used to indicate that the sender has the ability to perform fast authentication .

Receive the derived parameters from the SEAF network element, and send an authentication response to the SEAF network element; wherein, the authentication response is at least generated based on the derived parameters and the stored home key.

Optionally, the first indication information further includes: information about a fast authentication method that the sender can use.

Optionally, the second memory also stores the following instructions executable by the second processor:

Receive second indication information from the SEAF network element; wherein, the second indication information is used to instruct the UE to perform quick authentication.

Optionally, the second memory also stores the following instructions executable by the second processor:

Receive network hashes from SEAF network elements.

A desired network hash is generated based on at least the derived parameters and the stored attribution key.

An authentication response is sent when the network hash is expected to be the same as the network hash.

Although the embodiments disclosed in the present invention are as above, the content is only for the convenience of understanding the present invention, and is not intended to limit the present invention. Anyone skilled in the field of the present invention can make any modifications and changes in the form and details of the implementation without departing from the spirit and scope disclosed by the present invention, but the patent protection scope of the present invention must still be The scope defined by the appended claims shall prevail.

Claims (24)

1. An authentication method, comprising: The first network element receives a request carrying first indication information from a security anchor function SEAF network element; wherein the first indication information is used to indicate that the second network element has the ability to perform fast authentication; The first network element performs fast authentication with the second network element according to the first indication information. 2. The authentication method according to claim 1, wherein the first network element is an authentication service function AUSF network element, and the second network element is a user terminal UE; or; The first network element is the UE, and the second network element is the AUSF network element. 3. The authentication method according to claim 2, wherein when the first network element is the UE and the second network element is the AUSF network element, the first network element according to The first instruction information performs fast authentication with the second network element, including: The UE sends a registration request carrying second indication information to the SEAF network element; wherein the second indication information is used to instruct the AUSF network element to perform fast authentication; The UE receives the derived parameter sent by the AUSF network element through the SEAF network element; wherein, the derived parameter is generated by the AUSF network element. 4. The authentication method according to claim 2, wherein when the first network element is the AUSF network element and the second network element is the UE, the first network element according to The first instruction information performs fast authentication with the second network element, including: The AUSF network element sends the derived parameter to the UE through the SEAF network element; wherein the derived parameter is generated by the AUSF network element. 5 . The authentication method according to claim 1 , wherein the first indication information further includes: information about a fast authentication method that can be used by the first network element. 6 . 6. The authentication method according to claim 3 or 4, further comprising: The AUSF network element determines to send the derived parameter message according to the first indication information. 7. The authentication method according to claim 3 or 4, further comprising: The AUSF network element sends a network hash and an expected hash to the SEAF network element; wherein the network hash is generated based at least on the derived parameters and the home key stored in the AUSF network element; the expected A hash is generated based on at least said derived parameters and an expected response; said expected response is generated based on at least said derived parameters and said home key. 8. The authentication method according to claim 4, further comprising: The AUSF network element sends second indication information to the UE through the SEAF network element; wherein the second indication information is used to instruct the UE to perform fast authentication. 9. An authentication method comprising: The UE sends a registration request carrying the first indication information to the SEAF network element; or, the UE receives a message carrying the first indication information sent by the SEAF network element; wherein the first indication information is used to indicate sending Party has the ability to perform fast certification; The UE receives the derived parameters from the SEAF network element, and sends an authentication response to the SEAF network element; wherein the authentication response is at least generated based on the derived parameters and the stored home key. 10 . The authentication method according to claim 9 , wherein the first indication information further includes: information of a fast authentication method that the sender can use. 11 . 11. The authentication method according to claim 9, wherein before sending the authentication response to the SEAF network element, further comprising: The UE receives second indication information from the SEAF network element; wherein the second indication information is used to instruct the UE to perform fast authentication. 12. The authentication method according to claim 11, further comprising: The UE receives a network hash from the SEAF network element; said UE generates a desired network hash based at least on said derived parameters and a stored home key; The UE sends the authentication response when the expected network hash is identical to the network hash. 13. A first network element, comprising: The first receiving module is configured to receive an authentication request carrying first indication information and a permanent user ID from a SEAF network element; wherein the first indication information is used to identify that the UE corresponding to the permanent user ID is capable of performing fast Ability to certify; A first processing module, configured to perform fast authentication with the second network element according to the first indication information. 14. The first network element according to claim 13, wherein the first network element is an AUSF network element, and the second network element is a UE; or The first network element is the UE, and the second network element is the AUSF network element. 15. The first network element according to claim 14, wherein when the first network element is the UE and the second network element is the AUSF network element, the first processing Modules are used specifically for: Sending a registration request carrying second indication information to the SEAF network element; wherein the second indication information is used to instruct the AUSF network element to perform fast authentication; The UE receives the derived parameter sent by the AUSF network element through the SEAF network element; wherein, the derived parameter is generated by the AUSF network element. 16. The first network element according to claim 14, wherein when the first network element is the AUSF network element and the second network element is the UE, the first processing Modules are used specifically for: sending the derived parameter to the UE through the SEAF network element; wherein the derived parameter is generated by the AUSF network element. 17. The first network element according to claim 13, wherein the first indication information further includes: information about a fast authentication method that the first network element can use. 18. The first network element according to claim 15 or 16, characterized in that, The first processing module is further configured to determine to send the derived parameter message according to the first indication information. 19. The first network element according to claim 15 or 16, characterized in that, The first processing module is further configured to send a network hash and an expected hash to the SEAF network element; wherein the network hash is at least based on the derived parameter and the home key stored in the AUSF network element generating; the expected hash is generated based on at least the derived parameters and an expected response; the expected response is generated based on at least the derived parameters and the home key. 20. The first network element according to claim 16, characterized in that, The first processing module is further configured to send second indication information to the UE through the SEAF network element; wherein the second indication information is used to instruct the UE to perform fast authentication. 21. A UE, characterized by comprising: The second processing module is configured to send a registration request carrying the first indication information to the SEAF network element, or receive a message carrying the first indication information sent by the SEAF network element; wherein the first indication information is used To indicate that the UE is capable of performing fast authentication; The second receiving module is configured to receive derived parameters from the SEAF network element, and send an authentication response to the SEAF network element; wherein the authentication response is at least generated based on the derived parameters and a stored home key. 22. The UE according to claim 21, wherein the first indication information further includes: information of a fast authentication method that the sender can use. 23. The UE according to claim 21, characterized in that, The second receiving module is further configured to receive second indication information from the SEAF network element; wherein the second indication information is used to instruct the UE to perform fast authentication. 24. The UE according to claim 23, characterized in that, The second receiving module is further configured to receive the network hash from the SEAF network element; The second processing module is further configured to generate a desired network hash based at least on the derived parameters and the stored attribution key; It also includes: a sending module, configured to send the authentication response when the expected network hash is the same as the network hash.