[go: up one dir, main page]

WO2021031053A1 - 一种通信方法、装置及系统 - Google Patents

一种通信方法、装置及系统 Download PDF

Info

Publication number
WO2021031053A1
WO2021031053A1 PCT/CN2019/101243 CN2019101243W WO2021031053A1 WO 2021031053 A1 WO2021031053 A1 WO 2021031053A1 CN 2019101243 W CN2019101243 W CN 2019101243W WO 2021031053 A1 WO2021031053 A1 WO 2021031053A1
Authority
WO
WIPO (PCT)
Prior art keywords
akma
network element
function network
authentication
terminal device
Prior art date
Application number
PCT/CN2019/101243
Other languages
English (en)
French (fr)
Inventor
吴�荣
李�赫
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201980099062.3A priority Critical patent/CN114208111B/zh
Priority to PCT/CN2019/101243 priority patent/WO2021031053A1/zh
Priority to EP19942153.8A priority patent/EP4016950A4/en
Publication of WO2021031053A1 publication Critical patent/WO2021031053A1/zh
Priority to US17/674,607 priority patent/US12273344B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H04L9/0841—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols
    • H04L9/0844—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H04L9/3273—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response for mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor

Definitions

  • the embodiments of the present application relate to the field of communication technologies, and in particular, to a communication method, device, and system.
  • terminal devices can support application authentication and key management (authentication and key management for applications, AKMA) services.
  • AKMA authentication and key management for applications
  • the terminal device is authenticated with AKMA in the following manner: after the terminal device is successfully registered and the master authentication is completed, the terminal device is additionally authenticated with AKMA.
  • the AKMA authentication process is more complicated and the signaling overhead is relatively large.
  • the embodiments of the present application provide a communication method, device, and system to simplify the AKMA authentication process and reduce signaling overhead.
  • a communication method including: a terminal device sends a registration request message to a mobility management network element;
  • the terminal device After the terminal device successfully authenticates through the main authentication process and activates the non-access stratum NAS security protection, it receives a NAS security-protected registration response sent by the mobility management network element, the registration response including the terminal.
  • the AKMA authentication is completed without additional AKMA authentication, which simplifies the AKMA authentication process and reduces the signaling overhead.
  • the AKMA temporary identifier includes a random number, a home network indication, and a routing identifier; wherein the random number is allocated by a network device and is used to identify the parameters of the terminal device; the home network indication It is used to indicate the home network of the terminal device; the routing identifier is used to determine the network function entity that generates the key Kakma of the AKMA service.
  • the AKMA temporary identifier received by the terminal device not only includes the identification information of the terminal device, but also includes information for determining the network function entity that generates the key Kakma of the AKMA service corresponding to the terminal device.
  • the AKMA authentication function network element on the network side can determine the network function entity that generates the key Kakma of the AKMA service corresponding to the terminal device according to the AKMA temporary identifier, and then obtains Kakma, and according to the obtained Kakma, the AKMA application function network element distributes the communication key for communicating with the terminal device.
  • the AKMA temporary identification further includes at least one of the address information of the AKMA authentication function network element or the address information of the AKMA application function network element.
  • the terminal device assigns a temporary identity, it can assign appropriate AKMA authentication function network element address information or AKMA application function network element to the terminal device according to certain factors, and carry their addresses in the AKMA temporary identity for subsequent follow-up
  • the terminal device determines a suitable AKMA application function network element according to the AKMA temporary identification or facilitates subsequent AKMA application function network elements to determine a suitable AKMA authentication function network element according to the AKMA temporary identification.
  • the network function entity that generates the key Kakma of the AKMA service is an authentication server function network element.
  • a communication method including: in a registration process of a terminal device, an authentication server function network element receives first indication information sent by a unified data management network element, and the first indication information is used to indicate the The terminal device supports application authentication and key management AKMA service; after the master authentication of the terminal device succeeds, the authentication server function network element determines the AKMA temporary identification of the terminal device; the authentication server The functional network element sends the AKMA temporary identifier to the terminal device through the mobility management network element.
  • the terminal device when the terminal device supports the AKMA service, the master authentication of the terminal device is successful, and the AKMA authentication is considered successful. No additional AKMA authentication process is required to perform AKMA authentication on the terminal device, and no additional procedures are required. AKMA authentication simplifies the AKMA authentication process and reduces signaling overhead.
  • the AKMA temporary identifier includes a random number, a home network indication, and a routing identifier; the random number is allocated by a network device and is used to identify the parameters of the terminal device; the home network indicates a parameter To indicate the home network of the terminal device; the routing identifier is a network functional entity used to determine the key Kakma for generating the AKMA service.
  • the AKMA temporary identification further includes at least one of the address information of the AKMA authentication function network element or the address information of the AKMA application function network element.
  • the authentication server function network element determining the AKMA temporary identifier includes:
  • the authentication server function network element generates the AKMA temporary identifier by itself.
  • the authentication server function network element determining the AKMA temporary identifier includes: the authentication server function network element sends a first request message to the AKMA authentication function network element, and the first The request message is used to request the AKMA authentication function network element to generate the AKMA temporary identifier; the authentication server function network element receives the first response message sent by the AKMA authentication function network element, the first response message Carries the AKMA temporary identifier.
  • the AKMA authentication function network element generates the AKMA temporary identifier.
  • the authentication server function network element determining the AKMA temporary identifier includes: the authentication server function network element determining the AKMA temporary identifier according to first auxiliary information; wherein, the The first auxiliary information includes at least one of slice information of the terminal device, data network name information of the terminal device, or service or session continuity mode information of the terminal device.
  • the AKMA temporary identifier includes the address information of the AKMA authentication function network element.
  • different AKMA authentication function network elements can be selected according to the difference of the first auxiliary information, which improves the flexibility of selecting the AKMA authentication function network element.
  • the method further includes: the authentication server function network element sending a second request message to the mobility management network element, and the second request message carries the first indication information;
  • the authentication server function network element receives a second response message sent by the mobility management network element, and the second response message carries the first auxiliary information.
  • the method further includes: the authentication server function network element receiving a third request message sent by the AKMA authentication function network element, and the third request message carries the AKMA temporary identifier;
  • the authentication server function network element obtains a first key according to the AKMA temporary identifier, and the first key is an intermediate key in the main authentication process;
  • the authentication server function network element obtains a first key according to the The first key generates the key Kakma for the AKMA service; the authentication server function network element sends the Kakma to the AKMA authentication function network element.
  • the method further includes: after the master authentication of the terminal device succeeds, the authentication server function network element stores the AKMA temporary identifier, the terminal device identifier, and the Correspondence of the first key; the authentication server function network element obtains the first key according to the AKMA temporary identification, including: the authentication server function network element according to the AKMA temporary identification and the correspondence , Get the first key.
  • the first key is Kausf.
  • the method further includes: the authentication server function network element sends the AKMA in the AKMA temporary identification
  • the address information of the authentication function network element is updated from the first address information to the second address information, the first address information is the address information of the first AKMA authentication function network element, and the second address information is the second AKMA Address information of the authentication function network element.
  • a communication method which includes: in the registration process of the terminal device, the unified data management network element receives a third request message sent by the authentication server function network element, and the third request message includes the terminal device’s Identification; the unified data management network element determines that the terminal device supports application authentication and key management AKMA services according to the contract data of the terminal device; the unified data management network element sends the authentication server function network element Send a third response message, where the third response message includes first indication information, and the first indication information indicates that the terminal device supports the AKMA service.
  • the third request message is a UDM servicing request message for obtaining an authentication vector
  • the third response message is a UDM servicing response message for obtaining an authentication vector
  • a communication method including: in the registration process of the terminal device, the identity verification and key management of the first application program, the AKMA authentication function network element receives the fourth request message sent by the authentication server function network element , The fourth request message is used to request the AKMA temporary identifier of the terminal device; the first AKMA authentication function network element generates the AKMA temporary identifier; the first AKMA authentication function network element sends the authentication server The functional network element sends a fourth response message, and the fourth response message carries the AKMA temporary identifier.
  • the first AKMA authentication function network element receiving a fifth request message sent by the AKMA application function network element, and the fifth request message is used to request the terminal device to communicate with the The communication key used by the AKMA application function network element for communication; in the case that the first AKMA authentication function network element can provide services for the AKMA application function network element, the first AKMA authentication function network element Acquire the key Kakma of the AKMA service corresponding to the AKMA temporary identifier from the authentication server function network element; the first AKMA authentication function network element generates the communication key according to the Kakma; the first AKMA The authentication function network element sends the communication key to the AKMA application function network element.
  • the method further includes: in the case that the first AKMA authentication function network element cannot provide services for the AKMA application function network element, determining the first AKMA authentication function network element 2. AKMA authentication function network element; the first AKMA authentication function network element sends a fourth response message to the AKMA application function network element, and the fourth response message is used to instruct the AKMA application function network element to The second AKMA authentication function network element obtains a communication key; wherein, the fourth response message carries address information of the second AKMA authentication function network element.
  • a communication system including: an authentication server function network element and a unified data management network element;
  • the authentication server function network element is used to send a first request message to the unified data management network element in the registration process of the terminal device, where the first request message includes the identification of the terminal device; the unified data management network element, It is used to determine, according to the contract data of the terminal device, that the terminal device supports the AKMA service of application authentication and key management, and send a first response message to the authentication server function network element; wherein, the The first response message includes first indication information, and the first indication information is used to indicate that the terminal device supports the AKMA service; the authentication server function network element is also used in the master authentication of the terminal device. After the authorization is successful, the AKMA temporary identifier of the terminal device is determined, and the AKMA temporary identifier is sent to the terminal device through the mobility management network element.
  • the AKMA temporary identifier includes a random number, a home network indication, and a routing identifier; the random number is allocated by a network device and is used to identify the parameters of the terminal device; the home network indicates a parameter To indicate the home network of the terminal device; the routing identifier is a network functional entity used to determine the key Kakma for generating the AKMA service.
  • the AKMA temporary identification further includes at least one of the address information of the AKMA authentication function network element or the address information of the AKMA application function network element.
  • the authentication server function network element determines the AKMA temporary identifier of the terminal device, it is specifically used for: the authentication server function network element itself generates the AKMA temporary identifier.
  • the communication system further includes a first AKMA authentication function network element, and the authentication server function network element is specifically used for: the authentication when determining the AKMA temporary identity of the terminal device
  • the right server function network element is configured to send a second request message to the first AKMA authentication function network element, where the second request message is used to request the first AKMA authentication function network element to generate the AKMA temporary identifier
  • the first AKMA authentication function network element is used to determine the AKMA temporary identifier, and send a second response message to the authentication server function network element, the second response message carries the AKMA temporary Logo.
  • the authentication server function network element determines the AKMA temporary identifier of the terminal device, it is specifically used for: the authentication server function network element determines the AKMA according to the first auxiliary information Temporary identification; wherein, the first auxiliary information includes at least one of slice information of the terminal device, data network name information of the terminal device, or service or session continuity mode information of the terminal device.
  • the system further includes a mobility management network element, and the authentication server function network element is further configured to send a third request message to the mobility management network element, in the third request message Carrying the first indication information; the mobility management network element is used to obtain the first auxiliary information, and send a third response message to the authentication server function network element, the third response message carries There is the first auxiliary information.
  • the third request message is a unified data management UDM service request message for obtaining an authentication vector
  • the third response message is a UDM service request message for obtaining an authentication vector. news.
  • the communication system further includes an AKMA application function network element and a first AKMA authentication function network element
  • the method further includes: the AKMA application function network element is configured to communicate to the first The AKMA authentication function network element sends a fourth request message, and the fourth request message carries the AKMA temporary identifier; the first AKMA authentication function network element is used to log on the first AKMA authentication function network
  • the element can provide services for the AKMA application function network element, obtain the key Kakma of the AKMA service corresponding to the AKMA temporary identifier from the authentication server function network element; generate the communication according to the Kakma Key; and, sending the communication key to the AKMA application function network element.
  • the first AMKA authentication function network element when the first AMKA authentication function network element obtains the AKMA service key Kakma corresponding to the AKMA temporary identifier from the AKMA application function network element, it is specifically used for:
  • the first AKMA authentication function network element is configured to send a fifth request message to the authentication server function network element, where the fifth request message carries the AKMA temporary identifier; the authentication server function network element, It is used to obtain a first key according to the AKMA temporary identification, and the first key is an intermediate key in the master authentication process; according to the first key, to generate the key Kakma of the AKMA service, And send the Kakma to the first AKMA authentication function network element.
  • the first AKMA authentication function network element is also used to determine when the first AKMA authentication function network element cannot provide services for the AKMA application function network element
  • the address information of the second AKMA authentication function network element is also used to send a relocation message to the AKMA application function network element, and the relocation message includes the Address information of the second AKMA authentication function network element.
  • the AKMA application function network element is further configured to send a sixth request message to the second AKMA authentication network element, and the sixth request message includes the AKMA temporary identifier;
  • the second AKMA authentication network is also used to obtain the AKMA service key Kakma corresponding to the AKMA temporary identifier from the authentication server function network element; generate the communication key according to the Kakma; and, Sending the communication key to the AKMA application function network element.
  • the authentication server function network element is also used to save the AKMA temporary identifier, the terminal device identifier, and the first terminal device after the master authentication of the terminal device succeeds. Correspondence between the keys; when the authentication server function network element obtains the first key according to the AKMA temporary identifier, it is specifically used for: the authentication server function network element according to the AKMA temporary identifier and the Correspondence, obtaining the first key.
  • the first key is kausf.
  • the authentication server function network element when the authentication server function network element includes the address information of the AKMA authentication function network element in the AKMA temporary identifier, the AKMA authentication function network element in the AKMA temporary identifier The address information is updated from the first address information to the second address information.
  • the first address information is the address information of the first AKMA authentication function network element
  • the second address information is the second AKMA authentication function.
  • a communication device may be a terminal device or a chip in a terminal device.
  • the device includes a transceiver module and a processing module for performing the corresponding functions in the first aspect and any one of the possible designs. :
  • the transceiver module is used to send a registration request message to the mobility management network element, and, after the authentication through the main authentication process is successful and the non-access layer NAS security protection is activated, receive the NAS security message sent by the mobility management network element Protected registration response.
  • the registration response includes the AKMA temporary identification of the application program of the terminal device and the key management.
  • the processing module is used to save the AKMA temporary identification.
  • transceiver module For the specific functions of the transceiver module and the processing module, please refer to the record in the first aspect above, which will not be described here.
  • a device in a seventh aspect, may be an authentication server functional network element or a chip in an authentication server functional network element.
  • the device includes a transceiver module and a processing module for executing the second aspect and any one of the foregoing
  • the corresponding functions that may be designed, specifically:
  • the transceiver module is used to receive the first instruction information sent by the unified data management network element in the registration process of the terminal device, the first instruction information is used to instruct the terminal device to support the identity verification and key management of the application program AKMA service;
  • a processing module configured to determine the AKMA temporary identity of the terminal device after the master authentication of the terminal device is successful
  • the transceiver module is also used to send the AKMA temporary identifier to the terminal device through the mobility management network element.
  • a device in an eighth aspect, may be a unified data management network element or a chip in a unified data management network element.
  • the device includes a transceiver module and a processing module for executing the third aspect and any possible design.
  • a transceiver module configured to receive a third request message sent by an authentication server function network element during a registration process of a terminal device, where the third request message includes an identifier of the terminal device;
  • a processing module configured to determine, according to the contract data of the terminal device, that the terminal device supports the identity verification and key management AKMA service of the application;
  • the transceiver module is further configured to send a third response message to the authentication server function network element, where the third response message includes first indication information, and the first indication information indicates that the terminal device supports the AKMA service.
  • a device in a ninth aspect, may be a first AKMA authentication function network element or a chip in the first AKMA authentication function network element.
  • the device includes a transceiver module and a processing module for executing the fourth aspect and The corresponding function of any possible design, specifically:
  • the transceiver module is configured to receive a fourth request message sent by the authentication server functional network element in the registration process of the terminal device, where the fourth request message is used to request the AKMA temporary identifier of the terminal device;
  • the transceiver module is further configured to send a fourth response message to the authentication server function network element, where the fourth response message carries the AKMA temporary identifier.
  • a communication device including a communication interface, a processor, and a memory; the memory is used to store computer-executable instructions; the processor is used to execute the computer-executable instructions stored in the memory to enable the communication
  • the apparatus sends and receives messages through the communication interface, and realizes the function of the following equipment in the method described in any one of the first aspect to the fourth aspect: the secure access device, or the second core network element.
  • a computer-readable storage medium stores computer instructions.
  • the communication device executes any one of the first to fourth aspects. The method described in the aspect.
  • a computer program product includes computer instructions.
  • the communication device executes any of the above-mentioned aspects of the first to fourth aspects. The method described.
  • a device for implementing the method described in any one of the first to fourth aspects.
  • a device including a processor and a memory, the processor is coupled to the memory, and the processor is configured to execute the method described in any one of the first to fourth aspects.
  • FIG. 1 is a schematic diagram of a network architecture provided by an embodiment of this application.
  • FIG. 2 is a schematic diagram of AKMA authentication provided by an embodiment of this application.
  • FIG. 3 is a schematic diagram of AKMA authentication provided by an embodiment of this application.
  • FIG. 4 is a schematic diagram of AKMA authentication provided by an embodiment of this application.
  • FIG. 5 is a schematic diagram of AKMA authentication provided by an embodiment of this application.
  • FIG. 6 is a schematic diagram of terminal device access provided by an embodiment of this application.
  • FIG. 7 is a schematic diagram of terminal device access provided by an embodiment of this application.
  • FIG. 12 is a schematic structural diagram of a communication device provided by an embodiment of this application.
  • the embodiments of this application can be applied to 4G (fourth generation mobile communication system) evolution systems, such as long term evolution (LTE) systems, or can also be 5G (fifth generation mobile communication systems) systems, such as adopting new wireless Access technology (new radio access technology, New RAT) access network; cloud radio access network (cloud radio access network, CRAN), etc., or even future communication systems such as 6G (sixth generation mobile communication system).
  • 4G fourth generation mobile communication system
  • LTE long term evolution
  • 5G fourth generation mobile communication systems
  • 5G fourth generation mobile communication systems
  • new wireless Access technology new radio access technology, New RAT
  • cloud radio access network cloud radio access network, CRAN
  • 6G sixth generation mobile communication system
  • the network architecture provided by this embodiment of the application at least includes a terminal device, an access network (AN), a core network, and a data service network. It can be understood that FIG. 1 is only a schematic illustration and is not intended to limit the application.
  • the terminal device can be referred to as a terminal for short, which is a device with wireless transceiver function.
  • the terminal device can be deployed on the land, including indoor or outdoor, handheld or vehicle-mounted; or on the water (such as ships); Deploy in the air (for example, on airplanes, balloons, satellites, etc.).
  • the terminal device may be a mobile phone (mobile phone), a tablet computer (pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, an industrial control ( Wireless terminal equipment in industrial control, wireless terminal equipment in unmanned driving (self-driving), wireless terminal equipment in remote medical (remote medical), wireless terminal equipment in smart grid (smart grid), transportation safety (transportation) Wireless terminal equipment in safety), wireless terminal equipment in a smart city (smart city), wireless terminal equipment in a smart home (smart home), and may also include user equipment (UE), etc.
  • UE user equipment
  • the terminal device can also be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), and a wireless communication Functional handheld devices, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminal devices in the 5th generation (5G) network in the future, or public land mobile communication networks that will evolve in the future (Public land mobile network (PLMN) terminal equipment, etc.
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • PLMN Public land mobile network
  • Terminal equipment can sometimes be called terminal equipment, user equipment (UE), access terminal equipment, vehicle-mounted terminal equipment, industrial control terminal equipment, UE unit, UE station, mobile station, mobile station, remote station, and remote terminal Equipment, mobile equipment, UE terminal equipment, terminal equipment, wireless communication equipment, UE agent or UE device, etc.
  • the terminal device can also be fixed or mobile. The embodiment of the application does not limit this.
  • the access network AN can adopt different types of access technologies.
  • the access network may adopt 3rd Generation Partnership Project (3rd Generation Partnership Project, 3GPP) access technologies (for example, wireless access technologies adopted in 3G, 4G, or 5G systems).
  • 3rd Generation Partnership Project 3rd Generation Partnership Project
  • non-3rd Generation Partnership Project one 3rd Generation Partnership Project, non-3GPP
  • the access network adopting 3GPP access technology is called a radio access network (radio access network, RAN).
  • the access network equipment in the 5G system is called the next generation Node Basestation (gNB) and so on.
  • Non-3GPP access technologies refer to access technologies that do not comply with 3GPP standard specifications, for example, air interface technologies represented by wireless fidelity access points (WIFI AP).
  • WIFI AP wireless fidelity access points
  • the core network may include authentication server function network elements, mobile management network elements, session function network elements, application authentication and key management (authentication and key management for applications, AKMA) authentication function network elements, unified data management network
  • the user plane function network element is the user plane data export, which is mainly used to connect to the external network.
  • the authentication function server network element is a functional entity for the network to authenticate the UE, and is mainly used for the network to verify the authenticity of the UE.
  • Mobility management network element mainly responsible for mobility management.
  • the session function network element is mainly used to allocate session resources for the user plane.
  • the unified data management network element is used to store user subscription data and generate long-term keys used to authenticate users.
  • the AKMA authentication function network element is a functional entity that handles AKMA authentication, and is mainly used to provide the AKMA authentication anchor function.
  • the network elements in the aforementioned core network may have different names.
  • the above-mentioned mobility management network element may be referred to as a mobility management entity (MME).
  • MME mobility management entity
  • AMF access and mobility management function
  • the user plane function network element may be called the user plane function (UPF)
  • the authentication server function network element may be called the authentication server function (authentication server function, AUSF)
  • Mobile management network elements can be called AMF
  • session management function network elements can be called session management function (session management function, SMF)
  • unified data management network element can be called unified data management (UDM)
  • AKMA authentication The network element with the right function can be called AKMA authentication function (AKMA authentication function, AAuF) and so on.
  • the core network element in FIG. 1 is only a schematic illustration, and is not meant to be a limitation.
  • the core network may include the network slice selection function (NSSF) and the network exposure function (NEF) in addition to the core network elements shown in FIG.
  • NRF Network Repository Function
  • Policy Control Function Policy Control Function
  • AF application function
  • SCP SCP
  • the data service network may specifically be a data network (DN), etc.
  • the AKMA application function (AKMA application function, AApF) network element can be deployed in one or more servers in the DN to provide data services for 3GPP user terminals. It is understandable that the AKMA application function network element can be deployed in the DN server or in the core network without limitation. In the embodiment of the present application, the AKMA application network element is deployed in the server of the DN as an example for description.
  • the embodiment of the present application provides an application scenario in which the terminal device can support the AKMA service, and the core network device can perform AKMA authentication on the terminal device.
  • an AKMA authentication process is provided.
  • the UE can be specifically a terminal device in the architecture shown in Figure 1 above
  • AAuF can be specifically an AKMA authentication function network in the architecture shown in Figure 1 above
  • Element, AUSF can be specifically the authentication function service network element in the architecture shown in Figure 1 above, and the process includes:
  • the UE sends a first request to the AAuF, and the first request carries the permanent identity (subscriber permanent identifier, SUPI) or the concealed identity (subscriber concealed identifier, SUCI) of the terminal device. It is understandable that the UE may send the first request to AAuF through AApF. For example, after receiving the first request, AAPF finds that the UE has not passed the AKMA authentication, and can forward the first request to AAuF.
  • SUPI subscriber permanent identifier
  • SUCI subscriber concealed identifier
  • S202 AAuF sends an authentication request (authentication request) to AUSF, and the authentication request carries the SUPI or SUCI of the terminal device.
  • a two-way authentication is performed between the AUSF and the UE, and the two-way authentication may specifically be an extensible authentication protocol (extensible authentication protocol, EAP) exchange (exchange).
  • EAP extensible authentication protocol
  • the UE and AUSF are successfully authenticated in both directions, and the AKMA authentication of the terminal equipment can be considered as successful.
  • AUSF sends an authentication response (authentication response) to AAuF.
  • the authentication response carries an indication of successful AKMA authentication and the key Kakma of the terminal device AKMA service.
  • the AAuF can save the Kakma and assign the AKMA temporary identifier to the terminal device.
