5G network end-to-end secure communication method, system and equipment

Abstract

The invention relates to the technical field of 5G communication core networks, in particular to a 5G network end-to-end secure communication method, device and equipment, and the method specifically comprises the steps: receiving a registration request of a terminal containing capability information of whether the terminal supports end-to-end encryption or not, storing the capability information in a UDM, and storing the capability information in the UDM in a PCF through an SMF; when the calling terminal initiates a call request to the called terminal, an authorization request is initiated to the PCF of the called network through the IMS, so that the PCF of the called network generates an encryption key when both the calling terminal and the called terminal support end-to-end encryption, and the encryption key is returned to the IMS; therefore, the calling terminal and the called terminal carry out secure communication based on the encryption key. Therefore, in the framework and message flow of the existing network, the end-to-end secure communication for the 5G network can be realized with minimum modification by expanding the message parameters.

Description

Technical Field

[0001] The present invention relates to the technical field of 5G communication core network, and specifically to a 5G network end-to-end secure communication method, device and equipment. Background Art

[0002] Currently, in 3G / 4G networks, end-to-end encrypted communication can be achieved to ensure communication security. However, with the development of 5G networks, end-to-end encrypted communication for 5G is also receiving more and more attention. However, due to the characteristics of 5G networks, end-to-end encrypted communication for them cannot be achieved at present. Therefore, how to achieve end-to-end encrypted communication for 5G networks has become a problem that needs to be solved urgently. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide a 5G network end-to-end secure communication method, device and equipment to overcome the current problem of 5G network wireless end-to-end encrypted communication.

[0004] To achieve the above objectives, the present invention adopts the following technical solutions:

[0005] In a first aspect, the present application provides a 5G network end-to-end secure communication method, comprising:

[0006] Receiving a registration request from a terminal, wherein the registration request includes capability information of whether the terminal supports end-to-end encryption;

[0007] The capability information is stored in the UDM, and the capability information in the UDM is stored in the PCF through the SMF;

[0008] When the calling terminal initiates a call request to the called terminal, an authorization request is initiated to the PCF of the called network through the IMS, so that the PCF of the called network generates an encryption key when both the calling terminal and the called terminal support end-to-end encryption, and returns the encryption key to the IMS;

[0009] Based on the encryption key, the calling terminal and the called terminal perform secure communication.

[0010] Further, in some embodiments of the present application, the step of saving the capability information in the UDM to the PCF through the SMF includes:

[0011] During the process of establishing a session between the terminal and the 5G core network, the capability information is obtained from the UDM through SMF, and the capability information is carried when SMF notifies PCF to establish a PCF session, so that PCF saves the capability information.

[0012] Furthermore, in some embodiments of the present application, both the call request and the authorization request include capability information of whether the calling terminal supports end-to-end encryption.

[0013] Furthermore, in some embodiments of the present application, the call request is sent by the terminal to the IMS when initiating an IMS call.

[0014] Further, in some embodiments of the present application, after initiating an authorization request to the PCF of the called network through the IMS, the method further includes:

[0015] When at least one of the calling terminal and the called terminal does not support end-to-end encryption, no encryption key is generated, so that the calling terminal and the called terminal perform ordinary communication.

[0016] Furthermore, in some embodiments of the present application, enabling the calling terminal and the called terminal to communicate securely based on the encryption key includes: distributing the encryption key through an IMS.

[0017] Further, in some embodiments of the present application, the step of enabling the calling terminal and the called terminal to perform secure communication based on the encryption key includes:

[0018] Complete a call establishment process through the IMS, wherein the encryption key is carried in the call signaling in the call establishment process;

[0019] The terminal receives a call establishment message including the encryption key, stores the encryption key, and performs encryption and decryption processing on the call based on the encryption key.

[0020] Further, in some embodiments of the present application, the method of enabling the calling terminal and the called terminal to perform secure communication based on the encryption key further includes:

[0021] After the call is terminated, the encryption key stored in the terminal is deleted.

[0022] In a second aspect, the present application provides a 5G network end-to-end secure communication system, including: a terminal and a 5G network, for executing the 5G network end-to-end secure communication method as described above.

[0023] In a third aspect, the present application provides a 5G network end-to-end secure communication device, including a processor and a memory, wherein the processor is connected to the memory:

[0024] Wherein, the processor is used to call and execute the program stored in the memory;

[0025] The memory is used to store the program, and the program is at least used to execute the above-mentioned 5G network end-to-end secure communication method.

