WO2019096075A1 - Method and apparatus for message protection - Google Patents

Abstract

A method and apparatus for message protection, which relate to the technical field of communications. The method comprises: a terminal device obtaining a protected initial NAS message according to a symmetric key and a first security algorithm, and sending the protected initial NAS message to a first network device; and sending a key-related parameter to a second network device, wherein the key-related parameter is used to obtain the symmetric key. Since a terminal device can carry out security protection on an initial NAS message by means of a symmetric key and a first security algorithm, the present invention improves the transmission security of the initial NAS message, and compared with the existing technical solution, is at the same time conducive to the reduction of the complexity of carrying out security protection on the initial NAS message, and is conducive to the improvement of the access efficiency of the terminal device.

Description

Method and device for message protection

In this application, the priority of the Chinese Patent Application entitled "Method and Apparatus for Message Protection", filed on November 14, 2017, with the application number of 201711125181.0, is hereby incorporated by reference. In the application.

Technical field

The present application relates to the field of communications technologies, and in particular, to a method and an apparatus for message protection.

Background technique

In long term evolution (LTE), the security protection of a non-access stratum (NAS) message is activated after the network device sends a NAS security mode command (SMC) message to the terminal device. Before the terminal device receives the NAS SMC message sent by the network device, the NAS message transmitted between the terminal device and the network device, such as the initial NAS message, is a message that has not been secured, so these messages are tampered with or snangled by the attacker. Exploring the risks.

In the prior art, in order to improve the security of the initial NAS message in the communication process, the initial NAS message sent by the terminal device to the network device only includes the user permanent identifier (SUPI) and the security capability of the terminal device, when the terminal After receiving the NAS SMC message, the device protects the other parameters in the initial NAS message and sends it to the network device. This implementation delays the processing of the initial NAS message by the network device and affects the access of the terminal device. Efficiency, but more complicated.

Summary of the invention

The embodiment of the present invention provides a message protection method and device, which helps reduce the complexity of security protection for an initial NAS message and improve the access efficiency of the terminal device.

The first aspect, the message protection method of the embodiment of the present application includes:

The terminal device obtains the protected initial NAS message according to the symmetric key and the first security algorithm, and sends the protected initial NAS message to the first network device; and sends the key related parameter to the second network device, where the key is related The parameter is used to obtain a symmetric key.

In the embodiment of the present application, the terminal device can perform security protection on the initial NAS message by using the symmetric key and the first security algorithm, which improves the security of the initial NAS message transmission, and helps reduce the comparison compared with the prior art solution. The complexity of the initial NAS message for security protection, and helps to improve the access efficiency of the terminal device.

In one possible design, the key related parameters include the public key of the terminal device, and the terminal device can obtain the symmetric key according to the following manner:

The terminal device generates a symmetric key according to the public key of the second network device and the private key of the terminal device.

The terminal device generates a symmetric key according to the public key of the second network device and the private key of the terminal device. In a specific implementation, a possible design is:

The terminal device generates an intermediate key according to the public key of the second network device and the private key of the terminal device, and then generates a symmetric key according to the intermediate key and the fixed string. Optionally, the fixed string can be pre-configured in the terminal device.

In a possible design, the key-related parameter includes a ciphertext of a symmetric key, wherein the ciphertext of the symmetric key is obtained according to the public key of the second network device, and the terminal device can obtain the symmetric key according to the following manner:

Optionally, the terminal device generates a symmetric key according to a random key generation algorithm; or, optionally, the terminal device generates a symmetric key according to a random number, a permanent key, and a key derivation function (KDF). .

In a possible design, the key related parameter includes the ciphertext of the first security algorithm, wherein the ciphertext of the first security algorithm is obtained according to the public key of the second network device.

The above technical solution helps to improve the security of transmitting the first security algorithm.

In one possible design, the first security algorithm is determined by the terminal device according to a pre-configured policy.

In one possible design, the initial NAS message is a registration request message.

In a possible design, after receiving the protected downlink NAS message from the first network device, the terminal device decrypts the protected downlink NAS message according to the symmetric key and the first security algorithm to obtain the downlink NAS message. The downlink NAS message may be a registration accept message or a NAS SMC message.

The above technical solution helps to improve the security of transmitting a registration accept message or a NAS SMC message.

In a possible design, the terminal device receives the protected downlink NAS message from the first network device, where the downlink NAS message includes a second security algorithm, and the terminal device can be configured according to the symmetric key and the first security algorithm. The protected downlink NAS message is decrypted, the downlink NAS message is obtained, and then the second security algorithm is obtained from the downlink NAS message. Finally, if the first network device performs integrity protection on the ciphertext of the downlink NAS message, the terminal device according to the The second security algorithm verifies the integrity of the protected downlink NAS message. If the first network device performs integrity protection on the downlink NAS message, the terminal device checks the integrity of the downlink NAS message according to the second security algorithm. The downlink NAS message is a registration accept message.

The first network device in the foregoing solution can send the second security algorithm to the terminal device by using the registration accept message, so that the NAS SMC message can be transmitted to the terminal device, which helps save signaling overhead. The second security algorithm is a security algorithm selected by the first network device.

In a possible design, the terminal device receives the protected downlink NAS message from the first network device, and verifies the integrity of the downlink NAS message according to the symmetric key and the first security algorithm, where the downlink NAS message may be Downward rejection message.

The foregoing technical solution can verify the integrity of the downlink reject message, and help the terminal device determine whether the downlink reject message is forged or falsified, and reduce the possibility that the terminal device enters a Deny of Service (DoS) state. .

In a possible design, the first network device is an access management function (AMF), and the second network device is a unified data management (UDM) entity, or an authentication service function ( Authentication server function, AUSF) entity.

The second aspect, the method for message protection in the embodiment of the present application includes:

The second network device receives the key related parameter from the terminal device, obtains a symmetric key according to the key related parameter, and then sends a symmetric key to the first network device, wherein the key related parameter is used to obtain a symmetric key, and the symmetric The key is used to secure the initial NAS message.

In the embodiment of the present application, the second network device can send the symmetric key to the first network device, so that the first network device can obtain the initial NAS message according to the symmetric key.

In one possible design, the key related parameters include the public key of the terminal device; the second network device obtains the symmetric key according to the following manner:

The second network device generates a symmetric key according to the public key of the terminal device and the private key of the second network device.

The second network device generates a symmetric key according to the public key of the terminal device and the private key of the second network device. In a specific implementation, a possible design is:

The second network device generates an intermediate key according to the public key of the terminal device and the private key of the second network device, and then generates a symmetric key according to the intermediate key and the fixed string. Optionally, the fixed string may be pre-configured in the second network device.

In one possible design, the key related parameters include the ciphertext of the symmetric key; the second network device obtains the symmetric key according to the following manner:

The second network device decrypts the ciphertext of the symmetric key according to the private key of the second network device to obtain a symmetric key.

In a possible design, the key related parameter includes the ciphertext of the first security algorithm; the second network device decrypts the ciphertext of the first security algorithm according to the public key of the second network device, to obtain the first security algorithm, And transmitting the first security algorithm to the first network device.

The above technical solution helps to improve the security of the first security algorithm transmission.

In one possible design, the first network device is an AMF entity; the second network device is a UDM entity, or an AUSF entity.

The third aspect, the method for message protection in the embodiment of the present application includes:

The first network device receives the protected initial NAS message from the terminal device; and receives the symmetric key from the second network device; and then obtains the initial NAS message according to the symmetric key and the first security algorithm.

In the embodiment of the present application, since the initial NAS message is securely protected by the symmetric key and the first security algorithm, the security of the initial NAS message transmission is improved, and the initial solution is reduced compared with the prior art solution. The complexity of NAS messages for security protection and helps improve the access efficiency of terminal devices.

In one possible design, the first network device receives the first security algorithm from the second network device.

The above technical solution helps to improve the security of the first security algorithm transmission.

In one possible design, the initial NAS message is a registration request message.

In a possible design, the first network device obtains the protected downlink NAS message according to the symmetric key and the first security algorithm; and sends the protected downlink NAS message to the terminal device.

The above technical solution helps to improve the security of transmitting downlink NAS messages.

In one possible design, the downlink NAS message is a registration accept message or a NAS SMC message.

In a possible design, the first network device obtains the ciphertext of the downlink NAS message according to the symmetric key and the first security algorithm, where the downlink NAS message is a registration accept message, and the registration accept message includes a second security algorithm; The network device performs integrity protection on the ciphertext of the downlink NAS message according to the second security algorithm, obtains the protected downlink NAS message, and sends the protected downlink NAS message to the terminal device. The first network device in the foregoing solution can send the second security algorithm to the terminal device by using the registration accept message, so that the NAS SMC message can be transmitted to the terminal device, which helps save signaling overhead. The second security algorithm is a security algorithm selected by the first network device.

In a possible design, the first network device performs integrity protection on the downlink NAS message according to the second security algorithm, where the downlink NAS message is a registration accept message, and the registration accept message includes a second security algorithm; then the first network device Obtaining the protected downlink NAS message according to the symmetric key and the first security algorithm, where the protected downlink NAS message is the ciphertext of the integrity protected downlink NAS message; finally, the first network device sends the protected downlink device to the terminal device Downstream NAS message. The first network device in the foregoing solution can send the second security algorithm to the terminal device by using the registration accept message, so that the NAS SMC message can be transmitted to the terminal device, which helps save signaling overhead. The second security algorithm is a security algorithm selected by the first network device.

In a possible design, the first network device performs integrity protection on the downlink NAS message according to the symmetric key and the first security algorithm, obtains the protected downlink NAS message, and then sends the protected downlink NAS to the terminal device. The message, wherein the downlink NAS message may be a registration reject message.

The foregoing technical solution can perform integrity protection on the downlink reject message, and helps the terminal device determine whether the received downlink reject message is forged or falsified, and reduces the possibility that the terminal device enters the DoS state.

In one possible design, the first network device is an AMF entity; the second network device is a UDM entity, or an AUSF entity.

In a fourth aspect, the device for protecting a message in the embodiment of the present application may be a terminal device or a chip in the terminal device. The device has the function of implementing the first aspect and the technical solutions of the various possible designs of the first aspect. This function can be implemented in hardware or in hardware by executing the corresponding software. The hardware or software includes one or more modules corresponding to the functions described above.

In one possible design, the apparatus includes a processing unit and a communication unit, the processing unit may be, for example, a processor, the communication unit may be, for example, a transceiver, and the transceiver may include a radio frequency circuit. The processing unit is configured to obtain the protected initial NAS message according to the symmetric key and the first security algorithm, the communication unit is configured to send the protected initial NAS message to the first network device, and send the key related parameter to the second network device. Where the key related parameter is used to obtain a symmetric key.

In another possible design, the apparatus includes a processor and a memory, wherein the memory is for storing a program, and the processor is configured to call a program stored in the memory to implement the first aspect and any of the possible designs of the first aspect The method of message protection. It should be noted that the processor can transmit or receive data through an input/output interface, a pin or a circuit. The memory can be a register, a cache, etc. within the chip. In addition, the memory may also be a memory unit located outside the chip in the terminal device, such as a read-only memory (ROM), other types of static storage devices that can store static information and instructions, and random access memory (random Access memory, RAM), etc.

The processor mentioned in any of the above may be a general central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more An integrated circuit for controlling a program for performing the method of message protection of any of the above-described first aspect or any of the first aspects.

In a fifth aspect, the apparatus for message protection in the embodiment of the present application may be a network device or a chip in the network device. The device has the function of realizing the technical solutions of the above-mentioned second aspect and the respective possible designs of the second aspect. This function can be implemented in hardware or in hardware by executing the corresponding software. The hardware or software includes one or more modules corresponding to the functions described above.

