Communication management method, device, system, terminal, management entity and storage medium

Abstract

The embodiments of the present invention provide a communication management method, device, system, terminal, management entity and storage medium. After accessing a first-standard network, the terminal obtains first security information. After successfully accessing a second-standard network, the terminal generates second security information based on the first security information, and uses the second security information for secure communication. That is, after switching between networks of different standards, the terminal generates security information of the network after switching based on the security information of the network before switching, and uses the security information of the network after switching for subsequent secure communication, thereby meeting the network communication security requirements.

Description

Technical Field

[0001] The present invention relates to the field of communications, and in particular to a communication management method, device, system, terminal, management entity and storage medium. Background Art

[0002] When users use mobile phones to communicate, network switching scenarios usually occur, such as switching from the 4G (the 4 Generation mobile communication technology) network to the 5G (5-Generation, fifth generation mobile communication technology) network.

[0003] 3GPP (3rd Generation Partnership Project) provides the following scenarios for terminal switching from 4G to 5G: Figure 8 The switching process shown is composed of Figure 8 It can be seen that after the handover is completed, the terminal UE and the AMF (Authentication Management Function) of the 5G network communicate securely based on the security information of 4G, and the terminals that do not meet the requirements of the 5G network need to use the security information of 5G for secure communication. That is, in the prior art, after the terminal switches to a network of different standards, it still uses the security information of the network before the switch for subsequent secure communication, which does not meet the network communication security requirements. Summary of the invention

[0004] Embodiments of the present invention provide a communication management method, device, system, terminal, management entity and storage medium to solve the problem in the prior art that after a terminal switches to a network of a different standard, it still uses the security information of the network before switching for subsequent secure communications, which does not meet the network communication security requirements.

[0005] To achieve the above object, an embodiment of the present invention provides a terminal communication management method, which includes:

[0006] The terminal accesses the first standard network, establishes communication with the first management entity, and obtains first security information;

[0007] When the terminal accesses the second-standard network, it sends an access request for the second-standard network to the second management entity; the access request carries a security verification code generated by the terminal according to the first security information and the access request;

[0008] receiving a successful response sent by the second management entity; the successful response is sent by the second management entity when the second management entity sends a terminal authentication request to the first management entity based on the access request and when the first management entity authenticates the terminal successfully according to the terminal authentication request;

[0009] Second security information is generated according to the first security information, and the second security information is used for secure communication.

[0010] The embodiment of the present invention also provides a terminal communication management method, which includes:

[0011] The second management entity receives an access request from the terminal; the access request is sent by the terminal when accessing the second network from the first network, and carries a security verification code generated by the terminal according to the first security information and the access request, and the first security information is obtained by the terminal after establishing communication with the first management entity in the first network;

[0012] Determine the first management entity corresponding to the terminal according to the access request, and send a terminal verification request to the first management entity; the terminal verification request carries a security verification code;

[0013] receiving a pass response sent by the first management entity; the pass response is sent by the first management entity when the terminal verification is successful according to the terminal verification request;

[0014] obtaining second security information, and using the second security information for secure communication;

[0015] Send a success response to the terminal.

[0016] The embodiment of the present invention also provides a terminal communication management method, which includes:

[0017] The terminal accesses the first standard network, establishes communication with the first management entity, and obtains the first security information; when accessing the second standard network, the terminal sends an access request for the second standard network to the second management entity; the access request carries a security verification code generated by the terminal according to the first security information and the access request;

[0018] The second management entity receives the access request from the terminal, determines the first management entity corresponding to the terminal according to the access request, and sends a terminal verification request to the first management entity; the terminal verification request carries a security verification code;

[0019] The first management entity receives the terminal verification request, verifies the terminal according to the security verification code, and sends a pass response to the second management entity when the verification passes;

[0020] The second management entity receives the pass response sent by the first management entity, obtains the second security information, uses the second security information to perform secure communication, and sends a success message to the terminal;

[0021] The terminal receives the success message sent by the second management entity, generates second security information according to the first security information, and uses the second security information to perform secure communication.

[0022] The embodiment of the present invention further provides a terminal communication management device, which is arranged in a terminal, and the terminal communication management device includes:

[0023] An access module, used to access a first-standard network, establish communication with a first management entity, obtain first security information, and send an access request for the second-standard network to the second management entity when accessing a second-standard network; the access request carries a security verification code generated by the terminal according to the first security information and the access request;

[0024] A receiving module, configured to receive a successful response sent by the second management entity; the successful response is sent by the second management entity when the second management entity sends a terminal authentication request to the first management entity based on the access request and when the first management entity authenticates the terminal successfully according to the terminal authentication request;

[0025] The communication module is used to generate second security information according to the first security information and use the second security information to perform secure communication.

[0026] The embodiment of the present invention further provides a terminal, which includes: a processor, a memory and a communication bus, wherein:

[0027] The communication bus is used to realize the connection and communication between the processor and the memory;

[0028] The processor is used to execute one or more programs stored in the memory to implement the steps of the terminal communication management method provided by the embodiment of the present invention.

[0029] The embodiment of the present invention further provides a terminal communication management device, which is arranged in a second management entity, and the terminal communication management device includes:

[0030] A receiving module, configured to receive an access request from a terminal; the access request is sent by the terminal when accessing the second standard network from the first standard network, and carries a security verification code generated by the terminal according to the first security information and the access request, and the first security information is obtained by the terminal after establishing communication with the first management entity in the first standard network;

[0031] The verification module is used to determine the first management entity corresponding to the terminal according to the access request, and send a terminal verification request to the first management entity; the terminal verification request carries a security verification code; and receive a pass response sent by the first management entity; the pass response is sent by the first management entity when the terminal verification is successful according to the terminal verification request;

[0032] The communication module is used to obtain the second security information, use the second security information to perform secure communication, and send a success response to the terminal.

[0033] The embodiment of the present invention further provides a management entity, which includes: a processor, a memory and a communication bus, wherein:

[0034] The communication bus is used to realize the connection and communication between the processor and the memory;

[0035] The processor is used to execute one or more programs stored in the memory to implement the steps of the terminal communication management method provided by the embodiment of the present invention.

[0036] The embodiment of the present invention further provides a terminal communication management system, which includes a terminal, a first management entity arranged in a first standard network, and a second management entity arranged in a second standard network, wherein:

[0037] The terminal is used to access the first standard network, establish communication with the first management entity, and obtain the first security information; when accessing the second standard network, the terminal sends an access request for the second standard network to the second management entity; the access request carries a security verification code generated by the terminal according to the first security information and the access request;

[0038] The second management entity is used to receive an access request from the terminal, determine the first management entity corresponding to the terminal according to the access request, and send a terminal verification request to the first management entity; the terminal verification request carries a security verification code;

[0039] The first management entity is used to receive a terminal verification request, and verify the terminal according to the security verification code, and send a pass response to the second management entity when the verification passes;

[0040] The second management entity is used to receive the pass response sent by the first management entity, obtain the second security information, use the second security information to perform secure communication, and send a success message to the terminal;

[0041] The terminal is used to receive a success message sent by the second management entity, generate second security information according to the first security information, and use the second security information to perform secure communication.

[0042] An embodiment of the present invention also provides a computer-readable storage medium, characterized in that the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the terminal communication management method provided by the embodiment of the present invention.

[0043] The beneficial effects of the present invention are:

[0044] According to the communication management method, device, system, terminal, management entity and storage medium provided by the embodiments of the present invention, after the terminal accesses the first-standard network, it obtains first security information, and after successfully accessing the second-standard network, it generates second security information based on the first security information, and uses the second security information for secure communication; that is, after the terminal switches to networks of different standards, it generates security information of the network after switching based on the security information of the network before switching, and uses the security information of the network after switching for subsequent secure communication, thereby meeting the network communication security requirements.

