CAG information processing method, terminal, network element and USIM

Abstract

The present invention provides a CAG information processing method, a terminal, a network element and a USIM. The CAG information processing method applied to the terminal comprises: when the terminal successfully registers in a public land mobile network PLMN, receiving update information sent by a first network element of a visited public land mobile network VPLMN; when the first protection information is different from the second protection information, performing a first operation. The present invention can improve the reliability of terminal service execution.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communication technology, and in particular to a CAG information processing method, a terminal, a network element and a USIM. Background Art

[0002] In a mobile communication system, the Home Public Land Mobile Network (HPLMN) can send Closed Access Group (CAG) information to a terminal through the Visiting Public Land Mobile Network (VPLMN). When forwarding the CAG information sent by the HPLMN, the VPLMN may tamper with the CAG information.

[0003] However, in the prior art, the terminal cannot distinguish whether the received CAG information is tampered by the VPLMN. Thus, if the CAG information received by the terminal is tampered by the VPLMN, the terminal will not perform services on the network expected by the HPLMN, resulting in low reliability of service execution. Summary of the invention

[0004] The embodiment of the present invention provides a CAG information processing method, a terminal, a network element and a USIM to solve the problem that the existing terminal cannot distinguish whether the received CAG information is tampered with by the VPLMN, resulting in that when the CAG information received by the terminal is tampered with by the VPLMN, the terminal does not execute the service on the network expected by the HPLMN, resulting in low reliability of service execution.

[0005] To solve the above problems, the present invention is achieved as follows:

[0006] In a first aspect, an embodiment of the present invention provides a CAG information processing method, which is applied to a terminal, and the method includes:

[0007] When the terminal successfully registers in a public land mobile network PLMN, receiving update information sent by a first network element of a visited public land mobile network VPLMN, the update information including target information, header information, counter information and first protection information corresponding to the target information;

[0008] In the case where the first protection information is different from the second protection information, performing a first operation, the first operation comprising at least one of the following: discarding the target information; reducing the priority of the first object; leaving the first object; giving up sending feedback information corresponding to the target information to the home public land mobile network HPLMN;

[0009] The second protection information is generated based on the target information, the header information, the counter information and the key information stored in the terminal; the target information is any one of the following: the updated CAG information, the first security package corresponding to the updated CAG information, the first roaming control SOR information including the updated CAG information, and the second security package corresponding to the first SOR information; the first object is any one of the following: the VPLMN, the tracking area TA in the VPLMN, the CAG cell in the VPLMN, and the non-CAG cell in the VPLMN.

[0010] In a second aspect, an embodiment of the present invention provides a CAG information processing method, which is applied to a first network element of a VPLMN, and the method includes:

[0011] When the terminal successfully registers in the PLMN, receiving first indication information sent by a second network element of the HPLMN, wherein the first indication information includes update information and is used to instruct the first network element to forward the update information to the terminal;

[0012] Sending the update information to the terminal;

[0013] The update information includes target information, header information, counter information and first protection information corresponding to the target information, and the target information is any one of the following: updated CAG information, a first security package corresponding to the updated CAG information, a first roaming control SOR information including the updated CAG information, and a second security package corresponding to the first SOR information.

[0014] In a third aspect, an embodiment of the present invention provides a CAG information processing method, which is applied to a second network element in a HPLMN, and is characterized in that the method includes:

[0015] When the terminal successfully registers in the PLMN and the CAG information is updated, sending first indication information to a first network element of the VPLMN, where the first indication information includes update information and is used to instruct the first network element to forward the update information to the terminal;

[0016] The update information includes target information, header information, counter information and first protection information corresponding to the target information, and the target information is any one of the following: updated CAG information, a first security package corresponding to the updated CAG information, a first roaming control SOR information including the updated CAG information, and a second security package corresponding to the first SOR information.

[0017] In a fourth aspect, an embodiment of the present invention provides a CAG information processing method, which is applied to a USIM, and the method includes:

[0018] receiving security package information sent by a terminal, the security package information including a first security package corresponding to the updated CAG information or a second security package corresponding to the first SOR information, the first SOR information including the updated CAG information;

[0019] Sending the updated CAG information to the terminal.

[0020] In a fifth aspect, an embodiment of the present invention further provides a terminal, the terminal comprising:

[0021] A first receiving module is used to receive update information sent by a first network element of a visited public land mobile network VPLMN when the terminal is successfully registered in the public land mobile network PLMN, wherein the update information includes target information, header information, counter information and first protection information corresponding to the target information;

[0022] an operation module, configured to perform a first operation when the first protection information is different from the second protection information, wherein the first operation includes at least one of the following: discarding the target information; reducing the priority of the first object; leaving the first object; and giving up sending feedback information corresponding to the target information to a home public land mobile network HPLMN;

[0023] The second protection information is generated based on the target information, the header information, the counter information and the key information stored in the terminal; the target information is any one of the following: the updated CAG information, the first security package corresponding to the updated CAG information, the first roaming control SOR information including the updated CAG information, and the second security package corresponding to the first SOR information; the first object is any one of the following: the VPLMN, the tracking area TA in the VPLMN, the CAG cell in the VPLMN, and the non-CAG cell in the VPLMN.

[0024] In a sixth aspect, an embodiment of the present invention further provides a network element, where the network element is a first network element of a VPLMN, and the network element includes:

[0025] a fourth receiving module, configured to receive, when the terminal successfully registers in the PLMN, first indication information sent by a second network element of the HPLMN, wherein the first indication information includes update information and is configured to instruct the first network element to forward the update information to the terminal;

[0026] A fourth sending module, used for sending the update information to the terminal;

[0027] The update information includes target information, header information, counter information and first protection information corresponding to the target information, and the target information is any one of the following: updated CAG information, a first security package corresponding to the updated CAG information, a first roaming control SOR information including the updated CAG information, and a second security package corresponding to the first SOR information.

[0028] In a seventh aspect, an embodiment of the present invention further provides a network element, where the network element is a second network element in the HPLMN, and the network element includes:

[0029] a seventh sending module, configured to send first indication information to a first network element of a VPLMN when the terminal is successfully registered in the PLMN and the CAG information is updated, wherein the first indication information includes update information and is configured to instruct the first network element to forward the update information to the terminal;

[0030] The update information includes target information, header information, counter information and first protection information corresponding to the target information, and the target information is any one of the following: updated CAG information, a first security package corresponding to the updated CAG information, a first roaming control SOR information including the updated CAG information, and a second security package corresponding to the first SOR information.