In a possible design, the device comprises a processing unit and a communication unit, the processing unit may be, for example, a processor, and the communication unit may be, for example, a communication interface, optionally, the processor and the communication interface may be through an optical fiber, a twisted pair, or the like. In a wired manner, the communication unit may also be a transceiver. The transceiver may include a radio frequency circuit. Alternatively, the processor and the transceiver may be connected by wireless means such as wireless fidelity (WIFI).

Specifically, the communication unit is configured to receive a key related parameter from the terminal device, the key related parameter is used to obtain a symmetric key, the symmetric key is used to secure the initial NAS message, and the processing unit is configured to use the key related parameter according to the key A symmetric key is obtained, and the communication unit is further configured to send a symmetric key to the first network device.

In another possible design, the apparatus includes a processor and a memory, wherein the memory is for storing a program, and the processor is configured to call a program stored in the memory to implement the second aspect and any of the possible designs of the second aspect The method of message protection. It should be noted that the processor can send or receive data through an input/output interface, a pin or a circuit. The memory can be a register, a cache, etc. within the chip. In addition, the memory can also be a memory unit external to the chip within the network device, such as a ROM, other types of static storage devices that can store static information and instructions, RAM, and the like.

Wherein, the processor mentioned in any of the above may be a general-purpose CPU, a microprocessor, a specific ASIC, or one or more messages for controlling the execution of any of the above second aspect or the second aspect. A method of protecting the integrated circuit of the program.

In a sixth aspect, the apparatus for message protection in the embodiment of the present application may be a network device or a chip in the network device. The device has the function of realizing the technical solutions of the various possible designs of the third aspect and the third aspect described above. This function can be implemented in hardware or in hardware by executing the corresponding software. The hardware or software includes one or more modules corresponding to the functions described above.

In a possible design, the device comprises a processing unit and a communication unit, the processing unit may be, for example, a processor, and the communication unit may be, for example, a communication interface, optionally, the processor and the communication interface may be through an optical fiber, a twisted pair, or the like. In a wired manner, the communication unit may also be a transceiver, and the transceiver may include a radio frequency circuit. Optionally, the processor and the transceiver may be connected by wireless means such as WIFI.

Specifically, the communication unit is configured to receive the protected initial NAS message from the terminal device, and receive a symmetric key from the second network device, where the processing unit is configured to obtain the initial NAS message according to the symmetric key and the first security algorithm.

In another possible design, the apparatus includes a processor and a memory, wherein the memory is for storing a program, and the processor is configured to call a program stored in the memory to implement the third aspect and any one of the possible designs of the third aspect The protection method of the message. It should be noted that the processor can transmit or receive data through an input/output interface, a pin or a circuit. The memory can be a register, a cache, etc. within the chip. In addition, the memory can also be a memory unit external to the chip within the network device, such as a ROM, other types of static storage devices that can store static information and instructions, RAM, and the like.

Wherein, the processor mentioned in any of the above may be a general-purpose CPU, a microprocessor, a specific ASIC, or one or more messages for controlling the possible design of any of the above third aspect or the third aspect. A method of protecting the integrated circuit of the program.

In a seventh aspect, the embodiment of the present application further provides a computer readable storage medium storing a program, when the program is run on a computer, causing the computer to execute the method described in the above aspects.

In an eighth aspect, the present application also provides a computer program product comprising a program, which when executed on a computer, causes the computer to perform the method described in the above aspects.

In a ninth aspect, the embodiment of the present application further provides a communication system, including any one of the possible aspects of the fourth aspect or the fourth aspect, the device of any one of the fifth aspect or the fifth aspect, and A device of any of the possible aspects of the sixth or sixth aspect.

In addition, the technical effects brought by any possible design manners in the fourth aspect to the ninth aspect can be referred to the technical effects brought by different design modes in the first aspect, and details are not described herein again.

DRAWINGS

FIG. 1 is a schematic diagram of a possible network architecture applicable to an embodiment of the present application;

2 is a schematic diagram of another possible network architecture applicable to an embodiment of the present application;

FIG. 3 is a schematic flowchart diagram of a method for message protection according to an embodiment of the present disclosure;

FIG. 4 is a schematic flowchart diagram of another method for message protection according to an embodiment of the present disclosure;

FIG. 5 is a schematic flowchart of another method for message protection according to an embodiment of the present disclosure;

FIG. 6 is a schematic flowchart of a method for message protection according to an embodiment of the present disclosure;

FIG. 7 is a schematic diagram of another apparatus for message protection according to an embodiment of the present disclosure;

FIG. 8 is a schematic diagram of another apparatus for message protection according to an embodiment of the present disclosure;

FIG. 9 is a schematic diagram of another apparatus for message protection according to an embodiment of the present disclosure;

FIG. 10 is a schematic diagram of another apparatus for message protection according to an embodiment of the present disclosure;

FIG. 11 is a schematic diagram of another apparatus for message protection according to an embodiment of the present disclosure;

FIG. 12 is a schematic diagram of another apparatus for message protection according to an embodiment of the present disclosure;

13a and 13b are schematic diagrams of a communication system provided by an embodiment of the present application.

Detailed ways

As shown in FIG. 1 , it is a schematic diagram of a possible network architecture applicable to the embodiments of the present application. The network architecture is the 4th Generation mobile communication technology (4G) network architecture. The network elements in the 4G architecture include a terminal device, a mobility management entity (MME), a serving GPRS support node (SGSN), a home subscriber server (HSS), and a service gateway ( Serving gateway, S-GW), packet data network gateway (PDN gateway, P-GW), policy and charging rules function (PCRF) entity, evolved universal terrestrial radio access Evolved universal terrestrial radio access network (E-TURAN).

The E-UTRAN is composed of a plurality of evolved base stations (eNodeBs), and the eNodeBs are interconnected by an X2 interface. The eNodeB and the evolved packet core (EPC) are interconnected through an S1 interface, and the eNodeB and the terminal are connected. The devices are interconnected via LTE-Uu.

The main functions of the MME are to support NAS messages and their security, management of track area (TA) lists, selection of P-GW and S-GW, selection of MMEs when switching across MMEs, and access to 2G/3G access systems. During the handover process, SGSN selection, terminal device authentication, roaming control, and bearer management, and mobility management between core network nodes of different access networks of the 3rd generation partnership project (3GPP) are performed.

The S-GW is a gateway terminated on the E-UTRAN interface. Its main functions include: acting as a local anchor point when performing inter-base station handover, and assisting in completing the reordering function of the base station; as a mobile when switching between 3GPP different access systems Sexual anchor; perform lawful interception; perform routing and forwarding of data packets; perform packet marking at the upstream and downstream transport layers; and be used for inter-operator billing.

The P-GW is a gateway that terminates the PDN to the SGi interface. If the terminal device accesses multiple PDNs, the terminal device will correspond to one or more P-GWs. The main functions of the P-GW include a packet filtering function based on the terminal device, a lawful interception function, an internet protocol (IP) address allocation function between the networks of the terminal devices, and a packet transmission level in the uplink. Marking, performing uplink and downlink service level charging and service level threshold control, and performing service-based uplink and downlink rate control.

The HSS is a database for storing terminal device subscription information, and the home network may include one or more HSSs. The HSS is responsible for storing information related to the terminal device, such as terminal device identification, numbering and routing information, security information, location information, profile information, and the like.

The SGSN can be used for signaling interaction when the 2G/3G and E-UTRAN 3GPP access networks move, including the selection of the P-GW and the S-GW, and the terminal equipment for switching to the E-UTRAN 3GPP access network. The selection of the MME is performed.

The PCRF entity terminates on the Rx interface and the Gx interface. In the non-roaming scenario, there is only one PCRF in the local public land mobile network (HPLMN) and an IP connectivity access network of the terminal device (IP-connectivity access). Network), IP-CAN session related; in the roaming scenario and the traffic flow is local grooming, there may be two PCRFs associated with the IP-CAN session of a terminal device.

A terminal device is a wireless transceiver function that can be deployed on land, indoors or outdoors, handheld or on-board; it can also be deployed on the water (such as ships); it can also be deployed in the air (such as airplanes, balloons). And satellites, etc.). Specifically, the terminal device may be a user equipment (UE), a mobile phone, a tablet, a computer with wireless transceiver function, a virtual reality (VR) terminal, and augmented reality. , AR) terminal, wireless terminal in industrial control, wireless terminal in self driving, wireless terminal in remote medical, wireless terminal in smart grid, A wireless terminal in a transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home, and the like.

FIG. 2 is a schematic diagram of another possible network architecture applicable to the embodiments of the present application. The network architecture is the 5th Generation mobile communication technology (5G) network architecture. The 5G architecture may include a terminal device, a radio access network (RAN), an AMF entity, a session management function (SMF) entity, a user plane function (UPF) entity, a UDM entity, Authentication server function (AUSF) entity, data network (DN). In addition, the 5G network architecture may include an authentication credential Repository and Processing Function (ARPF) entity and a security anchor function (SEAF) in addition to the network element as shown in FIG. Entity, subscription identifier de-concealing function (SIDF) entity, etc.

The main function of the RAN is to control the terminal device to access the mobile communication network through wireless. The RAN is part of a mobile communication system. It implements a wireless access technology. Conceptually, it resides between devices (such as mobile phones, a computer, or any remote controller) and provides connectivity to its core network. The RAN device includes, but is not limited to, (g nodeB, gNB), evolved node B (eNB), radio network controller (RNC), node B (node B, NB) in 5G, Base station controller (BSC), base transceiver station (BTS), home base station (for example, home evolved node B, or home node B, HNB), baseband unit (BBU), transmission A transmitting and receiving point (TRP), a transmitting point (TP), a mobile switching center, and the like may further include a wireless fidelity (wifi) access point (AP) and the like.

The AMF entity is responsible for access management and mobility management of the terminal device. In practical applications, it includes the mobility management function of the MME in the 4G network framework and adds the access management function.

The SMF entity is responsible for session management, such as user session establishment.

The UPF entity is a functional network element of the user plane, and is mainly responsible for connecting to an external network, which includes related functions of the SGW and the P-GW in the 4G network architecture.

The DN is responsible for providing services for the terminal devices. For example, some DNs provide Internet access for terminal devices, and other DNs provide SMS functions for terminal devices.

The AUSF entity has an authentication service function for terminating the authentication function of the SEAF request.

The UDM entity can store subscription information of the terminal device and implement a backend similar to the HSS in 4G.

The ARPF entity has an authentication credential storage and processing function for storing a long-term authentication credential of the UE, such as a permanent key K. In 5G, the functionality of ARPF can be incorporated into UDM entities.

The SEAF entity is used to complete the authentication process for the terminal device. In 5G, the function of the SEAF can be incorporated into the AMF entity.

The SIDF entity can resolve the identity information of the subscriber, for example, obtaining a subscription permanent identifier (SUPI) according to a subscription concealed identifier (SUCI).

For the terminal device, refer to the terminal device in the network architecture shown in FIG. 1.

The embodiment of the present application is applicable to the 4G network architecture shown in FIG. 1 and to the 5G network architecture shown in FIG. 2 .

In the embodiment of the present application, the first network device may be a mobility mobility management function entity for managing the terminal device, or may be a chip in the mobility management function entity or the mobility management function entity, for example, the MME in the 4G, 5G. The AMF entity or the SEAF entity; the second network device may be a private key for storing the network device, or a storage function entity for decrypting a message encrypted according to the public key of the network device, or a chip within the functional entity, for example, HSS in 4G, APRF entity in 5G, or AUSF entity, or SIDF entity, or UDM entity. For convenience of description, the embodiments of the present application are described by using the first network device as the mobility management function entity and the second network device as the storage function entity as an example, which is not limited.

