Method and device for sending user identification

Abstract

The present application provides a method and device for sending a user identification, the method comprising: the ME receives USIM card information from the UICC in the cloud card pool through a first communication connection; the ME receives an identity request from the 5G SA network, the identity request is used to request to obtain SUCI; the ME obtains the SUCI according to the identity request and the USIM card information, the USIM card information is used to indicate that the generating device of the SUCI is the ME or the UICC; the ME sends the SUCI to the 5G SA network, the SUCI is used to establish a second communication connection. SUCI can be generated on the ME side or on the UICC side. The first communication connection can be a roaming communication connection, and the second communication connection can be a non-roaming communication connection. The above method can establish a non-roaming 5G communication connection in a cloud communication scenario, saving costs for users.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a method and device for sending a user identification. Background Art

[0002] Cloud communication is a method of establishing a communication connection without using a physical subscriber identity module (SIM) card. The terminal device can establish a first communication connection through a physical or virtual SIM card, obtain cloud SIM card information from the cloud through the communication connection, and use the cloud SIM card information to establish a second communication connection. There is no need to set up two card slots in the terminal device, thereby saving the cost of the terminal device.

[0003] If the second communication link is the fifth generation (5 th In a 5G (5G generation) mobile communication system, if a communication connection is established with a standalone (SA) network, the SA network needs to verify the identity of the terminal device when establishing the second communication connection. How the terminal device completes the identity verification of the SA network to establish the second communication connection in the cloud communication scenario is a problem that needs to be solved at present. Summary of the invention

[0004] The present application provides a method and device for sending a user identification, which can complete the identity verification of the SA network in a cloud communication scenario, thereby establishing a second communication connection.

[0005] In a first aspect, a method for sending a user identification is provided, including: a mobile equipment (ME) receives, through a first communication connection, universal subscriber identity module (USIM) card information from a universal integrated circuit card (UICC) in a cloud card pool; the ME receives an identity request from a 5G SA network, where the identity request is used to request to obtain a subscriber concealed identifier (SUCI); the ME obtains the SUCI according to the identity request and the USIM card information, where the USIM card information is used to indicate that a device generating the SUCI is the ME or the UICC; the ME sends the SUCI to the 5G SA network, where the SUCI is used to establish a second communication connection.

[0006] SUCI can be generated on the ME side or on the UICC side. In some cases, the USIM card information indicates that SUCI is generated on the ME side, then the ME can generate SUCI locally, avoiding the delay of obtaining SUCI from the UICC, so that the second communication connection can be quickly established. In other cases, the USIM card information indicates that SUCI is generated on the UICC side, for example, if the USIM card information lacks 124 service and 125 service, then the ME can obtain SUCI from the UICC, thereby ensuring the successful establishment of the second communication connection.

[0007] In a second aspect, a device for sending a user identification is provided, comprising a unit for executing any one of the methods in the first aspect.

[0008] In a third aspect, a device for sending a user identification is provided, comprising a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the device executes any one of the methods in the first aspect.

[0009] According to a fourth aspect, a computer program product is provided, the computer program product comprising: a computer program code, when the computer program code is executed by a device that sends a user identification, the device executes any one of the methods in the first aspect.

[0010] According to a fifth aspect, a computer-readable medium is provided, wherein the computer-readable medium stores a program code, wherein the program code includes instructions for executing any one of the methods according to the first aspect.

[0011] The present application discloses a method and device for sending a user identification, which can complete the identity verification of the SA network in a cloud communication scenario, thereby establishing a second communication connection in an independent network of a mobile communication system in 5G. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 is a schematic diagram of a communication system provided by the present application;

[0013] Figure 2 It is a schematic diagram of a method for sending a user identification provided by the present application;

[0014] Figure 3 It is a schematic diagram of another method for sending a user identification provided by the present application;

[0015] Figure 4 is a schematic diagram of another method for sending a user identification provided by the present application;

[0016] Figure 5 It is a schematic diagram of a device for sending a user identification provided by the present application;

[0017] Figure 6 This is a schematic diagram of a device for sending a user identification provided by the present application. DETAILED DESCRIPTION

[0018] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0019] First, we introduce the application scenario of this application. Figure 1 is a schematic diagram of a communication system suitable for the present application.