[0031] In an eighth aspect, an embodiment of the present invention further provides a USIM, wherein the USIM includes:

[0032] an eighth receiving module, configured to receive security package information sent by the terminal, the security package information including a first security package corresponding to the updated CAG information or a second security package corresponding to the first SOR information, the first SOR information including the updated CAG information;

[0033] The tenth sending module is used to send the updated CAG information to the terminal.

[0034] In the ninth aspect, an embodiment of the present invention further provides a communication device, comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the method of the first aspect, the second aspect, the third aspect, or the fourth aspect as described above.

[0035] In the tenth aspect, an embodiment of the present invention further provides a readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method of the first aspect, the second aspect, the third aspect or the fourth aspect described above is implemented.

[0036] In the eleventh aspect, an embodiment of the present invention provides a chip, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the methods of the first aspect, the second aspect, the third aspect or the fourth aspect as described above.

[0037] In an embodiment of the present invention, the terminal can determine whether the target information is tampered with by the VPLMN by comparing whether the received first protection information is the same as the second protection information generated by itself, and can perform the first operation when the first protection information is different from the second protection information, thereby improving the reliability of service execution. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0039] Figure 1 is a schematic diagram of a UE configuration update process provided by an embodiment of the present invention;

[0040] Figure 2 is one of the flow charts of the CAG information processing method provided by an embodiment of the present invention;

[0041] Figure 3 This is the second flowchart of the CAG information processing method provided by the embodiment of the present invention;

[0042] Figure 4 This is the third flowchart of the CAG information processing method provided by the embodiment of the present invention;

[0043] Figure 5 This is the fourth flowchart of the CAG information processing method provided by an embodiment of the present invention;

[0044] Figure 6 This is the fifth flowchart of the CAG information processing method provided by the embodiment of the present invention;

[0045] Figure 7 This is the sixth flowchart of the CAG information processing method provided by the embodiment of the present invention;

[0046] Figure 8 This is the seventh flowchart of the CAG information processing method provided by an embodiment of the present invention;

[0047] Fig. 9 This is the eighth flowchart of the CAG information processing method provided by the embodiment of the present invention;

[0048] Fig.10 is a structural diagram of a terminal provided by an embodiment of the present invention;

[0049] Fig.11 It is one of the structural diagrams of the network element provided by the embodiment of the present invention;

[0050] Fig.12 This is the second structural diagram of the network element provided by the embodiment of the present invention;

[0051] Fig.13 is a structural diagram of a USIM provided by an embodiment of the present invention;

[0052] Fig.14 It is a structural diagram of a communication device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] In the embodiment of the present invention, the terminal may be a mobile phone, a tablet personal computer, a laptop computer, a personal digital assistant (PDA), a mobile Internet device (MID), a wearable device (Wearable Device) or a vehicle-mounted device, etc. In addition, the terminal may also be referred to as a user equipment (UE). The first network element in the visit public land mobile network (VPLMN) may be an access and mobility management function (AMF), etc. The second network element in the home public land mobile network (HPLMN) may be a unified data management entity (UDM), etc. The third network element of the HPLMN may be an authentication server function (AUSF), etc.

[0055] For ease of understanding, some contents involved in the embodiments of the present invention are described below:

[0056] 1. UE configuration update process

[0057] like Figure 1 As shown, the process may include the following steps:

[0058] Step 101: The access and AMF sends a configuration update command (Configuration Update Command) to the UE.

[0059] Step 102: The UE sends a Configuration Update Complete message to the AMF.

[0060] The configuration update command may include closed access group (CAG) information list information. In the embodiment of the present invention, the CAG information list information may also be referred to as CAG information. The configuration update command may be an air interface message.

[0061] The format of the configuration update command can be seen in Table 1.

[0062] Table 1: Contents of the configuration update command

[0063] IEI IE Type / Reference state Format Length (bytes) Configuration update command message identifier Message Type 9.7 M V 1 F- …… …… 75 CAG information list CAG information list 9.11.3.18A O TLV-E 3-n

[0064] In Table 1, Information Element Indication (IEI); Information Element (IE); Type (Type); Reference (Reference); Presence (Presence); Format (Format); Length (Length); Extended protocol discriminator (Extended protocol discriminator); Security header type (Securityheader type); Spare half octet (Spare half octet); Configuration update command message identity (Configuration update command message identity); Message type (Message type); General Packet Radio Service (GPRS).

[0065] The CAG information list is a type 6 information element, with a minimum length of 3 octets. The CAG information list can be found in Table 2.

[0066] Table 2: CAG information list IE

[0067]

[0068] In Table 2, the length of the CAG information list contents (Length of CAG information list contents); the entry (Entry) in Table 2 can be found in Table 3.

[0069] Table 3: Entry n

[0070]

[0071] In Table 3, the length of entry contents; CAG identifier (CAG-ID); Spare; and MCC digit.

[0072] In addition, the CAG information list IE may also include: bits 1 to 4 of octet q+1 and octet q+2 include the Mobile Country Code (MCC); bits 5 to 8 of octet q+2 and octet q+3 include the Mobile Network Code (MNC); bit 1 of octet q+4 includes an indication that the UE is only allowed to access 5GS via CAG cells (CAG only)). If the value of bit 1 of octet q+4 is 0, it means that the above indication is not set ('Indication that the UE is only allowed to access 5GS via CAG cells' is not set), in which case the UE can access the 5GS through a non-CAG cell. If the value of bit 1 of octet q+4 is 1, it means that the above indication has been set ('Indication that the UE is only allowed to access 5GS via CAG cells' is set). In this case, the UE cannot access 5GS via non-CAG cells.

[0073] The following is a description of the CAG information processing method according to an embodiment of the present invention.

[0074] See also Figure 2 , Figure 2 This is one of the flow charts of the CAG information processing method provided by the embodiment of the present invention. The CAG information processing method of the embodiment of the present invention is applied to a terminal.

[0075] like Figure 2 As shown, the CAG information processing method applied to the terminal may include the following steps:

[0076] Step 201: When the terminal is successfully registered in the public land mobile network PLMN, receive update information sent by a first network element of a visited public land mobile network VPLMN.

[0077] In specific implementation, after the UE successfully registers in the PLMN, the HPLMN will send the CAG information update information to the UE through the VPLMN if the CAG information is updated. In actual applications, the UE successfully registers in the PLMN and may include at least one of the following: the UE successfully registers in the HPLMN, or the UE successfully registers in the VPLMN.