It should be noted that the method provided by the embodiments of the present application can protect not only the complete initial NAS message but also some fields of the initial NAS message. For convenience of description, embodiments of the present application are described by taking a complete initial NAS message as an example. When protecting a part of the field of the initial NAS message, the ciphertext of the initial NAS message, the MAC of the initial NAS message, and the ciphertext of the initial NAS message. The MAC may be replaced with the ciphertext of the initial NAS message part field, the MAC of the initial NAS message part field, and the MAC of the ciphertext of the initial NAS message part field, which are not limited.

The method for message protection in the embodiment of the present application is described in detail below with reference to the accompanying drawings.

As shown in FIG. 3, a schematic flowchart of a method for message protection provided by an embodiment of the present application includes the following steps:

Step 301: The terminal device obtains the protected initial NAS message according to the symmetric key and the first security algorithm.

The initial NAS message may be the first NAS message sent to the mobility management function entity during the process in which the terminal device accesses the mobility management function entity. For example, the initial NAS message may be a registration request (RR) message, an attach request message, or a tracking area update (TAU) update request (TAU request) message.

The symmetric key may be an encryption key or an integrity protection key, and may also include an encryption key and an integrity protection key.

Exemplarily, the symmetric key is an encryption key, and the first security algorithm is an encryption algorithm; or the symmetric key is an integrity protection key, the first security algorithm is an integrity protection algorithm; or the symmetric key includes an encryption key. The key and integrity protection keys, the first security algorithm includes an encryption algorithm and an integrity protection algorithm.

The encryption involved in the present application is used to obtain the true content of the message to be expressed by the third party after the message content sent by the target receiver is not known by the third party. The integrity protection is used to ensure that the content of the message received by the target recipient has not been tampered with by the third party, consistent with the message sent by the sender to the intended recipient.

It should be noted that when the symmetric key is an encryption key and the first security algorithm is an encryption algorithm, the protected initial NAS message may be the ciphertext of the initial NAS message; when the symmetric key is the integrity protection key, the first When a security algorithm is an integrity protection algorithm, the protected initial NAS message may be a message authentication code (MAC) of the initial NAS message and the initial NAS message; when the symmetric key includes an encryption key and an integrity protection secret At the time of the key, the protected initial NAS message may be the ciphertext and MAC of the initial NAS message, where the MAC may be the MAC of the ciphertext of the initial NAS message, or the MAC is the MAC of the initial NAS message, and further, when the symmetric key includes encryption When the key and the integrity protection key are used, the protected initial NAS message may also be the ciphertext of the integrity-protected initial NAS message, where the encrypted content in the ciphertext of the integrity-protected initial NAS message includes the initial NAS message. And the MAC of the initial NAS message, the MAC in the specific protected initial NAS message is the MAC of the ciphertext of the initial NAS message or the MAC of the initial NAS message and the terminal device is the beginning The integrity protection of the NAS message is related to the integrity protection of the ciphertext of the initial NAS message, and whether the MAC is encrypted in the case of performing integrity protection on the initial NAS message, and is implemented by the terminal device in specific implementation. The internal implementation is determined.

In a specific implementation, the symmetric key may be pre-configured on the terminal device, or the symmetric key may be generated by the terminal device. The method for generating a symmetric key is provided in the application, and may be applied to a case where a symmetric key generation algorithm is pre-configured on the terminal device, and may also be applied when the symmetric key is pre-configured in the terminal device. .

The first way for the terminal device to generate a symmetric key is as follows:

The terminal device generates a symmetric key according to the public key of the storage function entity and the private key of the terminal device. It should be noted that the terminal device can generate the public key and the private key of the terminal device according to the pre-configured asymmetric parameters. Optionally, the algorithm for generating the public key and the private key of the terminal device can be an elliptic curve complete encryption method (elliptic curve). Integrated encryption scheme, ECIES).

The following describes the manner in which the terminal device generates a symmetric key.

Example 1: The terminal device directly generates a symmetric key according to the public key of the storage function entity and the private key of the terminal device. Optionally, the algorithm for generating a symmetric key may be a key agreement function (KAF) pre-configured on the terminal device. Optionally, the symmetric key generated in the first example may be an encryption key or an integrity protection key, and may be applied when the symmetric key is an encryption key or an integrity protection key; or, optional The symmetric key generated in Example 1 can be used both as an encryption key and as an integrity protection key. It can be applied to symmetric keys including encryption keys and integrity protection keys, and encryption keys and integrity. If the protection key is the same, or alternatively, the terminal device may directly generate the symmetric key 1 and the symmetric key 2 according to the public key of the storage function entity and the private key of the terminal device for different private keys. The terminal device may use the symmetric key 1 as an encryption key, and the symmetric key 2 may be used as an integrity protection key. The terminal device includes two or more private keys, which may be applied to the symmetric key. The encryption key and the integrity protection key, and the encryption key and the integrity protection key are different.

Example 2: The terminal device generates an intermediate key according to the public key of the storage function entity and the private key of the terminal device, and then generates a symmetric key according to the intermediate key and the fixed string. The fixed character string may be pre-configured on the terminal device and the network side (such as a storage function entity), or pre-configured on the terminal device or the network side. Specifically, the terminal device and the network side may pre-configure one or more fixed character strings. In a case where multiple fixed character strings are pre-configured, the terminal device may select at least one fixed character string according to a preset algorithm or rule, for example, Select at least one fixed string randomly, or select one or more fixed strings in a certain priority order. Specifically, the fixed string can be "NAS", "INITIAL", "INITIAL NAS", "SUPI", "INITIAL ENC", "INITIAL NAS ENC", "INITIAL INT", "INITIAL NAS INT", etc. It is noted that the method for generating the intermediate key in the second example is similar to the method for generating the symmetric key. For example, the algorithm for generating the intermediate key may be a KAF pre-configured at the terminal device.

For example, the symmetric key generated in the second example may be an encryption key or an integrity protection key, and may be applied when the symmetric key is an encryption key or an integrity protection key; or Alternatively, the symmetric key generated in the second example can be used as an encryption key or as an integrity protection key, and can be applied to a symmetric key including an encryption key and an integrity protection key, and an encryption key and integrity. If the protection key is the same, or alternatively, the terminal device may separately generate the symmetric key 1 and the symmetric key according to the public key of the storage function entity and the private key of the terminal device for different private keys. And then generate a symmetric key according to the intermediate key 1 and the fixed string 1. Generate a symmetric key 2 according to the intermediate key 2 and the fixed string, and directly use the symmetric key 1 as the encryption key and the symmetric key 2 as the integrity. Protection key, where the terminal device has two or more private keys, which can be applied to the symmetric key including the encryption key and the integrity protection key, and the encryption key and the integrity protection key. In the same case; or alternatively, the terminal device generates an intermediate key according to the public key of the storage function entity and the private key of the terminal device, and then the terminal device can select the encryption key and the integrity protection key. Two different fixed strings, such as fixed string 1 and fixed string 2. Specifically, fixed string 1 can be "ENC", "KEY ENC", "INIITIAL ENC", etc., fixed string 2 can be " INT", "KEY INT", "INIITIAL INT", etc., and generate a symmetric key 1 based on the fixed string 1 and the intermediate key, and generate a symmetric key 2 based on the fixed string 2 and the intermediate key, which will be symmetric Key 1 is used as the encryption key, and symmetric key 2 is used as the integrity protection key. The terminal device may have one or more private keys, which may be applied to the symmetric key including the encryption key and the integrity protection key, and The encryption key and the integrity protection key are different.

It should be noted that, in the second example, an optional manner is: the terminal device directly sends the public key of the terminal device to the storage function entity, in which case the storage function entity is based on the public key and storage of the terminal device. The private key of the functional entity generates an intermediate key, and then generates a symmetric key according to the intermediate key and the symmetric string; another optional manner is: the terminal device sends the generated intermediate key to the storage function entity, and the storage function The entity can directly generate a symmetric key according to the intermediate key and the fixed string, which reduces the step of the storage function entity to generate a symmetric key, and helps improve communication efficiency. An optional method is: the terminal device encrypts the symmetric key according to the public key of the storage function entity, and then sends the ciphertext of the symmetric key to the storage function entity. In this case, the storage function entity only needs to A symmetric key is obtained by decrypting the ciphertext of the symmetric key by storing the private key of the functional entity. The parameters sent by the specific terminal device to the storage function entity are determined by a pre-configured algorithm or policy in the terminal device.

Example 3: The terminal device generates a temporary key 1 according to the public key of the storage function entity and the private key of the terminal device, and then generates a temporary key 2 based on the temporary key 1 and further key derivation based on the pre-configured KDF. Optionally, the terminal device directly uses the temporary key 2 as a symmetric key; or, the terminal device cuts the length of the temporary key 1 or the temporary key 2 to a pre-configured length according to a pre-configured truncted function. Get a symmetric key.

For example, the symmetric key generated in the third example may be an encryption key or an integrity protection key, and may be applied when the symmetric key is an encryption key or an integrity protection key; or Optionally, the terminal device generates an encryption key or an integrity protection key according to the symmetric key and the fixed string generated in the third example. Specifically, the fixed string may be “NAS”, “INITIAL”, “INITIAL NAS”, etc. Or, optionally, the symmetric key generated in Example 3 can be used as an encryption key or as an integrity protection key, and can be applied to a symmetric key including an encryption key and an integrity protection key, and encrypted. If the key and the integrity protection key are the same; or, optionally, the terminal device can use the private key 1 and the private key 2 to generate the symmetric key 1 and the symmetric key 2 respectively according to the method in the third example, and then directly The symmetric key 1 is used as the encryption key, and the symmetric key 2 is used as the integrity protection key. The terminal device has two or more private keys, which can be applied to the symmetric key including the encryption key. If the key and the integrity protection key are different, and the encryption key and the integrity protection key are different; or alternatively, the terminal device generates a temporary key according to the public key of the storage function entity and the private key of the terminal device. 1, in order to obtain the encryption key and integrity protection key, the terminal device can select two different fixed string, such as fixed string 1 and fixed string 2, specifically, fixed string 1 can be "ENC" , "KEY ENC", "INIITIAL ENC", etc., fixed string 2 can be "INT", "KEY INT", "INIITIAL INT", etc., and based on fixed string 1 and temporary key 1, based on pre-set KDF For further key derivation, a symmetric key 1 is generated, and according to the fixed character string 2 and the intermediate key, based on the preset KDF for further key derivation, a symmetric key 2 is generated, and the symmetric key 1 is used as the encryption key. The key, the symmetric key 2 is used as an integrity protection key, wherein the terminal device has one or more private keys, which can be applied to the symmetric key including the encryption key and the integrity protection key, and is encrypted. The key and integrity protection keys are different.

The second way for the terminal device to generate a symmetric key is as follows:

The terminal device generates a symmetric key according to a random key generation algorithm. Optionally, the random key generation algorithm is pre-configured on the terminal device. Specifically, the terminal device generates a key that satisfies the required length of the random key generation algorithm according to a pre-configured random key generation algorithm, and uses the key as a symmetric key.

For example, the symmetric key generated in the second mode may be an encryption key or an integrity protection key, and may be applied when the symmetric key is an encryption key or an integrity protection key; or, optional The symmetric key generated in the second method can be used as both an encryption key and an integrity protection key, and can be applied to a symmetric key including an encryption key and an integrity protection key, and an encryption key and integrity. If the protection key is the same, or alternatively, the symmetric key generated by the terminal device according to the pre-configured random key generation algorithm may include a symmetric key 1 and a symmetric key 2, wherein the terminal device may use the symmetric key 1 as an encryption key and symmetric key 2 as an integrity protection key, which can be applied to a case where a symmetric key includes an encryption key and an integrity protection key; or, alternatively, the terminal device can be pre-configured according to a random key generation algorithm, generating a temporary key 4, and then generating an encryption key based on the KDF based on the temporary key 4 and the pre-configured first fixed string, according to the temporary 4 and the second fixed key pre-configured string, generate an integrity protection key based KDF, may be applied to the symmetric key comprises an encryption key and an integrity protection key case.