  • the Kakma is used to generate a communication key between the terminal device and the AKMA application function network element.
  • AAuF can use the above-mentioned Kakma to generate communication keys for different AKMA application function network elements to communicate with terminal devices.
  • the AAuF may generate a communication key used for communication between the AKMA application function network element and the terminal device according to the above-mentioned Kakma and AKMA application function network element identifiers.
  • the communication keys used by different AKMA application function network elements to communicate with the same terminal device may be different.
  • the AAuF sends a first response to the UE.
  • the first response includes the AKMA temporary identifier of the terminal device and the validity period of the AKMA temporary identifier.
  • the terminal device saves the AKMA temporary identification.
  • the present application provides a communication method, and the principle of the communication method is: in the registration process of the UE, the UE and the network equipment require master authentication.
  • the UE in the registration process of the UE, after the UE has successfully authenticated with the network device master, it is considered that the AKMA authentication of the UE is also successful, and the UE is assigned an AKMA temporary identity. It can be seen that in the embodiment of the present application, the UE does not need to perform additional AKMA authentication, which simplifies the authentication process and reduces signaling overhead.
  • At least one of a, b, or c can represent: a; b; c; a and b; a and c; b and c; or a, b and c.
  • a, b, and c may be single or multiple.
  • the terminal device in the flow can be the terminal device in the architecture of Figure 1
  • the mobility management network element can be the mobility management network element in the architecture of Figure 1.
  • the authentication server functions The network element can be the authentication server function network element in the architecture of Figure 1, and the unified data management network element can be the unified data management network element in the architecture of Figure 1.
  • the specific process is:
  • the terminal device sends a first request message to the mobility management network element, and the first request message carries the subscriber concealed identifier (SUCI) of the terminal device or the 5G global unique Temporary UE identity (5G-globally unique temporary UE Identity, 5G-GUTI).
  • SUCI subscriber concealed identifier
  • 5G-GUTI 5G global unique Temporary UE identity
  • the first request message may be a registration request (registration request).
  • the SUCI can be carried in the first request message, and the SUCI is the hidden identity information of the terminal device.
  • the 5G-GUTI can be carried in the first request message, and the 5G-GUTI is the temporary identity of the UE.
  • the mobility management network element sends a second request message to the authentication server function network element, where the second request message carries the SUCI or SUPI of the terminal device.
  • the second request message is used to trigger authentication of the UE.
  • the authentication can be the primary authentication authentication, or AKMA authentication, etc., which is not specifically limited.
  • the second request message may be referred to as a UE authentication request message (Nausf_UE_Authentication request).
  • the mobility management network element can directly obtain the SUCI of the terminal device in the second request message.
  • the mobility management network element may determine the permanent identity (subscriber permanent identifier, SUPI) of the terminal device according to the 5G-GUTI of the terminal device. For example, if the mobility management network element needs to authenticate the terminal device, the mobility management network element can determine the SUPI of the terminal device according to the GUTI of the terminal device when authenticating the terminal device.
  • SUPI subscriber permanent identifier
  • the authentication server function sends a third request message to the unified data management network element, where the third request message carries the SUCI or SUPI of the terminal device.
  • the third request message is used to request an authentication vector from the unified data management network element.
  • the authentication vector requested by the third request message may be the authentication vector used for primary authentication, or the authentication vector requested by the third request message may be the authentication vector used for AKMA authentication, or the third request message request
  • the authentication vector of can be used for both main authentication and AKMA authentication, etc., without limitation.
  • the unified data management network element determines whether the terminal device supports or does not support the AKMA service according to the contract information of the terminal device. For example, the unified data management network element may determine the subscription information of the terminal device according to the SUCI or SUPI of the terminal device carried in the third request message. For example, in the case that the third request message carries SUCI, the unified data management network element needs to obtain SUPI from SUCI first, and then determine the subscription information of the terminal device according to SUPI. Further, according to the authentication information of the terminal device, it is determined whether the terminal device supports the AKMA service.
  • the unified data management network element determines that the terminal device does not support the AKMA service, the unified data management network element performs corresponding operations according to the description in section 6.1 of the existing standard TS33.501. If the unified data management network element determines that the terminal device supports the AKMA service, the unified data management network element executes the following steps in S304.
  • the unified data management network element sends a first response message to the authentication server function network element, and the authentication server function network element receives the first response message.
  • the first response message carries the first indication information.
  • the indication information can display or implicitly indicate that the terminal device supports AKMA service. Specifically, when the first indication information takes the first preset value, it means that the terminal device supports the AKMA service; when the first indication information takes the second preset value, it means that the terminal device does not support the AKMA service.
  • the first indication information may be a one-bit symbol. When the symbol currently has a value of 0, it means that the terminal device does not support the AKMA service; when the value is 1, it means that the terminal device supports the AKMA service.
  • the first indication information may implicitly indicate that the terminal device supports the AKM service. For example, if characters such as "AKMA" appear in the first response message, it means that the terminal device supports the AKMA service.
  • the form of the first indication information may be an enumerated type, that is, in a string format, etc., which is not limited.
  • the first response message may also carry one or more of first auxiliary information, authentication vector (authentication vector, AV), SUPI of the terminal device or SUCI of the terminal device, etc., the first response message It may specifically be a UE authentication response message (Nudm_UEAuthentication_GetResponse).
  • the first auxiliary information may include at least one of terminal device slice information, data network name (DNN) information, service or session continuity mode (service and session continuity, SSC, mode) information, and at least one of subscription data .
  • the first auxiliary information may include part or all of the subscription information of the user.
  • the unified data management network element may determine whether the first auxiliary information needs to be provided to the authentication server function network element according to one or more of the following situations. If the first auxiliary information needs to be provided to the authentication server function network element, the first auxiliary information is carried in the first response message. If it is not necessary to provide the first auxiliary information to the authentication server function network element, the first auxiliary information may not be carried in the first response message.
  • the unified data management network element can determine whether the first auxiliary information needs to be provided to the authentication server function network element according to the contract information of the terminal device. For example, the unified data management network element determines that the terminal device is a terminal device with low latency requirements according to the contract information of the terminal device, and then provides the first auxiliary information to the authentication server function network element. For another example, UDM determines that the terminal device has special requirements according to the contract information of the terminal device, and then provides the first auxiliary information to the authentication server function network element.
  • the unified data management network element can detect whether the terminal device has been authenticated. If the unified data management network element determines that the terminal device has been authenticated, it can notify the authentication server function network element of all or part of the first auxiliary information. If the unified data management network element determines that the terminal device has not been authenticated, or although the terminal device has been authenticated, but the authentication information has expired, it can inform the authentication server function network element of part of the information in the first auxiliary information . For example, part of the information in the first auxiliary information may not include the location information of the terminal device.
  • the unified data management network element can detect the current stage process of the terminal device, and determine whether the first auxiliary information needs to be provided to the authentication server function network element according to the current stage process of the terminal device. For example, if the terminal device is currently in a mobile management (mobile management, MM) process, there is no need to provide the first auxiliary information to the authentication server functional network element. If the terminal device is currently in a session management (session management, SM) process, the first auxiliary information needs to be provided to the authentication server function network element.
  • mobile management mobile management
  • SM session management
  • S305 Perform two-way authentication between the authentication server function network element and the terminal device. It should be noted that if the process shown in FIG. 3 is an authentication registration process, the process shown in FIG. 3 will include S305. If the process shown in FIG. 3 is a PDU session establishment process, the process shown in FIG. 3 may not include S305.
  • the authentication server function network element can authenticate the legitimacy of the terminal device, and the terminal device can authenticate the authenticity of the entire wireless network.
  • the authentication server function network element can authenticate the UE according to the description in section 6.1 of the existing standard TS 33.501.
  • the UE can also perform authentication server function according to the description in section 6.1 of the existing standard TS 33.501
  • the network element performs authentication and so on.
  • the authentication method specifically adopts authentication methods such as EAP-AKA or 5G-AKA, which is not limited in this application.
  • the authentication server function network element determines the AKMA temporary identifier (temporary identifier) of the terminal device.
  • the AKMA temporary identifier of the terminal device can also be referred to as the AKMA temporary identifier of the terminal device.
  • the AKMA temporary identifier of the UE is used when the UE accesses the AKMA application function network element.
  • the AKMA temporary identifier includes at least a random value (random value), a home network identifier (home network identifier), and a routing indicator (routing indicator, RI).
  • the random number is assigned by the network side device and is used to identify the parameter of the terminal device; the home network indication is used to indicate the home network of the terminal device.
  • the routing identifier is used to determine the network functional entity that generates the key Kakma for the AKMA service.
  • the network function entity that generates the key Kakma for the AKMA service is the authentication server function network element.
  • a device in the network such as AMF, may determine the authentication server function network element according to the home network indication and the routing identifier.
  • the AKMA temporary identifier may also include at least one of the address information of the AKMA authentication function entity or the address information of the AKMA user function entity.
  • the AKMA temporary identifier carries at least the temporary identity information of the terminal device, the home network identifier of the terminal device, and the address information of the authentication server function network element.
  • the hometown network information may be a mobile network code (mobile network code MNC), a mobile country code (mobile country code, MCC), etc.
  • the address information of the authentication server function network element is the information that can find the authentication server function network element.
  • the address information of the authentication server function network element may include the number information and/or authentication of the authentication server function network element Routing information (routing ID) of the server function network element.
  • the number information of the authentication server function network element may be a number assigned by the operator to the authentication server function network element within the network, and is used to determine a certain authentication server function network element.
  • the routing information of the authentication server function network element is stored on the terminal device or stored in the universal subscriber identity module (USIM).
  • USIM universal subscriber identity module
  • the Routing ID is carried in the SUCI for the mobility management network element to determine the authentication server function network element that can serve the UE.
  • the address information of the authentication server function network element cannot uniquely identify an authentication server function network element on a global scale, then when determining the specific authentication server function network element, the home network information of the terminal device and The address information of the authentication server function network element is used in combination.
  • the AKMA temporary identification of the terminal device also includes the address information of the AKMA authentication function network element and/or the address information of the AKMA application function network element.
  • the address information of the AKMA authentication function network element is information that can uniquely determine the AKMA authentication function network element.
  • the address information of the AKMA authentication function network element may include the number information of the AKMA authentication function network element and/or the routing information (routing ID) of the first AKMA authentication function network element.
  • the number information of the AKMA authentication function network element may be the number assigned by the operator to the AKMA authentication function network element within the network, and is used to determine a certain AKMA authentication function network element.
  • the routing information authentication server function network element of the AKMA authentication function network element can be obtained by query, such as querying the network management system or querying the NRF, or can be obtained according to a locally pre-configured list.
  • the routing information of the AKMA authentication function network element can enable the AKMA application function network element or the UE to determine the AKMA authentication function network element serving the UE.
  • the address information of the AKMA authentication function network element cannot uniquely identify an AKMA authentication function network element on a global scale, then when determining the specific AKMA authentication function network element, the home network information of the terminal device and The address information of the AKMA authentication function network element is used in combination.
  • the address information of the AKMA application function network element is information that can uniquely identify the AKMA application function network element.
  • the address information of the AKMA application function network element may include the number information of the AKMA application function network element and/or the routing information (routing ID) of the AKMA application function network element.
  • the number information of the AKMA application function network element may be the number assigned by the operator or the application provider to the AKMA application function network element within the network, and is used to determine a certain AKMA application function network element.
  • the routing information of the AKMA application function network element can be obtained by query, for example, the AKMA authentication function network element or the authentication server function network element can query the network management system or the NRF, or can be obtained according to the locally pre-configured list.
  • the routing information of the AKMA authentication function network element can enable the AKMA application function network element or the UE to determine the AKMA authentication function network element serving the UE.
  • the address information of the AKMA application function network element cannot uniquely identify an AKMA application function network element on a global scale, then when determining the specific AKMA application function network element, the home network information of the terminal device and the AKMA application function should be determined.
  • the address information of the network element is used in combination.
  • the address information of the AKMA authentication function network element may be determined by the authentication server function network element.
  • the AKMA authentication function network element may be a default or protocol-defined AKMA authentication function network element.
  • the AKMA authentication function network element may be the AKMA authentication function network element determined by the authentication server function network element according to the first auxiliary information in S204. For example, if the first auxiliary information includes the location information of the terminal device, the authentication server function network element can query other core network entities (for example, NRF, etc.), the network management configuration list, or the preconfigured list of the authentication server function network element, etc. In this way, query the nearest AKMA authentication function network element to the terminal device.
  • core network entities for example, NRF, etc.
  • the first auxiliary information includes slice information of the terminal device, DNN information, SSC information, etc.
  • the authentication server function network element may comprehensively select an AKMA authentication function that meets the conditions based on all or part of the information in the first auxiliary information Network element.
  • the authentication server function network element can select an AKMA authentication function network element that can serve the slice-data network name.
  • the address information of the AKMA application function network element may be determined by the authentication server function network element, or may be determined by the AKMA authentication function network element.
  • an AKMA authentication function network element is determined to determine an AKMA application function network element; for another example, an AKMA application function network element is An application on mobile edge computing (MEC).
  • the authentication server function network element or the AKMA authentication function network element must determine which mobile edge computing function to use, that is, which AKMA application function network element to use.
  • the address information of the AKMA application function network element and the AKMA authentication function network element may also be or contain information about the mobile edge computing entity. In the same way, the address information of a mobile edge computing entity can be used as address information that uniquely determines a mobile edge computing function, or it can determine the address information of a mobile edge computing function together with the MCC and MNC.
  • the temporary identity information of the terminal device may be composed of binary bits. For example, 32-bit 0 and/or 1 may constitute the temporary identity of the terminal device.
  • the authentication server function network element can generate a random number by itself for the temporary identity information of the device in it. Or, use some fields in the K authentication server function network element as the temporary identity information of the device, or the K authentication server function network element further generates a random number, and all or part of this random number is used as the temporary identity of the terminal device information.
  • the authentication server function network element may generate temporary identity information of the terminal device based on the RAND value in the authentication vector, for example, intercept a part of the RAND value, or directly use all the RAND values.
  • the authentication server function network element may request a random number from the unified data management network element, and determine the temporary identity information of the UE according to the requested random number. Or, the authentication server function network element transmits the random number requested above to the AKMA authentication function network element, and then the AKMA authentication function network element determines the temporary identity information of the terminal device according to the random number, and then transmits the above terminal device The temporary identity is passed to the authentication server function network element and so on. Alternatively, the authentication server function network element may determine the temporary identity of the terminal device, etc. according to the SUCI of the terminal device. For example, the temporary identity information of the UE can be generated according to the encrypted field in the SUCI of the terminal device.
  • the AKMA authentication function network element may determine the temporary identity information of the terminal device according to the SUCI of the terminal device. For example, the temporary identity information of the UE can be generated according to the encrypted field in the SUCI of the terminal device, and then the AKMA authentication function network element transmits the temporary identity of the terminal device to the authentication server function network element, etc., which is not limited.
  • the AKMA temporary identification of the terminal device can be formed in one or more of the following ways:
  • Routing ID which is the Routing ID of the authentication server functional network element
  • xxxx is 4 decimal digits, representing the routing information that determines the authentication server functional network element, and is used to find the authentication server functional network element use.
  • tid ⁇ value> represents the temporary identity assigned to the UE, where tid is the abbreviation of temporary Identifier.
  • AAuF ⁇ Value> represents the address information of the AAuF serving the UE. This information can help the UE or the AKMA application function network element to find the AAuF. It can be AAuF ID information, or AAuF routing information, etc.
  • mnc ⁇ MNC>.mnc ⁇ MCC> represents the home network identifier of the UE.
  • it carries AAPF ⁇ Value>, which represents that the address information of the AAPF that the UE needs to access may be the ID information of the AAPF, or the routing information of the AAPF.
  • 3gppnetwork.org represents the 3GPP network.
  • the AKMA temporary identifier contains the values of AApF and ⁇ or AAuF
  • the values of AApF and AAuF may be default values, such as all 0. It can also be a non-default value.
  • the default value means that an AApF and ⁇ or AAuF can be used arbitrarily.
  • the non-default value means that the specified AApF and ⁇ or AAuF need to be connected.
  • AKMA temporary identifiers When UE, AApF, and AAuF use AKMA temporary identifiers, they can select certain fields in AKMA temporary identifiers to use. For example, if the UE wants to find a certain AAPF, the UE can use AAPF ⁇ value>, or use AAPF ⁇ value>.mnc ⁇ MNC> and mnc ⁇ MCC>. Furthermore, the UE can form AAPF ⁇ value>@mnc ⁇ MNC>. The form of mnc ⁇ MCC>.3gppnetwork.org is used as a process to find and determine AAPF.
  • AApF when AApF needs to find and determine an AAuF, the AApF can only use AAuF ⁇ value>, or use AAuF ⁇ value>.mnc ⁇ MNC> and mnc ⁇ MCC>.
  • AAuF determines the authentication server function network element You can use the routing ID of the authentication server function network element or the routing ID of the authentication server function network element and the home network identifier. Therefore, AKMA temporary identifiers can play different roles depending on the user. The user can obtain the necessary information according to the AKMA temporary identifier, which is used to determine the information of other AKMA network elements serving the UE.
  • the temporary identifier can be further composed of the temporary identity information of the UE, the hometown network information of the UE, the address information of the authentication server function network element and the indication information indicating that the temporary identifier is used for the AKMA service.
  • the authentication server function network element may specifically send the AKMA temporary identifier determined in S306 to the terminal device through the mobility management network element. For example, see the description in S307 to S309 below.
  • the authentication server function network element sends a second response message to the mobility management network element, where the second response message may carry the AKMA temporary identifier.
  • the second response message may also carry the authentication result, the SUPI of the terminal device, and so on.
  • the AKMA temporary identifier can be sent to the mobility management network element together with the SUPI of the terminal device along with the authentication result, or can be sent to the mobility management network element separately.
  • the AKMA temporary identifier can be sent to the mobility management network element along with the authentication result and the SUPI of the terminal device.
  • the AKMA temporary identifier is sent to the service network along with other content.
  • S308 Perform a non-access stratum security mode control (NAS SMC) process between the mobility management network element and the terminal device to activate NAS security.
  • NAS SMC non-access stratum security mode control
  • the mobility management network element sends a third response message protected by NAS security to the terminal device, where the third message carries the AKMA temporary identifier.
  • the third response message may be a registration acceptance (registration accept) of the terminal device or a PDU session establishment completion message of the terminal device, etc. It is understandable that the third response message is protected by NAS security.
  • S310 The terminal device saves the final AKMA temporary identification.
  • the unified data management network element will determine whether the terminal device supports the AKMA service. If it is supported, the authentication server function network element or the AKMA authentication function network element is notified to assign a temporary identifier to the terminal device. If it is not supported, no temporary identification will be assigned to the terminal device. In contrast, the authentication server function network element or the AKMA authentication function network element does not consider whether the terminal device supports the AKMA service, and always assigns a temporary identifier to the terminal device, which reduces the process overhead.
  • the implementation process of the authentication server function network element determining the AKMA temporary identifier of the terminal device may include one or more of the following methods:
  • the first type the authentication server function network element generates the AKMA temporary identification of the terminal device itself.
  • the second type the authentication server function network element sends a request message to the first AKMA authentication function network element, and the first AKMA authentication function network element generates the AKMA temporary identifier of the terminal device. And the first AKMA authentication function network element sends the AKMA temporary identifier of the terminal device to the authentication server function network element.
  • the authentication server function network element sends a request message to the first AKMA authentication function network element, and the first AKMA authentication function network element generates the AKMA temporary identifier of the terminal device.
  • the first AKMA authentication function network element sends the AKMA temporary identifier of the terminal device to the authentication server function network element.
  • the third type the authentication server function network element determines the AKMA temporary identifier of the terminal device according to the second auxiliary information.
  • the second auxiliary information may include at least one of slice selection (slice selection) information of the terminal device, session and service continuity (Session and Service Continuity, SSC) mode information of the terminal device.
  • slice selection slice selection
  • SSC Session and Service Continuity
  • the manner in which the authentication server function network element determines the second auxiliary information is not limited.
  • the second auxiliary information may be obtained from the mobility management network element. For details, refer to the record in FIG. 5 below.
  • the terminal device in the flow can be the terminal device in the architecture of Figure 1
  • the mobility management network element can be the mobility management network element in the architecture of Figure 1.
  • the authentication server functions The network element can be the authentication server function network element in the architecture of Figure 1, and the unified data management network element can be the unified data management network element in the architecture of Figure 1.
  • the specific process is:
  • S400-S405 are the same as S300-S305 in the embodiment of FIG. 3.
  • the authentication server function network element sends a fourth request message to the first AKMA authentication function network element.
  • the fourth request message is used to request the first AKMA authentication function network element to allocate an AKMA temporary identifier to the terminal device.
  • the first AKMA authentication function network element may be a default AKMA authentication function network element, or the first AKMA authentication function network element may be an authentication server function network element according to the first auxiliary information carried in S404, The selected AKMA authentication function network element, etc., are not limited.
  • the fourth request message may carry information such as Kakma of the terminal device.
  • the fourth request message carries the first auxiliary information.
  • the authentication server function network element sends the first auxiliary information to the default AKMA authentication function network element, and the default AKMA authentication function network element selects a suitable AKMA authentication function network element and sends the address of the AKMA authentication function network element
  • the information is returned to the authentication server functional network element.
  • the authentication server function network element then requests the appropriate AKMA authentication function network element to assign an AKMA temporary identifier to the terminal device.
  • the first AKMA authentication function network element determines the AKMA temporary identifier of the terminal device.
  • the first AKMA authentication function network element may also store the association relationship between the AKMA temporary identifier, the terminal device identifier, and the first key.
  • the first key can implicitly indicate that the AKMA authentication of the terminal device is successful, and the first key is an intermediate key in the master authentication process.
  • the first key may be Kausf.
  • the identifier of the terminal device may be SUCI or SUPI.
  • the first AKMA authentication function network element sends a fourth response message to the authentication server function network element, and the fourth response message carries the AKMA temporary identifier.
  • S407-S410 are the same as S307-S310 in the embodiment of FIG. 3.
  • the AKMA authentication function network element generates the AKMA temporary identification of the terminal device. Using the method shown in Figure 4 above has better compatibility with the prior art.
  • the terminal device in the flow can be the terminal device in the architecture of Figure 1, and the mobility management network element can be the mobility management network element in the architecture of Figure 1.
  • the authentication server functions The network element can be the authentication server function network element in the architecture of Figure 1, and the unified data management network element can be the unified data management network element in the architecture of Figure 1.
  • the specific process is:
  • the terminal device sends a first request message to the mobility management network element.
  • the mobility management network element sends a second request message to the authentication server function network element.
  • the authentication server function network element sends a third request message to the unified data management network element.
  • the unified data management network element determines whether the terminal device supports or does not support the AKMA service according to the contract information of the terminal device.
  • S504 The unified data management network element sends a first response message to the authentication server function network element.
  • S505 two-way authentication between the terminal device and the authentication server function network element.
  • the authentication server function network element sends a second response message to the mobility management network element, the second response message may carry a first indication, and the first indication may indicate that the terminal device supports the AKMA service.
  • the second response message may also carry the SUPI of the terminal device and/or the authentication success result (for example, EAP success, etc.), and the second response message may also be called Nauf-UT Authentication_Authenticate, etc. It should be noted that if the process shown in FIG. 5 is an authentication registration process, the process shown in FIG. 5 will include S506. If the process shown in FIG. 5 is a PDU session establishment process, the process shown in FIG. 5 may not include S506.
  • S507 Perform a NAS SMC process between the service network and the terminal device to activate NAS security.
  • the process shown in FIG. 5 is an authentication registration process, the process shown in FIG. 5 will include S507. If the flow shown in FIG. 5 is a PDU session establishment flow, S507 may not be included in the flow shown in FIG. 5.
  • the service network determines the second auxiliary information.
  • the second auxiliary information may specifically be location management related information of the terminal determined by a mobility management network element, or session management related information determined by SMF.