[0020] The communication system 100 includes a network device 110 , a network device 120 , and a terminal device 130 .

[0021] In the present application, the network device 110 may be a base station defined by 3GPP, for example, a base station (gNB) in a 5G communication system. The network device 110 may also be a relay station, an access point, an in-vehicle device, a wearable device, and other types of communication devices.

[0022] The network device 120 may be a server, which is used to provide the terminal device 130 with the information required to establish a communication connection. For example, the server may include at least one UICC. When the terminal device 130 needs to establish a communication connection with the network device 110, the server provides the authentication service required in the process of establishing the communication connection. Therefore, the network device 120 may also be called a remote authentication module or a cloud card pool.

[0023] The terminal device 130 can communicate with the network device 110 and the network device 120. The terminal device 130 may include various handheld devices, vehicle-mounted devices, or wearable devices with wireless communication functions, such as the Third Generation Partnership Project (3GPP) rd The user equipment (UE), mobile station (MS), ME, etc. defined by the 3GPP (3rd Generation Partnership Project).

[0024] The communication system 100 is only an example, and the communication system applicable to the present application is not limited thereto. For example, the communication system 100 includes more network devices.

[0025] In order to ensure the security of the network, when the terminal device 130 attempts to establish a communication connection with the network device 110, the network device 110 needs to verify the identity of the terminal device 130, that is, the network device 110 needs to obtain the SUCI of the terminal device 130. The SUCI can be generated at the terminal device 130 or at the network device 120. After obtaining the SUCI, the terminal device 130 can send the SUCI to the network device 110, so that the network device 110 can establish a communication connection after performing a security check on the SUCI.

[0026] The following describes in detail the method for sending a user ID provided by the present application. Figure 2 As shown, the method 200 includes:

[0027] S210, the ME receives USIM card information from the UICC in the cloud card pool through the first communication connection.

[0028] The first communication connection may be a wireless connection, such as a cellular network connection or a Wi-Fi connection; the first communication connection may also be a wired connection. The present application does not limit the specific form of the first communication connection.

[0029] In the present application, adjectives such as "first" and "second" are used to distinguish different individuals in the same type of objects. For example, the first communication connection and the second communication connection mentioned below represent two different communication connections.

[0030] The USIM card information may be an EFust file (ie, USIM service table) or other information. This application does not limit the specific content of the USIM card information.

[0031] The USIM card information is used to establish a second communication connection. After obtaining the USIM card information, the ME can establish a radio resource control (RRC) link with the 5G SA network and send a registration request containing a globally unique temporary identifier (GUTI) to the 5G SA network through the RRC link. After receiving the registration request, the 5G SA network sends an identity request to the ME, and the ME can perform the following steps.

[0032] S220, the ME receives an identity request from the 5G SA network, where the identity request is used to request to obtain SUCI.

[0033] S230: The ME obtains the SUCI according to the identity request and the USIM card information, where the USIM card information is used to indicate that a device generating the SUCI is the ME or the UICC.

[0034] SUCI can be generated on the ME side or on the UICC side. In some cases, the USIM card information indicates that SUCI is generated on the ME side, then the ME can generate SUCI locally, avoiding the delay of obtaining SUCI from the UICC, so that the second communication connection can be quickly established. In other cases, the USIM card information indicates that SUCI is generated on the UICC side, for example, if the USIM card information lacks 124 service and 125 service, then the ME can obtain SUCI from the UICC, thereby ensuring the successful establishment of the second communication connection.

[0035] Table 1 shows several situations in which ME obtains SUCI.