The third way for the terminal device to generate a symmetric key is:

The terminal device generates a symmetric key according to the random number, the permanent key, and the KDF. Optionally, the permanent key and the KDF are pre-configured in the terminal device, and the random number is randomly generated by the terminal device.

For example, the symmetric key generated in the third mode may be an encryption key or an integrity protection key, and may be applied when the symmetric key is an encryption key or an integrity protection key; or, optional The symmetric key generated in the third method can be used as both an encryption key and an integrity protection key, and can be applied to a symmetric key including an encryption key and an integrity protection key, and an encryption key and integrity. If the protection key is the same, or alternatively, the terminal device may respectively generate an encryption key and an integrity protection key according to different random numbers according to different random numbers, and may be applied to the symmetric key including the encryption key. In the case of a key and integrity protection key; or, optionally, the terminal device may generate an encryption key based on the KDF based on the permanent key, the random number and the pre-configured first fixed string, and according to the permanent key, Random number and pre-configured second fixed string, based on KDF to generate integrity protection key, can be applied to symmetric key including encryption key and integrity protection secret in the case of.

In addition, the first security algorithm in the embodiment of the present application may be pre-configured in the terminal device, and the terminal device determines the policy according to the pre-configured policy, where the optional pre-configured policy is sent by the network side device to the terminal device, where the network The side device may be a mobility management function entity that the terminal device needs to access in the embodiment of the present application, or may be another mobility management function entity that the terminal device in the network has accessed, for example, when the terminal device accesses the mobility management entity for the first time. The pre-configured policy can be sent to other mobility management function entities that the terminal device in the network has accessed. In addition, the pre-configured policy can also be manually configured in the terminal device. An optional pre-configured policy mode is as follows: if the terminal device accesses the mobility management function entity for the first time, the first security algorithm may be a security algorithm pre-configured in the terminal device, optionally, if the terminal device is pre-configured When multiple security algorithms are configured, the first security algorithm may be one of a plurality of pre-configured security algorithms. How the specific terminal device selects the first security algorithm from multiple pre-configured security algorithms is The internal implementation of the terminal device is determined. If the terminal device accesses the mobility management function entity for the Nth time, where N is an integer greater than or equal to 2, the first security algorithm may be used by the terminal device when accessing the mobility management entity (N-1) times. Security algorithm. Optionally, the pre-configured policy may be pre-configured in the terminal device at the factory. For example, the pre-configured policy may be the highest priority security algorithm in the security algorithm.

Step 302: The terminal device sends the protected initial NAS message to the mobility management function entity, and sends a key related parameter to the storage function entity, where the key related parameter is used to obtain a symmetric key.

In a possible implementation manner, the terminal device directly sends the key related parameter to the storage function entity; in another possible implementation manner, the terminal device transparently transmits the key related parameter to the storage function entity through the mobility management function entity, for example, the terminal The device may send the key related parameters along with the protected initial NAS message to the mobility management functional entity.

For example, if the symmetric key is generated according to the public key of the storage function entity and the private key of the terminal device, the key related parameter includes the public key of the terminal device; if the symmetric key is generated according to the random key generation algorithm, Or the symmetric key is generated according to the random number, the permanent key, and the KDF, and the key related parameter includes the ciphertext of the symmetric key, wherein the ciphertext of the symmetric key is obtained according to the public key of the storage function entity, and the specific The terminal device encrypts the symmetric key according to the public key of the storage function entity, and obtains the ciphertext of the symmetric key.

Optionally, in order to facilitate the mobility management function entity to obtain the initial NAS message after receiving the protected initial NAS message, the key related parameter further includes a first security algorithm, or a ciphertext of the first security algorithm, where the first security The ciphertext of the algorithm is obtained according to the public key of the storage function entity. Specifically, the terminal device encrypts the first security algorithm according to the public key of the storage function entity, and obtains the ciphertext of the first security algorithm.

In the case that the key-related parameter does not include the first security algorithm or the ciphertext of the first security algorithm, the mobility management function entity may obtain the initial NAS message according to the symmetric key and its pre-configured security algorithm, and usually move The pre-configured security algorithms in the management function entity include pre-configured security algorithms in the terminal device.

Step 303: After receiving the key related parameter, the storage function entity obtains a symmetric key according to the key related parameter.

In an example, the key related parameter includes a public key of the terminal device, and the storage function entity may generate a symmetric key according to the public key of the terminal device and the private key of the storage function entity. Specifically, the storage function entity generates a symmetric key according to the public key of the terminal device and the private key of the storage function entity, and the manner in which the terminal device generates the symmetric key according to the public key of the storage function entity and the private key of the terminal device is similar to This will not be repeated here.

In another example, the storage function entity generates an intermediate key according to the public key of the terminal device and the private key of the storage function entity, and then generates a symmetric key according to the intermediate key and the fixed string and the terminal device according to the storage function entity. The public key and the private key of the terminal device generate an intermediate key, and then the symmetric key is generated according to the intermediate key and the fixed character string, and is not described here.

In another example, the key related parameter includes a ciphertext of a symmetric key, and the storage function entity decrypts the ciphertext of the symmetric key according to the private key of the storage function entity to obtain a symmetric key.

In addition, in the case that the ciphertext of the first security algorithm is included in the key-related parameter, the method further includes: the storage function entity decrypts the ciphertext of the first security algorithm according to the private key of the storage function entity, and obtains the first Security algorithm.

Step 304: The storage function entity sends a symmetric key to the mobility management function entity.

It should be noted that, in a case that the storage function entity generates an intermediate key according to the public key of the terminal device and the private key of the storage function entity, the symmetric key sent by the storage function entity to the mobility management function entity may also be an intermediate key. A symmetric key for obtaining the initial NAS message can then be generated by the mobility management function entity based on the intermediate key and the fixed string.

For example, in the case where the symmetric key includes an encryption key and an integrity protection key, the mobility management function entity may generate an encryption key based on the KDF according to the intermediate key and the pre-configured first fixed character string; The key and the pre-configured second fixed string generate an integrity protection key based on the KDF. In addition, the mobility management function entity may also generate a symmetric key according to the intermediate key and the fixed string in other manners. For details, refer to the manner in which the storage function entity generates a symmetric key, and details are not described herein.

In the case that the first security algorithm or the ciphertext of the first security algorithm is included in the key related parameter, the method further includes: the storage function entity sending the first security algorithm to the mobility management function entity.

Step 305: After receiving the protected initial NAS message from the terminal device and the symmetric key from the storage function entity, the mobility management function entity obtains an initial NAS message according to the symmetric key and the first security algorithm.

The first security algorithm may be pre-configured on the mobility management functional entity.

Optionally, in a case that the storage function entity sends the first security algorithm to the mobility management function entity, the mobility management function entity further receives the first security algorithm from the storage function entity.

Specifically, the mobility management function entity can obtain the initial NAS message based on the following methods:

Manner 1: The mobility management function entity decrypts the protected initial NAS message according to the symmetric key and the first security algorithm to obtain an initial NAS message, which can be applied to the protected initial NAS message as the ciphertext of the initial NAS message. In the case, the symmetric key is an encryption key, and the first security algorithm is an encryption algorithm, and the ciphertext of the initial NAS message is obtained according to the encryption key and the first security algorithm.

Manner 2: The mobility management function entity verifies the integrity of the initial NAS message according to the symmetric key and the first security algorithm, and may be applied to the case where the symmetric key is an integrity protection key and the first security algorithm is an integrity protection algorithm. under. Specifically, the mobility management function entity may verify the integrity of the initial NAS message according to the following manner: since the protected initial NAS message is the MAC of the initial NAS message and the initial NAS message, the mobility management function entity may be based on the symmetric key, The first security algorithm and the received initial NAS message generate a new MAC. If the new MAC is the same as the MAC in the protected initial NAS message, the mobility management function entity verifies that the integrity of the initial NAS message is successful; if the new MAC is The MAC in the protected initial NAS message is different, and the mobility management function entity fails to verify the integrity of the initial NAS message.

Manner 3: The mobility management function entity verifies the integrity of the ciphertext of the initial NAS message according to the integrity protection key and the integrity protection key algorithm, wherein the mobility management function entity checks the integrity of the ciphertext of the initial NAS message and The integrity of the initial NAS message is verified by the mobility management function entity in mode 2, and the description is not repeated here. Optionally, in the case that the mobility management function entity verifies that the integrity of the ciphertext of the initial NAS message is successful, the mobility management function entity decrypts the ciphertext of the initial NAS message according to the encryption key and the encryption algorithm to obtain an initial The NAS message; or, optionally, the mobility management function entity directly decrypts the ciphertext of the initial NAS message regardless of the verification result of the integrity protection, and the foregoing manner can be applied to the protected initial NAS message as the initial NAS message. In the case of the ciphertext of the ciphertext and the ciphertext of the initial NAS message, wherein the symmetric key includes an encryption key and an integrity protection key, the first security algorithm includes an encryption algorithm and an integrity protection algorithm, and a ciphertext of the initial NAS message. Obtained according to the encryption key and the encryption algorithm, the MAC of the ciphertext of the initial NAS message is obtained according to the integrity protection key and the integrity protection key algorithm.

Mode 4: The mobility management function entity first decrypts the protected initial NAS message according to the encryption key and the encryption algorithm, obtains the initial NAS message, and then verifies the initial according to the integrity protection key and the integrity protection algorithm. The integrity of the NAS message, where the integrity of the initial NAS message obtained by the mobility management function entity is verified and the integrity of the mobile management function entity verifying the initial NAS message in Mode 2 is similar, and the description is not repeated here. The foregoing manner may be applied to the protected initial NAS message being the protected initial NAS message being the ciphertext of the initial NAS message and the MAC of the initial NAS message, or the ciphertext of the integrity-protected initial NAS message, after integrity protection. Where the encrypted content of the initial NAS message includes the MAC of the initial NAS message and the initial NAS message, wherein the symmetric key includes an encryption key and an integrity protection key, and the first security algorithm includes an encryption algorithm and an integrity protection algorithm. The ciphertext of the initial NAS message or the integrity-protected initial NAS message is obtained according to the encryption key and the encryption algorithm. The MAC of the initial NAS message is obtained according to the integrity protection key and the integrity protection key algorithm. of.

In this embodiment, the terminal device performs security protection on all or part of the content in the initial NAS message according to the symmetric key and the first security algorithm, and is not allowed to secure the NAS message after receiving the NAS SMC message sent by the network device. The limitation of protection not only improves the reliability of the initial NAS message transmission, but also improves the access efficiency of the terminal device.

It should be noted that, as an alternative to the embodiment shown in FIG. 3, step 302 may be replaced by: the terminal device sends the protected initial NAS message and the key related parameter to the storage function entity. In a specific implementation, optionally, the terminal device sends the protected initial NAS message and the key related parameter to the mobility management function entity, and the mobility management function entity receives the protected initial NAS message and the key related to the terminal device. After the parameter, the protected initial NAS message and key related parameters are transparently transmitted to the storage function entity. Alternatively, optionally, the terminal device directly sends the protected initial NAS message and the key related parameter to the storage function entity. Then step 303 is performed, and after step 303 is performed, steps 304 and 305 are replaced with the following: the storage function entity obtains an initial NAS message according to the symmetric key and the first security algorithm, and then sends an initial NAS message to the mobility management function entity. The manner in which the storage function entity obtains the initial NAS message according to the symmetric key and the first security algorithm is similar to the manner in which the mobile management function entity obtains the initial NAS message according to the symmetric key and the first security algorithm in step 305, and details are not described herein again. .