  • the slice selection (slice selection) information of the terminal device and the session and service (Session and Service Continuity, SSC) mode information of the terminal device.
  • the difference from the first auxiliary information is that the first auxiliary information belongs to the subscription data information of the UE or the information (such as location information) that needs to be stored by the unified data management network element, while the second auxiliary information is generated by the mobility management network element and/ Or information determined by SMF that is strongly related to the current network status of the UE.
  • the second auxiliary information is more accurate than the first auxiliary information. Therefore, the second auxiliary information can select a more suitable AKMA application function network element and/or AKMA authentication function network element for the UE.
  • the second auxiliary information may be slice information (Allowed S-NSSAI) allowed to be used by the terminal device determined by the mobility management network element in the registration process.
  • the mobility management network element sends a fourth request message to the authentication server function network element, where the fourth request message carries second auxiliary information.
  • the fourth request message may be called _UE_Authentication Request.
  • the authentication server function network element determines the AKMA temporary identifier of the terminal device according to the second auxiliary information.
  • the AKMA temporary identifier may include a random number, home network indication, routing identifier, and the address of the AKMA authentication function network element, and the second auxiliary information is used to determine the appropriate AKMA authentication function network. Yuan's address, and then determine the AKMA temporary identification.
  • the authentication server function network element may determine the AKMA authentication function network element in combination with the first auxiliary information and the second auxiliary information.
  • the authentication server function network element sends the first auxiliary information and the second auxiliary information to the default AKMA authentication function network element, and the default AKMA authentication function network element allocates an AKMA temporary identifier to the terminal device.
  • the default AKMA authentication function network element selects a suitable AKMA authentication function network element, and the address information of the suitable AKMA authentication function network element is returned to the authentication server function network element.
  • the authentication server function network element then sends the first auxiliary information and the second auxiliary information to the appropriate AKMA authentication function network element, and requests the appropriate AKMA authentication function network element to allocate an AKMA temporary identifier to the terminal device.
  • the authentication server function network element may also only send the second auxiliary information to the AKMA authentication function network element to request the AKMA authentication function network element to allocate the AKMA temporary identifier to the terminal device.
  • the authentication server function network element sends a third response message to the mobility management network element, and the third response message carries the AKMA temporary identifier of the terminal device.
  • the third response message may be called UE_Authentication Response.
  • the specific message name varies from process to process.
  • the mobility management network element sends a fourth response message to the terminal device, where the fourth response message carries the AKMA temporary identifier of the terminal device.
  • the fourth response message may be called registration acceptance (registration acceptance).
  • registration acceptance registration acceptance
  • the specific message name varies from process to process.
  • the terminal device saves the AKMA temporary identification of the terminal device.
  • the AKMA temporary identifier of the terminal device may include the address information of the AKMA authentication function network element.
  • the authentication server function network element may select a suitable AKMA authentication function network element according to the second auxiliary information fed back by the service network.
  • the AKMA authentication function network element may be related to the slice.
  • one AKMA authentication function network element can serve at least one type of slice, or one AKMA authentication function network element can only serve one type of slice.
  • the types of slices can be classified according to services, such as eMBB slices, Internet of Vehicles slices, and low-latency slices.
  • the method in the embodiment of the present application can be used to select an AKMA authentication function network element matching the slice type for the terminal device.
  • the temporary identification can be allocated to the terminal device through the above-mentioned methods in FIG. 3, FIG. 4, and FIG. In the following Figure 6 or Figure 7, will continue to describe how the terminal device obtains the communication key Kaf between the terminal device and the AKMA application function network element according to the AKMA temporary identification to protect the communication between the terminal device and the AKMA application function network element .
  • the terminal device in the process can be the terminal device in the architecture of Figure 1, and the AKMA application function network element can be the AKMA application function network element in the architecture of Figure 1.
  • the first The AKMA authentication function network element can be the AKMA authentication function network element in the architecture of Figure 1
  • the authentication server function network element can be the authentication server function network element in the architecture of Figure 1.
  • the process includes:
  • the terminal device sends a first request message to the AKMA application function network element, where the first request message carries the AKMA temporary identifier of the terminal device.
  • the first request message may be called request.
  • the terminal device can initiate an access request to the AKMA application function network element through the user. If the AKMA temporary identification of the terminal device includes the address information of the AKMA application function network element, the terminal device can determine the AKMA application function network element to be accessed according to the address information of the AKMA application function network element. If the AKMA temporary identification of the terminal device does not include the address information of the AKMA application function network element, or the carried address information of the AKMA application function network element is the default value, the terminal device can choose any AKMA application according to the application used Functional network element.
  • the AKMA application function network element sends a second request message to the first AKMA authentication function network element, and the second request message carries information about the AKMA temporary identifier and the identifier of the AKMA application function network element.
  • the second request The message is used to request the communication key used when the terminal device communicates with the AKMA application function network element.
  • the second request message may be referred to as an application request (application request).
  • application request application request
  • the aforementioned communication key may also be referred to as a kaf key. In the following example, take the kaf key as an example.
  • the first AKMA authentication function network element may be the default. Therefore, the AKMA application function network element may directly send the second request message to the default first AKMA authentication function network element.
  • the AKMA temporary identifier of the terminal device may include the address information of the first AKMA authentication function network element, and the AKMA application function network element may determine the address information of the first AKMA authentication function network element according to the AKMA temporary identifier of the terminal device.
  • the first AKMA authentication function network element determines whether the first AKMA authentication function network element provides services for the AKMA application function network element. If it is determined that the first AKMA authentication function network element provides services for it, the following step S603 is executed. If not, the AKMA authentication function network element redirection is required. The process of how to perform the AKMA authentication function network element redirection will be described in detail in Figure 7 below.
  • the first AKMA authentication function network element may determine the location information of the AKMA application function network element according to the identification information of the AKMA application function network element. According to the location information of the AKMA application function network element, it is determined whether the AKMA application function network element is within the service range of the first AKMA authentication function network element. If it is within the service range of the first AKMA authentication function network element, it is considered that the first AKMA authentication function network element can provide services for the AKMA application function network element; otherwise, it is considered that the first AKMA authentication function network element cannot be an AKMA application Functional network elements provide services.
  • this step is optional.
  • the reason for this option is that it depends on the deployment scenarios of the AKMA authentication function network element. If the AKMA authentication function network element is deployed in the same location as the authentication server function network element and unified data management network element, that is, there is only one or a limited number of network elements in an operator's network, then the AKMA authentication function network element may be configured according to the network management And the default is selected.
  • the AKMA authentication function network element is the same as the mobile management network element and SMF deployment location, that is, there are many in an operator’s network, such as one in each province, then the AKMA authentication function network element may be a similar mobile management network element, SMF is the default, or the AKMA authentication function network element should determine whether it can serve the UE according to the location and subscription of the UE. If the deployment location of the AKMA authentication function network element is the same as the base station, or the same as the MEC server, there are many AKMA authentication function network elements in a network, so selecting the appropriate AKMA authentication function network element must follow the steps. The selection of the AKMA application function network element is the same as the above selection of the AKMA authentication function network element.
  • the first AKMA authentication function network element may directly execute the following step S606. If the first AKMA authentication function network element does not currently obtain the Kakma key of the terminal device, the following steps S603 to S606 can be performed between the first AKMA authentication function network element and the authentication server function network element.
  • the first AKMA authentication function network element sends a third request message to the authentication server function network element, where the third request message carries an AKMA temporary identifier.
  • the third request message may also carry the identity of the first AKMA authentication function network element, and the third request message may also be called AKMA Key request, etc.
  • the authentication server function network element determines the key Kakma of the AKMA service of the terminal device according to the AKMA temporary identifier of the terminal device. Specifically, the authentication server function network element may obtain the first key according to the AKMA temporary identifier, and the first key is an intermediate key in the master authentication process. For example, the first key may be Kausf. The authentication server function network element can generate the key Kakma of the AKMA service according to the first key. For example, in the embodiment of this application, after the authentication of the terminal device is completed, the authentication server function network element may store one of the AKMA temporary identification, the first key, and the identification of the terminal device. Correspondence between.
  • the authentication server function network element may obtain the first key etc. according to the AKMA temporary identifier and the corresponding relationship.
  • the terminal device identifier may specifically be SUCI or SUPI, etc., which is not limited.
  • the authentication server function network element sends a first response message to the first AKMA authentication function network element, where the first response message carries the Kakma key.
  • the first response message may also be called an authentication response (authentication response), etc.
  • the first AKMA authentication function network element determines the communication key between the terminal device and the AKMA application function network element according to the Kakma key.
  • the above-mentioned communication key is expressed as a Kaf key.
  • the first AKMA authentication function network element determines the communication key between the terminal device and the AKMA application function network element according to the Kakma key and the identity of the AKMA application function network element.
  • the first AKMA authentication function network element can generate different communication keys for different AKMA application function network elements.
  • the first AKMA authentication function network element sends a second response message to the AKMA application function network element, where the second response message carries the Kaf key.
  • the AKMA application function network element sends a request message to the first AKMA authentication function network element, the request message is used to request communication between the terminal device and the AKMA application service network element
  • the key namely Kaf.
  • the AKMA application function network element sends a third response message to the terminal device.
  • the third response message may carry the identity of the AKMA application function network element.
  • the third response message may be a success (success) message.
  • S609 The terminal device determines the Kaf key according to the Kakma key.
  • the terminal device determines the Kaf key according to the identity of the AKMA application function network element and the Kakma key.
  • the terminal device and the AKMA application function network element communicate based on the protection of the Kaf key. For example, when the terminal device sends the first message to the AKMA application function network element, the Kaf key may be used to encrypt the first message. In the same way, when the AKMA application function network element sends the second message to the terminal device, the Kaf key can be used to encrypt the second message.
  • the terminal device in the process can be the terminal device in the architecture of Figure 1, and the AKMA application function network element can be the AKMA application function network element in the architecture of Figure 1.
  • the first The AKMA authentication function network element and the second AKMA authentication function network element can be the AKMA authentication function network element in the architecture of Figure 1, and the authentication server function network element can be the authentication server function network element in the architecture of Figure 1.
  • the process includes:
  • the terminal device sends the first request message to the AKMA application function network element.
  • the AKMA application function network element sends a second request message to the first AKMA authentication function network element.
  • the first AKMA authentication function network element determines whether the first AKMA authentication function network element provides services for the AKMA application function network element. For example, the AKMA authentication function network element can determine whether it meets specific preset conditions according to a pre-configured list or according to the identification of the AKMA application function network element. For example, the AKMA authentication function network element sends the authentication server function network element to the NRF , The network management system determines whether it can provide services for the AKMA application function network element. If not, execute S311. If it is, execute it as shown in Figure 6.
  • the first AKMA authentication function network element sends a relocation message to the AKMA application function network element, where the relocation message carries address information of the second AKMA authentication function network element.
  • the relocation may also be referred to as redirection. Without this special description, in this embodiment of the present application, relocation and redirection are not distinguished.
  • the first AKMA authentication function network element may select a suitable AKMA authentication function network element according to the identifier of the AKMA application function network element carried in the second request message, and the suitable AKMA authentication function network element is The second AKMA authentication function network element.
  • the second AKMA authentication function network element may obtain the address information of the second AKMA authentication function network element according to a pre-configured list, or a method such as requesting from other network elements or network management systems.
  • the first AKMA authentication function network element may send the identity of the AKMA application function network element to the unified data management network element to obtain the location information of the terminal device.
  • the first AKMA authentication function network element determines the address information of the second AKMA authentication function network element and the like through the location information of the terminal device.
  • the AKMA application function network element sends a third request message to the second AKMA authentication function network element according to the address information of the second AKMA authentication function network element, and the third request message carries the AKMA temporary identifier of the terminal device .
  • the AKMA temporary identifier of the terminal device carried in the third request information may be an AKMA temporary identifier allocated to the terminal device in the manner shown in FIG. 3, FIG. 4, or FIG. 5, or the third request information
  • the AKMA temporary identifier of the terminal device carried in the terminal device may be the updated AKMA temporary identifier of the first AKMA authentication function network element, or the AKMA temporary identifier of the updated AKMA authentication server function network element, which is not limited.
  • the third request message further includes the identifier of the AKMA application function network element, and the third request message may also be referred to as an application request (application request).
  • application request application request
  • the third request message carries the AKMA temporary identifier and the address information of the second AKMA authentication function network element allocated to the terminal device in the manner shown in FIG. 3, FIG. 4 or FIG.
  • the second AKMA authentication function network element sees its own address information and is temporarily identified with the original AKMA, it determines that this is a redirected message, so the second AKMA authentication function network element does not need to determine again whether Can serve this AKMA application function network element.
  • the second AKMA authentication function network element determines the address information of the authentication server function network element according to the AKMA temporary identifier.
  • the second AKMA authentication function network element sends a fourth request message to the authentication server function network element, where the fourth request message is used to request the key Kakma of the AKMA service corresponding to the terminal device, in the fourth request message Including AKMA temporary logo.
  • the fourth request message may also include the identifier of the second AKMA authentication function network element, and the fourth request message may also be called AKMA key request.
  • the authentication server function network element determines the key Kakma of the AKMA service of the terminal device according to the identification of the terminal device. For example, in this embodiment of the application, the authentication server function network element may obtain a first key according to the AKMA temporary identifier, where the first key is an intermediate key in the master authentication process; The authentication server function network element generates the key Kakma of the AKMA service according to the first key; the authentication server function network element sends the Kakma to the AKMA authentication function network element.
  • the authentication server function network element saves the AKMA temporary identifier, the corresponding relationship between the terminal device identifier and the first key; the authentication The server function network element obtains the first key according to the AKMA temporary identifier and the corresponding relationship.
  • the first key may be Kausf, etc.
  • the authentication server function network element sends a first reply message to the second AKMA authentication function network element, where the first reply message carries the Kakma.
  • the authentication server function network element may update the AKMA temporary identification of the terminal device according to the address of the second AKMA authentication function network element. Because the terminal device can only address the first AKMA authentication function network element according to the original temporary identification. After the AKMA temporary identification of the terminal device is updated to the second AKMA authentication function network element, the terminal device can directly address the second AKMA authentication function network element according to the updated temporary identification.
  • the first reply message may also include the updated AKMA temporary identifier of the terminal device.
  • the above process can be described as: when the AKMA temporary identifier includes the address information of the AKMA authentication function network element, the authentication server function network element will change the AKMA authentication function network element in the AKMA temporary identifier
  • the address information is updated from the first address information to the second address information.
  • the first address information is the address information of the first AKMA authentication function network element
  • the second address information is the second AKMA authentication function network element. Address information.
  • the second AKMA authentication function network element generates a communication key used when the terminal device communicates with the AKMA application function network element according to the Kakma key, and the communication key may also be called Kaf.
  • Kaf the communication key
  • the Kaf key can be taken as an example for description.
  • the second AKMA authentication function network element sends a second reply message to the AKMA application function network element, where the second reply message carries the Kaf key.
  • the second reply message also includes the validity time of the Kaf key, and the second reply message may also be referred to as an application response (application response).
  • the AKMA application function network element sends a request message to the first AKMA authentication function network element, where the request message is used to request communication between the terminal device and the AKMA application service network element
  • the key namely Kaf.
  • the AKMA application function network element sends a third reply message to the terminal device.
  • the third reply message may also be referred to as a success message.
  • S720 The terminal device determines the Kaf key according to the Kakma key.
  • S721 The terminal device and the AKMA application function network element communicate based on the protection of the Kaf key.
  • the AUSF may also use the first address information in the AKMA temporary identification, Update to the second address information, the first address information is the address information of the first AKMA authentication function network element, and the second address information is the address information of the second AKMA authentication function network element.
  • the methods provided in the embodiments of the present application are introduced from the perspective of the core network network element, the terminal, and the interaction between the core network network element and the terminal.
  • the core network elements and terminal devices may include hardware structures and/or software modules, which are implemented in the form of hardware structures, software modules, or hardware structures plus software modules. Each function. Whether one of the above-mentioned functions is executed in a hardware structure, a software module, or a hardware structure plus a software module depends on the specific application and design constraint conditions of the technical solution.
  • an embodiment of the present application further provides an apparatus 800 for executing the method executed by the terminal device in the method embodiment shown in FIG. 3 to FIG. 7.
  • the device 800 includes a transceiver module 801 and a processing module 802.
  • the transceiver module 801 is configured to send a registration request message to the mobility management network element, and to receive the NAS security message sent by the mobility management network element after successful authentication through the main authentication process and activation of the non-access layer NAS security protection A protected registration response, the registration response including the AKMA temporary identification of the application program of the terminal device and the key management.
  • the processing module 802 is configured to save the AKMA temporary identifier.
  • transceiver module 801 Regarding the specific functions of the transceiver module 801 and the processing module 802, reference may be made to the record in the foregoing method embodiment, which will not be described here.
  • an embodiment of the present application further provides a device 900 for executing the method executed by the authentication server function network element in the method embodiment shown in FIG. 3 to FIG. 7.
  • the device 900 includes a transceiver module 901 and a processing module 902.
  • the transceiver module 901 is configured to receive the first instruction information sent by the unified data management network element during the registration process of the terminal device, where the first instruction information is used to instruct the terminal device to support application authentication and key management AKMA service;
  • the processing module 902 is configured to determine the AKMA temporary identifier of the terminal device after the master authentication of the terminal device succeeds, the authentication server function network element;
  • the transceiver module 901 is further configured to send the AKMA temporary identifier to the terminal device through the mobility management network element.
  • an embodiment of the present application further provides a device 1000 for executing the method executed by the authentication server function network element in the method embodiment shown in FIG. 3 to FIG. 7.
  • the device 1000 includes a transceiver module 1001 and a processing module 1002.
  • the transceiver module 1001 is configured to receive a third request message sent by the authentication server function network element during the registration process of the terminal device, where the third request message includes the identification of the terminal device;
  • the processing module 1002 is configured to determine, according to the contract data of the terminal device, that the terminal device supports the application's identity verification and key management AKMA service;
  • the transceiver module 1001 is further configured to send a third response message to the authentication server function network element, where the third response message includes first indication information, and the first indication information indicates that the terminal device supports the AKMA service.
  • transceiver module 1001 and the processing module 1002 can be referred to the record in the foregoing method embodiment, which will not be described here.
  • an embodiment of the present application further provides a device 1100 for executing the method executed by the authentication server function network element in the method embodiment shown in FIG. 3 to FIG. 7.
  • the device 1100 includes a transceiver module 1101 and a processing module 1102.
  • the transceiver module 1101 is configured to receive a fourth request message sent by the authentication server function network element during the registration process of the terminal device, where the fourth request message is used to request the AKMA temporary identifier of the terminal device;
  • the processing module 1102 is configured to generate the AKMA temporary identifier
  • the transceiver module 1101 is further configured to send a fourth response message to the authentication server function network element, where the fourth response message carries the AKMA temporary identifier.
  • the transceiver module 1101 and the processing module 1102 reference may be made to the record in the foregoing method embodiment, which is not described here.
  • the division of units in the embodiments of this application is illustrative, and is only a logical function division. In actual implementation, there may be other division methods.
  • the functional units in the various embodiments of this application can be integrated into one process. In the device, it can also exist alone physically, or two or more units can be integrated into a module.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional module.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of this application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , Including a number of instructions to enable a terminal device (which may be a personal computer, a mobile phone, or a network device, etc.) or a processor to execute all or part of the steps of the method in each embodiment of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program code .
  • the terminal device, the authentication server function network element, the unified data management network element, and the AKMA authentication function network element may all be presented in the form of dividing each functional module in an integrated manner.
  • the "module” here can refer to a specific ASIC, circuit, processor and memory that executes one or more software or firmware programs, integrated logic circuit, and/or other devices that can provide the above-mentioned functions.
  • the communication device 1200 shown in FIG. 12 includes at least one processor 1201, a memory 1202, and optionally, a communication interface 1203.
  • the memory 1202 may be a volatile memory, such as a random access memory; the memory may also be a non-volatile memory, such as read only memory, flash memory, hard disk drive (HDD) or solid-state drive (solid-state drive, SSD) or the memory 1202 is any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.
  • the memory 1202 may be a combination of the above-mentioned memories.
  • connection medium between the foregoing processor 1201 and the memory 1202 is not limited in the embodiment of the present application.
  • the memory 1202 and the processor 1201 are connected by a bus 1204 in the figure.
  • the bus 1204 is represented by a thick line in the figure.
  • the connection mode between other components is only for schematic illustration, and is not quoted. Is limited.
  • the bus 1204 can be divided into an address bus, a data bus, and a control bus. For ease of representation, only one thick line is used to represent in FIG. 12, but it does not mean that there is only one bus or one type of bus.
  • the processor 1201 may have a data transceiver function and can communicate with other devices.
  • an independent data transceiver module such as a communication interface 1203, may be used to send and receive data; the processor 1201 is communicating with other devices. During communication, data can be transmitted through the communication interface 1203.
  • the processor in FIG. 12 may call the computer execution instructions stored in the memory 1202, so that the terminal device executes any of the foregoing method embodiments. The method executed by the terminal device.
  • the functions/implementation process of the processing module and the transceiver module in FIG. 8 can be implemented by the processor 1201 in FIG. 12 calling a computer execution instruction stored in the memory 1202.
  • the function/implementation process of the processing module in FIG. 8 may be implemented by the processor 1201 in FIG. 12 calling computer execution instructions stored in the memory 1202
  • the function/implementation process of the transceiver module in FIG. 8 may be implemented by the communication in FIG. 12 Interface 1203 is implemented.
  • the processor in FIG. 12 may call a computer execution instruction stored in the memory 1202, so that the authentication server function executes the foregoing The method for executing the authentication server function in any method embodiment.
  • the functions/implementation processes of the processing module and the transceiver module in FIG. 9 may be implemented by the processor 1201 in FIG. 12 calling a computer execution instruction stored in the memory 1202.
  • the function/implementation process of the processing module in FIG. 9 may be implemented by the processor 1201 in FIG. 12 calling computer execution instructions stored in the memory 1202, and the function/implementation process of the transceiver module in FIG. 9 may be implemented through the communication in FIG. Interface 1203 is implemented.
  • the processor in FIG. 12 may call the computer execution instructions stored in the memory 1202 to make the unified data management network element execute The method executed by the unified data management network element in any of the foregoing method embodiments.
  • the functions/implementation processes of the processing module and the transceiver module in FIG. 10 may be implemented by the processor 1201 in FIG. 12 calling a computer execution instruction stored in the memory 1202.
  • the function/implementation process of the processing module in FIG. 10 may be implemented by the processor 1201 in FIG. 12 calling computer execution instructions stored in the memory 1202, and the function/implementation of the transceiver module in FIG. 10 may be implemented through the communication interface in FIG. 1203 to achieve.
  • the processor in FIG. 12 may call the computer execution instructions stored in the memory 1202 to make the AKMA authentication function network element execute the above The method executed by the AKMA authentication function network element in any method embodiment.
  • the functions/implementation processes of the processing module and the transceiver module in FIG. 11 can be implemented by the processor 1201 in FIG. 12 calling a computer execution instruction stored in the memory 1202.
  • the function/implementation process of the processing module in FIG. 11 may be implemented by the processor 1201 in FIG. 11 calling computer execution instructions stored in the memory 1202, and the function/implementation of the transceiver module in FIG. 11 may be implemented through the communication interface in FIG. 1203 to achieve.
  • An embodiment of the present application also provides a communication system, which may include at least one of an AKMA authentication function network element, a unified data management network element, an authentication server function network element, or an AKMA application function network element.
  • the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
  • a computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