[0036] Table 1

[0037]

[0038] In Table 1, client refers to the operator.

[0039] When the customer configures the information for executing the unencrypted policy in the USIM card information, and when the USIM card information satisfies any one of the four conditions in Table 1, the ME obtains the SUCI locally according to the identity request. When the customer configures the information for executing the unencrypted policy in the USIM card information, and when the USIM card information does not satisfy any one of the four conditions in Table 1 (i.e., the meaning shown by "N / A" in Table 1), the ME obtains the SUCI from the UICC according to the identity request.

[0040] The four conditions in Table 1 are: the USIM card information includes the configuration information of the operator requesting to generate SUCI at the ME; the USIM card information includes the configuration information of the unauthorized emergency session; the USIM card information is the information of the card before R15; the USIM card information is the information of the R15 card, but the R15 card is configured as an unencrypted card.

[0041] When the customer configures the information of executing encryption policy in the USIM card information, the ME can determine the generation method of SUCI based on whether the EFust file contains 124 service and 125 service, wherein the encryption policy is, for example, elliptic curve integrate encrypt scheme (ECIES).

[0042] For example, when the EFust file does not include the 124 service and the 125 service, the ME generates the SUCI locally; when the EFust file includes the 124 service and the 125 service, the ME obtains the SUCI from the UICC.

[0043] When the ME obtains the SUCI from the UICC according to the identity request, the ME may send a SUCI obtaining request to the UICC through the first communication connection, and receive the SUCI from the UICC through the first communication connection.

[0044] After the ME obtains the SUCI, it can perform the following steps.

[0045] S240, the ME sends the SUCI to the 5G SA network, where the SUCI is used to establish a second communication connection.

[0046] The first communication connection may be a roaming communication connection, and the second communication connection may be a non-roaming communication connection. Through method 200, a non-roaming 5G communication connection may be established in a cloud communication scenario, saving costs for users.

[0047] Combine the following Figure 3 and Figure 4 The process of establishing the second communication connection is further described.

[0048] like Figure 3 As shown, after establishing the first communication connection, the ME establishes an RRC link between the 5G SA network. Subsequently, the ME receives an identity request from the 5G SA network through the RRC link, and determines to obtain the SUCI according to the identity request.

[0049] ME can determine whether to implement the unencrypted policy based on the USIM card information. If the unencrypted policy is implemented, SUCI can be obtained from UICC; if the unencrypted policy is not implemented, ECIES can be implemented and the SUCI generation method can be determined based on whether the EFust file contains 124 service and 125 service.

[0050] When the EFust file does not include 124 services and 125 services, the ME generates SUCI locally; when the EFust file includes 124 services and 125 services, the ME obtains SUCI from the UICC.

[0051] After obtaining the SUCI, the ME may send an identity response including the SUCI to the 5G SA network through the RRC link, and then may receive an authentication request from the 5G SA network through the RRC link. The ME may forward the authentication request to the UICC, and after receiving the authentication response sent by the UICC, forward the authentication response to the 5G SA network through the RRC link, so as to establish a communication connection (i.e., a second communication connection) with the 5G SA network.

[0052] Figure 4 is another schematic diagram of establishing a second communication connection.

[0053] The steps before ME sends the authentication response to the 5G core network (5G core, 5GC) are the same as Figure 3 The authentication request may include 5G authentication and key agreement (AKA) information, and may also include extensible authentication protocol (EAP)-AKA information.

[0054] After 5GC completes the authentication task, it can send a non-access stratum (NAS) security mode command to ME through the radio access network (RAN). After receiving the NAS security mode command, ME executes the NAS security mode and sends a NAS security mode completion message to 5GC through RAN.

[0055] Subsequently, the RAN sends an access stratum (AS) security mode command to the ME. After receiving the AS security mode command, the ME executes the AS security mode and sends an AS security mode completion message to the RAN.