[0078] The update information includes target information, header information, counter information and first protection information corresponding to the target information.

[0079] The target information can be used by the UE to obtain updated CAG information. Specifically, the target information can be any one of the following: updated CAG information, a first security package corresponding to the updated CAG information, a first roaming control (Steering Of Roaming, SOR) information including the updated CAG information, and a second security package corresponding to the first SOR information. The first security package is a security package obtained by encrypting the updated CAG information; the second security package is a security package obtained by encrypting the first SOR information including the updated CAG information.

[0080] Step 202: When the first protection information is different from the second protection information, perform a first operation.

[0081] The second protection information is generated based on the target information, the header information, the counter information and the secret key information stored in the terminal. In practical applications, the secret key information stored in the terminal can be calculated by the terminal itself or extracted from the USIM by the terminal.

[0082] In this embodiment, the generation principle of the second protection information is the same as the generation principle of the first protection information. However, it can be seen from the foregoing that when the VPLMN forwards the CAG information sent by the HPLMN to the UE, it may tamper with the CAG information, that is, the target information used to generate the first protection information (hereinafter referred to as the first target information) may be different from the target information used to generate the second protection information (hereinafter referred to as the second target information), which may cause the first protection information and the second protection information to be different. Therefore, in this embodiment, the UE can determine whether the received target information is the target information actually sent by the HPLMN based on the determination result of whether the first protection information is equal to the second protection information, that is, determine whether the received target information is tampered with by the VPLMN.

[0083] When the first protection information is different from the second protection information, it indicates that the target information received by the UE is tampered by the VPLMN, and the reliability of the VPLMN is low. Therefore, the UE may perform a first operation. In this embodiment, the first operation may include at least one of the following:

[0084] discarding the target information;

[0085] Lower the priority of the first object;

[0086] leaving the first object;

[0087] Abandon sending feedback information corresponding to the target information to the HPLMN.

[0088] The first object may be any one of the following: the VPLMN, a Tracking Area (TA) in the VPLMN, a CAG cell in the VPLMN, or a non-CAG cell in the VPLMN. Further, the first object may be the TA in the VPLMN where the UE is located when receiving the update information, or the CAG cell in the VPLMN where the UE is located when receiving the update information.

[0089] For the scenario where the first operation includes discarding the target information, the UE will not execute the service according to the received target information tampered by the VPLMN, thereby avoiding the situation where the service is executed on a network not designated by the HPLMN, thereby improving the reliability of service execution.

[0090] For the scenario where the first operation includes lowering the priority of the first object, the UE may perform any one of the following: setting the first object as the object with the lowest priority when the CAG is selected; lowering the priority of the first object by p levels, where p may be configured by the network side device or agreed upon by the protocol; placing the first object in a low priority list. In this way, when the UE selects an object, the first object will not be selected first, thereby improving the reliability of service execution.

[0091] For a scenario where the first operation includes leaving the first object, in specific implementation, the operation of the UE leaving the first object may be triggered by any one of the following: UE active triggering, event triggering.

[0092] In the case of active triggering by the UE, when the UE detects that the first protection information is different from the second protection information, the UE can actively trigger the process of leaving the first object.

[0093] In the case of event triggering, optionally, the leaving the first object may include at least one of the following:

[0094] When the first object enters an idle state, leaving the first object;

[0095] When a first command is received, the terminal leaves the first object, where the first command is used to instruct the terminal to leave the first object.

[0096] It should be understood that after leaving the first object, the UE can select other objects to access, thereby improving the reliability of service execution.

[0097] For the scenario where the first operation includes giving up sending feedback information corresponding to the target information to the HPLMN, the UE does not send feedback information corresponding to the target information to the HPLMN, so that the HPLMN can know that the UE has not received the correct target information, and can perform related operations, such as: resending update information to the UE, or triggering the UE to leave the first object, so as to improve the reliability of UE service execution.

[0098] In the CAG information processing method of this embodiment, the terminal can determine whether the target information is tampered with by the VPLMN by comparing whether the received first protection information is the same as the second protection information generated by itself, and can perform the first operation when the first protection information is different from the second protection information, thereby improving the reliability of service execution.

[0099] In this embodiment, the update information sent by the VPLMN to the UE may be carried in (borne on) any downlink message, which is not limited in this embodiment of the present invention.

[0100] Optionally, the update information is carried in a first container of a downlink non-access layer NAS transmission message; or, the update information is carried in a first CAG information container.

[0101] The specific instructions are as follows:

[0102] Case 1: The update information is carried in the first container of a downlink (DL) non-access stratum (NAS) transport message.

[0103] In case 1, the update information may be carried in a first DL NAS transmission message. The content of the first DL NAS transmission message may be shown in Table 4.

[0104] Table 4: Contents of DL NAS transport message

[0105]

[0106] The payload container type in Table 4 can be found in Table 5, and the format of the payload container IE can be found in Table 6.

[0107] Table 5: Load container types

[0108]

[0109] Table 6: Load Container IE

[0110]

[0111] In Table 5, Short Message Service (SMS); LTE Positioning Protocol (LPP); Long Term Evolution (LTE) UE policy container (UE policy container); UE Parameters Update (UPU); Location services message container (Location services message container); Multiple payloads.

[0112] In a specific implementation, the first container may be any payload container in Table 5. Optionally, the first container may be: a UPU transparent container, or a SOR transparent container.

[0113] Optionally, the target information is carried in a UPU list in the UPU transparent container, or the target information is carried in a SOR list in the SOR transparent container.

[0114] Furthermore, the target information is carried in a target data group in the UPU list or the SOR list, and a CAG information type is newly added to the type of the target data group.

[0115] In specific implementation, in the first implementation, the type of each data group in the UPU list or SOR list may be newly added with a CAG information type. In this implementation, the target data group may be any target data group in the UPU list or SOR list, such as the first data group, or the i-th data group, etc. In the second implementation, the UPU list or SOR list may only have a CAG information type added to the type of one data group. In this implementation, the target data group is the data group in the UPU list or SOR list that has a CAG information type added to it. Of course, in other implementations, the types of some data groups in the UPU list or SOR list may be newly added with a CAG information type, and this embodiment does not limit this.

[0116] For ease of understanding, the specific instructions are as follows:

[0117] Implementation method 1: the target information is carried in the target data group of the UPU list in the UPU transparent container.

[0118] In this implementation, the load type in Table 4 is 0110, that is, a UPU transparent container. At this time, the encoding method of the load container content of the load container IE in Table 6 is the same as the content of the UPU transparent container IE. The content of the UPU transparent container IE can be found in Table 7.