[0045] Other features and corresponding beneficial effects of the present invention are described in the latter part of the specification, and it should be understood that at least part of the beneficial effects become obvious from the description in the specification of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A flowchart of a terminal communication management method provided in Embodiment 1 of the present invention;

[0047] Figure 2 A flow chart of the terminal communication management method provided in the first embodiment of the present invention on the terminal side;

[0048] Figure 3 A flow chart of the terminal communication management method provided in the first embodiment of the present invention on the management entity side;

[0049] Figure 4 A schematic diagram of a terminal provided in Embodiment 1 of the present invention;

[0050] Figure 5 A schematic diagram of a terminal communication management device provided in a terminal according to a first embodiment of the present invention;

[0051] Figure 6 A schematic diagram of a management system provided in Embodiment 1 of the present invention;

[0052] Figure 7 A schematic diagram of a terminal communication management device provided in a management entity according to a first embodiment of the present invention;

[0053] Figure 8 This is a flow chart for existing terminals switching from 4G to 5G;

[0054] Fig. 9 A first flow chart when a terminal switches from 4G to 5G provided in Embodiment 2 of the present invention;

[0055] Fig.10 A second flow chart when a terminal switches from 4G to 5G provided in Embodiment 2 of the present invention;

[0056] Fig.11A third flow chart when a terminal switches from 4G to 5G provided in Embodiment 2 of the present invention;

[0057] Fig.12 A fourth flow chart when a terminal switches from 4G to 5G provided in the second embodiment of the present invention;

[0058] Fig.13 A first flow chart when a terminal switches from 5G to 4G provided in Embodiment 3 of the present invention;

[0059] Fig.14 A second flow chart when a terminal switches from 5G to 4G provided in Embodiment 3 of the present invention;

[0060] Fig.15 A third flow chart when a terminal switches from 5G to 4G provided in Embodiment 3 of the present invention;

[0061] Fig.16 This is the fourth flow chart when the terminal provided in Embodiment 3 of the present invention switches from 5G to 4G. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the embodiments of the present invention are further described in detail below through specific implementation methods combined with the accompanying drawings. It should be understood that the specific embodiments described here are only used to explain the present invention and are not used to limit the present invention.

[0063] In the present invention, the first-standard network and the second-standard network refer to two networks of different standards, for example, 4G and 5G are two networks of different standards. The first management entity refers to a physical device in the first-standard network used to manage terminal users, and the first security information refers to the information used by the terminal for secure communications such as encryption and decryption of messages and data in the first-standard network. Correspondingly, the second management entity refers to a physical device in the second-standard network used to manage terminal users, and the second security information refers to the information used by the terminal for secure communications such as encryption and decryption of messages and data in the second-standard network.

[0064] In the present invention, security information at least includes encryption and decryption keys and key modification parameters. The key modification parameters refer to parameters for modifying encryption and decryption keys, including: how often the encryption and decryption keys are modified, or how many times they are used, and how to modify them. In practical applications, the control of how often the encryption and decryption keys are modified, or how many times they are used, can be implemented by a timer, etc., and the modification function, such as a hash function, can be used to implement the modification of encryption and decryption keys.

[0065] Embodiment 1:

[0066] In order to solve the problem in the prior art that after a terminal switches to a network of a different standard, the terminal still uses the security information of the network before switching for subsequent secure communication, which does not meet the network communication security requirements, this embodiment is provided. Figure 1 The terminal communication management method provided in this embodiment includes the following steps:

[0067] S101: The terminal accesses a first-standard network, establishes communication with a first management entity, and obtains first security information; when accessing a second-standard network, the terminal sends an access request for the second-standard network to a second management entity; the access request carries a security verification code generated by the terminal according to the first security information and the access request.

[0068] In the present invention, the terminal first accesses the first standard network, and then accesses the second standard network in scenarios such as restart, manual network selection by the user, and automatic cell switching.

[0069] In the present invention, the terminal first accesses the first standard network in the first cell, establishes communication with the first management entity, completes identity authentication, and then the first management entity generates first security information and sends it to the terminal. The terminal performs secure communication in the first standard network based on the first security information. Then the terminal reselects the cell due to movement or signal strength change, and determines whether the network standard of the new cell (second cell) is the same as the first cell according to the system broadcast sent by the base station. If the same, there is no switching of the network standard, and a regular access request is sent to the base station of the second cell to access the second cell and continue to communicate using the first security information. If they are different, the network standard is switched, and an access request is sent to the second standard network through the base station of the second cell.

[0070] S102: The second management entity receives an access request from the terminal, determines the first management entity corresponding to the terminal according to the access request, and sends a terminal verification request to the first management entity; the terminal verification request carries a security verification code.

[0071] S103: The first management entity receives the terminal verification request, verifies the terminal according to the security verification code, and sends a pass response to the second management entity when the verification passes.

[0072] This step includes: the first management entity extracts the first communication identifier and access request carried in the terminal verification request; searches for the first security information corresponding to the first communication identifier; generates a verification code based on the first security information and the access request; extracts the security code carried in the access request; compares the verification code and the security code; if the comparison passes, the terminal verification passes; if the comparison fails, the terminal verification fails, and a failure response is sent to the second management entity.

[0073] S104: The second management entity receives the pass response sent by the first management entity, obtains second security information, uses the second security information to perform secure communication, and sends a success message to the terminal.

[0074] S105: The terminal receives a success message sent by the second management entity, generates second security information according to the first security information, and uses the second security information to perform secure communication.

[0075] In some embodiments, the method further includes: the first management entity sends a failure response to the second management entity, and after receiving the failure response sent by the first management entity, the second management entity sends a failure message to the terminal to deny terminal access.

[0076] Specifically, Figure 2 As shown, the embodiment of this embodiment on the terminal side includes the following steps:

[0077] S201: The terminal accesses a first-standard network, establishes communication with a first management entity, and obtains first security information;

[0078] S202: When the terminal accesses the second-standard network, the terminal sends an access request for the second-standard network to the second management entity; the access request carries a security verification code generated by the terminal according to the first security information and the access request;

[0079] In some embodiments, this step includes: the terminal generates a second communication identifier in the second network based on the first communication identifier in the first network; constructs an access request carrying the second communication identifier; generates a security verification code based on the access request and the first security information; adds the security verification code to the access request; and sends the access request to the second management entity.

[0080] S203: receiving a successful response sent by the second management entity; the successful response is a terminal authentication request sent by the second management entity to the first management entity based on the access request, and sent when the first management entity authenticates the terminal successfully according to the terminal authentication request;

[0081] S204: Generate second security information according to the first security information, and use the second security information to perform secure communication.

[0082] In some embodiments, this step includes: generating an encryption and decryption key in the second security information based on the encryption and decryption key in the first security information; generating a key modification parameter in the second security information based on the key modification parameter in the first security information.

[0083] In some embodiments, generating the encryption and decryption key in the second security information based on the encryption and decryption key in the first security information includes: calling a preset conversion function; using the encryption and decryption key in the first security information as an input parameter of the conversion function, and using the output result of the conversion function as the encryption and decryption key in the second security information; using the conversion function to generate the encryption and decryption key in the second security information based on the encryption and decryption key in the first security information.

[0084] In some embodiments, the conversion function can be an equality function or a hash function. Taking the hash function as an example, generating the encryption and decryption key in the second security information based on the encryption and decryption key in the first security information includes: when the first-standard network is a fourth-generation mobile communication network and the second-standard network is a fifth-generation mobile communication network, using the anchor key in the first security information as the input of the hash function to derive the node key in the second security information; when the first-standard network is a fifth-generation mobile communication network and the second-standard network is a fourth-generation mobile communication network, using the node key in the first security information as the input of the hash function to derive the anchor key in the second security information.