[0056] RAN can also send a 5G capability query message to ME, and ME sends a 5G capability reporting message to RAN after receiving the 5G capability query message.

[0057] Subsequently, the 5GC may send a registration acceptance message to the ME via the RAN, and receive a registration completion message from the ME via the RAN, thereby establishing a second communication connection.

[0058] The above describes in detail an example of a method for sending a user identification provided by the present application. It is understandable that, in order to implement the above functions, the device for sending a user identification includes a hardware structure and / or software module corresponding to each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present application.

[0059] The present application can divide the device for sending user identification into functional units according to the above method example. For example, each function can be divided into each functional unit, or two or more functions can be integrated into one processing unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units. It should be noted that the division of units in the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0060] Figure 5 The schematic diagram of the structure of a device for sending a user identification provided by the present application is shown. The device 500 includes a processing unit 510, a receiving unit 520 and a sending unit 530. The processing unit 510 can realize a receiving function through the receiving unit 520, and the processing unit 510 can also realize a sending function through the sending unit 530.

[0061] The receiving unit 520 is used to: receive USIM card information from the UICC in the cloud card pool through the first communication connection; receive an identity request from the 5G SA network, where the identity request is used to request to obtain SUCI;

[0062] The processing unit 510 is configured to: obtain the SUCI according to the identity request and the USIM card information, where the USIM card information is used to indicate that the device generating the SUCI is the apparatus 500 or the UICC;

[0063] The sending unit 530 is used to: send the SUCI to the 5G SA network, where the SUCI is used to establish a second communication connection.

[0064] Optionally, the processing unit 510 is specifically configured to:

[0065] When the USIM card information includes encryption indication information, and when the USIM card configuration information does not include 124 service and 125 service, locally acquiring the SUCI according to the identity request; or,

[0066] When the USIM card information includes encryption indication information, and when the USIM card configuration information includes 124 service and 125 service, the SUCI is obtained from the UICC according to the identity request.

[0067] Optionally, the processing unit 510 is specifically configured to: send a SUCI acquisition request to the UICC through the first communication connection according to the identity request; and acquire the SUCI from the UICC through the first communication connection.

[0068] Optionally, the processing unit 510 is specifically configured to:

[0069] When the USIM card information does not include encryption indication information, and when the USIM card information does not satisfy any one of the following four conditions, obtaining the SUCI from the UICC according to the identity request; or,

[0070] When the USIM card information does not include encryption indication information, and when the USIM card information satisfies any one of the following four conditions, obtaining the SUCI locally according to the identity request;

[0071] The four conditions are: the USIM card information includes configuration information of the operator requesting to generate the SUCI at the device 500; the USIM card information includes configuration information of an unauthorized emergency session; the USIM card information is information of a card before R15; the USIM card information is information of an R15 card, but the R15 card is configured as an unencrypted card.

[0072] Optionally, the processing unit 510 is specifically configured to: send a SUCI acquisition request to the UICC through the first communication connection according to the identity request; and acquire the SUCI from the UICC through the first communication connection.

[0073] The specific manner in which the device 500 executes the method 200 and the beneficial effects produced can refer to the relevant description in the above method embodiment.

[0074] Figure 6 The schematic diagram of the structure of a device for sending a user identification provided by the present application is shown, wherein the dotted box indicates that the module or unit is optional. The device 600 can be used to implement the method described in the above method embodiment, and the device 600 can be a chip or a terminal device.

[0075] The device 600 includes one or more processors 601, which can support the device 600 to implement Figure 2 The method in the corresponding method embodiment. The processor 601 can be a general-purpose processor or a special-purpose processor. For example, the processor 601 can be a central processing unit (CPU) or a baseband processor. The baseband processor can be used to process communication data (for example, SUCI), and the CPU can be used to control the device 600, execute software programs, and process data of software programs.

[0076] The device 600 may further include a transceiver unit 605 and an antenna 606 to implement signal input (reception) and output (transmission).