一种通信方法、装置及系统，用于解决现有技术中AKMA鉴权，流程复杂，信令开销较大的问题。该方法的原理为：在终端设备的注册流程中，利用主鉴权，隐式表示AKMA鉴权。比如，主鉴权成功，可认为AKMA鉴权也成功。同时，在AKMA鉴权成功后，为终端设备分配AKMKA临时标识。采用本申请的方法、装置及系统，无需额外进行AKMA鉴权，简化流程，减少信令开销。

Description

一种通信方法、装置及系统 技术领域
本申请实施例涉及通信技术领域，尤其涉及一种通信方法、装置及系统。
背景技术
目前，终端设备可支持应用程序的身份验证和密钥管理(authentication and key management for applications，AKMA)服务。一般采用以下方式对终端设备进行AKMA鉴权：在终端设备注册成功，主鉴权完成后，额外再对终端设备进行AKMA鉴权，AKMA鉴权的流程较复杂，信令开销较大。
发明内容
本申请实施例提供一种通信方法、装置及系统，以简化AKMA鉴权的流程，减少信令开销。
第一方面，提供一种通信方法，包括：终端设备向移动管理网元发送注册请求消息；
所述终端设备在通过主鉴权流程鉴权成功，且激活非接入层NAS安全保护后，接收所述移动管理网元发送的经过NAS安全保护的注册响应，所述注册响应包括所述终端设备的应用程序的身份验证和密钥管理AKMA临时标识；所述终端设备保存所述AKMA临时标识。
通过上述方法,在终端设备的注册流程中,即完成AKMA鉴权,无需额外进行AKMA鉴权,简化AKMA鉴权的流程,减少信令开销。
在一种可能设计中，所述AKMA临时标识包括随机数、归属网络指示和路由标识；其中，所述随机数是网络设备分配的，用于标识所述终端设备的参数；所述归属网络指示用于指示所述终端设备的归属网络；所述路由标识用于确定生成所述AKMA服务的密钥Kakma的网络功能实体。
在本申请实施例中，终端设备接收到的AKMA临时标识既包括了终端设备的标识信息，还包括了用于确定生成终端设备对应的AKMA服务的密钥Kakma的网络功能实体的信息。后续终端设备使用AKMA临时标识访问AKMA应用功能网元的时候，网络侧的AKMA鉴权功能网元可以根据AKMA临时标识，确定生成终端设备对应的AKMA服务的密钥Kakma的网络功能实体，进而获取Kakma，并根据获取的Kakma为AKMA应用功能网元分配与终端设备通信的通信密钥。
在一种可能的设计中，所述AKMA临时标识还包括AKMA鉴权功能网元的地址信息或AKMA应用功能网元的地址信息中的至少一个。
通过上述方法，网络中可能存在多个AKMA鉴权功能网元以及提供相同应用服务的多个AKMA应用功能网元，在AKMA鉴权成功之后(本申请实施例中主鉴权成功之后)，为终端设备分配临时标识的时候可以根据一定的因素，为终端设备分配合适的AKMA鉴权功能网元的地址信息或AKMA应用功能网元，并将它们的地址携带在AKMA临时标识 中，以便于后续终端设备根据AKMA临时标识确定合适的AKMA应用功能网元或者便于后续AKMA应用功能网元根据AKMA临时标识确定合适的AKMA鉴权功能网元。
在一种可能的设计中，所述生成所述AKMA服务的密钥Kakma的网络功能实体为鉴权服务器功能网元。
第二方面，提供一种通信方法，包括：在终端设备的注册流程中，鉴权服务器功能网元接收统一数据管理网元发送的第一指示信息，所述第一指示信息用于指示所述终端设备支持应用程序的身份验证和密钥管理AKMA服务；在所述终端设备的主鉴权成功后，所述鉴权服务器功能网元确定所述终端设备的AKMA临时标识；所述鉴权服务器功能网元通过移动管理网元向所述终端设备发送所述AKMA临时标识。
本申请实施例中在终端设备支持AKMA服务时，对所述终端设备主鉴权成功，即可认为AKMA鉴权成功，不需要额外的AKMA鉴权流程对终端设备进行AKMA鉴权，无需额外进行AKMA鉴权,简化AKMA鉴权的流程,减少信令开销。
在一种可能的设计中，所述AKMA临时标识包括随机数、归属网络指示和路由标识；所述随机数是网络设备分配的，用于标识所述终端设备的参数；所述归属网络指示用于指示所述终端设备的归属网络；所述路由标识为用于确定生成所述AKMA服务的密钥Kakma的网络功能实体。
在一种可能的设计中，所述AKMA临时标识还包括AKMA鉴权功能网元的地址信息或AKMA应用功能网元的地址信息中的至少一个。
在一种可能的设计中，所述鉴权服务器功能网元确定所述AKMA临时标识，包括：
所述鉴权服务器功能网元自己生成所述AKMA临时标识。
在一种可能的设计中，所述鉴权服务器功能网元确定所述AKMA临时标识，包括：所述鉴权服务器功能网元向AKMA鉴权功能网元发送第一请求消息，所述第一请求消息用于请求所述AKMA鉴权功能网元生成所述AKMA临时标识；所述鉴权服务器功能网元接收所述AKMA鉴权功能网元发送的第一响应消息，所述第一响应消息中携带有所述AKMA临时标识。
由于在现有技术中，由AKMA鉴权功能网元生成所述AKMA临时标识。采用该方法，与现有技术的兼容性高，改动性小。
在一种可能的设计中，所述鉴权服务器功能网元确定所述AKMA临时标识，包括：所述鉴权服务器功能网元根据第一辅助信息，确定所述AKMA临时标识；其中，所述第一辅助信息包括所述终端设备的切片信息、所述终端设备的数据网络名称信息或所述终端设备的业务或会话连续性模式信息中的至少一个。
通过上述方法，所述AKMA临时标识中包括AKMA鉴权功能网元的地址信息。在本申请实施例中，可根据第一辅助信息的不同，选择不同的AKMA鉴权功能网元，提高选择AKMA鉴权功能网元的灵活性。
在一种可能的设计中，还包括：所述鉴权服务器功能网元向所述移动管理网元发送第二请求消息，所述第二请求消息中携带有所述第一指示信息；所述鉴权服务器功能网元接收所述移动管理网元发送的第二响应消息，所述第二响应消息中携带有所述第一辅助信息。
在一种可能的设计中，还包括:所述鉴权服务器功能网元接收所述AKMA鉴权功能网元发送的第三请求消息，所述第三请求消息中携带有所述AKMA临时标识；所述鉴权服务器功能网元根据所述AKMA临时标识，获取第一密钥，所述第一密钥是所述主鉴权过 程中的中间密钥；所述鉴权服务器功能网元根据所述第一密钥，生成所述AKMA服务的密钥Kakma；所述鉴权服务器功能网元向所述AKMA鉴权功能网元发送所述Kakma。
在一种可能的设计中，所述方法还包括：在所述终端设备的主鉴权成功后，所述鉴权服务器功能网元保存所述AKMA临时标识、所述终端设备的标识与所述第一密钥的对应关系；所述鉴权服务器功能网元根据所述AKMA临时标识，获取第一密钥，包括：所述鉴权服务器功能网元根据所述AKMA临时标识和所述对应关系，获取第一密钥。
在一种可能的设计中，所述第一密钥为Kausf。
在一种可能的设计中，在所述AKMA临时标识中包括AKMA鉴权功能网元的地址信息时，所述方法还包括：所述鉴权服务器功能网元将所述AKMA临时标识中的AKMA鉴权功能网元的地址信息由第一地址信息，更新为第二地址信息，所述第一地址信息为第一AKMA鉴权功能网元的地址信息，所述第二地址信息为第二AKMA鉴权功能网元的地址信息。
第三面，提供一种通信方法，包括：在终端设备的注册流程中，统一数据管理网元接收鉴权服务器功能网元发送的第三请求消息，所述第三请求消息中包括终端设备的标识；所述统一数据管理网元根据所述终端设备的签约数据，确定所述终端设备支持应用程序的身份验证和密钥管理AKMA服务；所述统一数据管理网元向鉴权服务器功能网元发送第三响应消息，所述第三响应消息中包括第一指示信息，所述第一指示信息表示所述终端设备支持所述AKMA服务。
在一种可能的设计中，所述第三请求消息为用于获取鉴权向量的UDM服务化请求消息，所述第三响应消息为用于获取鉴权向量的UDM服务化的响应消息。
第四方面，提供一种通信方法，包括：在终端设备的注册流程中，第一应用程序的身份验证和密钥管理AKMA鉴权功能网元接收鉴权服务器功能网元发送的第四请求消息，所述第四请求消息用于请求所述终端设备的AKMA临时标识；所述第一AKMA鉴权功能网元生成所述AKMA临时标识；所述第一AKMA鉴权功能网元向鉴权服务器功能网元发送第四响应消息，所述第四响应消息中携带有所述AKMA临时标识。
在一种可能的设计中，还包括：所述第一AKMA鉴权功能网元接收AKMA应用功能网元发送的第五请求消息，所述第五请求消息用于请求所述终端设备与所述AKMA应用功能网元进行通信时使用的通信密钥；在所述第一AKMA鉴权功能网元能够为所述AKMA应用功能网元提供服务的情况下，所述第一AKMA鉴权功能网元从鉴权服务器功能网元获取与所述AKMA临时标识对应的AKMA服务的密钥Kakma；所述第一AKMA鉴权功能网元根据所述Kakma，生成所述通信密钥；所述第一AKMA鉴权功能网元将所述通信密钥发送给所述AKMA应用功能网元。
在一种可能的设计中，还包括：在所述第一AKMA鉴权功能网元不能够为所述AKMA应用功能网元提供服务的情况下，所述第一AKMA鉴权功能网元确定第二AKMA鉴权功能网元；所述第一AKMA鉴权功能网元向所述AKMA应用功能网元发送第四响应消息，所述第四响应消息用于指示所述AKMA应用功能网元向所述第二AKMA鉴权功能网元获取通信密钥；其中，所述第四响应消息中携带有所述第二AKMA鉴权功能网元的地址信息。
第五方面，提供一种通信系统，包括：鉴权服务器功能网元和统一数据管理网元；
鉴权服务器功能网元，用于在终端设备的注册流程中，向统一数据管理网元发送第一请求消息，所述第一请求消息中包括终端设备的标识；所述统一数据管理网元，用于根据所述终端设备的签约数据，确定所述终端设备支持应用程序的身份验证和密钥管理AKMA服务，以及，向所述鉴权服务器功能网元发送第一响应消息；其中，所述第一响应消息中包括第一指示信息，所述第一指示信息用于表示所述终端设备支持所述AKMA服务；所述鉴权服务器功能网元，还用于在所述终端设备的主鉴权成功后，确定所述终端设备的AKMA临时标识，以及，通过移动管理网元向所述终端设备发送所述AKMA临时标识。
在一种可能的设计中，所述AKMA临时标识包括随机数、归属网络指示和路由标识；所述随机数是网络设备分配的，用于标识所述终端设备的参数；所述归属网络指示用于指示所述终端设备的归属网络；所述路由标识为用于确定生成所述AKMA服务的密钥Kakma的网络功能实体。
在一种可能的设计中，所述AKMA临时标识还包括AKMA鉴权功能网元的地址信息或AKMA应用功能网元的地址信息中的至少一个。
在一种可能的设计中，所述鉴权服务器功能网元在确定所述终端设备的AKMA临时标识时，具体用于：所述鉴权服务器功能网元自己生成所述AKMA临时标识。
在一种可能的设计中，所述通信系统还包括第一AKMA鉴权功能网元，所述鉴权服务器功能网元在确定所述终端设备的AKMA临时标识时，具体用于：所述鉴权服务器功能网元，用于向所述第一AKMA鉴权功能网元发送第二请求消息，所述第二请求消息用于请求所述第一AKMA鉴权功能网元生成所述AKMA临时标识；所述第一AKMA鉴权功能网元，用于确定所述AKMA临时标识，以及向所述鉴权服务器功能网元发送第二响应消息，所述第二响应消息中携带有所述AKMA临时标识。
在一种可能的设计中，所述鉴权服务器功能网元在确定所述终端设备的AKMA临时标识时，具体用于：所述鉴权服务器功能网元根据第一辅助信息，确定所述AKMA临时标识；其中，所述第一辅助信息包括所述终端设备的切片信息、所述终端设备的数据网络名称信息或所述终端设备的业务或会话连续性模式信息中的至少一个。
在一种可能的设计中，所述系统还包括移动管理网元，所述鉴权服务器功能网元，还用于向所述移动管理网元发送第三请求消息，所述第三请求消息中携带有所述第一指示信息；所述移动管理网元，用于获取所述第一辅助信息，且向所述鉴权服务器功能网元发送第三响应消息，所述第三响应消息中携带有所述第一辅助信息。
在一种可能的设计中，所述第三请求消息为用于获取鉴权向量的统一数据管理UDM服务化请求消息，所述第三响应消息为用于获取鉴权向量的UDM服务化的响应消息。
在一种可能的设计中，所述通信系统还包括AKMA应用功能网元和第一AKMA鉴权功能网元，所述方法还包括：所述AKMA应用功能网元，用于向所述第一AKMA鉴权功能网元发送第四请求消息，所述第四请求消息中携带有所述AKMA临时标识；所述第一AKMA鉴权功能网元，用于在所述第一AKMA鉴权功能网元能够为所述AKMA应用功能网元提供服务的情况下，从所述鉴权服务器功能网元获取与所述AKMA临时标识对应的AKMA服务的密钥Kakma；根据所述Kakma，生成所述通信密钥；以及，将所述通信密钥发送给所述AKMA应用功能网元。
在一种可能的设计中，所述第一AMKA鉴权功能网元在从所述AKMA应用功能网元获取与所述AKMA临时标识对应的AKMA服务的密钥Kakma时，具体用于：所述第一 AKMA鉴权功能网元，用于向所述鉴权服务器功能网元发送第五请求消息，所述第五请求消息中携带有所述AKMA临时标识；所述鉴权服务器功能网元，用于根据所述AKMA临时标识，获取第一密钥，所述第一密钥是主鉴权过程中的中间密钥；根据所述第一密钥，生成所述AKMA服务的密钥Kakma，且向所述第一AKMA鉴权功能网元发送所述Kakma。
在一种可能的设计中，所述第一AKMA鉴权功能网元，还用于在所述第一AKMA鉴权功能网元不能够为所述AKMA应用功能网元提供服务的情况下，确定所述第二AKMA鉴权功能网元的地址信息；所述第一AKMA鉴权功能网元，还用于向所述AKMA应用功能网元发送重定位消息，所述重定位消息中包括所述第二AKMA鉴权功能网元的地址信息。
在一种可能的设计中，所述AKMA应用功能网元，还用于向所述第二AKMA鉴权网元发送第六请求消息，所述第六请求消息中包括所述AKMA临时标识；所述第二AKMA鉴权网，还用于从所述鉴权服务器功能网元获取与所述AKMA临时标识对应的AKMA服务的密钥Kakma；根据所述Kakma，生成所述通信密钥；以及，将所述通信密钥发送给所述AKMA应用功能网元。
在一种可能的设计中，所述鉴权服务器功能网元，还用于在所述终端设备的主鉴权成功后，保存所述AKMA临时标识、所述终端设备的标识与所述第一密钥的对应关系；所述鉴权服务器功能网元在根据所述AKMA临时标识，获取第一密钥时，具体用于：所述鉴权服务器功能网元根据所述AKMA临时标识和所述对应关系，获取所述第一密钥。
在一种可能的设计中，所述第一密钥为kausf。
在一种可能的设计中，所述鉴权服务器功能网元，在所述AKMA临时标识中包括AKMA鉴权功能网元的地址信息时，将所述AKMA临时标识中的AKMA鉴权功能网元的地址信息由第一地址信息，更新为第二地址信息，所述第一地址信息为所述第一AKMA鉴权功能网元的地址信息，所述第二地址信息为所述第二AKMA鉴权功能网元的地址信息。
第六方面，提供一种通信装置，该装置可以是终端设备或终端设备中的芯片，该装置包括收发模块和处理模块用于执行上述第一方面及任一种可能设计的相应功能，具体的：
收发模块，用于向移动管理网元发送注册请求消息，以及，在通过主鉴权流程鉴权成功，且激活非接入层NAS安全保护后，接收所述移动管理网元发送的经过NAS安全保护的注册响应。其中，所述注册响应包括所述终端设备的应用程序的身份验证和密钥管理AKMA临时标识。处理模块，用于保存所述AKMA临时标识。
关于收发模块和处理模块的具体功能可参见上述第一方面的记载，在此不再说明。
第七方面，提供一种装置，该装置可以是鉴权服务器功能网元，或鉴权服务器功能网元中的芯片，该装置包括收发模块和处理模块用于执行上述第二方面及任一种可能设计的相应功能，具体的：
收发模块，用于在终端设备的注册流程中，接收统一数据管理网元发送的第一指示信息，所述第一指示信息用于指示所述终端设备支持应用程序的身份验证和密钥管理AKMA服务；
处理模块，用于在所述终端设备的主鉴权成功后，确定所述终端设备的AKMA临时标识；
收发模块，还用于通过移动管理网元向所述终端设备发送所述AKMA临时标识。
关于收发模块和处理模块的具体功能可参见上述第二方面的记载，在此不再说明。
第八方面，提供一种装置，该装置可以是统一数据管理网元，或统一数据管理网元中的芯片，该装置包括收发模块和处理模块用于执行上述第三方面及任一种可能设计的相应功能，具体的：
收发模块，用于在终端设备的注册流程中，接收鉴权服务器功能网元发送的第三请求消息，所述第三请求消息中包括终端设备的标识；
处理模块，用于根据所述终端设备的签约数据，确定所述终端设备支持应用程序的身份验证和密钥管理AKMA服务；
收发模块，还用于向鉴权服务器功能网元发送第三响应消息，所述第三响应消息中包括第一指示信息，所述第一指示信息表示所述终端设备支持所述AKMA服务。
关于收发模块和处理模块的具体功能可参见上述第三方面的记载，在此不再说明。
第九方面，提供一种装置，该装置可以是第一AKMA鉴权功能网元或第一AKMA鉴权功能网元中的芯片，该装置包括收发模块和处理模块用于执行上述第四方面及任一种可能设计的相应功能，具体的：
收发模块，用于在终端设备的注册流程中，接收鉴权服务器功能网元发送的第四请求消息，所述第四请求消息用于请求所述终端设备的AKMA临时标识；
处理模块，用于生成所述AKMA临时标识；
收发模块，还用于向鉴权服务器功能网元发送第四响应消息，所述第四响应消息中携带有所述AKMA临时标识。
第十方面，提供一种通信装置，包括通信接口、处理器和存储器；所述存储器用于存储计算机执行指令；所述处理器用于执行所述存储器所存储的计算机执行指令，以使所述通信装置通过所述通信接口收发消息，并实现上述第一方面至第四方面任一方面所述的方法中如下设备的功能：所述安全接入设备，或者，所述第二核心网网元。
第十一方面，提供一种计算机可读存储介质，所述存储介质存储有计算机指令，当所述计算机指令被通信装置执行时，使得所述通信装置执行上述第一方面至第四方面任一方面所述的方法。
第十二方面，提供一种计算机程序产品，所述计算机程序产品包括计算机指令，当所述计算机指令被通信装置执行时，使得所述通信装置执行上述第一方面至第四方面任一方面所述的方法。
第十三方面，提供一种装置，用于实现上述第一方面至第四方面任一方面所述的方法。
第十四方面，提供一种装置，包括处理器和存储器，所述处理器和所述存储器耦合，所述处理器用于执行第一方面至第四方面任一方面所述的方法。
附图说明
图1为本申请实施例提供的网络架构的一示意图；
图2为本申请实施例提供的AKMA鉴权的一示意图；
图3为本申请实施例提供的AKMA鉴权的一示意图；
图4为本申请实施例提供的AKMA鉴权的一示意图；
图5为本申请实施例提供的AKMA鉴权的一示意图；
图6为本申请实施例提供的终端设备接入的一示意图；
图7为本申请实施例提供的终端设备接入的一示意图；
图8至图11为本申请实施例提供的通信装置的示意图；
图12为本申请实施例提供的通信装置的结构示意图。
具体实施方式
本申请实施例可以适用于4G(第四代移动通信系统)演进系统，如长期演进(long term evolution，LTE)系统，或者还可以为5G(第五代移动通信系统)系统，如采用新型无线接入技术(new radio access technology，New RAT)的接入网；云无线接入网(cloud radio access network，CRAN)等，或者，甚至未来的6G(第六代移动通信系统)等通信系统。
参见图1，为本申请实施例提供的网络架构，该网络架构至少包括终端设备、接入网(access network，AN)、核心网和数据服务网络。可以理解的是，图1仅为示意性说明，并不作为对本申请的限定。
其中，终端设备可以简称为终端，是一种具有无线收发功能的设备，终端设备可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。所述终端设备可以是手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端设备、无人驾驶(self driving)中的无线终端设备、远程医疗(remote medical)中的无线终端设备、智能电网(smart grid)中的无线终端设备、运输安全(transportation safety)中的无线终端设备、智慧城市(smart city)中的无线终端设备、智慧家庭(smart home)中的无线终端设备，以及还可以包括用户设备(user equipment，UE)等。终端设备还可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，未来第五代(the 5th generation，5G)网络中的终端设备或者未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中的终端设备等。终端设备有时也可以称为终端设备、用户设备(user equipment，UE)、接入终端设备、车载终端设备、工业控制终端设备、UE单元、UE站、移动站、移动台、远方站、远程终端设备、移动设备、UE终端设备、终端设备、无线通信设备、UE代理或UE装置等。终端设备也可以是固定的或者移动的。本申请实施例对此并不限定。
接入网AN，可以采用不同类型的接入技术。比如，接入网可采用第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)接入技术(例如3G、4G或5G系统中采用的无线接入技术)。或者，非第三代合作伙伴计划(none 3rd Generation Partnership Project，non-3GPP)接入技术。其中，采用3GPP接入技术的接入网称为无线接入网(radio access network，RAN)。例如，5G系统中的接入网设备称为下一代基站节点(next generation Node Basestation，gNB)等。非3GPP接入技术是指不符合3GPP标准规范的接入技术，例如，以无线保真接入点(wireless fidelity access point，WIFI AP)为代表的空口技术等。
核心网可包括鉴权服务器功能网元、移动管理网元、会话功能网元、应用程序的身份验证和密钥管理(authentication and key management for applications，AKMA)鉴权功能网元、统一数据管理网元或用户面功能网元等中的一个或多个。其中，用户面功能网元为用 户面数据出口，主要用于连接外部网络。鉴权功能服务器网元，为网络认证UE的功能实体，主要用于网络验证UE的真实性。移动管理网元，主要负责移动性管理。会话功能网元主要用于为用户面分配会话资源。统一数据管理网元，用于存储用户的签约数据，生成用于鉴权用户的长期密钥。AKMA鉴权功能网元，为处理AKMA认证的功能实体，主要用于提供AKMA的鉴权锚点功能。
需要说明的是，在不同的通信系统中，上述核心网中的网元可有不同的名称。比如，在第四代移动通信系统中，上述移动管理网元可称为移动管理实体(mobility management entity，MME)。在第五代移动通信系统中，上述移动管理网元可称为接入和移动性管理功能(access and mobility management function，AMF)等。在本申请实施例中，以第五代移动通信系统为例，介绍上述核心网网元，并不作为对本申请实施例的限定。比如，在第五代移动通信系统中，用户面功能网元可称为用户功能(user plane function，UPF)，鉴权服务器功能网元可称为鉴权服务器功能(authentication server function，AUSF)、移动管理网元可称为AMF、会话管理功能网元可称为会话管理功能(session management function，SMF)、统一数据管理网元可称为统一数据管理(unified data management，UDM)、AKMA的鉴权功能网元可称为AKMA的鉴权功能(AKMA authentication function，AAuF)等。
可以理解的是，图1的核心网网元仅为示意性的说明，并不作为限定。比如，在本申请实施例中核心网，除包括图1所示的核心网网元外，还可包括网络切片选择功能(Network Slice Selection Function，NSSF)、网络开放功能(Network Exposure Function，NEF)、网络存储器功能(Network Repository Function，NRF)、策略控制功能(Policy Control Function，PCF)、应用功能(Application Function，AF)或SCP等中的一个或多个网元。
数据服务网络可具体为数据网络(data network，DN)等。AKMA应用功能(AKMA application function，AApF)网元，可以部署在DN中的一个或多个服务器中，为3GPP用户终端提供数据服务。可以理解的是，AKMA应用功能网元可部署在DN的服务器中，还可布署于核心网内，不作限定。在本申请实施例中，是以AKMA应用网元部署在DN的服务器中为例进行说明的。
针对图1所示的架构，本申请实施例提供一种应用场景，在该应用场景中，终端设备可支持AKMA服务，核心网设备可对终端设备进行AKMA鉴权。如图2所示，提供一种AKMA鉴权流程，在该流程中UE可具体为上述图1所示架构中的终端设备，AAuF可具体为上述图1所示架构中的AKMA鉴权功能网元，AUSF可具体为上述图1所示架构中的鉴权功能服务网元，该流程包括：
S201：UE向AAuF发送第一请求，所述第一请求中携带有终端设备的永久身份标识(subscriber permanent identifier，SUPI)或隐藏的身份标识(subscriber concealed identifier，SUCI)。可以理解的是，UE可通过AApF向AAuF发送第一请求。比如，AApF在接收到第一请求后，发现UE还未通过AKMA鉴权，则可将第一请求转发至AAuF。
S202：AAuF向AUSF发送鉴权请求(authentication request)，所述鉴权请求中携带有终端设备的SUPI或SUCI。
S203：AUSF和UE之间进行双向鉴权，所述双向鉴权可具体为可扩展鉴权协议(extensible authentication protocol，EAP)交换(exchange)。UE和AUSF双向鉴权成功，可认为终端设备的AKMA鉴权成功。