[0119] Table 7: UPU transparent container IE

[0120]

[0121] In implementation mode 1, since the update information is carried in a UPU transparent container, the header information may be expressed as UPU header information, carried in the UPU header in Table 7; the first protection information may be expressed as UPU-MAC-I AUSF ; The counter information can be expressed as: Counter UPU The format of the UPU header can be found in Table 8a, and the format of the UPU list can be found in Table 8b.

[0122] Table 8a: UPU header

[0123]

[0124] In Table 8a, REG is used to indicate whether the UE re-initiates registration; ACK is used to indicate whether the UE feeds back CAG information.

[0125] Table 8b: UPU List

[0126]

[0127] In Table 8, at least one UPU data group type is newly added with a CAG information type. Thus, when the type of a certain UPU data group is selected as the CAG information type, the target information can be carried in the UPU data group, that is, the content of the UPU data group includes the target information. The type of the UPU data group can be seen in Table 9.

[0128] Table 9: Types of UPU data groups

[0129]

[0130] In Table 9, Routing indicator update data; Default configured NSSAI update data.

[0131] As can be seen from Table 9, when the bit indicating the type of the target data group takes the value of 0001, the content of the target data group includes the routing indication update data; when the bit indicating the type of the target data group takes the value of 0010, the content of the target data group includes the default configured NSSAI update data; when the bit indicating the type of the target data group takes the value of 0010, the content of the target data group includes CAG information. Therefore, when the target information is carried by the target data group, the bit indicating the type of the target data group can be set to 0010, as shown in the following example:

[0132] In Example 1, the UPU list can be seen in Table 10. In Table 10, the type of the first data group in the UPU list is 0010, so the first data group is used to carry the target information. That is, in Table 10, the target information is placed in the first data group in the UPU list of the UPU transparent container.

[0133] Table 10: UPU List

[0134]

[0135] In Example 2, the UPU list can be seen in Table 11. In Table 11, the type of the i-th data group in the UPU list is 0010, so the i-th data group is used to carry the target information. That is, in Table 11, the target information is placed in the i-th data group in the UPU list of the UPU transparent container.

[0136] Table 11: UPU List

[0137]

[0138] In the first implementation mode, the format of the CAG information may be the same as the format of Table 2, or the first byte in Table 2 may be removed based on the format of Table 2, and the rest of the format may remain the same as Table 2.

[0139] Embodiment 2: The target information is carried in the target data group of the SOR list in the SOR transparent container.

[0140] In this implementation, the payload type in Table 4 is 0100, that is, a SOR transparent container. At this time, the encoding method of the content of the payload container is the same as the content of the SOR transparent container IE. The content of the SOR transparent container IE can be seen in Table 12.

[0141] Table 12: SOR transparent container IE

[0142]

[0143] In the first implementation mode, since the update information is carried in the SOR transparent container, the header information can be expressed as SOR header information, which is carried in the SOR header in Table 12; the first protection information can be expressed as SOR-MAC-I AUSF ; The counter information can be expressed as: Counter SOR The format of the SOR list can be found in Table 13. In the embodiment of the present invention, the SOR list may also be called a SOR transparent information list (SOR Transparent Information list).

[0144] Table 13: SOR List

[0145]

[0146] The type of the target data group in Table 13 is newly added with a CAG information type, so that the target information can be carried in the target data group, that is, the content of the target data group includes the target information.

[0147] Case 2: the update information is carried in the first CAG information container.

[0148] In practical applications, the update information may be carried in any downlink message including a CAG information container.

[0149] Optionally, the first CAG information container is a container newly added to the downlink NAS transmission message. In this optional implementation, the update information may be carried in a second DL NAS transmission message newly added with a CAG information container.

[0150] In specific implementation, the payload container type of the second DL NAS transmission message is newly added with a CAG information container. The content of the second DL NAS transmission message can be seen in Table 4, the format of the payload container IE can be seen in Table 6, and the payload container type can be seen in Table 14.

[0151] Table 14: Load container types

[0152]

[0153] Compared with the payload container type in Table 5, the payload container type in Table 14 is newly added with a CAG information container. It can be seen that in case 2, in order to transmit the update information through the payload container IE in the DL NAS transport message, a CAG information container is newly added to the payload container type in the DL NAS transport message, and the CAG information container is used to carry the update information (If the payload container type is set to "CAG Information list data CONTAINER" and is included in the DL NAS TRANSPORT message, the payload container contents are coded the same way as the contents of the CAG Information list data transparent container IE for CAG data type is set to value "0").

[0154] The purpose of the newly added CAG information container IE is to provide CAG information such as CAG Information list, and optionally, whether the UE is required to feedback CAG information (The purpose of the CAG Information list data transparent container information element in the DL NAS TRANSPORT message is to provide the CAG data (eg CAG Information list) and optional acknowledgement request). The format of the newly added CAG information container IE can be found in Table 15a and Table 15b.

[0155] Table 15a: CAG Information Container IE

[0156]

[0157] Table 15b: CAG Information Container IE

[0158]

[0159] In case 2, since the update information is carried in the CAG information container, the header information may be expressed as CAG header information, carried in the CAG header in Table 15a or Table 15b; the first protection information may be expressed as CAG-MAC-I AUSF ; The counter information can be expressed as: Counter CAG .

[0160] The difference between the CAG information container IE shown in Table 15a and Table 15b is that the target information carried by the CAG information container is expressed in different forms. Optionally, when the target information is the updated CAG information, the target information can be carried in the CAG information container shown in Table 15b; when the target information is the security package corresponding to the updated CAG information, the target information can be carried in the CAG information container shown in Table 15a.

[0161] The header of the CAG header in Table 15a and Table 15b can be found in Table 16.

[0162] Table 16: CAG header

[0163]

[0164] In case 2, CAG-MAC-I AUSF 、CAG-MAC-I UE and Counter CAG Generation principle and UPU-MAC-I AUSF 、UPU-MAC-I UE and Counter UPU The generation principle is the same and will not be repeated here.

[0165] For the bit used to indicate the CAG data type in Table 16, if the value is 0, it can represent that the CAG information container carries CAG information (The CAG transparent container carries CAG information); if the value is 1, it can represent that the CAG information container carries the confirmation of successful reception of the steering of roaming information (The CAG transparent container carries acknowledgement of successful reception of the steering of roaming information).