In addition, since the mobile management function entity obtains the real content that needs to be transmitted in the protected initial NAS message, which is obtained on the premise that the symmetric key and the first security algorithm are acquired, when the mobile management entity obtains the initial NAS message, When the downlink NAS message needs to be sent to the terminal device, in order to improve the reliability of the downlink NAS message transmission, the downlink NAS message may be securely protected according to the symmetric key and the first security algorithm, and then sent to the terminal device.

Specifically, a, an optional implementation is:

The mobility management function entity obtains the protected downlink NAS message according to the symmetric key and the first security algorithm, and then sends the protected downlink NAS message to the terminal device, where the terminal device receives the protected downlink NAS from the mobility management function entity. After the message, the downlink NAS message is obtained according to the symmetric key and the first security algorithm. It should be noted that, in a manner that the mobility management entity obtains the protected downlink NAS message according to the symmetric key and the first security algorithm, refer to the manner in which the terminal device obtains the protected initial NAS message according to the symmetric key and the first security algorithm. . For the manner in which the terminal device obtains the downlink NAS message according to the symmetric key and the first security algorithm, refer to the manner in which the mobility management function entity obtains the initial NAS message according to the symmetric key and the first security algorithm.

For example, when the initial NAS message is a registration request message, the downlink NAS message may be a registration accept message, a registration reject message, or a NAS SMC message.

For example, the downlink NAS message is a NAS SMC message or a registration accept message. To improve the reliability of the downlink NAS message transmission, optionally, the mobility management function entity obtains the protected downlink NAS message according to the symmetric key and the first security algorithm. The protected downlink NAS message is the ciphertext of the downlink NAS message, and then the protected downlink NAS message is sent to the terminal device, and after receiving the protected downlink NAS message, the terminal device according to the symmetric key and the first security algorithm, The protected downlink NAS message is decrypted to obtain a downlink NAS message. The above manner can be applied to the case where the symmetric key includes an encryption key and the first complete algorithm includes an encryption algorithm. In addition, optionally, in the case that the symmetric key includes an encryption key and an integrity protection key, and the first security algorithm includes an encryption algorithm and an integrity protection algorithm, the protected downlink NAS message may include the density of the downlink NAS message. The ciphertext MAC address of the text and the downlink NAS message, or the protected downlink NAS message includes the ciphertext of the downlink NAS message and the MAC address of the downlink NAS message, or the ciphertext of the integrity-protected downlink NAS message, where the integrity is protected. The content encrypted by the ciphertext of the downlink NAS message includes the MAC of the downlink NAS message and the downlink NAS message. Optionally, in the case that the symmetric key includes an integrity protection key and the first security algorithm is an integrity protection algorithm, the protected downlink NAS message is a MAC of a downlink NAS message and a downlink NAS message.

For example, the downlink NAS message is a registration reject message, and the mobility management function entity performs integrity protection on the downlink NAS message according to the symmetric key and the first security algorithm to obtain the protected downlink NAS message; and sends the protected downlink message to the terminal device. Downstream NAS message. After receiving the downlink NAS message, the terminal device checks the integrity of the downlink NAS message according to the symmetric key and the first security algorithm. The above manner can be applied to the case where the symmetric key contains an integrity protection key and the first security algorithm includes an integrity protection algorithm.

Specifically, since the mobility management function entity may reject the registration request of the terminal device, such as the SUPI cannot be found, the terminal device is invalid, and the like, the reason why the mobility management function entity rejects the registration request of the terminal device may be referred to Table 9.9 of 3GPP TS 24.301. .3.9.1. In the prior art, the registration rejection message cannot be protected, and the registration rejection message sent by the mobility management function entity to the terminal device may be tampered with, forged, sniffed, etc., causing the terminal device to enter the DoS state. In the embodiment of the present application, in the case that the downlink NAS message is a registration reject message, the mobility management function entity may perform integrity protection and/or encryption on the registration reject message according to the symmetric key and the first security algorithm. , thereby helping to reduce the possibility of registration rejection messages being tampered with, forged, sniffed, and the like.

b. Another alternative implementation is:

The mobility management function entity obtains the ciphertext of the downlink NAS message according to the symmetric key and the first security algorithm, where the downlink NAS message includes the second security algorithm, and then the mobility management function entity performs the ciphertext of the downlink NAS message according to the second security algorithm. Integrity protection, obtaining the protected downlink NAS message, and then sending the protected downlink NAS message to the terminal device. After receiving the protected downlink NAS message from the mobility management function entity, the terminal device decrypts the ciphertext of the downlink NAS message according to the symmetric key and the first security algorithm to obtain the downlink NAS message, and then the terminal device receives the downlink NAS message. And obtaining the second security algorithm, and then verifying the integrity of the ciphertext of the downlink NAS message according to the second security algorithm. For example, in this implementation, the downlink NAS message may be a registration accept message.

Specifically, in the case that the symmetric key includes the encryption key and the first security algorithm includes the encryption algorithm, on the network side, the mobility management function entity encrypts the downlink NAS message according to the encryption key and the encryption algorithm to obtain the downlink NAS message. On the terminal side, the terminal device decrypts the ciphertext of the downlink NAS message according to the encryption key and the encryption algorithm to obtain a downlink NAS message.

c. Another possible implementation is:

The mobility management function entity performs integrity protection on the downlink NAS message according to the second security algorithm, and obtains the protected downlink NAS message according to the symmetric key and the first security algorithm, where the protected downlink NAS message is integrity protected. The ciphertext of the downlink NAS message is then sent to the terminal device for the protected downlink NAS message. After receiving the protected downlink NAS message from the mobility management function entity, the terminal device decrypts the protected downlink NAS message according to the symmetric key and the first security algorithm to obtain a downlink NAS message, and then obtains the downlink NAS message. The second security algorithm checks the integrity of the downlink NAS message according to the second security algorithm. Specifically, the content encrypted by the ciphertext of the integrity-protected downlink NAS message includes the MAC of the downlink NAS message and the downlink NAS message.

It should be noted that, in the embodiment of the present application, the mobility management function entity may perform integrity protection on the downlink NAS message according to the second security algorithm, obtain the MAC address of the downlink NAS message, and perform downlink on the basis of the symmetric key and the first security algorithm. The NAS message is encrypted to obtain the ciphertext of the downlink NAS message. In this implementation, the protected downlink NAS message is the ciphertext of the downlink NAS message and the MAC of the downlink NAS message. The protected downlink NAS message is then sent to the terminal device. After receiving the protected downlink NAS message from the mobility management function entity, the terminal device decrypts the ciphertext of the downlink NAS message according to the symmetric key and the first security algorithm to obtain the downlink NAS message, and then obtains the downlink NAS message from the downlink NAS message. The second security algorithm further checks the integrity of the downlink NAS message according to the second security algorithm.

For example, in the foregoing implementation manner, the downlink NAS message may be a registration accept message, a NAS SMC message, or the like.

In the implementation manners b and c, the second security algorithm includes an integrity protection algorithm. Optionally, the second security algorithm may further include an encryption algorithm. Specifically, the second security algorithm is a mobility management function entity according to the terminal device. Security capabilities and a list of pre-configured algorithms are selected. It should be noted that the first security algorithm and the second security algorithm may be the same or different. For example, the encryption algorithm included in the first security algorithm and the encryption algorithm included in the second security algorithm are the same, and the integrity of the first security algorithm is included. The protection algorithm and the second security algorithm comprise different integrity protection algorithms; or the encryption algorithm included in the first security algorithm and the encryption algorithm included in the second security algorithm are different, the integrity protection algorithm included in the first security algorithm, and the second security The algorithm includes the same integrity protection algorithm; or the encryption algorithm included in the first security algorithm is the same as the encryption algorithm included in the second security algorithm, the integrity protection algorithm included in the first security algorithm, and the integrity protection included in the second security algorithm The algorithm is the same; or the encryption algorithm included in the first security algorithm is different from the encryption algorithm included in the second security algorithm, and the integrity protection algorithm included in the first security algorithm is different from the integrity protection algorithm included in the second security algorithm. Optionally, if the first security algorithm and the second security algorithm are the same, the second security algorithm may not be carried in the downlink NAS message, or the encryption algorithm included in the first security algorithm and the encryption included in the second security algorithm If the algorithm is the same, the integrity protection algorithm included in the first security algorithm, and the integrity protection algorithm included in the second security algorithm are different, the downlink NAS message carries the second security algorithm, and the second security algorithm carried in the downlink NAS message Includes encryption algorithms that are integrity protection algorithms and are not included. After obtaining the downlink NAS message, the terminal device communicates with the mobility management function entity based on the security algorithm carried in the downlink NAS message.

When the downlink NAS message is a NAS SMC message, it helps to better complicate the negotiation process of the existing security algorithm while improving the reliability of the initial NAS message transmission. Optionally, when the security algorithm determined by the mobility management function entity is inconsistent with the security algorithm determined by the terminal device, the mobility management function entity may send the security algorithm determined by the mobility management function entity to the terminal device by using the NAS SMC message, when the mobility management function entity determines If the security algorithm is consistent with the security algorithm determined by the terminal device, the mobility management function entity may not send the NAS SMC message to the terminal device, which helps to reduce signaling interaction to a certain extent and provide communication efficiency; When the NAS message is a registration accept message, the mobility management function entity can directly negotiate the security algorithm used by the terminal device through the registration accept message, omitting the transmission of the NAS SMC message, thereby reducing the signaling interaction and improving the communication efficiency.

The method for message protection in the embodiment of the present application is specifically described below based on the implementation of different symmetric keys.

As shown in FIG. 4, a method for message protection is provided in the embodiment of the present application. The method is described by using a symmetric key, including an encryption key and an integrity protection key, as follows.

Step 401: The terminal device generates a first symmetric key according to the public key of the storage function entity and the private key of the terminal device, where the first symmetric key includes the first encryption key and the first integrity protection key.

Specifically, for the manner in which the terminal device generates the first symmetric key, refer to the manner in which the terminal device generates a symmetric key according to the public key of the storage function entity and the private key of the terminal device in the embodiment shown in FIG. 3, and details are not described herein again.

Step 402: The terminal device encrypts the initial NAS message according to the first encryption key and the first encryption algorithm, and obtains the ciphertext of the initial NAS message.

The first encryption algorithm may be pre-configured in the terminal device and the mobility management function entity.

Step 403: The terminal device performs integrity protection on the ciphertext of the initial NAS message according to the first integrity protection key and the first integrity protection algorithm, and obtains the MAC address of the ciphertext of the initial NAS message.

The first integrity protection algorithm may be pre-configured in the terminal device and the mobility management function entity.

Step 404: The terminal device sends the protected initial NAS message and the public key of the terminal device to the mobility management function entity.

The protected initial NAS message may include the ciphertext of the initial NAS message and the ciphertext of the initial NAS message.

Step 405: After receiving the protected initial NAS message and the public key of the terminal device, the mobility management function entity sends the public key of the terminal device to the storage function entity.

Step 406: After receiving the public key of the terminal device sent by the mobility management function entity, the storage function entity generates a second symmetric key according to the public key of the terminal device and the private key of the storage function entity.

The second symmetric key may include a second encryption key and a second integrity protection key. Specifically, the second encryption key and the first encryption key may be the same, and the second integrity protection key and the first The integrity protection key can be the same.

For the manner in which the storage function entity generates the second symmetric key, refer to the manner in which the storage function entity generates a symmetric key according to the public key of the terminal device and the private key of the storage function entity in the embodiment shown in FIG. Description.

Step 407: The storage function entity sends a second symmetric key to the mobility management function entity.