[0085] In some embodiments, the hash function can be an HMAC-SHA-256 function, the input of which includes a key and a hash parameter. The anchor key and the node key can be converted based on this function. For example, when the anchor key is the string {123456}, after calculation by the HMAC-SHA-256 function, the output string {284369} can then be used as the node key.

[0086] Specifically, Figure 3 As shown, the embodiment of this embodiment on the management entity side includes the following steps:

[0087] S301: The second management entity receives an access request from a terminal; the access request is sent by the terminal when accessing the second network from the first network, and carries a security verification code generated by the terminal according to the first security information and the access request; the first security information is obtained by the terminal after establishing communication with the first management entity in the first network;

[0088] S302: Determine the first management entity corresponding to the terminal according to the access request, and send a terminal verification request to the first management entity; the terminal verification request carries a security verification code;

[0089] In some embodiments, this step includes: extracting the second communication identifier of the terminal in the second-standard network carried by the access request; generating the first communication identifier of the terminal in the first-standard network based on the second communication identifier; constructing a terminal verification request carrying the first communication identifier and the access request; and sending the terminal verification request to the first management entity.

[0090] S303: Receive a pass response sent by the first management entity; the pass response is sent by the first management entity when the terminal verification is successful according to the terminal verification request;

[0091] S304: Acquire second security information, and use the second security information for secure communication;

[0092] In some embodiments, this step includes: directly extracting the second security information carried by the response, where the second security information is generated by the first management entity based on the first security information; or, extracting the first security information carried by the response, and generating the second security information based on the first security information.

[0093] In some embodiments, generating the second security information based on the first security information includes: generating the encryption and decryption keys in the second security information based on the encryption and decryption keys in the first security information; generating the key modification parameters in the second security information based on the key modification parameters in the first security information.

[0094] In some embodiments, generating the encryption and decryption key in the second security information based on the encryption and decryption key in the first security information includes: calling a preset conversion function; using the encryption and decryption key in the first security information as an input parameter of the conversion function, and using the output result of the conversion function as the encryption and decryption key in the second security information; using the conversion function to generate the encryption and decryption key in the second security information based on the encryption and decryption key in the first security information.

[0095] In some embodiments, the conversion function is a hash function, and generating the encryption and decryption key in the second security information based on the encryption and decryption key in the first security information includes: when the first-standard network is a fourth-generation mobile communication network and the second-standard network is a fifth-generation mobile communication network, using the anchor key in the first security information as the input of the hash function to derive the node key in the second security information; when the first-standard network is a fifth-generation mobile communication network and the second-standard network is a fourth-generation mobile communication network, using the node key in the first security information as the input of the hash function to derive the anchor key in the second security information.

[0096] S305: Send a success response to the terminal.

[0097] Specifically, Figure 4 As shown, the terminal provided in this embodiment includes: a processor 41, a memory 42 and a communication bus 43, wherein:

[0098] The communication bus 43 is used to realize the connection and communication between the processor 41 and the memory 42;

[0099] The processor 41 is used to execute one or more programs stored in the memory 42 to implement the following steps:

[0100] Accessing a first standard network, establishing communication with a first management entity, and obtaining first security information;

[0101] When accessing the second standard network, sending an access request for the second standard network to the second management entity; the access request carries a security verification code generated by the terminal according to the first security information and the access request;

[0102] receiving a successful response sent by the second management entity; the successful response is sent by the second management entity when the second management entity sends a terminal authentication request to the first management entity based on the access request and when the first management entity authenticates the terminal successfully according to the terminal authentication request;

[0103] Second security information is generated according to the first security information, and the second security information is used for secure communication.

[0104] In some embodiments, the processor 41 is used to execute one or more programs stored in the memory 42 to implement the following steps:

[0105] Generate a second communication identifier in a second network based on a first communication identifier in a first network; construct an access request carrying the second communication identifier; generate a security verification code based on the access request and the first security information; add the security verification code to the access request; and send the access request to a second management entity.

[0106] In some embodiments, the processor 41 is used to execute one or more programs stored in the memory 42 to implement the following steps:

[0107] Generate an encryption and decryption key in the second security information according to the encryption and decryption key in the first security information;

[0108] The key modification parameter in the second security information is generated according to the key modification parameter in the first security information.

[0109] In some embodiments, the processor 41 is used to execute one or more programs stored in the memory 42 to implement the following steps:

[0110] Call a preset conversion function; use the encryption and decryption key in the first security information as the input parameter of the conversion function, and use the output result of the conversion function as the encryption and decryption key in the second security information; use the conversion function to generate the encryption and decryption key in the second security information based on the encryption and decryption key in the first security information.

[0111] In some embodiments, the conversion function may be an equality function or a hash function. Taking the hash function as an example, the processor 41 is used to execute one or more programs stored in the memory 42 to implement the following steps:

[0112] When the first-standard network is a fourth-generation mobile communication network and the second-standard network is a fifth-generation mobile communication network, the anchor key in the first security information is used as an input to the hash function to derive the node key in the second security information; when the first-standard network is a fifth-generation mobile communication network and the second-standard network is a fourth-generation mobile communication network, the node key in the first security information is used as an input to the hash function to derive the anchor key in the second security information.

[0113] like Figure 5 As shown, the terminal communication management device 5 provided in the terminal in this embodiment includes:

[0114] The access module 51 is used to access the first standard network, establish communication with the first management entity, obtain the first security information, and send an access request of the second standard network to the second management entity when accessing the second standard network; the access request carries a security verification code generated by the terminal according to the first security information and the access request;

[0115] The receiving module 52 is used to receive a successful response sent by the second management entity; the successful response is sent by the second management entity when the terminal verification request is sent to the first management entity based on the access request and the first management entity passes the terminal verification according to the terminal verification request;

[0116] The communication module 53 is used to generate second security information according to the first security information, and use the second security information to perform secure communication.

[0117] In some embodiments, the access module 51 is used to: generate a second communication identifier in a second network based on a first communication identifier in a first network; construct an access request carrying the second communication identifier; generate a security verification code based on the access request and the first security information; add the security verification code to the access request; and send the access request to a second management entity.

[0118] In some embodiments, the communication module 53 is used to: generate the encryption and decryption key in the second security information according to the encryption and decryption key in the first security information; generate the key modification parameter in the second security information according to the key modification parameter in the first security information.

[0119] In some embodiments, the communication module 53 is used to: call a preset conversion function; use the encryption and decryption key in the first security information as an input parameter of the conversion function, and use the output result of the conversion function as the encryption and decryption key in the second security information; use the conversion function to generate the encryption and decryption key in the second security information based on the encryption and decryption key in the first security information.

[0120] In some embodiments, the conversion function can be an equality function or a hash function. Taking the hash function as an example, the communication module 53 is used for: when the first-standard network is a fourth-generation mobile communication network and the second-standard network is a fifth-generation mobile communication network, the anchor key in the first security information is used as the input of the hash function to derive the node key in the second security information; when the first-standard network is a fifth-generation mobile communication network and the second-standard network is a fourth-generation mobile communication network, the node key in the first security information is used as the input of the hash function to derive the anchor key in the second security information.