[0166] For the bit used to indicate the list indication in Table 16, if the value is 0, it can indicate that the HPLMN indicates "no change of the CAG information stored in the UE is needed and thus no list of CAG information is provided" (HPLMN indication that 'no change of the CAG information stored in the UE is needed and thus no list of CAG information is provided'); if the value is 1, it can indicate that a CAG information list is provided (list of CAG information is provided).

[0167] For the bit used to indicate the list type in Table 16, if the value is 0, it can be represented that the list type is a secured packet (The list type is a secured packet); if the value is 1, it can be represented that the list type is CAG information (The list type is a "CAG information list").

[0168] For the bit used to indicate the ACK type in Table 16, if the value is 0, it can represent that there is no requirement for feedback of the target information (acknowledgement not requested); if the value is 1, it can represent that feedback of the target information is requested (acknowledgement requested).

[0169] In case 2, the format of the CAG information may be the same as the format of the CAG information in case 1.

[0170] The following describes a case in which the first protection information and the second protection information are the same in this embodiment.

[0171] Optionally, when the first protection information is the same as the second protection information, the method further includes:

[0172] The feedback information is sent to the HPLMN, where the feedback information is used to indicate that the terminal has successfully received the updated CAG information.

[0173] In this way, after receiving the feedback information, the HPLMN can compare the feedback information with the verification information generated by itself, and further determine whether the UE has really received the updated CAG information sought according to the comparison result.

[0174] In specific implementation, the feedback information may be transmitted via any uplink message.

[0175] Optionally, the feedback information is carried in a second container of an uplink (Uplink, UL) NAS transmission message; or, the feedback information is carried in a second CAG information container.

[0176] In the case where the feedback information is carried in the second container, the second container may be any container of a UL NAS transmission message. Optionally, the second container is: a UPU transparent container, or a SOR transparent container.

[0177] In the case where the feedback information is carried in a CAG information container, the feedback information may be carried in any uplink message including the CAG information container.

[0178] Optionally, the second CAG information container may be a container newly added to the uplink NAS transmission message.

[0179] In this optional implementation, the update information may be carried in a UL NAS transmission message with a newly added CAG information container. In specific implementation, a CAG information container is newly added to the payload container type of the UL NAS transmission message. It can be seen that in order to transmit the feedback information through the payload container IE in the UL NAS transmission message, a CAG information container is newly added to the payload container type in the UL NAS transmission message, and the CAG information container is used to carry the feedback information.

[0180] The purpose of the CAG Information list data transparent container information element in the UL NAS TRANSPORT message is to indicate the UE acknowledgement of successful reception of the CAG Information list data transparent container IE in the DL NAS TRANSPORT message. The format of the newly added CAG information container IE can be found in Table 17.

[0181] Table 17: CAG Information Container IE

[0182]

[0183] CAG-MAC-I in Table 17 UEIt can be regarded as the aforementioned feedback information. The header of the CAG header in Table 17 can be seen in Table 18.

[0184] Table 18: CAG header

[0185]

[0186] It should be noted that the carrying method of the feedback information is similar to the carrying method of the update information. For details, please refer to the description of the carrying method of the feedback information, which will not be repeated here.

[0187] In this embodiment, when the target information is the first security package or the second security package, and the first protection information is the same as the second protection information, the UE needs to obtain the updated CAG information according to the security package. In specific implementation, the UE can obtain the updated CAG information in any of the following ways.

[0188] Mode 1: Optionally, when the target information is the first security package or the second security package, and the first protection information is the same as the second protection information, the method further includes:

[0189] Sending the target information to a universal subscriber identity card USIM;

[0190] Receive updated CAG information sent by the USIM.

[0191] In method 1, the UE sends the target information to the USIM, and the USIM unpacks the target information. Thereafter, the USIM sends the updated CAG information to the UE.

[0192] In specific implementation, the USIM may send the updated CAG information to the UE in the following manner.

[0193] Mode 1: Optionally, the receiving updated CAG information sent by the USIM includes:

[0194] A first refresh command sent by the USIM is received, where the first refresh command carries updated CAG information.

[0195] In mode 1, the USIM directly sends the processed updated CAG information to the UE through a refresh command, which can increase the rate at which the UE receives the updated CAG information.

[0196] Mode 2: Optionally, after sending the target information to a universal subscriber identity card USIM and before receiving the updated CAG information sent by the USIM, the method further includes:

[0197] receiving a second refresh command sent by the USIM, where the second refresh command instructs the terminal to obtain updated CAG information;

[0198] Sending a first request message to the USIM, where the first request message is used to request the updated CAG information;

[0199] The receiving updated CAG information sent by the USIM includes:

[0200] A first request response message sent by the USIM is received, where the first request response message includes the updated CAG information.

[0201] In method 2, the USIM sends the processed updated CAG information to the UE only after receiving the request for the updated CAG information sent by the UE. This can avoid the problem that the USIM still sends the updated CAG information to the UE even though the UE does not need the updated CAG information, resulting in a heavy operating burden on the UE.

[0202] Mode 2: Optionally, when the target information is the first security package or the second security package, and the first protection information is the same as the second protection information, the method further includes:

[0203] The target information is unpacked to obtain the updated CAG information.

[0204] In the second method, the UE can unpack the security package through the ME to obtain the updated CAG information. Compared with the first method, the second method does not require the participation of the USIM, thereby increasing the rate at which the UE obtains the CAG information.

[0205] The protection information, feedback information and counter information in this embodiment are described below.

[0206] 1) Protect information.

[0207] The protection information can be generated by a first algorithm using target information, header information, counter information and key information. The first algorithm can be any one of the following: KDF algorithm, DES algorithm, ECC algorithm, etc.

[0208] For ease of understanding, the following uses the KDF algorithm to generate protection information using target information, header information, counter information and secret key information as an example.

[0209] Calculate CAG-MAC-I AUSF When , the following parameters are used to form the input S of the KDF algorithm:

[0210] FC = indicates the function for calculating the key, such as 0x77, 0x78, etc.;

[0211] P0 = CAG header;

[0212] L0 = length of the CAG header;

[0213] P1=Counter CAG ;

[0214] L1=Counter CAG Length;

[0215] P2 = target information;

[0216] L2 = length of target information;

[0217] The input key KEY uses K AUS .

[0218] CAG-MAC-I AUSF The 128 least significant bits output by the KDF identify the CAG-MAC-I AUSF isidentified with the 128 least significant bits of the output of the KDF).

[0219] 2) Feedback information.