Step 408: After receiving the second symmetric key sent by the storage function entity, the mobility management function entity checks the integrity of the ciphertext of the initial NAS message according to the second integrity protection key and the first integrity protection algorithm.

The manner in which the mobility management function entity checks the integrity of the ciphertext of the initial NAS message is similar to the manner in which the integrity of the initial NAS message is verified in the message protection method in FIG. 3, and the description is not repeated here.

Step 409: The mobility management function entity decrypts the ciphertext of the initial NAS message according to the second encryption key and the first encryption algorithm when the integrity check of the ciphertext of the initial NAS message is successful, to obtain an initial NAS message.

After the initial NAS message is obtained, the mobility management function entity may send a downlink NAS message to the terminal device. To improve the reliability of transmitting the downlink NAS message, step 410 to step 412 may be performed.

Step 410: The mobility management function entity obtains the protected downlink NAS message according to the second symmetric key and the first security algorithm.

It should be noted that the specific implementation manner of obtaining the protected downlink NAS in the mobile management function entity in step 410 is similar to the specific implementation manner in which the mobility management function entity obtains the protected downlink NAS message in the embodiment shown in FIG. Repeat the instructions.

Step 411: The mobility management function entity sends the protected downlink NAS message to the terminal device.

Step 412: After receiving the protected downlink NAS message, the terminal device obtains the downlink NAS message according to the second symmetric key and the first security algorithm.

It should be noted that the specific implementation manner in which the terminal device obtains the downlink NAS in step 412 is similar to the specific implementation manner in which the terminal device obtains the downlink NAS message in the embodiment shown in FIG. 3, and the description is not repeated herein.

In the case that the initial NAS message is a registration request, the downlink NAS message may be a registration accept message, a NAS SMC message, or a registration reject message, and the specific downlink NAS message may be used by the mobility management function entity according to the actual situation or pre-configured. The strategy makes a decision.

Exemplarily, in the embodiment shown in FIG. 4, the second symmetric key includes a second encryption key and a second integrity protection key, and the first security algorithm includes a first encryption algorithm and a first integrity protection algorithm. The mobility management function entity can secure the downlink NAS message in the following manner:

Security protection mode 1: The mobility management function entity uses a partial key in the second symmetric key and a corresponding partial algorithm in the first security algorithm to secure the downlink NAS message, for example, using only the first encryption algorithm and the second encryption key. The key is used to secure the downlink NAS message; or the first integrity protection algorithm and the second integrity protection key are used to secure the downlink NAS message.

Security protection mode 2: The mobility management function entity uses the first security algorithm and the second symmetric key to perform integrity protection and encryption on the downlink NAS message.

Security protection mode 3: The mobility management function entity encrypts the downlink NAS message according to the first encryption algorithm and the second encryption key, and performs integrity protection on the ciphertext of the downlink NAS message or the downlink NAS message according to the second security algorithm, where The second security algorithm is selected by the mobility management function entity based on the terminal device security capability and the pre-configured algorithm list; the second security algorithm includes a second integrity protection algorithm, and the optional second security algorithm may further include a second encryption algorithm. In the third security protection mode, the second security algorithm is included in the downlink NAS message.

It should be noted that the specific security protection mode selected by the mobility management function entity may be determined by a pre-configured algorithm.

In this embodiment, when initially accessing the network, the terminal device performs encryption and integrity protection on the initial NAS message according to the first symmetric key and the first security algorithm, which not only improves the security of the initial NAS message transmission, but also improves the terminal. The efficiency with which the device accesses the network. In addition, after obtaining the initial NAS message, the mobility management function entity also performs security protection on the downlink NAS message sent to the terminal device, thereby improving the security of the downlink NAS message transmission.

It should be noted that, as an alternative to the embodiment shown in FIG. 4, step 402 and step 403 may be replaced by: if the protected initial NAS message includes the ciphertext of the initial NAS message and the MAC of the initial NAS message, Then, the terminal device performs integrity protection on the initial NAS message according to the first integrity protection key and the first integrity protection algorithm, and encrypts the initial NAS message according to the first encryption key and the first encryption algorithm. There is no necessary sequence of execution between the two steps. For example, the encryption step of the initial NAS message may be performed first, then the integrity protection step of the initial NAS message may be performed, and the integrity protection step of the initial NAS message may be performed first. The encryption step of the initial NAS message.

Further, step 408 and step 409 may be replaced by: after receiving the protected initial NAS message, the protected initial NAS message includes the ciphertext of the initial NAS message and the MAC of the initial NAS message, and the mobility management The functional entity may first decrypt the ciphertext of the initial NAS message to obtain the initial NAS message, and then verify the integrity of the initial NAS message. For other steps, refer to the steps in the embodiment shown in FIG. 4, and details are not described herein again.

Of course, the embodiment shown in FIG. 4 is only described as an example. For example, only the method for generating a symmetric key is given in the embodiment shown in FIG. 4, and the symmetric key may also be used in advance in the embodiment of the present application. It is configured in the terminal device, or may generate a symmetric key according to a random key generation algorithm or a random number.

As shown in FIG. 5, a method for message protection according to an embodiment of the present disclosure is described by taking a symmetric key as an encryption key as an example, as follows.

In step 501, the terminal device generates an encryption key.

Specifically, for the manner in which the terminal device generates the encryption key, refer to the manner in which the terminal device generates the symmetric key in the embodiment shown in FIG. 3, and details are not described herein again.

Step 502: The terminal device encrypts the encryption key according to the public key of the storage function entity, and obtains the ciphertext of the encryption key.

Step 503: The terminal device encrypts the initial NAS message according to the encryption key and the first encryption algorithm, and obtains the ciphertext of the initial NAS message.

The first encryption algorithm may be pre-configured in the terminal device and the mobility management function entity.

Step 504: The terminal device sends the ciphertext of the initial NAS message and the ciphertext of the encryption key to the mobility management function entity.

Step 505: After receiving the ciphertext of the initial NAS message and the ciphertext of the encryption key, the mobility management function entity sends the ciphertext of the encryption key to the storage function entity.

Step 506: After receiving the ciphertext of the encryption key sent by the mobility management function entity, the storage function entity decrypts the ciphertext of the encryption key according to the private key of the storage function entity to obtain an encryption key.

Step 507: The storage function entity sends an encryption key to the mobility management function entity.

Step 508: After receiving the encryption key sent by the storage function entity, the mobility management function entity decrypts the ciphertext of the initial NAS message according to the encryption key and the first encryption algorithm to obtain an initial NAS message.

Specifically, after obtaining the initial NAS message, the mobility management function entity may send a downlink NAS message to the terminal device. To improve the reliability of transmitting the downlink NAS message, step 509 to step 511 may be performed.

Step 509: The mobility management function entity encrypts the downlink NAS message according to the encryption key, and obtains the ciphertext of the downlink NAS message.

Step 510: The mobility management function entity sends the ciphertext of the downlink NAS message to the terminal device.

Step 511: After receiving the ciphertext of the downlink NAS message, the terminal device decrypts the ciphertext of the downlink NAS message according to the encryption key and the first encryption algorithm to obtain a downlink NAS message.

In the case that the initial NAS message is a registration request, the downlink NAS message may be a registration accept message, a NAS SMC message, or a registration reject message. In addition, the specific downlink NAS message may be used by the mobility management function entity according to the actual situation or pre- The configured policy is determined.

In addition, in the message protection method of the embodiment shown in FIG. 5, the mobility management function entity may select a new encryption algorithm and/or an integrity protection algorithm based on the security capabilities of the terminal device and the pre-configured algorithm list, and pass the downlink NAS. The message is sent to the terminal device. In addition, after the new integrity protection algorithm is selected, the mobility management function entity may perform integrity protection on the downlink NAS message based on the selected new integrity protection algorithm, and then perform step 509.

In this embodiment, when the terminal device initially accesses the network, the initial NAS message can be encrypted according to the encryption key and the first encryption algorithm, which not only improves the security of the initial NAS message transmission, but also improves the efficiency of the terminal device accessing the network. In addition, after obtaining the initial NAS message, the mobility management function entity also performs security protection on the downlink NAS message sent to the terminal device, thereby improving the security of the downlink NAS message transmission.

Of course, the embodiment shown in FIG. 5 is only described as an example. For example, in the embodiment shown in FIG. 5, only one way of generating an encryption key is given. In addition, the encryption key in the embodiment of the present application may also be pre- It is configured in the terminal device, or may generate an encryption key according to the private key of the terminal device and the public key of the storage function entity, or a random number. For example, in the embodiment shown in FIG. 5, only a configuration manner of the security algorithm is given. In addition, the security algorithm may be pre-configured in the storage function entity, and then sent to the mobility management function entity by the storage function entity.

As shown in FIG. 6, the embodiment of the present application provides a method for message protection, which is described by taking a symmetric key as an integrity protection key as an example, as follows.

Step 601: The terminal device generates an integrity protection key.

Specifically, for the manner of the integrity protection key generated by the terminal device, refer to the manner in which the terminal device generates a symmetric key in the embodiment shown in FIG. 3, and details are not described herein again.

Step 602: The terminal device encrypts the integrity protection key and the first integrity protection algorithm according to the public key of the storage function entity to obtain the first ciphertext.

The content encrypted by the first ciphertext may include an integrity protection key and a first integrity protection algorithm.

The first integrity protection algorithm may be determined by the terminal device according to the pre-configured policy, and the configuration of the pre-configured policy is similar to the related description in the embodiment shown in FIG.

Step 603: The terminal device performs integrity protection on the initial NAS message according to the integrity protection key and the first integrity protection algorithm, and obtains the MAC of the initial NAS message.

Step 604: The terminal device sends the MAC address of the initial NAS message, the initial NAS message, and the first ciphertext to the mobility management function entity.

Optionally, the first integrity protection algorithm is pre-configured in the terminal device and the mobility management function entity. In this case, the terminal device does not need to encrypt and send the first integrity protection algorithm to the storage function entity.

Step 605: After receiving the MAC, the initial NAS message, and the first ciphertext of the initial NAS message, the mobility management function entity sends the first ciphertext to the storage function entity.

Step 606: After receiving the first ciphertext sent by the mobility management function entity, the storage function entity decrypts the first ciphertext according to the private key of the storage function entity, and obtains an integrity protection key and a first integrity protection. algorithm.

Step 607: The storage function entity sends an integrity protection key and a first integrity protection algorithm to the mobility management function entity.

Step 608: After receiving the integrity protection key and the first integrity protection algorithm sent by the storage function entity, the mobility management function entity checks the integrity of the initial NAS message according to the integrity protection key and the first integrity protection algorithm. .

The manner in which the mobility management function entity checks the integrity of the initial NAS message is similar to the manner in which the integrity of the initial NAS message is verified in the embodiment shown in FIG. 3, and the description is not repeated here.

The mobile management function entity may send a downlink NAS message to the terminal device when the integrity check of the received initial NAS message is successful. To improve the reliability of transmitting the downlink NAS message, step 609 to step 611 may be performed.

Step 609: The mobility management function entity performs integrity protection on the downlink NAS message according to the integrity protection key and the first integrity protection algorithm, and obtains the MAC of the downlink NAS message.

Step 610: The mobility management function entity sends the MAC address of the downlink NAS message and the downlink NAS message to the terminal device.

Step 611: After receiving the MAC address of the downlink NAS message and the downlink NAS message, the terminal device checks the integrity of the downlink NAS message according to the integrity protection key and the first integrity protection algorithm.

In the case that the initial NAS message is a registration request, the downlink NAS message may be a registration accept message, a NAS SMC message, or a registration reject message. Specifically, the downlink NAS message may be used by the mobility management function entity according to the actual situation or pre- The configured policy is determined.