[0121] Specifically, Figure 6 As shown, the management entity provided in this embodiment includes: a processor 61, a memory 62 and a communication bus 63, wherein:

[0122] The communication bus 63 is used to realize the connection and communication between the processor 61 and the memory 62;

[0123] The processor 61 is used to execute one or more programs stored in the memory 62 to implement the following steps:

[0124] receiving an access request from a terminal; the access request is sent by the terminal when accessing the second standard network from the first standard network, and carries a security verification code generated by the terminal according to the first security information and the access request, and the first security information is obtained by the terminal after establishing communication with the first management entity in the first standard network;

[0125] Determine the first management entity corresponding to the terminal according to the access request, and send a terminal verification request to the first management entity; the terminal verification request carries a security verification code;

[0126] receiving a pass response sent by the first management entity; the pass response is sent by the first management entity when the terminal verification is successful according to the terminal verification request;

[0127] obtaining second security information, and using the second security information for secure communication;

[0128] Send a success response to the terminal.

[0129] In some embodiments, the processor 61 is used to execute one or more programs stored in the memory 62 to implement the following steps:

[0130] Extract the second communication identifier of the terminal in the second-standard network carried by the access request; generate the first communication identifier of the terminal in the first-standard network based on the second communication identifier; construct a terminal verification request carrying the first communication identifier and the access request; and send the terminal verification request to the first management entity.

[0131] In some embodiments, the processor 61 is used to execute one or more programs stored in the memory 62 to implement the following steps:

[0132] Directly extract the second security information carried in the response, where the second security information is generated by the first management entity based on the first security information; or, extract the first security information carried in the response, and generate the second security information based on the first security information.

[0133] In some embodiments, the processor 61 is used to execute one or more programs stored in the memory 62 to implement the following steps:

[0134] The encryption and decryption keys in the second security information are generated according to the encryption and decryption keys in the first security information; and the key modification parameters in the second security information are generated according to the key modification parameters in the first security information.

[0135] In some embodiments, the processor 61 is used to execute one or more programs stored in the memory 62 to implement the following steps:

[0136] Call a preset conversion function; use the encryption and decryption key in the first security information as the input parameter of the conversion function, and use the output result of the conversion function as the encryption and decryption key in the second security information; use the conversion function to generate the encryption and decryption key in the second security information based on the encryption and decryption key in the first security information.

[0137] In some embodiments, the conversion function is a hash function, and the processor 61 is used to execute one or more programs stored in the memory 62 to implement the following steps:

[0138] When the first-standard network is a fourth-generation mobile communication network and the second-standard network is a fifth-generation mobile communication network, the anchor key in the first security information is used as an input to the hash function to derive the node key in the second security information; when the first-standard network is a fifth-generation mobile communication network and the second-standard network is a fourth-generation mobile communication network, the node key in the first security information is used as an input to the hash function to derive the anchor key in the second security information.

[0139] like Figure 7 As shown, the terminal communication management device 7 provided in the management entity provided in this embodiment includes:

[0140] The receiving module 71 is used to receive an access request from a terminal; the access request is sent by the terminal when accessing the second standard network from the first standard network, and carries a security verification code generated by the terminal according to the first security information and the access request, and the first security information is obtained by the terminal after establishing communication with the first management entity in the first standard network;

[0141] The verification module 72 is used to determine the first management entity corresponding to the terminal according to the access request, and send a terminal verification request to the first management entity; the terminal verification request carries a security verification code; and receive a pass response sent by the first management entity; the pass response is sent by the first management entity when the terminal verification is successful according to the terminal verification request;

[0142] The communication module 73 is used to obtain the second security information, use the second security information to perform secure communication, and send a success response to the terminal.

[0143] In some embodiments, the verification module 72 is used to: extract the second communication identifier of the terminal in the second-standard network carried by the access request; generate the first communication identifier of the terminal in the first-standard network based on the second communication identifier; construct a terminal verification request carrying the first communication identifier and the access request; and send the terminal verification request to the first management entity.

[0144] In some embodiments, the communication module 73 is used to: generate the encryption and decryption keys in the second security information according to the encryption and decryption keys in the first security information; generate the key modification parameters in the second security information according to the key modification parameters in the first security information.

[0145] In some embodiments, the communication module 73 is used to: directly extract second security information carried by the response, where the second security information is generated by the first management entity based on the first security information; or, extract first security information carried by the response and generate second security information based on the first security information.

[0146] In some embodiments, the communication module 73 is used to: call a preset conversion function; use the encryption and decryption key in the first security information as an input parameter of the conversion function, and use the output result of the conversion function as the encryption and decryption key in the second security information; use the conversion function to generate the encryption and decryption key in the second security information based on the encryption and decryption key in the first security information.

[0147] In some embodiments, the communication module 73 is used for: when the first-standard network is a fourth-generation mobile communication network and the second-standard network is a fifth-generation mobile communication network, using the anchor key in the first security information as the input of the hash function to derive the node key in the second security information; when the first-standard network is a fifth-generation mobile communication network and the second-standard network is a fourth-generation mobile communication network, using the node key in the first security information as the input of the hash function to derive the anchor key in the second security information.

[0148] In some embodiments, this embodiment further provides a terminal communication management system, which includes a terminal, a first management entity set in a first-standard network, and a second management entity set in a second-standard network, wherein:

[0149] The terminal is used to access the first standard network, establish communication with the first management entity, and obtain the first security information; when accessing the second standard network, the terminal sends an access request for the second standard network to the second management entity; the access request carries a security verification code generated by the terminal according to the first security information and the access request;

[0150] The second management entity is used to receive an access request from the terminal, determine the first management entity corresponding to the terminal according to the access request, and send a terminal verification request to the first management entity; the terminal verification request carries a security verification code;

[0151] The first management entity is used to receive a terminal verification request, and verify the terminal according to the security verification code, and send a pass response to the second management entity when the verification passes;

[0152] The second management entity is used to receive the pass response sent by the first management entity, obtain the second security information, use the second security information to perform secure communication, and send a success message to the terminal;

[0153] The terminal is used to receive a success message sent by the second management entity, generate second security information according to the first security information, and use the second security information to perform secure communication.

[0154] According to the communication management method, device, system, terminal, management entity and storage medium provided in this embodiment, after accessing the first-standard network, the terminal obtains first security information, and after successfully accessing the second-standard network, generates second security information based on the first security information, and uses the second security information for secure communication; that is, after switching between networks of different standards, the terminal will generate security information of the network after switching based on the security information of the network before switching, and use the security information of the network after switching for subsequent secure communications, thereby meeting the network communication security requirements.

[0155] The present invention is now further described in conjunction with specific application scenarios.

[0156] With the development of communication technology, 4G and 5G will become mainstream communication networks. The terminal will be described in detail in the following embodiments. It can be foreseen that the present invention can be applied to any switching scenario of different network standards.

[0157] Embodiment 2:

[0158] This embodiment takes the switching of a terminal from 4G to 5G as an example.

[0159] Figure 8 The handover flow chart of the terminal from 4G to 5G provided by the existing 3GPP is as follows: Figure 8 As shown, the existing switching process includes the following steps:

[0160] S801: The terminal UE establishes a signaling connection with the MME (Mobility Management Entity) of the 4G network under the 4G network standard. Then the terminal UE enters the idle state due to factors such as mobility and releases the wireless connection. However, both the UE and the 4G MME retain the 4G context for the UE, including 4G security information and a 4G identifier (4G GUTI).

[0161] S802: The terminal accesses the network under the 5G network standard and sends a registration request to the 5G AMF.

[0162] The UE constructs a tracking area update message that will be sent when accessing the network under the 4G network standard, and uses the tracking area update message and the 4G security information to generate a message authentication code 4G MAC (Message Authentication Code, message authentication code, hash function with key). The tracking area update message contains the 4G identifier. The registration request carries the 5G identifier (5G GUTI) mapped from the 4G identifier, the tracking area update message constructed by the UE, and the message authentication code 4G MAC.