[0220] Calculate CAG-MAC-I UE When , the following parameters are used to form the input S of the KDF algorithm:

[0221] FC = indicates the function for calculating the key, such as 0x77, 0x78, etc.

[0222] P0 = 0x01 (CAG ACK: verification of CAG information list data is successful);

[0223] L0 = length of CAG Acknowledgement (ie 0x00 0x01);

[0224] P1=Counter CAG ;

[0225] L1=Counter CAG Length;

[0226] The input key KEY uses K AUS .

[0227] CAG-MAC-I UEThe 128 least significant bits output by the KDF identify the CAG-MAC-I UE isidentified with the 128 least significant bits of the output of the KDF).

[0228] 3) Counter information

[0229] A counter maintained in UE and AUSF respectively CAG , the counter and K AUSF Associated together.

[0230] When K AUSF When UE sets Counter CAG is 0.

[0231] When generating CAG_MAC_I AUSF AUSF needs to use this counter. Each time CAG_MAC_I is calculated AUSF After that, the value of this counter needs to be increased. AUSF and CAG_MAC_I UE This value can only be used once to mitigate replay attacks. AUSF needs to use Counter CAG and CAG-MAC-I AUSF The UE only receives the Counter that is smaller than the one stored locally on the UE from the air interface. CAG Bigger Counter CAG . When the UE receives the CAG_MAC_I AUSF After the check succeeds and is deemed valid, the UE needs to CAG After the UE saves the value, it is subsequently used in CAG_MAC_I UE Calculation of CAG_MAC_I UE Used to feedback ACK to the HPLMN.

[0232] Counter CAG With K AUSF The life cycle is the same.

[0233] AUSF is used to calculate K AUSF When you initialize Counter CAG to 0x00 0x01. That is, 0 does not need to calculate CAG-MAC-I AUSF and CAG_MAC_I UE . After calculating the first K AUSFAfter that, the value of the counter becomes 1, and it increases monotonically after each subsequent calculation.

[0234] If the counter is about to overflow, AUSF needs to suspend the CAG protection service.

[0235] K of rows generated each time AUSF When the CAG protection service is started, AUSF resets the counter to 1, and then AUSF restarts the CAG protection service.

[0236] See also Figure 3 , Figure 3 This is the second flowchart of the CAG information processing method provided by the embodiment of the present invention. The CAG information processing method of the embodiment of the present invention is applied to the first network element of the VPLMN.

[0237] like Figure 3 As shown, the CAG information processing method applied to the first network element of the VPLMN may include the following steps:

[0238] Step 301: When a terminal successfully registers in a PLMN, first indication information sent by a second network element of the HPLMN is received, where the first indication information includes update information and is used to instruct the first network element to forward the update information to the terminal.

[0239] Step 302: Send the update information to the terminal.

[0240] The update information includes target information, header information, counter information and first protection information corresponding to the target information, and the target information is any one of the following: updated CAG information, a first security package corresponding to the updated CAG information, a first roaming control SOR information including the updated CAG information, and a second security package corresponding to the first SOR information.

[0241] It should be noted that, in this embodiment, the target information in the update information included in the first indication information can be regarded as the first target information, and the target information in the update information sent by the VPLMN to the UE can be regarded as the second target information. In practical applications, the first target information and the second target information can be the same or different.

[0242] In the CAG information processing method of this embodiment, the VPLMN forwards the update information sent by the HPLMN to the UE, so that the UE can generate the second protection information based on the update information, and then determine whether the target information is tampered with by the VPLMN by comparing whether the received first protection information is the same as the generated second protection information, and can perform the first operation when the first protection information is different from the second protection information, thereby improving the reliability of service execution.

[0243] Optionally, the update information is carried in a first container of a downlink non-access layer NAS transmission message; or, the update information is carried in a first CAG information container.

[0244] Optionally, the first CAG information container is a newly added container of the downlink NAS transmission message.

[0245] Optionally, the first container is: a terminal parameter update UPU transparent container, or a SOR transparent container.

[0246] Optionally, the target information is carried in a UPU list in the UPU transparent container, or the target information is carried in a SOR list in the SOR transparent container.

[0247] Optionally, the target information is carried in a target data group in the UPU list or the SOR list, and the type of the target data group is newly added with a CAG information type.

[0248] Optionally, when the first protection information is the same as the second protection information, the method further includes:

[0249] receiving feedback information corresponding to the target information sent by the terminal, where the feedback information is used to indicate that the terminal has successfully received the updated CAG information;

[0250] Sending the feedback information to the second network element.

[0251] Optionally, the feedback information is carried in a second container of an uplink NAS transmission message; or, the feedback information is carried in a second CAG information container.

[0252] Optionally, the second CAG information container is a container newly added to the uplink NAS transmission message.

[0253] Optionally, the second container is: a UPU transparent container, or a SOR transparent container.

[0254] Optionally, after sending the update information to the terminal, the method further includes:

[0255] receiving second indication information sent by the second network element, where the second indication information is used to instruct the first network element to trigger the terminal to leave the first object;

[0256] Sending a first command to the terminal, where the first command is used to instruct the terminal to leave the first object;

[0257] The first object is any one of the following: the VPLMN, a tracking area TA in the VPLMN, a CAG cell in the VPLMN, and a non-CAG cell in the VPLMN.

[0258] In specific implementation, after the VPLMN receives the second indication information, the first network element may initiate a deregistration process, a paging process or a parameter update process, and then send the first command to the UE.

[0259] It should be noted that this embodiment is an embodiment of the first network element corresponding to the above method embodiment, and therefore, reference may be made to the relevant description in the above method embodiment, and the same beneficial effects can be achieved. To avoid repeated description, it will not be repeated here.

[0260] See also Figure 4 , Figure 4 This is the third flow chart of the CAG information processing method provided by the embodiment of the present invention. The CAG information processing method of the embodiment of the present invention is applied to the second network element of the HPLMN.

[0261] like Figure 4 As shown, the CAG information processing method applied to the second network element of the HPLMN may include the following steps:

[0262] Step 401: When the terminal successfully registers in the PLMN and the CAG information is updated, first indication information is sent to a first network element of the VPLMN, where the first indication information includes update information and is used to instruct the first network element to forward the update information to the terminal.

[0263] The update information includes target information, header information, counter information and first protection information corresponding to the target information, and the target information is any one of the following: updated CAG information, a first security package corresponding to the updated CAG information, a first roaming control SOR information including the updated CAG information, and a second security package corresponding to the first SOR information.

[0264] In this embodiment, the target information may be regarded as first target information.