In addition, in the message protection method shown in FIG. 6, if the mobility management function entity selects a new integrity protection algorithm based on the security capabilities of the terminal device and the pre-configured algorithm list, the downlink NAS message may be sent to the terminal device. In addition, after the mobility management function entity selects a new integrity protection algorithm, the mobility management function entity may first perform integrity protection on the downlink NAS message based on the selected new integrity protection algorithm. Specifically, the terminal device receives the downlink. After the MAC of the NAS message and the downlink NAS message, the new integrity protection algorithm is obtained from the downlink NAS message, and then the integrity check of the downlink NAS message is performed.

In this embodiment, the terminal device performs integrity protection on the initial NAS message according to the integrity key and the first integrity algorithm when initially accessing the network, thereby improving the integrity protection of the initial NAS message, and further, the mobility management function entity The downlink NAS message sent to the terminal device is also integrity-protected, and the security of the downlink NAS message transmission is improved, when the protected initial NAS message is received and the integrity check of the initial NAS message is successful.

Of course, FIG. 6 is only described as an example. For example, only a manner of generating an integrity protection key is given in FIG. 6. In addition, the integrity protection key in the embodiment of the present application may also be based on the private content of the terminal device. The public key generation of the key and storage function entity, or a random key generation algorithm, etc., generates an integrity protection key. For example, in FIG. 6, only one security algorithm is configured. In addition, a security algorithm may be pre-configured in the storage function entity, and then sent to the mobility management function entity by the storage function entity.

The foregoing provides a description of the solution provided by the present application from the perspective of interaction between the various network elements. It can be understood that, in order to implement the above functions, each of the foregoing network elements includes a hardware structure and/or a software module corresponding to each function. Those skilled in the art will readily appreciate that the present application can be implemented in a combination of hardware or hardware and computer software in combination with the elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present application.

Based on the same concept, as shown in FIG. 7 , a schematic diagram of a message protection device provided by the present application may be a terminal device or a chip or a system on a chip in a terminal device, as shown in FIG. 3 and FIG. 4 . The method performed by the terminal device in any of the embodiments shown in FIGS. 5 and 6.

The apparatus 700 includes at least one processor 710, a memory 730.

The memory 730 is used to store programs, and may be a ROM or other type of static storage device that can store static information and instructions, such as RAM or other types of dynamic storage devices that can store information and instructions, or may be electrically erasable or programmable. Electrostatic erasable programmabler-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc., disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store a desired program in the form of an instruction or data structure and that can be accessed by a computer, but is not limited thereto. Memory 730 can exist independently and be coupled to processor 710. Memory 730 can also be integrated with processor 710.

The processor 710 is configured to execute the program in the memory 730 to implement the steps performed by the terminal device in the solution of the message protection in the embodiment of the present application. For related features, reference may be made to the above, and details are not described herein again. For example, processor 710 can be a general purpose CPU, a microprocessor, a particular ASIC, or one or more integrated circuits for controlling the execution of the program of the present application.

In a particular implementation, as an embodiment, processor 710 may include one or more CPUs, such as CPU0 and CPU1 in FIG.

In a particular implementation, as an embodiment, apparatus 700 can include multiple processors, such as processor 710 and processor 711 in FIG. Each of these processors may be a single-CPU processor or a multi-core processor, where the processor may refer to one or more devices, circuits, and/or A processing core for processing data, such as computer program instructions.

Optionally, when the device 700 is a terminal device, the transceiver 720 as shown in FIG. 7 may be further included for communicating with other devices or communication networks, and the transceiver 720 includes a radio frequency circuit. The processor 710, the transceiver 720, and the memory 730 are connected in the terminal device through a communication bus. The communication bus can include a path for communicating information between the above units. When the device 700 is a chip in a terminal device or a system on the top, the processor 710 can transmit or receive data through an input/output interface, a pin or a circuit or the like.

FIG. 8 is a schematic diagram of another apparatus for message protection according to an embodiment of the present application. The apparatus may be a terminal device or a chip or a system on a chip in a terminal device, and may perform the foregoing FIG. 3, FIG. 4, FIG. The method performed by the terminal device in any of the embodiments shown in FIG. 6.

The apparatus includes a processing unit 801 and a communication unit 802.

The processing unit 801 is configured to obtain a protected initial NAS message according to the symmetric key and the first security algorithm, and the communication unit 802 is configured to send the protected initial NAS message to the first network device; and to the second network. The device sends a key related parameter, wherein the key related parameter is used to obtain a symmetric key.

Optionally, the key related parameter includes a public key of the terminal device, and the processing unit 801 is specifically configured to generate a symmetric key according to the public key of the second network device and the private key of the terminal device.

Optionally, the processing unit 801 is specifically configured to generate an intermediate key according to the public key of the second network device and the private key of the terminal device; and then generate a symmetric key according to the intermediate key and the fixed string.

Optionally, the key-related parameter includes a ciphertext of the symmetric key, where the ciphertext of the symmetric key is obtained according to the public key of the second network device, and the processing unit 801 is specifically configured to generate the heap according to the random key generation algorithm. Alternatively, the processing unit 801 is specifically configured to generate a symmetric key according to a random number, a permanent key, and a key derivation function (KDF).

Optionally, the key related parameter includes a ciphertext of the first security algorithm, where the ciphertext of the first security algorithm is obtained according to the public key of the second network device.

Optionally, the first security algorithm is determined by the terminal device according to the pre-configured policy.

Optionally, the initial NAS message is a registration request message.

Optionally, the processing unit 801 is further configured to: after the communication unit 802 receives the protected downlink NAS message from the first network device, decrypt the protected downlink NAS message according to the symmetric key and the first security algorithm, to obtain The downlink NAS message, where the downlink NAS message may be a registration accept message or a NAS SMC message.

Optionally, the communication unit 802 is further configured to receive the protected downlink NAS message from the first network device, where the downlink NAS message includes a second security algorithm, and the processing unit 801 is further configured to use the symmetric key and the first security. The algorithm decrypts the protected downlink NAS message, obtains the downlink NAS message, and then obtains the second security algorithm from the downlink NAS message. Finally, if the first network device performs integrity protection on the ciphertext of the downlink NAS message, The second security algorithm verifies the integrity of the protected downlink NAS message. If the first network device performs integrity protection on the downlink NAS message, the integrity of the downlink NAS message is verified according to the second security algorithm. The downlink NAS message is a registration accept message.

Optionally, the communication unit 802 is further configured to receive the protected downlink NAS message from the first network device, where the processing unit 801 is further configured to verify the integrity of the downlink NAS message according to the symmetric key and the first security algorithm, where The downlink NAS message may be a downlink reject message.

Optionally, the first network device is an AMF, and the second network device is a UDM, or an AUSF.

It should be understood that the device may be used to implement the steps performed by the terminal device in the method for message protection in the embodiment of the present application. For related features, reference may be made to the above, and details are not described herein again.

Based on the same concept, as shown in FIG. 9 , a schematic diagram of a device for message protection provided by the present application, where the device may be, for example, a chip or a system on chip in a second network device or a second network device, 3. A method performed by a storage function entity in any of the embodiments illustrated in Figures 4, 5 and 6.

The apparatus 900 includes at least one processor 910, a memory 930.

The memory 930 is used to store programs, and may be a ROM or other types of static storage devices such as RAM or other types of dynamic storage devices that can store static information and instructions, or may be EEPROM or CD-ROM. Or other disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), disk storage media or other magnetic storage devices, or can be used to carry or store expectations in the form of instructions or data structures And any other medium that can be accessed by a computer, but is not limited thereto. The memory 930 can exist independently and be coupled to the processor 910. Memory 930 can also be integrated with processor 910.

The processor 910 is configured to execute the program in the memory 930 to implement the steps performed by the second network device in the solution of the message protection in the embodiment of the present application. For related features, reference may be made to the above, and details are not described herein again. For example, processor 910 can be a general purpose CPU, a microprocessor, a particular ASIC, or one or more integrated circuits for controlling the execution of the program of the present application.

In a particular implementation, as an embodiment, processor 910 may include one or more CPUs, such as CPU0 and CPU1 in FIG.

In a particular implementation, as an embodiment, apparatus 900 can include multiple processors, such as processor 910 and processor 911 in FIG. Each of these processors may be a single-CPU processor or a multi-core processor, where the processor may refer to one or more devices, circuits, and/or A processing core for processing data, such as computer program instructions.

Optionally, when the device 900 is the first network device, the transceiver 920 as shown in FIG. 9 may be further included for communicating with other devices or communication networks, and the transceiver 920 includes a radio frequency circuit. The processor 910, the transceiver 920, and the memory 930 may be connected by a communication bus in the second network device. The communication bus can include a path for communicating information between the above units. When the device 900 is a chip in the second network device or a system on the top, the processor 910 can transmit or receive data through an input/output interface, a pin or a circuit or the like.

FIG. 10 is a schematic diagram of another apparatus for protecting a message according to an embodiment of the present application. The apparatus may be a second network device or a chip or a system on chip in the second network device, and the foregoing FIG. 3 and FIG. 4 may be performed. The method performed by the storage function entity in any of the embodiments shown in Figures 5 and 6.

The apparatus includes a processing unit 1001 and a communication unit 1002.

The communication unit 1002 is configured to receive a key related parameter from the terminal device, and the processing unit 1001 is configured to obtain a symmetric key according to the key related parameter, and then the communication unit 1002 is further configured to send the symmetric to the first network device. A key, where the key related parameter is used to obtain a symmetric key, and the symmetric key is used to secure the initial NAS message.

Optionally, the key related parameter includes a public key of the terminal device; the processing unit 1001 is specifically configured to generate a symmetric key according to the public key of the terminal device and the private key of the second network device.

Optionally, the processing unit 1001 is specifically configured to generate an intermediate key according to the public key of the terminal device and the private key of the second network device, and then generate a symmetric key according to the intermediate key and the fixed string.

Optionally, the key-related parameter includes a ciphertext of the symmetric key. The processing unit 1001 is specifically configured to decrypt the ciphertext of the symmetric key according to the private key of the second network device to obtain a symmetric key.

Optionally, the key-related parameter includes a ciphertext of the first security algorithm; the processing unit 1001 is further configured to decrypt the ciphertext of the first security algorithm according to the public key of the second network device, to obtain the first security algorithm, and the communication unit 1002 is further configured to send a first security algorithm to the first network device.

Optionally, the first network device is an AMF entity; the device 1000 is a UDM entity, or an AUSF entity.

It should be understood that the device may be used to implement the steps performed by the second network device in the method for message protection in the embodiment of the present application. For related features, reference may be made to the above, and details are not described herein again.

Based on the same concept, as shown in FIG. 11 , a schematic diagram of a device for message protection provided by the present application, where the device may be a first network device, or a chip of a first network device or a system on the top, and the foregoing 3. A method performed by a mobility management function entity in any of the embodiments illustrated in Figures 4, 5 and 6.

The first network device 1100 includes at least one processor 1110 and a memory 1130.

The memory 1130 is used to store programs, and may be a ROM or other types of static storage devices such as RAM or other types of dynamic storage devices that can store static information and instructions, or may be EEPROM or CD-ROM. Or other disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), disk storage media or other magnetic storage devices, or can be used to carry or store expectations in the form of instructions or data structures And any other medium that can be accessed by a computer, but is not limited thereto. The memory 1130 can exist independently and be coupled to the processor 1110. The memory 1130 can also be integrated with the processor 1110.

The processor 1110 is configured to execute the program in the memory 1130 to implement the steps performed by the first network device in the solution of the message protection in the embodiment of the present application. For related features, reference may be made to the above, and details are not described herein again. For example, processor 1110 can be a general purpose CPU, a microprocessor, a particular ASIC, or one or more integrated circuits for controlling the execution of the program of the present application.