[0163] S803: The 5G AMF obtains the 4G tracking area update message and 4G MAC from the registration request, obtains the 4G MME information according to the 4G identifier in the 4G tracking area message, and then sends a context request message to the 4G MME, which includes the 4G identifier, the 4G tracking area update message, and the 4G MAC.

[0164] S804: The 4G MME obtains the 4G identifier, the 4G tracking area update message and the 4G MAC from the context request message, uses the 4G identifier to find the 4G security information for the terminal UE, and verifies the 4G MAC using the included 4G tracking area update message and the 4G security information for the terminal UE. If the verification is successful, the terminal UE is authenticated successfully, otherwise the authentication fails.

[0165] S805: If the 4G MME successfully authenticates the terminal UE, a context response is sent to the 5G AMF, including 4G context information for the terminal UE, including 4G security information.

[0166] S806: The 5G AMF sends a registration response to the terminal UE, allowing the terminal UE to access the 5G mobile network.

[0167] S807: The 5G AMF and the terminal UE use 4G security information for secure communication.

[0168] In this process, the UE and the 5G network still use 4G security information instead of 5G security information to protect messages and data, which does not meet the communication requirements. At the same time, when accessing the 5G mobile network, the UE also needs to construct the messages required when accessing the 4G mobile network, which requires the UE to construct additional content, increases the message length, and reduces network access efficiency.

[0169] To solve Figure 8 There is a problem that UE and 5G network still use 4G security information, providing Fig. 9 or Fig.10 The embodiment shown.

[0170] like Fig. 9 As shown, the switching method provided in this embodiment includes the following steps:

[0171] S901: The terminal UE establishes a signaling connection with the 4G MME under the 4G network standard, and then the terminal UE enters an idle state due to factors such as mobility and releases the wireless connection, but the UE and the 4G MME both retain the 4G context for the UE, including 4G security information and a 4G identifier (4G GUTI).

[0172] S902: The terminal accesses the network under the 5G network standard and sends a registration request to the 5G AMF.

[0173] The UE constructs a tracking area update message that will be sent when accessing the network under the 4G network standard, and uses the tracking area update message and 4G security information to generate a message authentication code 4G MAC (Message Authentication Code, message authentication code, hash function with key). The tracking area update message contains the 4G identifier. The registration request carries the 5G identifier (5G GUTI) mapped from the 4G identifier, the tracking area update message, and the message authentication code 4G MAC.

[0174] S903: The 5G AMF generates a 4G identity based on the 5G identity, and then sends a context request message to the 4G MME. The message includes the 4G identity, a complete registration request, and a 4G MAC.

[0175] S904: 4G MME obtains the 4G identifier, the included registration request and 4G MAC from the context request message, uses the 4G identifier to find the security information for the terminal UE, uses the tracking area update message included in the registration request and the found security information for the terminal UE to regenerate the verification code to verify the 4G MAC included in the registration request (the same below). If the verification is successful, the terminal UE is authenticated successfully, otherwise the authentication fails.

[0176] S905: If the 4G MME successfully authenticates the terminal UE, the security information for the UE is used to generate 5G security information, such as using the anchor key Kasme in the 4G security information as the input of the HMAC-SHA-256 function to derive the node key Kamf used by the 5G AMF.

[0177] S906: The 4G MME then sends a context response to the 5G AMF, including context information for the terminal UE, including 5G security information.

[0178] S907: 5G AMF sends a registration success message to the terminal UE.

[0179] S908: The UE uses the same derivation method to derive the node key Kamf used by the 5G AMF using the anchor key Kasme in the 4G security information as the input of the HMAC-SHA-256 function.

[0180] S909: UE and 5G mobile network begin to use 5G security information for secure communication.

[0181] like Fig.10 As shown, the switching method provided in this embodiment includes the following steps:

[0182] S1001: The terminal UE establishes a signaling connection with the 4G MME under the 4G network standard, and then the terminal UE enters an idle state due to factors such as mobility and releases the wireless connection, but the UE and the 4G MME both retain the 4G context for the UE, including 4G security information and a 4G identifier (4G GUTI).

[0183] S1002: The terminal accesses the network under the 5G network standard and sends a registration request to the 5G AMF.

[0184] The UE constructs a tracking area update message that will be sent when accessing the network under the 4G network standard, and uses the tracking area update message and 4G security information to generate a message authentication code 4G MAC (Message Authentication Code, message authentication code, hash function with key). The tracking area update message contains the 4G identifier. The registration request carries the 5G identifier (5G GUTI) mapped from the 4G identifier, the tracking area update message, and the 4G MAC.

[0185] S1003: The 5G AMF generates a 4G identity based on the 5G identity, and then sends a context request message to the 4G MME. The message includes the 4G identity, a complete registration request, and a 4G MAC.

[0186] S1004: The 4G MME obtains the 4G identifier, the included registration request and 4G MAC from the context request message, uses the 4G identifier to find the security information for the terminal UE, uses the tracking area update message included in the registration request and the security information for the terminal UE to verify the 4G MAC carried in the registration request, if the verification is successful, the terminal UE is authenticated successfully, otherwise the authentication fails.

[0187] S1005: If the 4G MME successfully authenticates the terminal UE, the 4G MME sends a context response to the 5G AMF, including context information for the terminal UE, including 4G security information.

[0188] S1006: The 5G AMF generates 5G security information using the security information for the UE, such as using the anchor key Kasme in the 4G security information carried by the context response as the input of the HMAC-SHA-256 function to derive the node key Kamf used by the 5G AMF.

[0189] S1007: 5G AMF sends a registration success message to the terminal UE.

[0190] S1008: The UE uses the same derivation method to derive the node key Kamf used by the 5G AMF using the anchor key Kasme in the 4G security information as the input of the HMAC-SHA-256 function.

[0191] S1009: UE and 5G mobile network begin to use 5G security information for secure communication.

[0192] To solve Figure 8 The existing access efficiency is low. Fig.11 or Fig.12 The embodiment shown.

[0193] like Fig.11 As shown, the switching method provided in this embodiment includes the following steps:

[0194] S1101: The terminal UE establishes a signaling connection with the 4G MME under the 4G network standard, and then the terminal UE enters an idle state due to factors such as mobility and releases the wireless connection, but the UE and the 4G MME both retain the 4G context for the UE, including 4G security information and a 4G identifier (4G GUTI).

[0195] S1102: The terminal accesses the network under the 5G network standard and sends a registration request to the 5G AMF.

[0196] The terminal accesses the network under the 5G network standard and sends a registration request to the 5G AMF. The registration request carries the 5G identity (5G GUTI) mapped from the 4G identity, and the message authentication code 4GMAC generated by the UE using the registration request and 4G security information.

[0197] S1103: The 5G AMF generates a 4G identity based on the 5G identity, and then sends a context request message to the 4G MME, which includes the 4G identity, registration request, and 4G MAC.

[0198] S1104: The 4G MME obtains the 4G identifier, the included registration request and the 4G MAC from the context request message, uses the 4G identifier to find the security information for the terminal UE, and verifies the 4GMAC using the included registration request and the security information for the terminal UE. If the verification is successful, the terminal UE is authenticated successfully, otherwise the authentication fails.

[0199] S1105: If the 4G MME successfully authenticates the terminal UE, the security information for the UE is used to generate 5G security information, such as using the anchor key Kasme in the 4G security information as the input of the HMAC-SHA-256 function to derive the node key Kamf used by the 5G AMF.

[0200] S1106: The 4G MME then sends a context response to the 5G AMF, including context information for the terminal UE, including 5G security information.