S204：在鉴权成功后，AUSF向AAuF发送鉴权响应(authentication response)，所述 鉴权响应携带有AKMA鉴权成功的指示和终端设备AKMA服务的密钥Kakma。相应的，AAuF在接收到鉴权响应后，可保存Kakma，为终端设备分配AKMA临时标识。其中，所述Kakma用于生成所述终端设备和AKMA应用功能网元之间的通信密钥。在本申请实施例中，AAuF可以使用上述Kakma，为不同的AKMA应用功能网元生成与终端设备进行通信使用的通信密钥。具体的，AAuF可以根据上述Kakma和AKMA应用功能网元的标识，生成AKMA应用功能网元和终端设备进行通信使用的通信密钥。显然，不同的AKMA应用功能网元与同一个终端设备通信使用的通信密钥可以是不一样的。
S205：AAuF向UE发送第一响应，所述第一响应中包括终端设备的AKMA临时标识和AKMA临时标识的有效期。相应的，终端设备保存AKMA临时标识。
通过上述方法，可以发现，在UE注册成功，主鉴权完成后，需要额外再进行AKMA鉴权，且AKMA鉴权成功后再为终端设备分配AKMA临时标识，鉴权流程复杂，信令开销较大。
基于此，本申请提供一种通信方法，该通信方法的原理为：由于在UE的注册流程中，UE与网络设备需要主鉴权。在本申请实施例中，在UE的注册流程中，当UE与网络设备主鉴权成功后，即认为UE的AKMA鉴权也成功，同时为UE分配AKMA临时标识。可见，在本申请实施例中，UE无须进行额外的AKMA鉴权，简化鉴权流程，减少信令开销。
需要说明的是，在本申请的描述中，“第一”、“第二”等词汇，仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序，例如，“第一请求消息”和“第二请求消息”等。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A,B可以是单个或者多个。a、b、或c中的至少一项(个)，可以表示：a；b；c；a和b；a和c；b和c；或a、b和c。其中，a、b、c可以是单个，也可以是多个。
参照图3所示，提供一种通信方法的流程，该流程中的终端设备可为图1架构中的终端设备，移动管理网元可为图1架构中的移动管理网元，鉴权服务器功能网元可为图1架构中的鉴权服务器功能网元，统一数据管理网元可为图1架构中的统一数据管理网元，该流程具体为：
S300：在终端设备的注册流程中，终端设备向移动管理网元发送第一请求消息，所述第一请求消息中携带有终端设备的隐藏的身份标识(subscriber concealed identifier，SUCI)或5G全球唯一临时UE标识(5G-globally unique temporary UE Identity，5G-GUTI)。
可选的，所述第一请求消息可为注册请求(registration request)。当终端设备没有安全上下文的时候，可在第一请求消息中携带SUCI，SUCI为终端设备的隐藏的身份信息。当UE有安全上下文的时候，可在第一请求消息中携带5G-GUTI，5G-GUTI为UE的临时身份标识。
S301：移动管理网元向鉴权服务器功能网元发送第二请求消息，所述第二请求消息中携带终端设备的SUCI或SUPI。第二请求消息用于触发对UE进行鉴权。鉴权可以是主认证鉴权，也可以是AKMA鉴权等，不作具体限定。可选的，所述第二请求消息可称为UE鉴权请求消息(Nausf_UE_Authentication request)。当第二请求消息中携带终端设备的SUCI时，移动管理网元可直接在第二请求消息中获取终端设备的SUCI。当第二请求消息中携带终端设备的5G-GUTI时，移动管理网元可根据终端设备的5G-GUTI，确定终端设备的永久身份标识(subscriber permanent identifier，SUPI)。例如，如果移动管理网元需要对终 端设备进行鉴权，移动管理网元可在对终端设备鉴权时，根据终端设备的GUTI，确定终端设备的SUPI。
S302：鉴权服务器功能向统一数据管理网元发送第三请求消息，所述第三请求消息中携带有终端设备的SUCI或SUPI。所述第三请求消息用于向统一数据管理网元请求鉴权向量。第三请求消息所请求的鉴权向量可以是主鉴权用的鉴权向量，或者，第三请求消息请求的鉴权向量可以是AKMA鉴权用的鉴权向量，或者，第三请求消息请求的鉴权向量可以既用于主鉴权，又用于AKMA鉴权等，不作限定。
S303：统一数据管理网元根据终端设备的签约信息，确定终端设备支持或不支持AKMA服务。比如，统一数据管理网元可根据第三请求消息中携带的终端设备的SUCI或SUPI，确定终端设备的签约信息。例如，在第三请求消息携带SUCI的情况下，统一数据管理网元需先从SUCI获取SUPI，再根据SUPI确定终端设备的签约信息。进一步，再根据终端设备的鉴约信息，确定终端设备是否支持AKMA服务。
若统一数据管理网元确定终端设备不支持AKMA服务，则统一数据管理网元按照现有标准TS33.501中6.1章节的描述进行相应的操作。如果统一数据管理网元确定终端设备支持AKMA服务，则统一数据管理网元执行下述S304中的步骤。
S304：统一数据管理网元向鉴权服务器功能网元发送第一响应消息，鉴权服务器功能网元接收第一响应消息，所述第一响应消息中携带有第一指示信息，所述第一指示信息可显示或隐示指示终端设备支持AKMA服务。具体的，当第一指示信息取第一预设值的时候，代表终端设备支持AKMA服务；当第一指示信息取第二预设值的时候，代表终端设备不支持AKMA服务。例如，第一指示信息可以是一个比特位的符号，当前该符号取值为0的时候，表示终端设备不支持AKMA服务；取值为1的时候，表示终端设备支持AKMA服务。或者，第一指示信息可隐示指示终端设备支持AKM服务。比如，若第一响应消息中出现“AKMA”等字符，则代表终端设备支持AKMA服务。其中，第一指示信息的形式可以是枚举类型，即用字符串格式等，不作限定。
可选的，第一响应消息中还可携带第一辅助信息、鉴权向量(authentication vector，AV)、终端设备的SUPI或终端设备的SUCI等中的一个或多个，所述第一响应消息可具体为获取UE鉴权响应消息(Nudm_UE Authentication_Get Response)。所述第一辅助信息可包括终端设备的切片信息、数据网络名称(data network name，DNN)信息或业务或会话连续性模式(service and session continuity，SSC，mode)信息等签约数据中的至少一个。所述第一辅助信息可包括用户的部分或全部签约信息。
在本申请实施例中，统一数据管理网元可根据以下情况中的一个或多个，确定是否需要将第一辅助信息提供给鉴权服务器功能网元。如果需要将第一辅助信息提供给鉴权服务器功能网元，则在第一响应消息中携带第一辅助信息。如果不需要将第一辅助信息提供给鉴权服务器功能网元，则在第一响应消息中可不携带第一辅信息。
第一种情况：统一数据管理网元可根据终端设备的签约信息，确定是否需要将第一辅信息提供给鉴权服务器功能网元。比如，统一数据管理网元根据终端设备的签约信息，确定终端设备为有低时延需求的终端设备，则将第一辅助信息提供给鉴权服务器功能网元。再如，UDM根据终端设备的签约信息，确定终端设备有特殊需求，则将第一辅助信息提供给鉴权服务器功能网元。
第二种情况：统一数据管理网元可检测终端设备是否被鉴权过。如果统一数据管理网 元确定终端设备被鉴权过，则可将第一辅助信息的全部或部分告知鉴权服务器功能网元。如果统一数据管理网元确定终端设备未被鉴权过，或者，终端设备虽然被鉴权过，但鉴权信息已过期，则可将第一辅助信息中的部分信息告知鉴权服务器功能网元。比如，第一辅助信息中的部分信息中可不包括终端设备的位置信息等。
第三种情况：统一数据管理网元可检测终端设备的当前阶段流程，根据终端设备的当前阶段流程不同，确定是否需要将第一辅助信息提供给鉴权服务器功能网元。比如，若终端设备当前处于移动管理(mobile management，MM)流程中，则无需提供第一辅助信息给鉴权服务器功能网元。若终端设备当前处于会话管理(session management，SM)流程中，则需要将第一辅助信息提供给鉴权服务器功能网元。
可选的，S305：鉴权服务器功能网元和终端设备间进行双向鉴权。需要说明的是，如果图3所示的流程是鉴权的注册流程，则图3所示的流程中将包括S305。如果图3所示的流程是PDU会话建立流程，则图3所示的流程中可不包括S305。
其中，鉴权服务器功能网元可对终端设备的合法性进行鉴权，终端设备可对整个无线网络的真实性进行鉴权。具体的，鉴权服务器功能网元可按照现有标准TS 33.501中章节6.1中的描述对UE进行鉴权，同样，UE也可按照现有标准TS 33.501中章节6.1中的描述对鉴权服务器功能网元进行鉴权等。所述鉴权方法具体采用EAP-AKA，或5G-AKA等鉴权方法，本申请不作限定。
S306：鉴权服务器功能网元确定终端设备的AKMA临时标识(temporary identifier)。终端设备的AKMA临时标识还可称为终端设备的AKMA临时标识符等。UE的AKMA临时标识用于UE接入AKMA应用功能网元时使用。
其中，AKMA临时标识至少包括随机数(random value)、归属网络指示(home network identifier)和路由标识(routing indicator，RI)。随机数是网络侧设备分配的，用于标识终端设备的参数；归属网络指示用于指示终端设备的归属网络。路由标识用于确定生成AKMA服务的密钥Kakma的网络功能实体。比如，生成AKMA服务的密钥Kakma的网络功能实体为鉴权服务器功能网元。可选的，网络中的设备，例如AMF，可以根据归属网络指示和路由标识确定鉴权服务器功能网元的。可选的，AKMA临时标识还可包括AKMA鉴权功能实体的地址信息，或AKMA用户功能实体的地址信息中的至少一个。
或者，可以描述为：AKMA临时标识至少携带终端设备的临时身份信息、终端设备的家乡网络信息(home network identifier)和鉴权服务器功能网元的地址信息。进一步地，家乡网络信息可以为移动网络码(mobile network code MNC)和移动国家码(mobile country code,MCC)等。鉴权服务器功能网元的地址信息为可以找到该鉴权服务器功能网元的信息，比如，鉴权服务器功能网元的地址信息中可以包括鉴权服务器功能网元的编号信息和/或鉴权服务器功能网元的路由信息(routing ID)。鉴权服务器功能网元的编号信息可以是运营商在网络内部给鉴权服务器功能网元分配的编号，用于确定某一个鉴权服务器功能网元。鉴权服务器功能网元的路由信息是存储在终端设备上的或存储在全球用户身份模块(universal subscriber identity module，USIM)。当UE生成SUCI的时候，SUCI中携带Routing ID供移动管理网元确定可以为UE服务的鉴权服务器功能网元。在鉴权服务器功能网元的地址信息不能够在全球范围内唯一标识一个鉴权服务器功能网元的情况下，那么确定具体的鉴权服务器功能网元的时候要将终端设备的家乡网络信息和鉴权服务器功能网元的地址信息结合使用。可选的，终端设备的AKMA临时标识还包括AKMA鉴权功能网元的地 址信息和/或AKMA应用功能网元的地址信息。AKMA鉴权功能网元的地址信息为可以唯一确定AKMA鉴权功能网元的信息。比如，AKMA鉴权功能网元的地址信息可以包括AKMA鉴权功能网元的编号信息和/或第一AKMA鉴权功能网元的路由信息(routing ID)。AKMA鉴权功能网元的编号信息可以是运营商在网络内部给AKMA鉴权功能网元分配的编号，用于确定某一个AKMA鉴权功能网元。AKMA鉴权功能网元的路由信息鉴权服务器功能网元可以通过查询获得，比如向网管系统查询或者向NRF查询，也可以根据本地预配置的列表获得。AKMA鉴权功能网元的路由信息可以使AKMA应用功能网元或者UE确定为这个UE服务的AKMA鉴权功能网元。在AKMA鉴权功能网元的地址信息不能够在全球范围内唯一标识一个AKMA鉴权功能网元的情况下，那么确定具体的AKMA鉴权功能网元的时候要将终端设备的家乡网络信息和AKMA鉴权功能网元的地址信息结合使用。AKMA应用功能网元的地址信息为可以唯一确定AKMA应用功能网元的信息。比如，AKMA应用功能网元的地址信息可以包括AKMA应用功能网元的编号信息和/或AKMA应用功能网元的路由信息(routing ID)。AKMA应用功能网元的编号信息可以是运营商或者应用提供方在网络内部给AKMA应用功能网元分配的编号，用于确定某一个AKMA应用功能网元。AKMA应用功能网元的路由信息可以通过查询获得，比如AKMA鉴权功能网元或鉴权服务器功能网元向网管系统查询或者向NRF查询，也可以根据本地预配置的列表获得。AKMA鉴权功能网元的路由信息可以使AKMA应用功能网元或者UE确定为这个UE服务的AKMA鉴权功能网元。在AKMA应用功能网元的地址信息不能够在全球范围内唯一标识一个AKMA应用功能网元的情况下，那么确定具体的AKMA应用功能网元的时候要将终端设备的家乡网络信息和AKMA应用功能网元的地址信息结合使用。
进一步地，AKMA鉴权功能网元的地址信息可以由鉴权服务器功能网元确定，比如AKMA鉴权功能网元可为默认的或协议规定的AKMA鉴权功能网元。或者，AKMA鉴权功能网元可为鉴权服务器功能网元根据上述S204中的第一辅助信息，所确定的AKMA鉴权功能网元等。比如，第一辅助信息中包括终端设备的位置信息，则鉴权服务器功能网元可以通过查询其它核心网实体(例如，NRF等)、网管配置列表或鉴权服务器功能网元的预配置列表等方式，查询距离终端设备最近的AKMA鉴权功能网元。或者，第一辅助信息中包括终端设备的切片信息、DNN信息、SSC信息等，鉴权服务器功能网元可根据第一辅助信息中的全部或部分信息，综合选择一个满足条件的AKMA鉴权功能网元。例如，鉴权服务器功能网元可以选择一个可以为切片-数据网络名称服务的AKMA鉴权功能网元等。AKMA应用功能网元的地址信息可以由鉴权服务器功能网元确定，也可以由AKMA鉴权功能网元确定。比如，AKMA应用功能网元与AKMA鉴权功能网元存在绑定关系的情况下，确定了一个AKMA鉴权功能网元就确定了一个AKMA应用功能网元；再比如，AKMA应用功能网元是移动边缘计算(mobile edge computing，MEC)上的一个应用。鉴权服务器功能网元或AKMA鉴权功能网元要确定使用哪个移动边缘计算功能，即确定了使用哪个AKMA应用功能网元。在于移动边缘计算实体相关的情况下，AKMA应用功能网元、AKMA鉴权功能网元的地址信息也可以是，或者包含移动边缘计算实体的信息。同理，移动边缘计算实体的地址信息可以作为唯一确定一个移动边缘计算功能的地址信息，或者与MCC和MNC一同确定一个移动边缘计算功能的地址信息。
示例的，终端设备的临时身份信息可由二进制比特组成，比如，32位的0和/或1可构成终端设备的临时身份标识等。鉴权服务器功能网元可以自己生成随机数用于中的设备的 临时身份信息。或者，使用K鉴权服务器功能网元中的某些字段作为设备的临时身份信息，或者由K鉴权服务器功能网元进一步生成一个随机数，这个随机数的全部或部分作为终端设备的临时身份信息。或者，鉴权服务器功能网元可根据鉴权向量中的RAND值，生成终端设备的临时身份信息等，比如截取一部分RAND值，或者直接使用全部的RAND值。或者，鉴权服务器功能网元可向统一数据管理网元请求一个随机数，根据请求的随机数，确定UE的临时身份信息等。或者，鉴权服务器功能网元将上述请求的随机数传递给AKMA鉴权功能网元，然后由AKMA鉴权功能网元根据该随机数，确定终端设备的临时身份信息，然后再将上述终端设备的临时身份标识传递给鉴权服务器功能网元等。或者，鉴权服务器功能网元可根据终端设备的SUCI，确定终端设备的临时身份标识等。比如，可根据终端设备的SUCI中的加密字段，生成UE的临时身份信息等。或者，AKMA鉴权功能网元可根据终端设备的SUCI，确定终端设备的临时身份信息。比如，可根据终端设备的SUCI中的加密字段，生成UE的临时身份信息等然后AKMA鉴权功能网元将终端设备的临时身份标识，再传递给鉴权服务器功能网元等，不作限定。
示例的，终端设备的AKMA临时标识可采用以下中的一种或多种方式构成：
“ridxxxx.tid<value>@AAuF<Value>.mnc<MNC>.mnc<MCC>.3gppnetwork.org；或者，ridxxxx.tid<value>@AApF<Value>.AAuF<Value>.mnc<MNC>.mnc<MCC>.3gppnetwork.org,或者，
AApF<Value>.ridxxxx.tid<value>@AAuF<Value>.mnc<MNC>.mnc<MCC>.3gppnetwork.org
AAuF<Value>.ridxxx.tid<value>@mnc<MNC>.mnc<MCC>.3gppnetwork.org；或者，
AApF<Value>.AAuF<Value>.AAuF<Value>.ridxxx.tid<value>@mnc<MNC>.mnc<MCC>.3gppnetwork.org，或者
tid<value>@AAuF<Value>.ridxxx.mnc<MNC>.mnc<MCC>.3gppnetwork.org”
其中，rid全程是Routing ID，他是鉴权服务器功能网元的Routing ID，xxxx是4个10进制数字，代表确定鉴权服务器功能网元的路由信息,用于找到鉴权服务器功能网元使用。tid<value>代表为UE分配的临时身份，其中tid是temporary Identifier的缩写。AAuF<Value>代表为UE服务的AAuF的地址信息，该信息可以帮助UE或AKMA应用功能网元找到AAuF。可以是AAuF的ID信息，或者AAuF的路由信息等。mnc<MNC>.mnc<MCC>代表UE的家乡网络标识符。可选地，携带AApF<Value>，其代表UE需要接入的AApF的地址信息可以是AApF的ID信息，或者AApF的路由信息等。3gppnetwork.org代表接入的是3GPP网络。在AKMA临时标识符包含AApF和\或AAuF的值的情况下，AApF和AAuF的值可以是默认值，比如全部为0。也可以是非默认值。默认值代表可以任意使用一个AApF和\或AAuF。非默认值代表需要接入指定的AApF和\或AAuF。
在UE、AApF、AAuF使用AKMA临时标识符的时候，他们可以分别挑选AKMA临时标识符中的某些字段进行使用。比如，UE要查找某个AApF，则UE可以使用AApF<value>,或者使用AApF<value>.mnc<MNC>和mnc<MCC>.进而，UE可以构成AApF<value>@mnc<MNC>.mnc<MCC>.3gppnetwork.org的形式，作为查找、确定AApF的过程。同理当AApF需要查找、确定一个AAuF的时候，这个AApF可以只使用AAuF<value>,或者使用AAuF<value>.mnc<MNC>和mnc<MCC>.当AAuF确定鉴权服务器功能网元的时候，可以使用鉴权服务器功能网元的routing ID或者鉴权服务器功能网元的 routing ID和家乡网络标识符。因此，AKMA临时标识符可以因使用者的不同而发挥不同的作用。使用者可以根据AKMA临时标识符获得必要的信息，用于确定为UE服务的其他AKMA网元的信息。
需要说明的是，示例中的几种构成方法中并没有显示的说明这是一个AKMA的临时身份。如果需要显示说明，则需要再“@”符号前面或者后面加上指示这个临时标识符用于AKMA服务的指示信息。比如在“@”符号后面加字符串“AKMA”。因此，临时标识符的构成可以进一步为UE的临时身份信息，UE的家乡网络信息，鉴权服务器功能网元的地址信息和指示临时标识用于AKMA服务的指示信息。
在本申请实施例中，鉴权服务器功能网元可具体通过移动管理网元，将S306中确定的AKMA临时标识发送给终端设备。示例的，可参见下述S307至S309中的记载。
S307：鉴权服务器功能网元向移动管理网元发送第二响应消息，所述第二响应消息中可携带有AKMA临时标识。
可选的，所述第二响应消息中还可携带有鉴权结果，终端设备的SUPI等。也就是说，AKMA临时标识可以随着鉴权结果，终端设备的SUPI一起发送给移动管理网元，也可以单独发送给移动管理网元。比如，在注册流程中，如果发生了鉴权，那么AKMA临时标识符可以随着鉴权结果，终端设备的SUPI一起发送给移动管理网元。再比如，在PDU会话建立流程中，AKMA临时标识符是随着其他内容一起发送给服务网络的。
可选的，S308：移动管理网元和终端设备间进行非接入层安全模式控制(non-access stratum security mode control，NAS SMC)流程，激活NAS安全。需要说明的是，如果图3所示的流程是注册流程，则图3所示的流程中将包括S308。如果图3所示的流程是PDU会话建立流程，则图3所示的流程中可不包括S308。
S309：移动管理网元向终端设备发送经过NAS安全保护的第三响应消息，所述第三消息中携带有AKMA临时标识。可选的，第三响应消息可为终端设备的注册接受(registration accept)或终端设备的PDU会话建立完成消息等。可以理解的是，第三响应消息是经过NAS安全保护的。
S310：终端设备保存终AKMA临时标识。
通过上述方法，统一数据管理网元会确定终端设备是否支持AKMA服务。如果支持，则通知鉴权服务器功能网元或AKMA鉴权功能网元为终端设备分配临时标识。如果不支持，则不再为终端设备分配临时标识。相对于，鉴权服务器功能网元或者AKMA鉴权功能网元不考虑终端设备是否支持AKMA服务，始终给终端设备分配临时标识的方式，减少了流程开销。
需要说明的是，在本申请实施例中，在上述图3中的S306中，鉴权服务器功能网元确定终端设备的AKMA临时标识的实现过程可包括以下方式中的一种或多种：
第一种：鉴权服务器功能网元自己生成终端设备的AKMA临时标识。
第二种：鉴权服务器功能网元向第一AKMA鉴权功能网元发送请求消息，第一AKMA鉴权功能网元生成终端设备的AKMA临时标识。且第一AKMA鉴权功能网元将终端设备的AKMA临时标识发送给鉴权服务器功能网元。具体可参见下述图4中的记载。
第三种：鉴权服务器功能网元根据第二辅助信息，确定终端设备的AKMA临时标识。第二辅助信息可包括终端设备的切片选择(slice selection)信息，终端设备的会话和服务连续性(Session and Service Continuity，SSC)模式信息中的至少一个。在本申请实施例中， 对鉴权服务器功能网元确定第二辅助信息的方式，并不作限定。比如，在本申请实施例中，所述第二辅助信息可从移动管理网元处获取第二辅助信息，具体可参见下述图5中的记载。
参见图4所示，提供一种通信方法的流程，该流程中的终端设备可为图1架构中的终端设备，移动管理网元可为图1架构中的移动管理网元，鉴权服务器功能网元可为图1架构中的鉴权服务器功能网元，统一数据管理网元可为图1架构中的统一数据管理网元，该流程具体为：
S400-S405同图3实施例中S300-S305，相关步骤请参考图3实施例相关描述，这里不再赘述。
S406a：鉴权服务器功能网元向第一AKMA鉴权功能网元发送第四请求消息。所述第四请求消息用于请求第一AKMA鉴权功能网元为终端设备分配AKMA临时标识符。
其中，第一AKMA鉴权功能网元可为默认的AKMA鉴权功能网元，或者，第一AKMA鉴权功能网元可为鉴权服务器功能网元根据上述S404中携带的第一辅助信息，所选择的AKMA鉴权功能网元等，不作限定。可选的，第四请求消息中可携带终端设备的Kakma等信息。
可选的，在鉴权服务器功能网元无法确定合适的AKMA鉴权功能网元的情况下，第四请求消息携带第一辅助信息。鉴权服务器功能网元将第一辅助信息发给默认AKMA鉴权功能网元，由默认AKMA鉴权功能网元选择一个合适的AKMA鉴权功能网元，并将AKMA鉴权功能网元的地址信息返回给鉴权服务器功能网元。鉴权服务器功能网元再请求该合适的AKMA鉴权功能网元为终端设备分配AKMA临时标识。
S406b：第一AKMA鉴权功能网元确定终端设备的AKMA临时标识。可选的，第一AKMA鉴权功能网元还可保存AKMA临时标识、终端设备的标识与第一密钥之间的关联关系。第一密钥可隐式指示终端设备AKMA鉴权成功，所述第一密钥是主鉴权过程中的中间密钥。例如，第一密钥可为Kausf。所述终端设备的标识可为SUCI或SUPI等。
S406c：第一AKMA鉴权功能网元向鉴权服务器功能网元发送第四响应消息，第四响应消息中携带有AKMA临时标识。
S407-S410同图3实施例中S307-S310，相关步骤请参考图3实施例相关描述，这里不再赘述。
由于在现有技术中，由AKMA鉴权功能网元生成终端设备的AKMA临时标识。采用上述图4所示的方法，与现有技术有较好的兼容性。
参见图5所示，提供一种通信方法的流程，该流程中的终端设备可为图1架构中的终端设备，移动管理网元可为图1架构中的移动管理网元，鉴权服务器功能网元可为图1架构中的鉴权服务器功能网元，统一数据管理网元可为图1架构中的统一数据管理网元，该流程具体为：
S500：终端设备向移动管理网元发送第一请求消息。
S501：移动管理网元向鉴权服务器功能网元发送第二请求消息。
S502：鉴权服务器功能网元向统一数据管理网元发送第三请求消息。
S503：统一数据管理网元根据终端设备的签约信息，确定终端设备支持或不支持 AKMA服务。
S504：统一数据管理网元向鉴权服务器功能网元发送第一响应消息。
可选的，S505：终端设备和鉴权服务器功能网元间双向鉴权。
关于上述S500至S505的具体实现过程，可参见上述图3所示流程中S300至S305的记载，在此不再说明。
可选的，S506：鉴权服务器功能网元向移动管理网元发送第二响应消息，所述第二响应消息中可携带有第一指示，所述第一指示可指示终端设备支持AKMA服务。可选的，第二响应消息中还可携带有终端设备的SUPI和/或鉴权成功结果(例如，EAP success等)，第二响应消息还可称为Nauf-UT Authentication_Authenticate等。需要说明的是，如果图5所示的流程是鉴权的注册流程，则图5所示的流程中将包括S506。如果图5所示的流程是PDU会话建立流程，则图5所示的流程中可不包括S506。