[0026] The present invention relates to the technical field of 5G communication core network, and specifically to a method, device and equipment for secure end-to-end communication in a 5G network. The method specifically includes: receiving a registration request of a terminal including capability information of whether the terminal supports end-to-end encryption, saving the capability information in the UDM, and saving the capability information in the UDM to the PCF through the SMF; when the calling terminal initiates a call request to the called terminal, an authorization request is initiated to the PCF of the called network through the IMS, so that the PCF of the called network generates an encryption key when both the calling terminal and the called terminal support end-to-end encryption, and returns the encryption key to the IMS; thereby enabling the calling terminal and the called terminal to communicate securely based on the encryption key. In this way, in the framework and message flow of the existing network, by extending the message parameters, end-to-end secure communication for the 5G network can be achieved with minimal modification. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0028] Figure 1 It is a flowchart of a 5G network end-to-end secure communication method provided by an embodiment of the present invention;

[0029] Figure 2 It is a schematic diagram of the structure of a 5G network end-to-end secure communication system provided by an embodiment of the present invention;

[0030] Figure 3 It is a structural diagram of a 5G network end-to-end secure communication device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0031] To make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be described in detail below. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other implementation methods obtained by ordinary technicians in this field without creative work belong to the scope of protection of the present invention.

[0032] Figure 1 This is a flow chart of a 5G network end-to-end secure communication method provided by an embodiment of the present invention. Figure 1, this embodiment may include the following steps:

[0033] S101: Receive a registration request from a terminal.

[0034] The registration request includes capability information of whether the terminal supports end-to-end encryption.

[0035] Specifically, when the terminal has built-in media encryption and decryption functions such as voice and video, it has end-to-end encryption capability information. In this application, the terminal can initiate a registration request to the 5G network when it is turned on. The request contains whether it supports end-to-end encryption capability information or parameters.

[0036] S102: Save the capability information in the UDM, and save the capability information in the UDM to the PCF through the SMF.

[0037] Specifically, the terminal completes registration in the 5G core network, and the Unified Data Management (UDM) function in the 5G core network saves the capability information or parameters of whether the terminal supports end-to-end encryption. For example, when the user, i.e., the terminal, establishes a session, the SMF will obtain the session data from the UDM and carry the capability information of whether end-to-end encryption is supported. When the SMF creates the PCF session, it will bring the capability information to the PCF so that the PCF can save the capability information.

[0038] S103. When the calling terminal initiates a call request to the called terminal, an authorization request is initiated to the PCF of the called network through the IMS, so that the PCF of the called network generates an encryption key when both the calling terminal and the called terminal support end-to-end encryption, and returns the encryption key to the IMS.

[0039] Specifically, when the calling terminal initiates a call request to the called terminal, that is, initiates an IMS call, the call request is received through the IMS, and an authorization request is initiated to the PCF of the called network (the call request and the authorization request both include capability information on whether the calling terminal supports end-to-end encryption).

[0040] At this time, when the PCF of the called network determines that both the calling terminal and the called terminal support end-to-end encryption, it generates an encryption key and returns the encryption key to the IMS.

[0041] S104: Based on the encryption key, the calling terminal and the called terminal communicate securely.

[0042] Specifically, the encryption key is distributed through the IMS (eg, the encryption key is distributed to the calling terminal and the called terminal in the call signaling), so that the calling terminal and the called terminal supporting end-to-end encryption can communicate securely based on the encryption key.

[0043] The end-to-end secure communication method of the 5G network provided in the present application provides an end-to-end secure communication solution for 5G IMS calls, and meets user needs by extending parameters in the existing 5G architecture and messages. Specifically, when the user registers, the capability information of whether end-to-end encryption is supported is determined from the registration request and saved in the UDM. When the user establishes a session, the above capability information is carried when the SMF obtains the session data from the UDM; and when the SMF is creating a PCF session, the capability information is brought to the PCF so that the PCF saves the capability information. On this basis, when the calling terminal initiates an IMS call, it can carry the capability information of the calling terminal to the IMS, and the IMS carries the capability information to the PCF in the authorization request. During the authorization process, the PCF completes the key generation, and the IMS subsequently distributes the encryption key to the calling terminal and the called terminal in the call signaling, so that the calling terminal and the called terminal can perform end-to-end secure communication based on the encryption key.