[0077] For example, the device 600 may be a chip, the transceiver unit 605 may be an input and / or output circuit of the chip, or the transceiver unit 605 may be a communication interface of the chip, and the chip may be a component of a terminal device or other wireless communication device.

[0078] The device 600 may include one or more memories 602, on which a program 604 is stored. The program 604 can be executed by the processor 601 to generate instructions 603, so that the processor 601 performs the method described in the above method embodiment according to the instructions 603. Optionally, data may also be stored in the memory 602. Optionally, the processor 601 may also read the data stored in the memory 602, and the data may be stored at the same storage address as the program 604, or the data may be stored at a different storage address from the program 604.

[0079] The processor 601 and the memory 602 may be provided separately or integrated together, for example, integrated on a system on chip (SOC).

[0080] It should be understood that each step of the above method embodiment can be completed by a hardware-based logic circuit or a software-based instruction in the processor 601. The processor 601 can be a CPU, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, such as discrete gates, transistor logic devices, or discrete hardware components.

[0081] The specific manner in which the device 600 executes the method 200 and the beneficial effects produced can refer to the relevant description in the above method embodiment.

[0082] The present application also provides a computer program product, which, when executed by the processor 601, implements the communication method described in any method embodiment of the present application.

[0083] The computer program product may be stored in the memory 602 , for example, a program 604 , which is converted into an executable target file that can be executed by the processor 601 after preprocessing, compiling, assembling, and linking.

[0084] The present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a computer, the communication method described in any method embodiment of the present application is implemented. The computer program can be a high-level language program or an executable target program.

[0085] The computer-readable storage medium is, for example, a memory 602. The memory 602 may be a volatile memory or a nonvolatile memory, or the memory 602 may include both a volatile memory and a nonvolatile memory. Among them, the nonvolatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0086] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0087] In several embodiments provided in the present application, the disclosed systems, devices and methods can be implemented in other ways. For example, some features of the method embodiments described above can be ignored or not performed. The device embodiments described above are merely schematic, and the division of units is only a logical function division. There may be other division methods in actual implementation, and multiple units or components may be combined or integrated into another system. In addition, the coupling between the units or the coupling between the components may be direct coupling or indirect coupling, and the above coupling includes electrical, mechanical or other forms of connection.

[0088] It should be understood that in the various embodiments of the present application, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0089] In addition, the terms "system" and "network" are often used interchangeably in this article. The term "and / or" in this article is only a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0090] In short, the above is only a preferred embodiment of the technical solution of this application, and is not intended to limit the protection scope of this application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application should be included in the protection scope of this application.

Claims

1. A method for sending a user identification, characterized in that: include: The mobile device ME receives the universal user identity module USIM card information from the universal integrated circuit card UICC in the cloud card pool through the first communication connection; The ME receives an identity request from a fifth generation 5G independent SA network, where the identity request is used to request to obtain a user encryption identity SUCI; The ME acquires the SUCI according to the identity request and the USIM card information, where the USIM card information is used to indicate that a device generating the SUCI is the ME or the UICC; The ME sends the SUCI to the 5G SA network, where the SUCI is used to establish a second communication connection; The ME obtains the SUCI according to the identity request and the USIM card information, including: When the USIM card information includes encryption indication information, and when the USIM card configuration information does not include 124 service and 125 service, the ME obtains the SUCI locally according to the identity request; or, When the USIM card information includes encryption indication information, and when the USIM card configuration information includes 124 service and 125 service, the ME obtains the SUCI from the UICC according to the identity request; When the USIM card information does not include encryption indication information, and when the USIM card information does not satisfy any one of the following four conditions, the ME obtains the SUCI from the UICC according to the identity request; or, When the USIM card information does not include encryption indication information, and when the USIM card information satisfies any one of the following four conditions, the ME obtains the SUCI locally according to the identity request; The four conditions are: the USIM card information includes configuration information of the operator requesting to generate the SUCI at the ME; the USIM card information includes configuration information of an unauthorized emergency session; the USIM card information is information of a card before R15; the USIM card information is information of an R15 card, but the R15 card is configured as an unencrypted card; The first communication connection is a roaming communication connection, and the second communication connection is a non-roaming communication connection; The USIM card information is an EFust file. The ME obtains the USIM card information and establishes an RRC link with the 5G SA network, and sends a registration request including the GUTI to the 5G SA network through the RRC link. After receiving the registration request, the 5G SA network sends an identity request to the ME. After the ME sends an authentication response to the 5G core network, the 5G core network sends a NAS security mode command to the ME through the RAN. After receiving the NAS security mode command, the ME sends a NAS security mode completion message to the 5G core network through the RAN. After the RAN sends the AS security mode command to the ME, it executes the AS security mode and sends an AS security mode completion message to the RAN. The 5G core network sends a registration acceptance message to the ME through the RAN, and receives the registration completion message from the ME through the RAN, thereby establishing a second communication connection.