[0201] S1107: 5G AMF sends a registration success message to the terminal UE.

[0202] S1108: The UE uses the same derivation method to derive the node key Kamf used by the 5G AMF using the anchor key Kasme in the 4G security information as the input of the HMAC-SHA-256 function.

[0203] S1109: UE and 5G mobile network begin to use 5G security information for secure communication.

[0204] like Fig.12 As shown, the switching method provided in this embodiment includes the following steps:

[0205] S1201: The terminal UE establishes a signaling connection with the 4G MME under the 4G network standard, and then the terminal UE enters an idle state due to factors such as mobility and releases the wireless connection, but the UE and the 4G MME both retain the 4G context for the UE, including 4G security information and a 4G identifier (4G GUTI).

[0206] S1202: The terminal accesses the network under the 5G network standard and sends a registration request to the 5G AMF.

[0207] The terminal accesses the network under the 5G network standard and sends a registration request to the 5G AMF. The registration request carries the 5G identity (5G GUTI) mapped from the 4G identity, and the message authentication code 4GMAC generated by the UE using the registration request and 4G security information.

[0208] S1203: The 5G AMF generates a 4G identity based on the 5G identity, and then sends a context request message to the 4G MME, which includes the 4G identity, registration request, and 4G MAC.

[0209] S1204: The 4G MME obtains the 4G identifier, the included registration request and 4G MAC from the context request message, uses the 4G identifier to find the security information for the terminal UE, and verifies the 4GMAC using the included registration request and the security information for the terminal UE. If the verification is successful, the terminal UE is authenticated successfully, otherwise the authentication fails.

[0210] S1205: If the 4G MME successfully authenticates the terminal UE, the 4G MME sends a context response to the 5G AMF, including context information for the terminal UE, including 4G security information.

[0211] S1206: The 5G AMF generates 5G security information using the security information for the UE, such as using the anchor key Kasme in the 4G security information as the input of the HMAC-SHA-256 function to derive the node key Kamf used by the 5G AMF.

[0212] S1207: 5G AMF sends a registration success message to the terminal UE.

[0213] S1208: The UE uses the same derivation method to derive the node key Kamf used by the 5G AMF using the anchor key Kasme in the 4G security information as the input of the HMAC-SHA-256 function.

[0214] S1209: The UE and the 5G mobile network begin to use 5G security information for secure communication.

[0215] Embodiment three:

[0216] This embodiment takes the switching of a terminal from 5G to 4G as an example.

[0217] Since the existing 3GPP does not provide a handover flowchart for a terminal switching from 5G to 4G, this embodiment provides four specific handover processes for switching from 5G to 4G to fill this gap.

[0218] like Fig.13 As shown, the switching method provided in this embodiment includes the following steps:

[0219] S1301: The terminal UE establishes a signaling connection with the 5G AMF under the 5G network standard, and then the terminal UE enters the idle state, that is, the wireless connection is released, but the UE and the 5G AMF both retain the 5G context for the UE, including 5G security information and 5G identification (5G GUTI).

[0220] S1302: The terminal accesses the network under the 4G network standard and sends a tracking area update message to the 4G MMF.

[0221] The UE constructs a registration request that will be sent when accessing the network under the 5G network standard, and uses the registration request and 5G security information to generate a message authentication code 5G MAC. The tracking area update message can be a TAU Request message, carrying the 4G identity (4G GUTI) mapped from the 5G identity, the registration request and the 5G MAC.

[0222] S1303: The 4G MME generates a 5G identifier based on the 4G identifier, and then sends a context request message to the 5G AMF, where the message includes the 5G identifier, a complete tracking area update message, and a 5G MAC. In other embodiments, the 4G MME may directly carry the 4G identifier in the context request message.

[0223] S1304: 5G AMF obtains the 4G identifier or 5G identifier, the tracking area update message and 5G MAC contained in the context request message. If the received identifier is a 5G identifier, the 5G identifier is used to find the security information for the terminal UE. If the received identifier is a 4G identifier, the received 4G identifier is used to generate a 5G identifier, and then the 5G identifier is used to find the 5G security information for the terminal UE. The 5G AMF then uses the included registration request and the 5G security information for the terminal UE to verify the 5G MAC carried in the tracking area update message. If the verification is successful, the terminal UE is authenticated successfully, otherwise the authentication fails.

[0224] S1305: If the 5G AMF successfully authenticates the terminal UE, the 5G security information for the UE is used to generate the 4G security information, such as using the node key Kamf in the 5G security information as the input of the HMAC-SHA-256 function to derive the anchor key Kasme used by the 4G MME.

[0225] S1306: The 5G AMF then sends a context response to the 4G MME, including context information for the terminal UE, including 4G security information.

[0226] S1307: 4G MME sends a registration success message to the terminal UE.

[0227] S1308: The UE uses the same derivation method and uses the node key Kamf in the 5G security information as the input of the HMAC-SHA-256 function to derive the anchor key Kasme used by the 4G MME.

[0228] S1309: The UE and the 4G mobile network begin to use 4G security information for secure communication.

[0229] like Fig.14 As shown, the switching method provided in this embodiment includes the following steps:

[0230] S1401: The terminal UE establishes a signaling connection with the 5G AMF under the 5G network standard, and then the terminal UE enters the idle state, that is, the wireless connection is released, but the UE and the 5G AMF both retain the 5G context for the UE, including 5G security information and 5G identification (5G GUTI).

[0231] S1402: The terminal accesses the network under the 4G network standard and sends a tracking area update message to the 4G MMF.

[0232] The UE constructs a registration request that will be sent when accessing the network under the 5G network standard, and uses the registration request and 5G security information to generate a message authentication code 5G MAC. The tracking area update message can be a TAU Request message, carrying the 4G identity (4G GUTI) mapped from the 5G identity, the registration request and the 5G MAC.

[0233] S1403: The 4G MME generates a 5G identifier based on the 4G identifier, and then sends a context request message to the 5G AMF, where the message includes the 5G identifier, a complete tracking area update message, and a 5G MAC. In other embodiments, the 4G MME may directly carry the 4G identifier in the context request message.

[0234] S1404: 5G AMF obtains the 4G identifier or 5G identifier, the tracking area update message and 5G MAC contained in the context request message. If the received identifier is a 5G identifier, the 5G identifier is used to find the security information for the terminal UE. If the received identifier is a 4G identifier, the received 4G identifier is used to generate a 5G identifier, and then the 5G identifier is used to find the security information for the terminal UE. The 5G AMF then uses the included registration request and the 5G security information for the terminal UE to verify the 5GMAC carried in the tracking area update message. If the verification is successful, the terminal UE is authenticated successfully, otherwise the authentication fails.

[0235] S1405: If the 5G AMF successfully authenticates the terminal UE, the 5G AMF sends a context response to the 4G MME, which contains context information for the terminal UE, including 5G security information.

[0236] S1406: The 4G MME generates 4G security information using the 5G security information for the UE, such as using the node key Kamf in the 5G security information as the input of the HMAC-SHA-256 function to derive the anchor key Kasme used by the 4G MME.

[0237] S1407: 4G MME sends a registration success message to the terminal UE.

[0238] S1408: The UE uses the same derivation method to derive the anchor key Kasme used by the 4G MME using the node key Kamf in the 5G security information as the input of the HMAC-SHA-256 function.

[0239] S1409: The UE and the 4G mobile network begin to use 4G security information for secure communication.