可选的，S507：服务网络和终端设备间进行NAS SMC流程，激活NAS安全。
需要说明的是，如果图5所示的流程是鉴权的注册流程，则图5所示的流程中将包括S507。如果图5所示的流程是PDU会话建立流程，则图5所示的流程中可不包括S507。
S508：服务网络确定第二辅助信息。可选的，所述第二辅助信息可具体为移动管理网元确定的终端的位置管理相关信息，或者SMF确定的会话管理相关信息。比如，终端设备的切片选择(slice selection)信息，终端设备的会话和服务(Session and Service Continuity，SSC)模式信息。与第一辅助信息相区别的是，第一辅助信息属于UE的签约数据信息，或者需要统一数据管理网元存储的信息(比如位置信息)，而第二辅助信息是由移动管理网元和/或SMF确定的与UE当前在网络状态强相关的信息。可以理解为第二辅助信息比第一辅助信息更加准确。因此第二辅助信息可以为UE选择更合适的AKMA应用功能网元和/或AKMA鉴权功能网元。例如，第二辅助信息可以是注册流程中移动管理网元确定的终端设备允许使用的切片信息(Allowed S-NSSAI)。
S509：移动管理网元向鉴权服务器功能网元发送第四请求消息，所述第四请求消息中携带有第二辅助信息。可选的，第四请求消息可称为_UE_Authentication Request。
S510：鉴权服务器功能网元根据第二辅信息，确定终端设备的AKMA临时标识。
需要说明的是，在本申请实施例中，AKMA临时标识可以包括随机数、归属网络指示、路由标识和AKMA鉴权功能网元的地址，第二辅助信息用于确定合适的AKMA鉴权功能网元的地址，进而确定AKMA临时标识。
可选的，鉴权服务器功能网元可以结合第一辅助信息和第二辅助信息一起确定AKMA鉴权功能网元。
可选的，鉴权服务器功能网元将第一辅助信息和第二辅助信息发给默认AKMA鉴权功能网元，由默认AKMA鉴权功能网元为终端设备分配AKMA临时标识。或者，由默认AKMA鉴权功能网元选择一个合适的AKMA鉴权功能网元，并将该合适的AKMA鉴权功能网元的地址信息返回给鉴权服务器功能网元。鉴权服务器功能网元再将第一辅助信息和第二辅助信息发给该合适的AKMA鉴权功能网元，请求该合适的AKMA鉴权功能网元为终端设备分配AKMA临时标识。
可选的，鉴权服务器功能网元还可以只将第二辅助信息发给AKMA鉴权功能网元以请求AKMA鉴权功能网元为终端设备分配AKMA临时标识。
S511：鉴权服务器功能网元向移动管理网元发送第三响应消息，第三响应消息中携带 有终端设备的AKMA临时标识。可选的，第三响应消息可称为UE_Authentication Response。具体的消息名称因流程不同而不同。
S512：移动管理网元向终端设备发送第四响应消息，第四响应消息中携带有终端设备的AKMA临时标识。可选的，第四响应消息可称为注册接受(registration accept)。具体的消息名称因流程不同而不同。
S513：终端设备保存终端设备的AKMA临时标识。
示例的，通过上述记载可知，终端设备的AKMA临时标识中可包括AKMA鉴权功能网元的地址信息。在本申请实施例中，鉴权服务器功能网元可根据服务网络反馈的第二辅信息，选择合适的AKMA鉴权功能网元。比如，一场景中，AKMA鉴权功能网元可与切片相关。比如，一个AKMA鉴权功能网元可以服务至少1类切片、或者，一个AKMA鉴权功能网元可仅为一类切片服务。切片的类型可以按业务分类，比如可包括eMBB类切片、车联网切片、低时延切片等。在本申请实施例中，若第二辅助信息中包括切片类型信息，采用本申请实施例中的方法，可为终端设备选择与之切片类型相匹配的AKMA鉴权功能网元。
需要说明的是，在本申请实施例中，通过上述图3、图4和图5的方法，可为终端设备分配临时标识。在下述图6或图7中，将继续描述，终端设备如何根据AKMA临时标识，获取终端设备与AKMA应用功能网元间的通信密钥Kaf，以保护终端设备与AKMA应用功能网元间的通信。
如图6所示，提供一种通信方法的流程，该流程中的终端设备可为图1架构中的终端设备，AKMA应用功能网元可为图1架构中的AKMA应用功能网元，第一AKMA鉴权功能网元可为图1架构中的AKMA鉴权功能网元，鉴权服务器功能网元可为图1架构中的鉴权服务器功能网元，该流程包括：
S600：终端设备向AKMA应用功能网元发送第一请求消息，所述第一请求消息中携带有终端设备的AKMA临时标识。可选的，所述第一请求消息可称为request。
示例的，终端设备可通过用户面向AKMA应用功能网元发起接入请求。若终端设备的AKMA临时标识中包括AKMA应用功能网元的地址信息，则终端设备可根据AKMA应用功能网元的地址信息，确定要接入的AKMA应用功能网元。若终端设备的AKMA临时标识不包括AKMA应用功能网元的地址信息，或者，所携带的AKMA应用功能网元的地址信息为默认值，则终端设备可根据所使用的应用，任选择一个AKMA应用功能网元。
S601：AKMA应用功能网元向第一AKMA鉴权功能网元发送第二请求消息，所述第二请求消息中携带有AKMA临时标识和AKMA应用功能网元的标识的信息，所述第二请求消息用于请求所述终端设备与所述AKMA应用功能网元进行通信时使用的通信密钥。可选的，所述第二请求消息可称为应用请求(application request)。需要说明的是，上述通信密钥也可称为kaf密钥。在以下示例中，以kaf密钥为例进行说明。
在本申请实施例中，第一AKMA鉴权功能网元可为默认的，因此，AKMA应用功能网元可直接向默认的第一AKMA鉴权功能网元发送第二请求消息即可。或者，终端设备的AKMA临时标识中可包括第一AKMA鉴权功能网元的地址信息，AKMA应用功能网元可根据终端设备的AKMA临时标识，确定第一AKMA鉴权功能网元的地址信息。
可选的，S602：第一AKMA鉴权功能网元确定是否由第一AKMA鉴权功能网元为 AKMA应用功能网元提供服务。如果确定由第一AKMA鉴权功能网元为其提供服务，则执行下述S603的步骤。如果否，则需要进行AKMA鉴权功能网元重定向，关于如何进行AKMA鉴权功能网元重定向的过程，将在下述图7中详细介绍。
比如，第一AKMA鉴权功能网元可根据AKMA应用功能网元的标识信息，确定AKMA应用功能网元的位置信息。根据AKMA应用功能网元的位置信息，确定AKMA应用功能网元是否在第一AKMA鉴权功能网元的服务范围内。如果在第一AKMA鉴权功能网元的服务范围内，则认为第一AKMA鉴权功能网元可为AKMA应用功能网元提供服务，否则，认为第一AKMA鉴权功能网元不可为AKMA应用功能网元提供服务。
需要说明的是，此步是可选步骤。可选的原因是要根据AKMA鉴权功能网元的部署场景不同而不同。如果AKMA鉴权功能网元与鉴权服务器功能网元、统一数据管理网元部署位置一样，即一个运营商网络内只有一个或者有限的几个，那么AKMA鉴权功能网元可能就是根据网管配置而默认选择的。如果AKMA鉴权功能网元与移动管理网元、SMF部署位置一样，即一个运营商网络内有很多，比如每个省份一个，那么AKMA鉴权功能网元可能就是以相近的移动管理网元、SMF为默认，或者AKMA鉴权功能网元要根据UE的位置、签约等内容确定是否可以为其服务。如果AKMA鉴权功能网元的部署位置与基站一样，或者与MEC服务器一样，则一个网络内AKMA鉴权功能网元有众多，那么选择合适的AKMA鉴权功能网元就是必须按步骤。AKMA应用功能网元的选择与上述AKMA鉴权功能网元的选择同理。
需要说明的是，如果第一AKMA鉴权功能网元当前已获取终端设备的Kakma密钥，则第一AKMA鉴权功能网元可直接执行下述S606的步骤。如果第一AKMA鉴权功能网元当前未获取终端设备的Kakma密钥，则第一AKMA鉴权功能网元与鉴权服务器功能网元间可执行下述S603至S606的步骤。
可选的，S603：第一AKMA鉴权功能网元向鉴权服务器功能网元发送第三请求消息，所述第三请求消息中携带有AKMA临时标识。可选的，第三请求消息中还可携带有第一AKMA鉴权功能网元的标识，第三请求消息还可称为AKMA Key request等。
可选的，S604：鉴权服务器功能网元根据终端设备的AKMA临时标识，确定终端设备的AKMA服务的密钥Kakma。具体的，鉴权服务器功能网元可根据AKMA临时标识，获取第一密钥，所述第一密钥是主鉴权过程中的中间密钥。比如，第一密钥可为Kausf。鉴权服务器功能网元可根据第一密钥，生成AKMA服务的密钥Kakma。比如，在本申请实施例中，在AKMA鉴权阶段中，在终端设备的鉴权在功后，鉴权服务器功能网元中可保存有AKMA临时标识、第一密钥和终端设备的标识之间的对应关系。鉴权服务器功能网元可根据所述AKMA临时标识和所述对应关系，获取第一密钥等。示例的，在上述AKMA临时标识、第一密钥和终端设备的标识的对应关系中，所述终端设备的标识可具体为SUCI或SUPI等，不作限定。
可选的，S605：鉴权服务器功能网元向第一AKMA鉴权功能网元发送第一响应消息，所述第一响应消息中携带有Kakma密钥。可选的，第一响应消息还可称为鉴权响应(authentication response)等。
S606：第一AKMA鉴权功能网元根据Kakma密钥，确定终端设备与AKMA应用功能网元的通信密钥。为了便于描述，在以下示例中，将上述通信密钥，表示为Kaf密钥。
可选的，第一AKMA鉴权功能网元根据Kakma密钥和AKMA应用功能网元的标识， 确定终端设备与AKMA应用功能网元的通信密钥。第一AKMA鉴权功能网元可以为不同的AKMA应用功能网元生成不一样的通信密钥。
S607：第一AKMA鉴权功能网元向AKMA应用功能网元发送第二响应消息，所述第二响应消息中携带有Kaf密钥。
可选的，在上述S606之前，还可包括：AKMA应用功能网元向第一AKMA鉴权功能网元发送请求消息，所述请求消息用于请求终端设备与AKMA应用服务网元之间的通信密钥，即Kaf。
S608：AKMA应用功能网元向终端设备发送第三响应消息。可选的，所述第三响应消息中可携带有AKMA应用功能网元的标识。可选的，所述第三响应消息可为成功(success)消息。
S609：终端设备根据Kakma密钥，确定Kaf密钥。
可选的，终端设备根据AKMA应用功能网元的标识和Kakma密钥，确定Kaf密钥。
S610：终端设备和AKMA应用功能网元基于Kaf密钥的保护进行通信。比如，终端设备向AKMA应用功能网元发送第一消息时，可采用Kaf密钥对第一消息进行加密。同理，AKMA应用功能网元向终端设备发送第二消息时，可采用Kaf密钥对第二消息进行加密等。
参见图7所示，提供一种通信方法的流程，该流程中的终端设备可为图1架构中的终端设备，AKMA应用功能网元可为图1架构中的AKMA应用功能网元，第一AKMA鉴权功能网元和第二AKMA鉴权功能网元可为图1架构中的AKMA鉴权功能网元，鉴权服务器功能网元可为图1架构中的鉴权服务器功能网元，该流程包括：
S700：终端设备向AKMA应用功能网元发送第一请求消息。
S701：AKMA应用功能网元向第一AKMA鉴权功能网元发送第二请求消息。
S702：第一AKMA鉴权功能网元确定是否由第一AKMA鉴权功能网元为AKMA应用功能网元提供服务。比如，AKMA鉴权功能网元可以根据预配置的列表，或者根据AKMA应用功能网元的标识查找确定是否满足特定的预设条件，比如AKMA鉴权功能网元向鉴权服务器功能网元、NRF、网管系统确定是否可以为AKMA应用功能网元提供服务。如果否，则执行S311。如果是，则按图6所示的方法执行。
关于S700至S702中的具体实现过程，可参见上述图6中S600至S602中的记载，在此不再说明。
S711：第一AKMA鉴权功能网元向AKMA应用功能网元发送重定位消息，所述重定位消息中携带有第二AKMA鉴权功能网元的地址信息。所述重定位还可称为重定向，无此特殊说明，在本申请实施例中，重定位与重定向不作区分。
示例的，第一AKMA鉴权功能网元可根据第二请求消息中携带的AKMA应用功能网元的标识，选择合适的AKMA鉴权功能网元，所述合适的AKMA鉴权功能网元即为第二AKMA鉴权功能网元。比如，第二AKMA鉴权功能网元可根据预配置的列表、或者向其它网元或网管系统请求等方法，获取第二AKMA鉴权功能网元的地址信息。具体的，第一AKMA鉴权功能网元可将AKMA应用功能网元的标识发送给统一数据管理网元，以获取终端设备的位置信息。第一AKMA鉴权功能网元通过终端设备的位置信息，确定第二AKMA鉴权功能网元的地址信息等。
S712：AKMA应用功能网元根据第二AKMA鉴权功能网元的地址信息，向第二AKMA 鉴权功能网元发送第三请求消息，所述第三请求消息中携带有终端设备的AKMA临时标识。可选的，第三请求信息中携带的终端设备的AKMA临时标识可为通过上述图3、图4或图5所式的方式为终端设备分配的AKMA临时标识，或者，所述第三请求信息中携带的终端设备的AKMA临时标识可为第一AKMA鉴权功能网元更新后的AKMA临时标识，或者，AKMA鉴权服务器功能网元更新后的AKMA临时标识，不作限定。可选的，第三请求消息中还包括AKMA应用功能网元的标识，所述第三请求消息还可称为应用请求(application request)。若第三请求消息携带有通过上述图3、图4或图5所式的方式为终端设备分配的AKMA临时标识和第二AKMA鉴权功能网元的地址信息。当第二AKMA鉴权功能网元看到自己的地址信息并且与原始的AKMA临时标识的时候，确定这个是一个被重定向的消息，因此第二AKMA鉴权功能网元就不需要再次确定是否可以为这个AKMA应用功能网元服务了。
S713：第二AKMA鉴权功能网元根据AKMA临时标识，确定鉴权服务器功能网元的地址信息。
S714：第二AKMA鉴权功能网元向鉴权服务器功能网元发送第四请求消息，所述第四请求消息用于请求终端设备对应的AKMA服务的密钥Kakma，所述第四请求消息中包括AKMA临时标识。可选的，所述第四请求消息中还可包括第二AKMA鉴权功能网元的标识，第四请求消息还可称为AKMA key request。
S715：鉴权服务器功能网元根据终端设备的标识，确定终端设备的AKMA服务的密钥Kakma。比如，在本申请实施例中，鉴权服务器功能网元可根据所述AKMA临时标识，获取第一密钥，所述第一密钥是所述主鉴权过程中的中间密钥；所述鉴权服务器功能网元根据所述第一密钥，生成所述AKMA服务的密钥Kakma；所述鉴权服务器功能网元向所述AKMA鉴权功能网元发送所述Kakma。示例的，在所述终端设备的主鉴权成功后，所述鉴权服务器功能网元保存所述AKMA临时标识、所述终端设备的标识与所述第一密钥的对应关系；述鉴权服务器功能网元根据所述AKMA临时标识和所述对应关系，获取第一密钥。比如，第一密钥可为Kausf等。
S716：鉴权服务器功能网元向第二AKMA鉴权功能网元发送第一回复消息，所述第一回复消息中携带有所述Kakma。
针对终端设备包括AKMA鉴权功能网元地址信息的情况，鉴权服务器功能网元可根据第二AKMA鉴权功能网元的地址，更新终端设备的AKMA临时标识。因为终端设备根据原来的临时标识，仅能寻址到第一AKMA鉴权功能网元。再将终端设备的AKMA临时标识更新为第二AKMA鉴权功能网元后，终端设备根据更新后的临时标识，可直接寻址到第二AKMA鉴权功能网元。可选的，第一回复消息中还可包括更新后终端设备的AKMA临时标识。或者，上述过程可描述为：在所述AKMA临时标识中包括AKMA鉴权功能网元的地址信息时，所述鉴权服务器功能网元将所述AKMA临时标识中的AKMA鉴权功能网元的地址信息由第一地址信息，更新为第二地址信息，所述第一地址信息为第一AKMA鉴权功能网元的地址信息，所述第二地址信息为第二AKMA鉴权功能网元的地址信息。
S717：第二AKMA鉴权功能网元根据Kakma密钥，生成终端设备与所述AKMA应用功能网元进行通信时使用的通信密钥，所述通信密钥还可称为Kaf。为了方便于说明，在本申请实施例中，可以Kaf密钥为例进行说明。
S718：第二AKMA鉴权功能网元向AKMA应用功能网元发送第二回复消息，所述第 二回复消息中携带有Kaf密钥。可选的，第二回复消息中还包括Kaf密钥的有效时长(validity time)，第二回复消息还可称为应用回复(application response)等。
可选的，在上述717之前，还可包括：AKMA应用功能网元向第一AKMA鉴权功能网元发送请求消息，所述请求消息用于请求终端设备与AKMA应用服务网元之间的通信密钥，即Kaf。
S719：AKMA应用功能网元向终端设备发送第三回复消息。可选的，第三回复消息还可称为success消息。
S720：终端设备根据Kakma密钥，确定Kaf密钥。
S721：终端设备和AKMA应用功能网元基于Kaf密钥的保护进行通信。
需要说明的是，在本申请实施例中，针对重定向的过程，若AKMA的临时标识中包括AKMA鉴权功能网元的地址信息，则AUSF还可将AKMA临时标识中的第一地址信息，更新为第二地址信息，所述第一地址信息为第一AKMA鉴权功能网元的地址信息，所述第二地址信息为第二AKMA鉴权功能网元的地址信息。
上述本申请提供的实施例中，分别从核心网网元、终端、以及核心网网元和终端之间交互的角度对本申请实施例提供的方法进行了介绍。为了实现上述本申请实施例提供的方法中的各功能，核心网网元和终端设备可以包括硬件结构和/或软件模块，以硬件结构、软件模块、或硬件结构加软件模块的形式来实现上述各功能。上述各功能中的某个功能以硬件结构、软件模块、还是硬件结构加软件模块的方式来执行，取决于技术方案的特定应用和设计约束条件。
基于与方法实施例同一发明构思，本申请实施例还提供一种装置800，用于执行上述图3至图7所示的方法实施例中终端设备执行的方法，相关特征可参见上述方法实施例，在此不再赘述。作为一种示例，如图8所示，所述装置800包括收发模块801和处理模块802。
收发模块801，用于向移动管理网元发送注册请求消息，以及在通过主鉴权流程鉴权成功，且激活非接入层NAS安全保护后，接收所述移动管理网元发送的经过NAS安全保护的注册响应，所述注册响应包括所述终端设备的应用程序的身份验证和密钥管理AKMA临时标识。处理模块802，用于保存所述AKMA临时标识。
关于收发模块801和处理模块802的具体功能，可参见上述方法实施例中的记载，在此不再说明。
基于与方法实施例同一发明构思，本申请实施例还提供一种装置900，用于执行上述图3至图7所示的方法实施例中鉴权服务器功能网元执行的方法，相关特征可参见上述方法实施例，在此不再赘述。作为一种示例，如图9所示，所述装置900包括收发模块901和处理模块902。
收发模块901，用于在终端设备的注册流程中，接收统一数据管理网元发送的第一指示信息，所述第一指示信息用于指示所述终端设备支持应用程序的身份验证和密钥管理AKMA服务；
处理模块902，用于在所述终端设备的主鉴权成功后，所述鉴权服务器功能网元确定所述终端设备的AKMA临时标识；
收发模块901，还用于通过移动管理网元向所述终端设备发送所述AKMA临时标识。
关于收发模块901和处理模块902的具体功能，可参见上述方法实施例中的记载，在 此不再说明。
基于与方法实施例同一发明构思，本申请实施例还提供一种装置1000，用于执行上述图3至图7所示的方法实施例中鉴权服务器功能网元执行的方法，相关特征可参见上述方法实施例，在此不再赘述。作为一种示例，如图10所示，所述装置1000包括收发模块1001和处理模块1002。
收发模块1001，用于在终端设备的注册流程中，接收鉴权服务器功能网元发送的第三请求消息，所述第三请求消息中包括终端设备的标识；
处理模块1002，用于根据所述终端设备的签约数据，确定所述终端设备支持应用程序的身份验证和密钥管理AKMA服务；
收发模块1001，还用于向鉴权服务器功能网元发送第三响应消息，所述第三响应消息中包括第一指示信息，所述第一指示信息表示所述终端设备支持所述AKMA服务。
收发模块1001和处理模块1002的具体功能，可参见上述方法实施例中的记载，在此不再说明。
基于与方法实施例同一发明构思，本申请实施例还提供一种装置1100，用于执行上述图3至图7所示的方法实施例中鉴权服务器功能网元执行的方法，相关特征可参见上述方法实施例，在此不再赘述。作为一种示例，如图11所示，所述装置1100包括收发模块1101和处理模块1102。
收发模块1101，用于在终端设备的注册流程中，接收鉴权服务器功能网元发送的第四请求消息，所述第四请求消息用于请求所述终端设备的AKMA临时标识；
处理模块1102，用于生成所述AKMA临时标识；
收发模块1101，还用于向鉴权服务器功能网元发送第四响应消息，所述第四响应消息中携带有所述AKMA临时标识。
关于收发模块1101和处理模块1102的具体功能，可参见上述方法实施例中的记载，在此不再说明。本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，另外，在本申请各个实施例中的各功能单元可以集成在一个处理器中，也可以是单独物理存在，也可以两个或两个以上单元集成在一个模块中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
该集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台终端设备(可以是个人计算机，手机，或者网络设备等)或处理器(processor)执行本申请各个实施例该方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
在本申请实施例中，终端设备、鉴权服务器功能网元、统一数据管理网元和AKMA鉴权功能网元均可以采用集成的方式划分各个功能模块的形式来呈现。这里的“模块”可以指特定ASIC，电路，执行一个或多个软件或固件程序的处理器和存储器，集成逻辑电路，和/或其他可以提供上述功能的器件。
在一个简单无实施例中，如图12所示的通信装置1200，包括至少一个处理器1201、 存储器1202，可选的，还可包括通信接口1203。
存储器1202可以是易失性存储器，例如随机存取存储器；存储器也可以是非易失性存储器，例如只读存储器，快闪存储器，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)、或者存储器1202是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器1202可以是上述存储器的组合。
本申请实施例中不限定上述处理器1201以及存储器1202之间的具体连接介质。本申请实施例在图中以存储器1202和处理器1201之间通过总线1204连接，总线1204在图中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。该总线1204可以分为地址总线、数据总线、控制总线等。为便于表示，图12中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
处理器1201可以具有数据收发功能，能够与其他设备进行通信，在如图12装置中，也可以设置独立的数据收发模块，例如通信接口1203，用于收发数据；处理器1201在与其他设备进行通信时，可以通过通信接口1203进行数据传输。
一种示例中，当所述终端设备采用图12所示的形式时，图12中的处理器可以通过调用存储器1202中存储的计算机执行指令，使得所述终端设备执行上述任一方法实施例中的所述终端设备执行的方法。
具体的，图8的处理模块和收发模块的功能/实现过程均可以通过图12中的处理器1201调用存储器1202中存储的计算机执行指令来实现。或者，图8的处理模块的功能/实现过程可以通过图12中的处理器1201调用存储器1202中存储的计算机执行指令来实现，图8的收发模块的功能/实现过程可以通过图12中的通信接口1203来实现。
另一种示例中，当所述鉴权服务器功能网元采用图12所示的形式时，图12中的处理器可以调用存储器1202中存储的计算机执行指令，使得所述鉴权服务器功能执行上述任一方法实施例中的所述鉴权服务器功能执行的方法。
具体的，图9的处理模块和收发模块的功能/实现过程均可以通过图12中的处理器1201调用存储器1202中存储的计算机执行指令来实现。或者，图9的处理模块的功能/实现过程可以通过图12中的处理器1201调用存储器1202中存储的计算机执行指令来实现，图9的收发模块的功能/实现过程可以通过图12中的通信接口1203来实现。
另一种示例中，当所述统一数据管理网元采用图12所示的形式时，图12中的处理器可以通过调用存储器1202中存储的计算机执行指令，使得所述统一数据管理网元执行上述任一方法实施例中的所述统一数据管理网元执行的方法。
具体的，图10的处理模块和收发模块的功能/实现过程均可以通过图12中的处理器1201调用存储器1202中存储的计算机执行指令来实现。或者，图10的处理模块的功能/实现过程可以通过图12中的处理器1201调用存储器1202中存储的计算机执行指令来实现，图10的收发模块的功能/实现可以通过图12中的通信接口1203来实现。
另一种示例中，当所述AKMA鉴权功能网元采用图12所示的形式时，图12中的处理器可以调用存储器1202中存储的计算机执行指令，使得AKMA鉴权功能网元执行上述任一方法实施例中的所述AKMA鉴权功能网元执行的方法。
具体的，图11的处理模块和收发模块的功能/实现过程均可以通过图12中的处理器1201调用存储器1202中存储的计算机执行指令来实现。或者，图11的处理模块的功能/ 实现过程可以通过图11中的处理器1201调用存储器1202中存储的计算机执行指令来实现，图11的收发模块的功能/实现可以通过图12中的通信接口1203来实现。
本申请实施例还提供一种通信系统，该通信系统可包括AKMA鉴权功能网元、统一数据管理网元、鉴权服务器功能网元或AKMA应用功能网元中的至少一个。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (58)