In a specific implementation, as an embodiment, the processor 1110 may include one or more CPUs, such as CPU0 and CPU1 in FIG.

In a particular implementation, as an embodiment, apparatus 1100 can include multiple processors, such as processor 1110 and processor 1111 in FIG. Each of these processors may be a single-CPU processor or a multi-core processor, where the processor may refer to one or more devices, circuits, and/or A processing core for processing data, such as computer program instructions.

Optionally, when the device 1100 is the first network device, the transceiver 1120 as shown in FIG. 11 may be further included for communicating with other devices or communication networks, and the transceiver 1120 includes a radio frequency circuit. The processor 1110, the transceiver 1120, and the memory 1130 may be connected by a communication bus in the first network device. The communication bus can include a path for communicating information between the above units. When the device 1100 is a chip in the first network device or a system on the top, the processor 1110 can transmit or receive data through an input/output interface, a pin or a circuit or the like.

FIG. 12 is a schematic diagram of another apparatus for protecting a message according to an embodiment of the present application. The apparatus may be a first network device or a chip or a system on a chip in the first network device, and the foregoing apparatus may be implemented as shown in FIG. 3 and FIG. 4 . The method performed by the mobility management function entity in any of the embodiments illustrated in Figures 5 and 6.

The apparatus includes a processing unit 1201 and a communication unit 1202.

The communication unit 1202 is configured to receive the protected initial NAS message from the terminal device, and receive the symmetric key from the second network device. The processing unit 1201 is configured to obtain the initial NAS message according to the symmetric key and the first security algorithm. .

Optionally, the communication unit 1202 is further configured to receive a first security algorithm from the second network device.

Optionally, the initial NAS message is a registration request message.

Optionally, the processing unit 1201 is further configured to obtain the protected downlink NAS message according to the symmetric key and the first security algorithm, and the communication unit 1202 is further configured to send the protected downlink NAS message to the terminal device.

Optionally, the downlink NAS message is a registration accept message or a NAS SMC message.

Optionally, the processing unit 1201 is further configured to obtain the ciphertext of the downlink NAS message according to the symmetric key and the first security algorithm, where the downlink NAS message is a registration accept message, and the registration accept message includes a second security algorithm; the communication unit 1202 The communication unit 1202 is further configured to send the protected downlink NAS message to the terminal device according to the second security algorithm, performing integrity protection on the ciphertext of the downlink NAS message to obtain the protected downlink NAS message.

Optionally, the processing unit 1201 is further configured to perform integrity protection on the downlink NAS message according to the second security algorithm, where the downlink NAS message is a registration accept message, and the registration accept message includes a second security algorithm; The first security algorithm obtains the protected downlink NAS message, and the protected downlink NAS message is the ciphertext of the integrity-protected downlink NAS message. The communication unit 1202 is further configured to send the protected downlink NAS message to the terminal device.

Optionally, the processing unit 1201 is further configured to perform integrity protection on the downlink NAS message according to the symmetric key and the first security algorithm to obtain the protected downlink NAS message, and then the communication unit 1202 is further configured to send to the terminal device. The protected downlink NAS message, wherein the downlink NAS message may be a registration reject message.

Optionally, the device is an AMF entity; the second network device is a UDM entity, or an AUSF entity.

It should be understood that the device may be used to implement the steps performed by the first network device in the method for message protection in the embodiment of the present application. For related features, reference may be made to the above, and details are not described herein again.

It should be understood that the manner in which the device for message protection shown in FIG. 8, FIG. 10 and FIG. 12 is divided into modules is schematic, and only one logical function is divided, and the actual implementation may have another division manner. For example, the communication unit is divided into a receiving unit, a transmitting unit, and the like.

The embodiment of the present application further provides a communication system, which includes the device 700, the device 900, and the device 1100. The connection manner may be as shown in FIG. 13a or as shown in FIG. 13b.

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented in software, it may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present application are generated in whole or in part. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.). The computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media. The usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a Solid State Disk (SSD)) or the like.

Although the present application has been described herein in connection with the various embodiments, those skilled in the art can Other variations of the disclosed embodiments are achieved. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality. A single processor or other unit may fulfill several of the functions recited in the claims. Certain measures are recited in mutually different dependent claims, but this does not mean that the measures are not combined to produce a good effect.

Those skilled in the art will appreciate that embodiments of the present application can be provided as a method, apparatus (device), computer readable storage medium, or computer program product. Thus, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware aspects, which are collectively referred to herein as "module" or "system."

The present application is described with reference to flowchart illustrations and/or block diagrams of the methods, apparatus, and computer program products of the present application. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

While the present invention has been described in connection with the specific embodiments and embodiments thereof, various modifications and combinations can be made without departing from the spirit and scope of the application. Accordingly, the description and drawings are to be regarded as It will be apparent to those skilled in the art that various modifications and changes can be made in the present application without departing from the spirit and scope of the application. Thus, it is intended that the present invention cover the modifications and variations of the present invention.

Claims (30)

A method for message protection, characterized in that the method comprises: The terminal device obtains the protected initial non-access stratum NAS message according to the symmetric key and the first security algorithm; Transmitting, by the terminal device, the protected initial NAS message to the first network device; The terminal device sends a key related parameter to the second network device, where the key related parameter is used to obtain the symmetric key. The method of claim 1, wherein the key related parameter comprises a public key of the terminal device; the method further comprising: The terminal device generates the symmetric key according to the public key of the second network device and the private key of the terminal device. The method according to claim 2, wherein the terminal device generates the symmetric key according to the public key of the second network device and the private key of the terminal device, including: The terminal device generates an intermediate key according to the public key of the second network device and the private key of the terminal device; The terminal device generates the symmetric key according to the intermediate key and a fixed character string. The method according to claim 1, wherein the key related parameter comprises a ciphertext of the symmetric key, wherein the ciphertext of the symmetric key is based on a public key of the second network device acquired; The method further includes: The terminal device generates the symmetric key according to a random key generation algorithm; or The terminal device generates the symmetric key according to a random number, a permanent key, and a key derivation function KDF. The method according to any one of claims 1 to 4, wherein the key related parameter comprises a ciphertext of the first security algorithm, wherein the ciphertext of the first security algorithm is according to the first The public key of the second network device is obtained. The method of claim 5 wherein said first security algorithm is determined by said terminal device in accordance with a pre-configured policy. The method according to any one of claims 1 to 6, wherein the initial NAS message is a registration request message. The method according to any one of claims 1 to 7, wherein the method further comprises: Receiving, by the terminal device, the protected downlink NAS message from the first network device, where the downlink NAS message is a registration accept message or a NAS security mode command SMC message; The terminal device decrypts the protected downlink NAS message according to the symmetric key and the first security algorithm to obtain the downlink NAS message. The method according to any one of claims 1 to 7, wherein the method further comprises: The terminal device receives the protected downlink NAS message from the first network device, where the downlink NAS message is a registration accept message, and the registration accept message includes a second security algorithm; Decrypting the protected downlink NAS message according to the symmetric key and the first security algorithm to obtain the downlink NAS message; The terminal device obtains the second security algorithm from the downlink NAS message; The terminal device checks the integrity of the downlink NAS message or the protected downlink NAS message according to the second security algorithm. The method according to any one of claims 1 to 7, wherein the method further comprises: Receiving, by the terminal device, a protected downlink NAS message from the first network device, where the downlink NAS message is a registration reject message; The terminal device checks the integrity of the downlink NAS message according to the symmetric key and the first security algorithm. The method according to any one of claims 1 to 10, wherein the first network device is an access and mobility management function AMF entity; The second network device is an independent data management UDM entity or an authentication service function AUSF entity. A method for message protection, characterized in that the method comprises: The second network device receives a key-related parameter from the terminal device, where the key-related parameter is used to obtain a symmetric key, and the symmetric key is used to secure the initial non-access stratum NAS message; The second network device obtains the symmetric key according to the key related parameter; The second network device sends the symmetric key to the first network device. The method of claim 12, wherein the key related parameter comprises a public key of the terminal device; Obtaining the symmetric key according to the key related parameter, the second network device includes: The second network device generates the symmetric key according to the public key of the terminal device and the private key of the second network device. The method according to claim 13, wherein the second network device generates the symmetric key according to the public key of the terminal device and the private key of the second network device, including: The second network device generates an intermediate key according to the public key of the terminal device and the private key of the second network device; The second network device generates the symmetric key according to the intermediate key and a fixed string. The method of claim 12, wherein the key related parameter comprises a ciphertext of the symmetric key; Obtaining the symmetric key according to the key related parameter, the second network device includes: The second network device decrypts the ciphertext of the symmetric key according to the private key of the second network device to obtain the symmetric key. The method according to any one of claims 12 to 15, wherein the key related parameter comprises a ciphertext of the first security algorithm; the method further comprising: The second network device decrypts the ciphertext of the first security algorithm according to the public key of the second network device, to obtain the first security algorithm; The second network device sends the first security algorithm to the first network device. The method according to any one of claims 1 to 16, wherein the first network device is an access and mobility management function AMF entity; The second network device is an independent data management UDM entity or an authentication service function AUSF entity. A method for message protection, characterized in that the method comprises: The first network device receives the protected initial non-access stratum NAS message from the terminal device; The first network device receives a symmetric key from the second network device; The first network device obtains the initial NAS message according to the symmetric key and a first security algorithm. The method of claim 18, wherein the method further comprises: The first network device receives the first security algorithm from the second network device. The method of claim 18 or 19, wherein the initial NAS message is a registration request message. The method of any one of claims 18 to 20, wherein the method further comprises: The first network device obtains the protected downlink NAS message according to the symmetric key and the first security algorithm; The first network device sends the protected downlink NAS message to the terminal device. The method of claim 21, wherein the downlink NAS message is a registration accept message or a NAS security mode command SMC message. The method of any one of claims 18 to 20, wherein the method further comprises: The first network device obtains the ciphertext of the downlink NAS message according to the symmetric key and the first security algorithm, where the downlink NAS message is a registration accept message, and the registration accept message includes a second security algorithm; The first network device performs integrity protection on the ciphertext of the downlink NAS message according to the second security algorithm, to obtain a protected downlink NAS message. The first network device sends the protected downlink NAS message to the terminal device. The method of any one of claims 18 to 20, wherein the method further comprises: The first network device performs integrity protection on the downlink NAS message according to the second security algorithm, where the downlink NAS message is a registration accept message, and the registration accept message includes a second security algorithm; And obtaining, by the first network device, the protected downlink NAS message according to the symmetric key and the first security algorithm, where the protected downlink NAS message is a ciphertext of the integrity protected downlink NAS message; The first network device sends the protected downlink NAS message to the terminal device. The method of any one of claims 18 to 20, wherein the method further comprises: The first network device performs integrity protection on the downlink NAS message according to the symmetric key and the first security algorithm, and obtains a protected downlink NAS message, where the downlink NAS message is a registration reject message; The first network device sends the protected downlink NAS message to the terminal device. The method according to any one of claims 18 to 25, wherein the first network device is an access and mobility management function AMF entity; the second network device is an independent data management UDM entity, or an authentication service. Functional AUSF entity. A message protection device, comprising: a processor and a memory, wherein: The memory stores a program; The processor is configured to invoke a program stored in the memory to perform the method of any one of claims 1 to 11. A message protection device, comprising: a processor and a memory, wherein: The memory stores a program; The processor is configured to invoke a program stored in the memory to perform the method of any one of claims 12 to 17. A message protection device, comprising: a processor and a memory, wherein: The memory stores a program; The processor is operative to invoke a program stored in the memory to perform the method of any one of claims 18 to 26. A computer readable storage medium, characterized in that the computer readable storage medium stores a program that, when run on a computer, causes the computer to perform the method of any one of claims 1 to 26.

Images