[0265] In the CAG information processing method of this embodiment, the HPLMN sends the first indication information to the VPLMN, which can instruct the VPLMN to forward the update information to the UE. In this way, the UE can generate the second protection information based on the update information, and then determine whether the target information is tampered with by the VPLMN by comparing whether the received first protection information is the same as the generated second protection information, and can perform the first operation when the first protection information is different from the second protection information, thereby improving the reliability of service execution.

[0266] Optionally, the first indication information is i-th first indication information, i is a positive integer less than or equal to N, and N is a positive integer; after sending the first indication information to the first network element of the VPLMN, the method further includes at least one of the following:

[0267] When the first condition is met, sending (i+1)th first indication information to the first network element;

[0268] When the second condition is met, second indication information is sent to the first network element, where the second indication information is used to instruct the first network element to trigger the terminal to leave a first object, where the first object is any one of the following: the VPLMN, a tracking area TA in the VPLMN, a CAG cell in the VPLMN, and a non-CAG cell in the VPLMN;

[0269] The first condition satisfies at least one of the following: feedback information corresponding to the target information is not received, and i is less than N; the received feedback information is different from the verification information stored in the second network element, and i is less than N;

[0270] The second condition satisfies at least one of the following items: the feedback information is not received, and i is equal to N; the received feedback information is different from the verification information stored in the second network element, and i is equal to N.

[0271] In this optional implementation manner, after sending the i-th first indication information, the HPLMN may receive feedback information corresponding to the update information fed back by the UE, or may not receive the feedback information.

[0272] If the HPLMN does not receive the feedback information, it means that the UE has not received the correct updated CAG information, and the HPLMN can determine whether i is equal to N. If i is less than N, the HPLMN can try to send the first indication information again until feedback information identical to the verification information is received before i is equal to N, or, if i is equal to N, the second indication information is sent to the first network element.

[0273] When the HPLMN receives the feedback information, the HPLMN may compare the feedback information with the verification information. If the feedback information is equal to the verification information, it means that the UE has received a correct updated CAG process, and the process may be terminated.

[0274] If the feedback information is not equal to the verification information, it means that the UE has not received the correct updated CAG information, and the HPLMN may determine whether i is equal to N. When i is less than N, the HPLMN may try to send the first indication information again until feedback information identical to the verification information is received before i is equal to N, or when i is equal to N, the second indication information is sent to the first network element.

[0275] Through the above manner, the HPLMN can repeatedly send the first indication information multiple times, thereby increasing the probability that the UE receives the correct updated CAG information.

[0276] In this embodiment, the first protection information may be generated by a third network element of the HPLMN. Optionally, before sending the first indication information to the first network element of the VPLMN, the method further includes:

[0277] Sending second request information to a third network element of the HPLMN, where the second request information includes the target information and is used to request the third network element to protect the target information;

[0278] Receive second request response information sent by the third network element, where the second request response information includes the first protection information.

[0279] Further, the second request response information may include counter information. That is, the timer information may also be determined by the third network element.

[0280] For ease of understanding, the target information is taken as the first SOR information as an example for description.

[0281] The second network element may send the first SOR information to the AUSF, and request the third network element to protect the first SOR information containing the updated CAG information; after the third network element protects the first SOR information, it sends the protection information of the first SOR information to the second network element.

[0282] It should be understood that the second network element may obtain the first protection information in other ways, and this embodiment does not limit this.

[0283] It should be noted that this embodiment is an embodiment of a second network element corresponding to the above method embodiment, and therefore, reference may be made to the relevant description in the above method embodiment, and the same beneficial effects can be achieved. To avoid repeated description, it will not be repeated here.

[0284] See also Figure 5 , Figure 5 This is the fourth flowchart of the CAG information processing method provided by the embodiment of the present invention. The CAG information processing method of the embodiment of the present invention is applied to USIM.

[0285] like Figure 5 As shown, the CAG information processing method applied to USIM may include the following steps:

[0286] Step 501: receiving security package information sent by a terminal, wherein the security package information includes a first security package corresponding to updated CAG information or a second security package corresponding to first SOR information, and the first SOR information includes the updated CAG information.

[0287] Step 502: Send the updated CAG information to the terminal, where the updated CAG information is obtained by unpacking the security package information.

[0288] In the CAG information processing method of this embodiment, the USIM can unpack the security package and then send the obtained updated CAG information to the UE, so that the UE does not need to unpack the security package, which can reduce the operating burden of the UE.

[0289] Optionally, the sending the updated CAG information to the terminal includes:

[0290] A first refresh command is sent to the terminal, where the first refresh command carries the updated CAG information.

[0291] Optionally, after receiving the security packet corresponding to the updated CAG information sent by the terminal and before sending the updated CAG information to the terminal, the method further includes:

[0292] Sending a second refresh command to the terminal, where the second refresh command is used to instruct the terminal to obtain the updated CAG information;

[0293] receiving first request information sent by the terminal, where the first request information is used to request the updated CAG information;

[0294] The sending the updated CAG information to the terminal includes:

[0295] Sending first request response information to the terminal, where the first request response information includes the updated CAG information.

[0296] It should be noted that this embodiment is an embodiment of a USIM corresponding to the above method embodiment, and therefore, reference may be made to the relevant description in the above method embodiment, and the same beneficial effects may be achieved. In order to avoid repeated description, it will not be repeated here.

[0297] In practical applications, the various optional implementations introduced in the embodiments of the present invention may be implemented in combination with each other or may be implemented separately, which is not limited by the embodiments of the present invention.

[0298] For ease of understanding, the following examples are provided:

[0299] For UDM, after the UE successfully registers with the network:

[0300] If the UDM of the HPLMN finds that the CAG information has changed and needs to send the new CAG information to the UE, it needs to first protect the CAG information and then send it to the AMF of the VPLMN;

[0301] If the UDM expects to receive a confirmation message from the UE to confirm that the UE has received the CAG information, the UDM needs to wait for the UE's subsequent protected confirmation information. If the protection check of the confirmation information is successful, it is considered that the UE has received the CAG information. Otherwise, it is considered that the UE has not successfully received the CAG information and further performs related operations.