2. The method according to claim 1, characterized in that The ME obtaining the SUCI from the UICC according to the identity request includes: The ME sends a SUCI acquisition request to the UICC through the first communication connection according to the identity request; The ME obtains the SUCI from the UICC through the first communication connection.

3. A device for sending a user identification, characterized in that: It includes a receiving unit, a processing unit and a sending unit. The receiving unit is used to: receive global user identity module USIM card information from a universal integrated circuit card UICC in a cloud card pool through a first communication connection; receive an identity request from a fifth-generation 5G independent SA network, wherein the identity request is used to request to obtain a user encryption identity SUCI; The processing unit is configured to: acquire the SUCI according to the identity request and the USIM card information, wherein the USIM card information is used to indicate that a device generating the SUCI is the apparatus or the UICC; The sending unit is used to: send the SUCI to the 5G SA network, where the SUCI is used to establish a second communication connection; When the USIM card information includes encryption indication information, and when the USIM card configuration information does not include 124 service and 125 service, locally acquiring the SUCI according to the identity request; or, When the USIM card information includes encryption indication information, and when the USIM card configuration information includes 124 service and 125 service, obtaining the SUCI from the UICC according to the identity request; When the USIM card information does not include encryption indication information, and when the USIM card information does not satisfy any one of the following four conditions, obtaining the SUCI from the UICC according to the identity request; or, When the USIM card information does not include encryption indication information, and when the USIM card information satisfies any one of the following four conditions, obtaining the SUCI locally according to the identity request; The four conditions are: the USIM card information includes configuration information of the operator requesting to generate the SUCI at the device; the USIM card information includes configuration information of an unauthorized emergency session; the USIM card information is information of a card before R15; the USIM card information is information of an R15 card, but the R15 card is configured as an unencrypted card; The first communication connection is a roaming communication connection, and the second communication connection is a non-roaming communication connection; The USIM card information is an EFust file. The ME obtains the USIM card information and establishes an RRC link with the 5G SA network, and sends a registration request including the GUTI to the 5G SA network through the RRC link. After receiving the registration request, the 5G SA network sends an identity request to the ME. After the ME sends an authentication response to the 5G core network, the 5G core network sends a NAS security mode command to the ME through the RAN. After receiving the NAS security mode command, the ME sends a NAS security mode completion message to the 5G core network through the RAN. After the RAN sends the AS security mode command to the ME, it executes the AS security mode and sends an AS security mode completion message to the RAN. The 5G core network sends a registration acceptance message to the ME through the RAN, and receives the registration completion message from the ME through the RAN, thereby establishing a second communication connection.

4. The device according to claim 3, characterized in that The processing unit is specifically used for: sending a SUCI acquisition request to the UICC through the first communication connection according to the identity request; The SUCI is obtained from the UICC through the first communication connection.

Images