[0240] like Fig.15 As shown, the switching method provided in this embodiment includes the following steps:

[0241] S1501: The terminal UE establishes a signaling connection with the 5G AMF under the 5G network standard, and then the terminal UE enters the idle state, that is, the wireless connection is released, but the UE and the 5G AMF both retain the 5G context for the UE, including 5G security information and 5G identification (5G GUTI).

[0242] S1502: The terminal accesses the network under the 4G network standard and sends a tracking area update message to the 4G MMF.

[0243] The UE constructs a tracking area update message to be sent when accessing the network under the 4G network standard. It can be a TAURequest message. The message verification code 5G MAC is generated according to the tracking area update message and 5G security information. The tracking area update message carries the 4G identifier (4G GUTI) mapped from the 5G identifier, and the 5G MAC.

[0244] S1503: The 4G MME generates a 5G identifier based on the 4G identifier, and then sends a context request message to the 5G AMF, where the message includes the 5G identifier, a tracking area update message, and a 5G MAC. In other embodiments, the 4G MME may directly carry the 4G identifier in the context request message.

[0245] S1504: 5G AMF obtains the 4G identifier or 5G identifier, the tracking area update message and 5G MAC contained in the context request message. If the received identifier is a 5G identifier, the 5G identifier is used to find the security information for the terminal UE. If the received identifier is a 4G identifier, the received 4G identifier is used to generate a 5G identifier, and then the 5G identifier is used to find the security information for the terminal UE. The 5G AMF then uses the contained tracking area update message and the 5G security information for the terminal UE to verify the 5G MAC carried in the tracking area update message. If the verification is successful, the terminal UE is authenticated successfully, otherwise the authentication fails.

[0246] S1505: If the 5G AMF successfully authenticates the terminal UE, the 5G security information for the UE is used to generate 4G security information, such as using the node key Kamf in the 5G security information as the input of the HMAC-SHA-256 function to derive the anchor key Kasme used by the 4G MME.

[0247] S1506: The 5G AMF then sends a context response to the 4G MME, including context information for the terminal UE, including 4G security information.

[0248] S1507: 4G MME sends a registration success message to the terminal UE.

[0249] S1508: The UE uses the same derivation method to derive the anchor key Kasme used by the 4G MME using the node key Kamf in the 5G security information as the input of the HMAC-SHA-256 function.

[0250] S1509: The UE and the 4G mobile network begin to use 4G security information for secure communication.

[0251] like Fig.16 As shown, the switching method provided in this embodiment includes the following steps:

[0252] S1601: The terminal UE establishes a signaling connection with the 5G AMF under the 5G network standard, and then the terminal UE enters the idle state, that is, the wireless connection is released, but the UE and the 5G AMF both retain the 5G context for the UE, including 5G security information and 5G identification (5G GUTI).

[0253] S1602: The terminal accesses the network under the 4G network standard and sends a tracking area update message to the 4G MMF.

[0254] The UE constructs a tracking area update message to be sent when accessing the network under the 4G network standard. It can be a TAURequest message. The message verification code 5G MAC is generated according to the tracking area update message and 5G security information. The tracking area update message carries the 4G identifier (4G GUTI) mapped from the 5G identifier, and the 5G MAC.

[0255] S1603: The 4G MME generates a 5G identifier based on the 4G identifier, and then sends a context request message to the 5G AMF, where the message includes the 5G identifier, a tracking area update message, and a 5G MAC. In other embodiments, the 4G MME may directly carry the 4G identifier in the context request message.

[0256] S1604: 5G AMF obtains the 4G identifier or 5G identifier, the tracking area update message and 5G MAC contained in the context request message. If the received identifier is a 5G identifier, the 5G identifier is used to find the security information for the terminal UE. If the received identifier is a 4G identifier, the received 4G identifier is used to generate a 5G identifier, and then the 5G identifier is used to find the security information for the terminal UE. The 5G AMF then uses the contained tracking area update message and the 5G security information for the terminal UE to verify the 5G MAC carried in the tracking area update message. If the verification is successful, the terminal UE is authenticated successfully, otherwise the authentication fails.

[0257] S1605: If the 5G AMF successfully authenticates the terminal UE, the 5G AMF sends a context response to the UE, which contains context information for the terminal UE, including 5G security information.

[0258] S1606: The 4G MME generates 4G security information using the 5G security information for the UE, such as using the node key Kamf in the 5G security information as the input of the HMAC-SHA-256 function to derive the anchor key Kasme used by the 4G MME.

[0259] S1607: 4G MME sends a registration success message to the terminal UE.

[0260] S1608: The UE uses the same derivation method to derive the anchor key Kasme used by the 4G MME using the node key Kamf in the 5G security information as the input of the HMAC-SHA-256 function.

[0261] S1609: The UE and the 4G mobile network begin to use 4G security information for secure communication.

[0262] The present invention also provides a computer-readable storage medium, which stores one or more programs. The one or more programs are executed to implement the steps of the methods provided in all embodiments of the present invention.

[0263] In summary, through the implementation of the embodiments of the present invention, there are at least the following beneficial effects:

[0264] According to the communication management method, device, system, terminal, management entity and storage medium provided by the embodiments of the present invention, after the terminal accesses the first-standard network, it obtains first security information, and after successfully accessing the second-standard network, it generates second security information based on the first security information, and uses the second security information for secure communication; that is, after the terminal switches to networks of different standards, it generates security information of the network after switching based on the security information of the network before switching, and uses the security information of the network after switching for subsequent secure communication, thereby meeting the network communication security requirements.

[0265] Obviously, those skilled in the art should understand that the modules or steps of the above-mentioned embodiments of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a computer storage medium (ROM / RAM, magnetic disk, optical disk) and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Therefore, the present invention is not limited to any specific combination of hardware and software.

[0266] The above contents are further detailed descriptions of the embodiments of the present invention in combination with specific implementation methods, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A terminal communication management method, characterized in that: include: The terminal accesses the first standard network, establishes communication with the first management entity, and obtains first security information; When the terminal accesses the second-standard network, sending an access request of the second-standard network to the second management entity; The access request carries a security verification code generated by the terminal according to the first security information and the access request; receiving a success response sent by the second management entity; The success response is that the second management entity sends a terminal authentication request to the first management entity based on the access request, and is sent when the first management entity authenticates the terminal successfully according to the terminal authentication request; generating second security information according to the first security information, and using the second security information for secure communication; Generating the second security information according to the first security information includes: Generate the encryption and decryption key in the second security information according to the encryption and decryption key in the first security information; The key modification parameter in the second security information is generated according to the key modification parameter in the first security information.

2. The terminal communication management method according to claim 1, characterized in that: The generating the encryption / decryption key in the second security information according to the encryption / decryption key in the first security information includes: Call the preset conversion function; Using the encryption and decryption key in the first security information as an input parameter of the conversion function, and using the output result of the conversion function as the encryption and decryption key in the second security information; The conversion function is used to generate the encryption and decryption key in the second security information according to the encryption and decryption key in the first security information.

3. The terminal communication management method according to claim 2, characterized in that: The conversion function is a hash function, and the step of generating the encryption and decryption key in the second security information according to the encryption and decryption key in the first security information includes: When the first standard network is a fourth generation mobile communication network and the second standard network is a fifth generation mobile communication network, using the anchor key in the first security information as an input of the hash function to derive the node key in the second security information; When the first standard network is a fifth generation mobile communication network and the second standard network is a fourth generation mobile communication network, the node key in the first security information is used as the input of the hash function to derive the anchor key in the second security information.

4. The terminal communication management method according to any one of claims 1 to 3, characterized in that: The sending an access request to the second-standard network to the second management entity according to the first security information includes: The terminal generates a second communication identifier in the second standard network according to the first communication identifier in the first standard network; constructing an access request carrying the second communication identifier; Performing security verification on the access request and the first security information to generate a security verification code; adding the security verification code to the access request; Sending the access request to the second management entity.