  1. 一种通信方法，其特征在于，包括：
    终端设备向移动管理网元发送注册请求消息；
    所述终端设备在通过主鉴权流程鉴权成功，且激活非接入层NAS安全保护后，接收所述移动管理网元发送的经过NAS安全保护的注册响应，所述注册响应包括所述终端设备的应用程序的身份验证和密钥管理AKMA临时标识；
    所述终端设备保存所述AKMA临时标识。
  2. 如权利要求1所述的方法，其特征在于，所述AKMA临时标识包括随机数、归属网络指示和路由标识；其中，所述随机数是网络设备分配的，用于标识所述终端设备的参数；所述归属网络指示用于指示所述终端设备的归属网络；所述路由标识用于确定生成所述AKMA服务的密钥Kakma的网络功能实体。
  3. 如权利要求2所述的方法，其特征在于，所述AKMA临时标识还包括AKMA鉴权功能网元的地址信息或AKMA应用功能网元的地址信息中的至少一个。
  4. 如权利要求2或3所述的方法，其特征在于，所述生成所述AKMA服务的密钥Kakma的网络功能实体为鉴权服务器功能网元。
  5. 一种通信方法，其特征在于，包括：
    在终端设备的注册流程中，鉴权服务器功能网元接收统一数据管理网元发送的第一指示信息，所述第一指示信息用于指示所述终端设备支持应用程序的身份验证和密钥管理AKMA服务；
    在所述终端设备的主鉴权成功后，所述鉴权服务器功能网元确定所述终端设备的AKMA临时标识；
    所述鉴权服务器功能网元通过移动管理网元向所述终端设备发送所述AKMA临时标识。
  6. 如权利要求5所述的方法，其特征在于，所述AKMA临时标识包括随机数、归属网络指示和路由标识；所述随机数是网络设备分配的，用于标识所述终端设备的参数；所述归属网络指示用于指示所述终端设备的归属网络；所述路由标识为用于确定生成所述AKMA服务的密钥Kakma的网络功能实体。
  7. 如权利要求6所述的方法，其特征在于，所述AKMA临时标识还包括AKMA鉴权功能网元的地址信息或AKMA应用功能网元的地址信息中的至少一个。
  8. 如权利要求5至7任一项所述的方法，其特征在于，所述鉴权服务器功能网元确定所述AKMA临时标识，包括：
    所述鉴权服务器功能网元自己生成所述AKMA临时标识。
  9. 如权利要求5至7任一项所述的方法，其特征在于，所述鉴权服务器功能网元确定所述AKMA临时标识，包括：
    所述鉴权服务器功能网元向AKMA鉴权功能网元发送第一请求消息，所述第一请求消息用于请求所述AKMA鉴权功能网元生成所述AKMA临时标识；
    所述鉴权服务器功能网元接收所述AKMA鉴权功能网元发送的第一响应消息，所述第一响应消息中携带有所述AKMA临时标识。
  10. 如权利要求5至7任一项所述的方法，其特征在于，所述鉴权服务器功能网元确定所述AKMA临时标识，包括：
    所述鉴权服务器功能网元根据第一辅助信息，确定所述AKMA临时标识；其中，所述第一辅助信息包括所述终端设备的切片信息、所述终端设备的数据网络名称信息或所述终端设备的业务或会话连续性模式信息中的至少一个。
  11. 如权利要求10所述的方法，其特征在于，还包括：
    所述鉴权服务器功能网元向所述移动管理网元发送第二请求消息，所述第二请求消息中携带有所述第一指示信息；
    所述鉴权服务器功能网元接收所述移动管理网元发送的第二响应消息，所述第二响应消息中携带有所述第一辅助信息。
  12. 如权利要求5至11任一项所述的方法，其特征在于，还包括:
    所述鉴权服务器功能网元接收所述AKMA鉴权功能网元发送的第三请求消息，所述第三请求消息中携带有所述AKMA临时标识；
    所述鉴权服务器功能网元根据所述AKMA临时标识，获取第一密钥，所述第一密钥是所述主鉴权过程中的中间密钥；
    所述鉴权服务器功能网元根据所述第一密钥，生成所述AKMA服务的密钥Kakma；
    所述鉴权服务器功能网元向所述AKMA鉴权功能网元发送所述Kakma。
  13. 如权利要求12所述的方法，其特征在于，所述方法还包括：
    在所述终端设备的主鉴权成功后，所述鉴权服务器功能网元保存所述AKMA临时标识、所述终端设备的标识与所述第一密钥的对应关系；
    所述鉴权服务器功能网元根据所述AKMA临时标识，获取第一密钥，包括：
    所述鉴权服务器功能网元根据所述AKMA临时标识和所述对应关系，获取第一密钥。
  14. 如权利要求12或13所述的方法，其特征在于，所述第一密钥为Kausf。
  15. 如权利要求5至14任一项所述的方法，其特征在于，在所述AKMA临时标识中包括AKMA鉴权功能网元的地址信息时，所述方法还包括：
    所述鉴权服务器功能网元将所述AKMA临时标识中的AKMA鉴权功能网元的地址信息由第一地址信息，更新为第二地址信息，所述第一地址信息为第一AKMA鉴权功能网元的地址信息，所述第二地址信息为第二AKMA鉴权功能网元的地址信息。
  16. 一种通信方法，其特征在于，包括：
    在终端设备的注册流程中，统一数据管理网元接收鉴权服务器功能网元发送的第三请求消息，所述第三请求消息中包括终端设备的标识；
    所述统一数据管理网元根据所述终端设备的签约数据，确定所述终端设备支持应用程序的身份验证和密钥管理AKMA服务；
    所述统一数据管理网元向鉴权服务器功能网元发送第三响应消息，所述第三响应消息中包括第一指示信息，所述第一指示信息表示所述终端设备支持所述AKMA服务。
  17. 如权利要求16所述的方法，其特征在于，所述第三请求消息为用于获取鉴权向量的UDM服务化请求消息，所述第三响应消息为用于获取鉴权向量的UDM服务化的响应消息。
  18. 一种通信方法，其特征在于，包括：
    在终端设备的注册流程中，第一应用程序的身份验证和密钥管理AKMA鉴权功能网元接收鉴权服务器功能网元发送的第四请求消息，所述第四请求消息用于请求所述终端设备的AKMA临时标识；
    所述第一AKMA鉴权功能网元生成所述AKMA临时标识；
    所述第一AKMA鉴权功能网元向鉴权服务器功能网元发送第四响应消息，所述第四响应消息中携带有所述AKMA临时标识。
  19. 如权利要求18所述的方法，其特征在于，还包括：
    所述第一AKMA鉴权功能网元接收AKMA应用功能网元发送的第五请求消息，所述第五请求消息用于请求所述终端设备与所述AKMA应用功能网元进行通信时使用的通信密钥；
    在所述第一AKMA鉴权功能网元能够为所述AKMA应用功能网元提供服务的情况下，所述第一AKMA鉴权功能网元从鉴权服务器功能网元获取与所述AKMA临时标识对应的AKMA服务的密钥Kakma；
    所述第一AKMA鉴权功能网元根据所述Kakma，生成所述通信密钥；
    所述第一AKMA鉴权功能网元将所述通信密钥发送给所述AKMA应用功能网元。
  20. 如权利要求18或19所述的方法，其特征在于，还包括：
    在所述第一AKMA鉴权功能网元不能够为所述AKMA应用功能网元提供服务的情况下，所述第一AKMA鉴权功能网元确定第二AKMA鉴权功能网元；
    所述第一AKMA鉴权功能网元向所述AKMA应用功能网元发送第四响应消息，所述第四响应消息用于指示所述AKMA应用功能网元向所述第二AKMA鉴权功能网元获取通信密钥；其中，所述第四响应消息中携带有所述第二AKMA鉴权功能网元的地址信息。
  21. 一种通信系统，其特征在于，包括：鉴权服务器功能网元和统一数据管理网元；
    鉴权服务器功能网元，用于在终端设备的注册流程中，向统一数据管理网元发送第一请求消息，所述第一请求消息中包括终端设备的标识；
    所述统一数据管理网元，用于根据所述终端设备的签约数据，确定所述终端设备支持应用程序的身份验证和密钥管理AKMA服务，以及，向所述鉴权服务器功能网元发送第一响应消息；其中，所述第一响应消息中包括第一指示信息，所述第一指示信息用于表示所述终端设备支持所述AKMA服务；
    所述鉴权服务器功能网元，还用于在所述终端设备的主鉴权成功后，确定所述终端设备的AKMA临时标识，以及，通过移动管理网元向所述终端设备发送所述AKMA临时标识。
  22. 如权利要求21所述的系统，其特征在于，所述AKMA临时标识包括随机数、归属网络指示和路由标识；所述随机数是网络设备分配的，用于标识所述终端设备的参数；所述归属网络指示用于指示所述终端设备的归属网络；所述路由标识为用于确定生成所述AKMA服务的密钥Kakma的网络功能实体。
  23. 如权利要求22所述的系统，其特征在于，所述AKMA临时标识还包括AKMA鉴权功能网元的地址信息或AKMA应用功能网元的地址信息中的至少一个。
  24. 如权利要求21至23任一项所述的系统，其特征在于，所述鉴权服务器功能网元在确定所述终端设备的AKMA临时标识时，具体用于：
    所述鉴权服务器功能网元自己生成所述AKMA临时标识。
  25. 如权利要求21至23任一项所述的系统，其特征在于，所述通信系统还包括第一AKMA鉴权功能网元，所述鉴权服务器功能网元在确定所述终端设备的AKMA临时标识时，具体用于：
    所述鉴权服务器功能网元，用于向所述第一AKMA鉴权功能网元发送第二请求消息，所述第二请求消息用于请求所述第一AKMA鉴权功能网元生成所述AKMA临时标识；
    所述第一AKMA鉴权功能网元，用于确定所述AKMA临时标识，以及向所述鉴权服务器功能网元发送第二响应消息，所述第二响应消息中携带有所述AKMA临时标识。
  26. 如权利要求21至23任一项所述的系统，其特征在于，所述鉴权服务器功能网元在确定所述终端设备的AKMA临时标识时，具体用于：
    所述鉴权服务器功能网元根据第一辅助信息，确定所述AKMA临时标识；其中，所述第一辅助信息包括所述终端设备的切片信息、所述终端设备的数据网络名称信息或所述终端设备的业务或会话连续性模式信息中的至少一个。
  27. 如权利要求26所述的系统，其特征在于，所述系统还包括移动管理网元，
    所述鉴权服务器功能网元，还用于向所述移动管理网元发送第三请求消息，所述第三请求消息中携带有所述第一指示信息；
    所述移动管理网元，用于获取所述第一辅助信息，且向所述鉴权服务器功能网元发送第三响应消息，所述第三响应消息中携带有所述第一辅助信息。
  28. 如权利要求27所述的系统，其特征在于，所述第三请求消息为用于获取鉴权向量的统一数据管理UDM服务化请求消息，所述第三响应消息为用于获取鉴权向量的UDM服务化的响应消息。
  29. 如权利要求21至28任一项所述的系统，其特征在于，所述通信系统还包括AKMA应用功能网元和第一AKMA鉴权功能网元，所述方法还包括：
    所述AKMA应用功能网元，用于向所述第一AKMA鉴权功能网元发送第四请求消息，所述第四请求消息中携带有所述AKMA临时标识；
    所述第一AKMA鉴权功能网元，用于在所述第一AKMA鉴权功能网元能够为所述AKMA应用功能网元提供服务的情况下，从所述鉴权服务器功能网元获取与所述AKMA临时标识对应的AKMA服务的密钥Kakma；根据所述Kakma，生成所述通信密钥；以及，将所述通信密钥发送给所述AKMA应用功能网元。
  30. 如权利要求29所述的系统，其特征在于，所述第一AMKA鉴权功能网元在从所述AKMA应用功能网元获取与所述AKMA临时标识对应的AKMA服务的密钥Kakma时，具体用于：
    所述第一AKMA鉴权功能网元，用于向所述鉴权服务器功能网元发送第五请求消息，所述第五请求消息中携带有所述AKMA临时标识；
    所述鉴权服务器功能网元，用于根据所述AKMA临时标识，获取第一密钥，所述第一密钥是主鉴权过程中的中间密钥；根据所述第一密钥，生成所述AKMA服务的密钥Kakma，且向所述第一AKMA鉴权功能网元发送所述Kakma。
  31. 如权利要求29所述的系统，其特征在于，
    所述第一AKMA鉴权功能网元，还用于在所述第一AKMA鉴权功能网元不能够为所述AKMA应用功能网元提供服务的情况下，确定所述第二AKMA鉴权功能网元的地址信息；
    所述第一AKMA鉴权功能网元，还用于向所述AKMA应用功能网元发送重定位消息，所述重定位消息中包括所述第二AKMA鉴权功能网元的地址信息。
  32. 如权利要求31所述的系统，其特征在于，
    所述AKMA应用功能网元，还用于向所述第二AKMA鉴权功能网元发送第六请求消息，所述第六请求消息中包括所述AKMA临时标识；
    所述第二AKMA鉴权网，还用于从所述鉴权服务器功能网元获取与所述AKMA临时标识对应的AKMA服务的密钥Kakma；根据所述Kakma，生成所述通信密钥；以及，将所述通信密钥发送给所述AKMA应用功能网元。
  33. 如权利要求30或32所述的系统，其特征在于，
    所述鉴权服务器功能网元，还用于在所述终端设备的主鉴权成功后，保存所述AKMA临时标识、所述终端设备的标识与所述第一密钥的对应关系；
    所述鉴权服务器功能网元在根据所述AKMA临时标识，获取第一密钥时，具体用于：
    所述鉴权服务器功能网元根据所述AKMA临时标识和所述对应关系，获取所述第一密钥。
  34. 如权利要求30、32或33所述的系统，其特征在于，所述第一密钥为kausf。
  35. 如权利要求21至34任一项所述的系统，其特征在于，
    所述鉴权服务器功能网元，在所述AKMA临时标识中包括AKMA鉴权功能网元的地址信息时，将所述AKMA临时标识中的AKMA鉴权功能网元的地址信息由第一地址信息，更新为第二地址信息，所述第一地址信息为所述第一AKMA鉴权功能网元的地址信息，所述第二地址信息为所述第二AKMA鉴权功能网元的地址信息。
  36. 一种通信装置，其特征在于，包括：
    收发模块，用于向移动管理网元发送注册请求消息；
    收发模块，用于在通过主鉴权流程鉴权成功，且激活非接入层NAS安全保护后，接收所述移动管理网元发送的经过NAS安全保护的注册响应，所述注册响应包括所述终端设备的应用程序的身份验证和密钥管理AKMA临时标识；
    处理模块，用于保存所述AKMA临时标识。
  37. 如权利要求36所述的装置，其特征在于，所述AKMA临时标识包括随机数、归属网络指示和路由标识；其中，所述随机数是网络设备分配的，用于标识所述终端设备的参数；所述归属网络指示用于指示所述终端设备的归属网络；所述路由标识用于确定生成所述AKMA服务的密钥Kakma的网络功能实体。
  38. 如权利要求37所述的装置，其特征在于，所述AKMA临时标识还包括AKMA鉴权功能网元的地址信息或AKMA应用功能网元的地址信息中的至少一个。
  39. 如权利要求37或38所述的装置，其特征在于，所述生成所述AKMA服务的密钥Kakma的网络功能实体为鉴权服务器功能网元。
  40. 一种通信装置，其特征在于，包括：
    收发模块，用于在终端设备的注册流程中接收统一数据管理网元发送的第一指示信息，所述第一指示信息用于指示所述终端设备支持应用程序的身份验证和密钥管理AKMA服务；
    处理模块，用于在所述终端设备的主鉴权成功后，确定所述终端设备的AKMA临时标识；
    所述收发模块，还用于通过移动管理网元向所述终端设备发送所述AKMA临时标识。
  41. 如权利要求40所述的装置，其特征在于，所述AKMA临时标识包括随机数、归属网络指示和路由标识；所述随机数是网络设备分配的，用于标识所述终端设备的参数；所述归属网络指示用于指示所述终端设备的归属网络；所述路由标识为用于确定生成所述AKMA服务的密钥Kakma的网络功能实体。
  42. 如权利要求41所述的装置，其特征在于，所述AKMA临时标识还包括AKMA鉴权功能网元的地址信息或AKMA应用功能网元的地址信息中的至少一个。
  43. 如权利要求40至42任一项所述的装置，其特征在于，所述处理模块在确定所述AKMA临时标识时，具体用于：自己生成所述AKMA临时标识。
  44. 如权利要求40至42任一项所述的装置，其特征在于，所述处理模块在确定所述AKMA临时标识时，具体用于：
    控制所述收发模块向AKMA鉴权功能网元发送第一请求消息，所述第一请求消息用于请求所述AKMA鉴权功能网元生成所述AKMA临时标识；以及，控制所述收发模块接收所述AKMA鉴权功能网元发送的第一响应消息，所述第一响应消息中携带有所述AKMA临时标识。
  45. 如权利要求40至42任一项所述的装置，其特征在于，所述处理模块在确定所述AKMA临时标识时，具体用于：
    根据第一辅助信息，确定所述AKMA临时标识；其中，所述第一辅助信息包括所述终端设备的切片信息、所述终端设备的数据网络名称信息或所述终端设备的业务或会话连续性模式信息中的至少一个。
  46. 如权利要求45所述的装置，其特征在于，
    所述收发模块，还用于向所述移动管理网元发送第二请求消息，所述第二请求消息中携带有所述第一指示信息；
    所述收发模块，还用于接收所述移动管理网元发送的第二响应消息，所述第二响应消息中携带有所述第一辅助信息。
  47. 如权利要求40至46任一项所述的装置，其特征在于，
    所述收发模块，还用于接收所述AKMA鉴权功能网元发送的第三请求消息，所述第三请求消息中携带有所述AKMA临时标识；
    所述处理模块，还用于根据所述AKMA临时标识，获取第一密钥，所述第一密钥是所述主鉴权过程中的中间密钥；
    所述处理模块，还用于根据所述第一密钥，生成所述AKMA服务的密钥Kakma；
    所述收发模块，还用于向所述AKMA鉴权功能网元发送所述Kakma。
  48. 如权利要求47所述的装置，其特征在于，
    所述处理模块，还用于在所述终端设备的主鉴权成功后，保存所述AKMA临时标识、所述终端设备的标识与所述第一密钥的对应关系；
    所述处理模块在根据所述AKMA临时标识，获取第一密钥时，具体用于：
    根据所述AKMA临时标识和所述对应关系，获取第一密钥。
  49. 如权利要求47或48所述的装置，其特征在于，所述第一密钥为Kausf。
  50. 如权利要求40至49任一项所述的装置，其特征在于，所述处理模块，还用于在所述AKMA临时标识中包括AKMA鉴权功能网元的地址信息时，将所述AKMA临时标 识中的AKMA鉴权功能网元的地址信息由第一地址信息，更新为第二地址信息；其中，所述第一地址信息为第一AKMA鉴权功能网元的地址信息，所述第二地址信息为第二AKMA鉴权功能网元的地址信息。
  51. 一种通信装置，其特征在于，包括：
    收发模块，用于在终端设备的注册流程中，接收鉴权服务器功能网元发送的第三请求消息，所述第三请求消息中包括终端设备的标识；
    处理模块，用于根据所述终端设备的签约数据，确定所述终端设备支持应用程序的身份验证和密钥管理AKMA服务；
    所述收发模块，还用于向鉴权服务器功能网元发送第三响应消息，所述第三响应消息中包括第一指示信息，所述第一指示信息表示所述终端设备支持所述AKMA服务。
  52. 如权利要求51所述的装置，其特征在于，所述第三请求消息为用于获取鉴权向量的UDM服务化请求消息，所述第三响应消息为用于获取鉴权向量的UDM服务化的响应消息。
  53. 一种通信装置，其特征在于，包括：
    收发模块，用于在终端设备的注册流程中，接收鉴权服务器功能网元发送的第四请求消息，所述第四请求消息用于请求所述终端设备的AKMA临时标识；
    处理模块，用于生成所述AKMA临时标识；
    所述收发模块，还用于向鉴权服务器功能网元发送第四响应消息，所述第四响应消息中携带有所述AKMA临时标识。
  54. 如权利要求53所述的装置，其特征在于，还包括：
    所述收发模块，还用于接收AKMA应用功能网元发送的第五请求消息，所述第五请求消息用于请求所述终端设备与所述AKMA应用功能网元进行通信时使用的通信密钥；
    所述处理模块，在所述第一AKMA鉴权功能网元能够为所述AKMA应用功能网元提供服务的情况下，从鉴权服务器功能网元获取与所述AKMA临时标识对应的AKMA服务的密钥Kakma；
    所述处理模块，还用于根据所述Kakma，生成所述通信密钥；
    所述收发模块，还用于将所述通信密钥发送给所述AKMA应用功能网元。
  55. 如权利要求53或54所述的装置，其特征在于，
    所述处理模块，还用于在所述第一AKMA鉴权功能网元不能够为所述AKMA应用功能网元提供服务的情况下，确定第二AKMA鉴权功能网元；
    所述收发模块，还用于向所述AKMA应用功能网元发送第四响应消息，所述第四响应消息用于指示所述AKMA应用功能网元向所述第二AKMA鉴权功能网元获取通信密钥；其中，所述第四响应消息中携带有所述第二AKMA鉴权功能网元的地址信息。
  56. 一种通信装置，其特征在于，包括通信接口、处理器和存储器；
    所述存储器用于存储计算机执行指令；
    所述处理器用于执行所述存储器所存储的计算机执行指令，以使所述通信装置通过所述通信接口收发消息，并实现如权利要求1至20任一项所述的方法中如下设备的功能：所述安全接入设备，或者，所述第二核心网网元。
  57. 一种计算机可读存储介质，其特征在于，所述存储介质存储有计算机指令，当所述计算机指令被通信装置执行时，使得所述通信装置执行如权利要求1至20中任一项所 述的方法。
  58. 一种计算机程序产品，其特征在于，所述计算机程序产品包括计算机指令，当所述计算机指令被通信装置执行时，使得所述通信装置执行如权利要求1至20中任一项所述的方法。
PCT/CN2019/101243 2019-08-18 2019-08-18 一种通信方法、装置及系统 WO2021031053A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
CN201980099062.3A CN114208111B (zh) 2019-08-18 2019-08-18 一种通信方法、装置及系统
PCT/CN2019/101243 WO2021031053A1 (zh) 2019-08-18 2019-08-18 一种通信方法、装置及系统
EP19942153.8A EP4016950A4 (en) 2019-08-18 2019-08-18 COMMUNICATION METHOD, DEVICE AND SYSTEM
US17/674,607 US12273344B2 (en) 2019-08-18 2022-02-17 Communication method, apparatus, and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/101243 WO2021031053A1 (zh) 2019-08-18 2019-08-18 一种通信方法、装置及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/674,607 Continuation US12273344B2 (en) 2019-08-18 2022-02-17 Communication method, apparatus, and system