[0044] Furthermore, in order to meet various communication needs based on actual terminal conditions, the communication method provided by the present application also includes not generating an encryption key when at least one of the calling terminal and the called terminal does not support end-to-end encryption, so that the calling terminal and the called terminal perform ordinary communication. The communication method provided by the present application is described in detail below with a complete communication application process. Figure 2 This is a schematic diagram of the structure of the 5G network end-to-end secure communication system provided by an embodiment of the present invention. Figure 2 Taking terminal A and terminal B to communicate as an example (terminal A is a calling terminal and terminal B is a called terminal), this embodiment may include the following steps:

[0045] Step 1: Terminals A and B initiate a registration request to the 5G network when they are powered on.

[0046] The registration request includes capability information or parameters on whether end-to-end encryption is supported. In practical applications, AMF can be used to implement support for extending the parameter "whether end-to-end encryption is supported".

[0047] Step 2: Terminals A and B complete registration in the 5G core network, and the 5G core network saves the capability information of whether end-to-end encryption is supported through UDM.

[0048] Step 3: Terminals A and B complete session establishment in the 5G core network. During the establishment process, SMF obtains capability information from UDM and carries the capability parameters when notifying PCF to establish a PCF session. PCF saves the capability information in the session.

[0049] Step 4: Terminals A and B complete IMS registration.

[0050] Step 5: Terminal A initiates a call request to Terminal B.

[0051] The call request carries information about whether the calling terminal supports end-to-end encryption.

[0052] Step 6: After receiving the request, the IMS initiates an authorization request to the PCF of the called 5G core network (i.e., the 5G core network corresponding to the called terminal) (it should be noted that the calling terminal and the called terminal can belong to the same 5G core network or different core networks), and the authorization request adds the capability information of whether end-to-end encryption is supported.

[0053] Step 7: The called 5G core network PCF receives the authorization request sent by the IMS, triggering the establishment of the called bearer. Compared with the processing in the prior art, the following logic processing is added to achieve end-to-end secure communication:

[0054] Step 7.1: If terminal A supports end-to-end encryption, such as the authorization request carries the "support end-to-end encryption" parameter, then check whether terminal B supports end-to-end encryption, including:

[0055] Step 7.1.1: If terminal B does not support end-to-end encryption, no encryption key is generated.

[0056] Step 7.1.2: If terminal B supports end-to-end encryption, generate encryption keys for terminal A and terminal B.

[0057] Step 7.2: If terminal A does not support end-to-end encryption, such as if the "support end-to-end encryption" in the authorization request is no, no encryption key is generated.

[0058] Step 8: The called 5G core network PCF returns an authorization response to the IMS, which carries the encryption key for the calling and called calls (both the calling and called terminals support end-to-end encryption) or does not carry the encryption key (one of the calling and called terminals does not support end-to-end encryption).

[0059] Step 9: IMS completes the subsequent call establishment process and carries the call encryption key in the call signaling (both the calling terminal and the called terminal support end-to-end encryption) or does not carry the encryption key (at least one of the calling terminal and the called terminal does not support end-to-end encryption).

[0060] Step 10: Terminal A and Terminal B receive the call establishment message, and if the message contains an encryption key, they save the encryption key.

[0061] Step 11: Terminal A and Terminal B communicate with each other, and through the encryption and decryption module (in actual applications, the encryption and decryption module can be used to provide the above-mentioned capability information of whether end-to-end encryption is supported, and to store encryption keys and encryption and decryption information), the following are processed according to the encryption key:

[0062] Step 11.1: If the call has an encryption key (ie, both the corresponding calling terminal and the called terminal support end-to-end encryption), the encryption key is used for encryption and decryption processing.

[0063] Step 11.2: If the call has no encryption key (ie, at least one of the corresponding calling terminal and the called terminal does not support end-to-end encryption), no encryption and decryption processing is performed, and a normal call in the prior art is performed.

[0064] Step 12: When the session terminates, if there is an encryption key, the saved encryption key is deleted.

[0065] in addition, Figure 3 The RAN and UPF shown in the figure are conventional settings for calls in the existing 5G core network. You can refer to the call principles of the existing 5G core network for understanding, and will not go into details here.