5. A terminal communication management method, characterized in that: include: The second management entity receives an access request from the terminal; The access request is sent by the terminal when accessing the second-standard network from the first-standard network, and carries a security verification code generated by the terminal according to the first security information and the access request, wherein the first security information is obtained by the terminal after establishing communication with the first management entity in the first-standard network; Determine, according to the access request, a first management entity corresponding to the terminal, and send a terminal verification request to the first management entity; The terminal verification request carries the security verification code; receiving a pass response sent by the first management entity; the pass response is sent by the first management entity when the terminal authentication is successful according to the terminal authentication request; Acquiring second security information, and using the second security information for secure communication; Sending a success response to the terminal; The method of obtaining the second security information includes: directly extracting the second security information carried by the response, where the second security information is generated by the first management entity according to the first security information; or, Extracting the first security information carried by the response, and generating the second security information according to the first security information; Generating the second security information according to the first security information includes: Generate the encryption and decryption key in the second security information according to the encryption and decryption key in the first security information; The key modification parameter in the second security information is generated according to the key modification parameter in the first security information.

6. The terminal communication management method according to claim 5, characterized in that: The generating the encryption / decryption key in the second security information according to the encryption / decryption key in the first security information includes: Call the preset conversion function; Using the encryption and decryption key in the first security information as an input parameter of the conversion function, and using the output result of the conversion function as the encryption and decryption key in the second security information; The conversion function is used to generate the encryption and decryption key in the second security information according to the encryption and decryption key in the first security information.

7. The terminal communication management method according to claim 6, characterized in that: The conversion function is a hash function, and the step of generating the encryption and decryption key in the second security information according to the encryption and decryption key in the first security information includes: When the first standard network is a fourth generation mobile communication network and the second standard network is a fifth generation mobile communication network, using the anchor key in the first security information as an input of the hash function to derive the node key in the second security information; When the first standard network is a fifth generation mobile communication network and the second standard network is a fourth generation mobile communication network, the node key in the first security information is used as the input of the hash function to derive the anchor key in the second security information.

8. The terminal communication management method according to any one of claims 5 to 7, characterized in that: Sending a terminal authentication request to the first management entity based on the access request includes: Extracting a second communication identifier of the terminal in the second-standard network carried by the access request; Generate a first communication identifier of the terminal in a first-standard network according to the second communication identifier; Constructing a terminal authentication request carrying the first communication identifier and the access request; Sending the terminal authentication request to the first management entity.

9. A terminal communication management method, characterized in that: include: The terminal accesses the first standard network, establishes communication with the first management entity, and obtains first security information; When accessing the second-standard network, sending an access request of the second-standard network to the second management entity; The access request carries a security verification code generated by the terminal according to the first security information and the access request; The second management entity receives an access request from the terminal, determines a first management entity corresponding to the terminal according to the access request, and sends a terminal verification request to the first management entity; The terminal verification request carries the security verification code; The first management entity receives the terminal verification request, verifies the terminal according to the security verification code, and sends a pass response to the second management entity when the verification passes; The second management entity receives the pass response sent by the first management entity, obtains second security information, uses the second security information to perform secure communication, and sends a success message to the terminal; The terminal receives the success message sent by the second management entity, generates second security information according to the first security information, and uses the second security information for secure communication; Generating the second security information according to the first security information includes: Generate the encryption and decryption key in the second security information according to the encryption and decryption key in the first security information; The key modification parameter in the second security information is generated according to the key modification parameter in the first security information.

10. The terminal communication management method according to claim 9, characterized in that: The first management entity verifying the terminal includes: The first management entity extracts the first communication identifier and the access request carried in the terminal verification request; Searching for first security information corresponding to the first communication identifier; Generate a verification code according to the first security information and the access request; Extracting the security verification code carried in the access request; Comparing the verification code with the security verification code; If the comparison is successful, the terminal verification is successful.

11. A terminal communication management device, characterized in that: Set in the terminal, the terminal communication management device includes: An access module, configured to access a first-standard network, establish communication with a first management entity, obtain first security information, and send an access request for the second-standard network to the second management entity when accessing a second-standard network; the access request carries a security verification code generated by the terminal according to the first security information and the access request; a receiving module, configured to receive a successful response sent by the second management entity; the successful response is sent by the second management entity when the second management entity sends a terminal verification request to the first management entity based on the access request and when the first management entity passes the terminal verification according to the terminal verification request; A communication module, configured to generate second security information according to the first security information, and use the second security information for secure communication; Generating the second security information according to the first security information includes: Generate the encryption and decryption key in the second security information according to the encryption and decryption key in the first security information; The key modification parameter in the second security information is generated according to the key modification parameter in the first security information.

12. A terminal, characterized in that: include: A processor, a memory and a communication bus, wherein the communication bus is used to realize connection and communication between the processor and the memory; The processor is used to execute one or more programs stored in the memory to implement the steps of the terminal communication management method according to any one of claims 1 to 4.

13. A terminal communication management device, characterized in that: Set in the second management entity, the terminal communication management device includes: a receiving module, configured to receive an access request from a terminal; the access request is sent by the terminal when accessing a second-standard network from a first-standard network, and carries a security verification code generated by the terminal according to first security information and the access request, wherein the first security information is obtained by the terminal after establishing communication with a first management entity in the first-standard network; A verification module, configured to determine, according to the access request, a first management entity corresponding to the terminal, and send a terminal verification request to the first management entity; the terminal verification request carries the security verification code; and receive a pass response sent by the first management entity; the pass response is sent by the first management entity when the terminal verification is successful according to the terminal verification request; A communication module, configured to obtain second security information, use the second security information for secure communication, and send a success response to the terminal; The method of obtaining the second security information includes: directly extracting the second security information carried by the response, where the second security information is generated by the first management entity according to the first security information; or, Extracting the first security information carried by the response, and generating the second security information according to the first security information; Generating the second security information according to the first security information includes: Generate the encryption and decryption key in the second security information according to the encryption and decryption key in the first security information; The key modification parameter in the second security information is generated according to the key modification parameter in the first security information.

14. A management entity, characterized in that: include: A processor, a memory and a communication bus, wherein: The communication bus is used to realize the connection and communication between the processor and the memory; The processor is used to execute one or more programs stored in the memory to implement the steps of the terminal communication management method according to any one of claims 5 to 8.

15. A terminal communication management system, characterized in that: The system comprises a terminal, a first management entity arranged in a first-standard network, and a second management entity arranged in a second-standard network, wherein: The terminal is used to access a first-standard network, establish communication with the first management entity, and obtain first security information; when accessing a second-standard network, send an access request for the second-standard network to the second management entity; the access request carries a security verification code generated by the terminal according to the first security information and the access request; The second management entity is used to receive an access request from the terminal, determine the first management entity corresponding to the terminal according to the access request, and send a terminal verification request to the first management entity; the terminal verification request carries the security verification code; The first management entity is used to receive the terminal verification request, and verify the terminal according to the security verification code, and send a pass response to the second management entity when the verification passes; The second management entity is used to receive a pass response sent by the first management entity, obtain second security information, use the second security information to perform secure communication, and send a success message to the terminal; The terminal is used to receive a success message sent by the second management entity, generate second security information according to the first security information, and use the second security information for secure communication; Generating the second security information according to the first security information includes: Generate the encryption and decryption key in the second security information according to the encryption and decryption key in the first security information; The key modification parameter in the second security information is generated according to the key modification parameter in the first security information.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the terminal communication management method according to any one of claims 1 to 10.

Images