Publications (1)

Publication Number Publication Date
WO2021031053A1 true WO2021031053A1 (zh) 2021-02-25

Family

ID=74659569

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/101243 WO2021031053A1 (zh) 2019-08-18 2019-08-18 一种通信方法、装置及系统

Country Status (4)

Country Link
US (1) US12273344B2 (zh)
EP (1) EP4016950A4 (zh)
CN (1) CN114208111B (zh)
WO (1) WO2021031053A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220330019A1 (en) * 2020-03-31 2022-10-13 Zte Corporation Parameters for application communication establishment
WO2022233534A1 (en) * 2021-05-06 2022-11-10 Telefonaktiebolaget Lm Ericsson (Publ) Application-specific gpsi retrieval
US20230068196A1 (en) * 2020-02-19 2023-03-02 Samsung Electronics Co., Ltd. Apparatus and method of generating application specific keys using key derived from network access authentication
US11696124B2 (en) 2021-10-08 2023-07-04 Cisco Technology, Inc. Secure communications for a client device involving authentication and key management for applications (AKMA)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4016950A4 (en) * 2019-08-18 2022-08-10 Huawei Technologies Co., Ltd. COMMUNICATION METHOD, DEVICE AND SYSTEM
EP4078894A4 (en) * 2020-01-16 2022-12-28 ZTE Corporation METHOD, DEVICE AND SYSTEM FOR UPDATING ANCHOR KEY IN A COMMUNICATIONS NETWORK FOR ENCRYPTED COMMUNICATION WITH SERVICE APPLICATIONS
CN114766083A (zh) * 2020-01-19 2022-07-19 中兴通讯股份有限公司 用于为应用建立安全通信的方法和设备

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170150355A1 (en) * 2014-05-20 2017-05-25 Nokia Technologies Oy Cellular network authentication control
CN108347729A (zh) * 2017-01-24 2018-07-31 电信科学技术研究院 网络切片内鉴权方法、切片鉴权代理实体及会话管理实体
CN108738019A (zh) * 2017-04-25 2018-11-02 华为技术有限公司 融合网络中的用户认证方法及装置

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101772020B (zh) * 2009-01-05 2011-12-28 华为技术有限公司 鉴权处理方法和系统、3gpp认证授权计费服务器及用户设备
TWI437881B (zh) * 2011-05-04 2014-05-11 Inst Information Industry 自動拍照系統及其方法
US10779163B2 (en) * 2017-01-05 2020-09-15 Huawei Technologies Co., Ltd. Network architecture having multicast and broadcast multimedia subsystem capabilities
US10397892B2 (en) * 2017-02-06 2019-08-27 Huawei Technologies Co., Ltd. Network registration and network slice selection system and method
CN109413646B (zh) * 2017-08-16 2020-10-16 华为技术有限公司 安全接入方法、设备及系统
CN110049072B (zh) * 2018-01-15 2021-09-21 华为技术有限公司 会话建立方法及设备
CN109842880B (zh) * 2018-08-23 2020-04-03 华为技术有限公司 路由方法、装置及系统
EP4016950A4 (en) * 2019-08-18 2022-08-10 Huawei Technologies Co., Ltd. COMMUNICATION METHOD, DEVICE AND SYSTEM
CN113225176B (zh) * 2020-02-04 2022-09-16 华为技术有限公司 密钥获取方法及装置
CN113541925B (zh) * 2020-03-30 2023-02-14 华为技术有限公司 通信系统、方法及装置
CN113498057B (zh) * 2020-04-03 2025-03-07 华为技术有限公司 通信系统、方法及装置
CN115915132A (zh) * 2020-04-30 2023-04-04 华为技术有限公司 密钥管理方法、设备及系统
CN116325846A (zh) * 2020-10-12 2023-06-23 三星电子株式会社 用于为边缘计算服务建立安全连接的方法和装置
EP4262260B1 (en) * 2021-01-08 2024-11-27 Huawei Technologies Co., Ltd. Key identifier generation method, and related apparatus
US20240284377A1 (en) * 2021-06-10 2024-08-22 Nec Corporation Method of user equipment (ue), user equipment (ue), method of communication apparatus and communication apparatus
EP4254871A1 (en) * 2022-03-29 2023-10-04 Nokia Technologies Oy Enriched a-kid for akma authentication service

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170150355A1 (en) * 2014-05-20 2017-05-25 Nokia Technologies Oy Cellular network authentication control
CN108347729A (zh) * 2017-01-24 2018-07-31 电信科学技术研究院 网络切片内鉴权方法、切片鉴权代理实体及会话管理实体
CN108738019A (zh) * 2017-04-25 2018-11-02 华为技术有限公司 融合网络中的用户认证方法及装置

Non-Patent Citations (5)

* Cited by examiner, † Cited by third party
Title
3GPP TS 33.501
ANONYMOUS: "3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Study on authentication and key management for applications; based on 3GPP credential in 5G (Release 16)", 3GPP STANDARD; TECHNICAL REPORT; 3GPP TR 33.835, no. V0.5.0, 9 July 2019 (2019-07-09), pages 1 - 91, XP051754613 *
HUAWEI; HISILICON: "Architecture solution for AKMA with non-standalone function", 3GPP DRAFT; S3-190197-ARCHITECTURE SOLUTION FOR AKMA WITH NON-STANDALONE FUNCTION, vol. SA WG3, 21 January 2019 (2019-01-21), Kochi (India), pages 1 - 4, XP051611464 *
HUAWEI; HISILICON: "Solution for AKMA push", 3GPP DRAFT; S3-192249_WAS_S3-192160_SOLUTION FOR AKMA PUSH, vol. SA WG3, 28 June 2019 (2019-06-28), Sapporo (Japan), pages 1 - 4, XP051749926 *
See also references of EP4016950A4

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20230068196A1 (en) * 2020-02-19 2023-03-02 Samsung Electronics Co., Ltd. Apparatus and method of generating application specific keys using key derived from network access authentication
US20220330019A1 (en) * 2020-03-31 2022-10-13 Zte Corporation Parameters for application communication establishment
WO2022233534A1 (en) * 2021-05-06 2022-11-10 Telefonaktiebolaget Lm Ericsson (Publ) Application-specific gpsi retrieval
US11696124B2 (en) 2021-10-08 2023-07-04 Cisco Technology, Inc. Secure communications for a client device involving authentication and key management for applications (AKMA)

Also Published As

Publication number Publication date
CN114208111A (zh) 2022-03-18
CN114208111B (zh) 2023-08-04
EP4016950A4 (en) 2022-08-10
US20220174063A1 (en) 2022-06-02
US12273344B2 (en) 2025-04-08
EP4016950A1 (en) 2022-06-22

Similar Documents

Publication Publication Date Title
CN114208111B (zh) 一种通信方法、装置及系统
CN113541925B (zh) 通信系统、方法及装置
JP7443541B2 (ja) 鍵取得方法および装置
US20230008666A1 (en) Group Creation Method, Apparatus, and System
US11582602B2 (en) Key obtaining method and device, and communications system
WO2021148027A1 (zh) 一种通信方法、装置及系统
US10805793B2 (en) Communication method and device
EP3709692A1 (en) Routing method, apparatus and system
WO2020029729A1 (zh) 一种通信方法和装置
WO2021008466A1 (zh) 一种通信方法及装置
CN113498057B (zh) 通信系统、方法及装置
CN112087753B (zh) 认证的方法、装置及系统
JP2024029170A (ja) 通信システムにおける統合サブスクリプション識別子管理
CN109391942A (zh) 触发网络鉴权的方法及相关设备
CA3204394A1 (en) Registration method and apparatus, authentication method and apparatus, routing indicator determination method and apparatus, entity, and terminal
EP4322579A1 (en) Communication method and apparatus
EP4525499A1 (en) Communication method and apparatus
CN114301788B (zh) 一种切片管理方法、装置及通信设备
CN112637785A (zh) 用于多播传输的方法和装置
CN109845190B (zh) 网络访问控制方法、装置及设备
EP4243348A1 (en) Registering a user equipment to a communication network
CN113285805A (zh) 一种通信方法及装置
US20240380730A1 (en) Enabling distributed non-access stratum terminations
CN116896746A (zh) 用于akma认证服务的丰富的a-kid
CN103517267A (zh) 确定实际码号的系统、方法及设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19942153

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2019942153

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2019942153

Country of ref document: EP

Effective date: 20220318