[0066] Based on the same inventive concept, the present application also provides a 5G network end-to-end secure communication system, including: a terminal and a 5G network, for executing the 5G network end-to-end secure communication method mentioned in the above method embodiment.

[0067] Regarding the system in the above embodiment, the specific manner in which each part performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0068] The present application also provides a 5G network end-to-end secure communication device, Figure 3 is a schematic diagram of the structure of a 5G network end-to-end secure communication device provided by an embodiment of the present invention, such as Figure 3 As shown, the 5G network end-to-end secure communication device provided by the present application may specifically include a processor 1 and a memory 2, and the processor 1 is connected to the memory 2: wherein the processor 1 is used to call and execute the program stored in the memory 2; the memory 2 is used to store the program, which is at least used to execute the 5G network end-to-end secure communication method mentioned in the above method embodiment.

[0069] The specific implementation scheme of the 5G network end-to-end secure communication device provided in the embodiment of the present application can refer to the implementation scheme of the 5G network end-to-end secure communication method in any of the above embodiments, and will not be repeated here.

[0070] It can be understood that the same or similar parts of the above embodiments can be referenced to each other, and the contents not described in detail in some embodiments can refer to the same or similar contents in other embodiments.

[0071] It should be noted that, in the description of the present invention, the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In addition, in the description of the present invention, unless otherwise specified, the meaning of "plurality" refers to at least two.

[0072] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention belong.

[0073] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0074] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0075] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0076] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0077] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0078] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A 5G network end-to-end secure communication method, characterized in that: include: Receiving a registration request from a terminal, wherein the registration request includes capability information of whether the terminal supports end-to-end encryption; The capability information is stored in the UDM, and the capability information in the UDM is stored in the PCF through the SMF; When the calling terminal initiates a call request to the called terminal, an authorization request is initiated to the PCF of the called network through the IMS, so that the PCF of the called network generates an encryption key when both the calling terminal and the called terminal support end-to-end encryption, and returns the encryption key to the IMS; Based on the encryption key, the calling terminal and the called terminal perform secure communication.

2. The 5G network end-to-end secure communication method according to claim 1, characterized in that: The step of saving the capability information in the UDM to the PCF through the SMF includes: During the process of establishing a session between the terminal and the 5G core network, the capability information is obtained from the UDM through SMF, and the capability information is carried when SMF notifies PCF to establish a PCF session, so that PCF saves the capability information.

3. The 5G network end-to-end secure communication method according to claim 1, characterized in that: The call request and the authorization request both include capability information of whether the calling terminal supports end-to-end encryption.

4. The 5G network end-to-end secure communication method according to claim 1, characterized in that: The call request is sent by the terminal to the IMS when initiating an IMS call.

5. The 5G network end-to-end secure communication method according to claim 1, characterized in that: After initiating an authorization request to the PCF of the called network through the IMS, it also includes: When at least one of the calling terminal and the called terminal does not support end-to-end encryption, no encryption key is generated, so that the calling terminal and the called terminal perform normal communication.

6. The 5G network end-to-end secure communication method according to claim 1, characterized in that: The enabling the calling terminal and the called terminal to perform secure communication based on the encryption key includes: distributing the encryption key through an IMS.

7. The 5G network end-to-end secure communication method according to claim 1, characterized in that: The step of enabling the calling terminal and the called terminal to perform secure communication based on the encryption key includes: Complete a call establishment process through the IMS, wherein the encryption key is carried in the call signaling in the call establishment process; The terminal receives a call establishment message including the encryption key, stores the encryption key, and performs encryption and decryption processing on the call based on the encryption key.

8. The 5G network end-to-end secure communication method according to claim 1, characterized in that: The step of enabling the calling terminal and the called terminal to perform secure communication based on the encryption key further includes: After the call is terminated, the encryption key stored in the terminal is deleted.

9. A 5G network end-to-end secure communication system, characterized in that: include: A terminal and a 5G network, used to execute the 5G network end-to-end secure communication method as described in any one of claims 1-8.

10. A 5G network end-to-end secure communication device, characterized in that: The invention comprises a processor and a memory, wherein the processor is connected to the memory: Wherein, the processor is used to call and execute the program stored in the memory; The memory is used to store the program, and the program is at least used to execute the 5G network end-to-end secure communication method described in any one of claims 1-8.

Images