[0302] For AMF, after the UE successfully registers in the network:

[0303] The AMF of the VPLMN finds that the UDM of the HPLMN sends the CAG information with security protection, and then sends the CAG information with security protection to the UE through the downlink message of the successful registration into the DL NAS TRANSPORT;

[0304] When the AMF of the VPLMN finds that the UE sends a security-protected confirmation message to the UDM to confirm receipt of the CAG information, it transparently forwards the confirmation message to the UDM;

[0305] For UE, after the UE successfully registers in the network:

[0306] When receiving a message from the network such as DL NAS TRANSPORT and finding that it contains CAG information that has been protected by security, a security check is performed, such as decryption, integrity protection, etc. If the security check is successful, the message is accepted and further processed. If the UDM requires the UE to reply with a confirmation message, the UE needs to protect the confirmation message and send it to the UDM through the uplink message UL NAS TRANSPORT after successful registration. Otherwise, if the security check fails, the CAG information in the message is considered invalid and further related operations are performed.

[0307] CAG information is protected for security, such as encryption and integrity protection; the encryption and integrity protection algorithms may include KDF algorithm, DES algorithm, ECC algorithm, etc.

[0308] If the UE finds that the CAG security check fails, it can be considered that the current VPLMN has tampered with the CAG information and thus leave the current VPLMN network, unless there is no other available network at the current location.

[0309] If the HPLMN UDM finds that the security check of the confirmation information fed back by the UE fails, it is considered that the UE has not successfully received the CAG information, and the HPLMN UDM can try to send the protected CAG information to the UE again; if multiple attempts to send the protected CAG information fail, the HPLMN UDM can consider that the current UE's service network, that is, the current VPLMN, is unreliable, and can trigger the UE to leave the current VPLMN. The method of triggering the UE to leave the current VPLMN includes triggering the AMF of the VPLMN to initiate a deregistration process, or initiate a PAGING process, or initiate a parameter update process, etc.

[0310] Embodiment 1: In "parameters update transparent container", add CAG INFO.

[0311] Add CAG INFO in the UE "parametersupdate transparent container" in the Payload container type of the DL NAS TRANSPORT message.

[0312] The CAG Informationlist is updated using a method similar to Routing Indicator or SoR.

[0313] The CAG information processing method of this embodiment can be found in Figure 6 .like Figure 6 As shown, the following steps may be included:

[0314] Step 601: UDM finds that the CAG information list is updated.

[0315] UDM uses the CAG Information list, UE parameters update header information, Counter_UPU information and a key such as KEY (which can be KAUSF) to jointly generate UPU-MAC-I AUSF , and may generate UPU-MAC-I UE .

[0316] Step 602: UDM sends the first indication information to AMF.

[0317] The first indication information includes CAG Information list information, UE parameters update header information, Counter_UPU information and UPU-MAC-I AUSF etc., but do not send the key KEY and UPU-MAC-I UE .

[0318] Step 603: AMF sends a DL NAS transmission message to the UE.

[0319] When the AMF generates a DL NAS transport message to the UE, it shall include the CAGInformation list information generated by the HPLMN, the UE parameters update header information, the Counter_UPU information and the UPU-MAC-I AUSF Wait, don't make any changes.

[0320] Step 604: UE generates UPU-MAC-I AUSF' , and compare UPU-MAC-I AUSF With UPU-MAC-I AUSF' .

[0321] In specific implementation, the UE generates the UE local UPU-MAC-I according to the received CAG Information list information, Counter_UPU information, and the current K_AUSF information stored locally in the UE. AUSF' .

[0322] 1) If UPU-MAC-I AUSF With UPU-MAC-I AUSF' If they are equal, it is considered that the VPLMN has not tampered with the CAGInformation list information sent by the HPLMN.

[0323] The UE's processing of the newly received CAG Information list that has been successfully checked is the same as the existing protocol.

[0324] The UE can further generate UPU-MAC-I UE' , and execute step 605.

[0325] 2) If UPU-MAC-I AUSF With UPU-MAC-I AUSF' If they are not equal, it is considered that the VPLMN has tampered with the CAGInformation list information sent by the HPLMN.

[0326] The UE may perform at least one of the following:

[0327] The UE discards the received CAG Information list;

[0328] The UE considers that the current network (VPLMN, and / or the current TA area, and / or the current CAG or non-CAG cell) is set as the network (PLMN, and / or the current TA area, and / or the current CAG or non-CAG cell) with the lowest priority when selecting CAG, and puts the current network VPLMN into a low priority list; then when the UE enters IDLE in the current network, it selects other networks (PLMN, and / or TA area, and / or CAG or non-CAG cell) to try to apply for service;

[0329] The network is no longer fed back with the CAG Information list information, that is, step 605 and step 606 are no longer executed due to the CAG Information list.

[0330] Step 605: The UE sends a UL NAS transmission message to the AMF.

[0331] In specific implementation, the UL NAS transmission message includes UPU-MAC-I UE '.

[0332] Step 606: AMF sends UPU-MAC-I UE' Issued to UDM;

[0333] UDM can check the received UPU-MAC-IUE' with the UPU-MAC-IUE generated locally by UDM. If they are equal, it is considered that the UE has successfully received the CAG Information List and that the current VPLMN has not tampered with the information. If they are not equal, it is considered that either the UE has not successfully received the CAG Information List, or that the current VPLMN has tampered with the UE's feedback information. Furthermore, the HPLMN can decide to trigger the UE to leave the current VPLMN.

[0334] In the first embodiment, a type is added to the UE parameters update data set type: CAGInformation List data, and the CAG information is transmitted through the newly added IE.

[0335] Embodiment 2: Add CAG Information list data to the Payload container type.

[0336] Add CAG Informationlist data to the Payload container type of the DL NAS TRANSPORT message.

[0337] Update the CAG Information list using a method similar to Routing Indicator or SoR.

[0338] The CAG information processing method of this embodiment can be found in Figure 7 .like Figure 7 As shown, the following steps may be included:

[0339] Step 701: UDM finds that the CAG information list is updated.

[0340] UDM uses the CAG Information list, UE parameters update header information, Counter_CAG information, and keys such as KEY (which can be K AUSF ), jointly generate CAG-MAC-I AUSF , and may generate CAG-MAC-I UE .

[0341] Step 702: UDM sends the first indication information to AMF.

[0342] The first indication information includes CAG Information list information, UE parameters update header information, Counter_CAG information and CAG-MAC-I AUSF etc., but do not send the key KEY and CAG-MAC-I UE .

[0343] Step 703: AMF sends a DL NAS transmission message to the UE.

[0344] When the AMF generates a DL NAS transport message to the UE, it shall include the CAGInformation list information generated by the HPLMN, the UE parameters update header information, the Counter_CAG information and the CAG-MAC-I AUSF Wait, don't make any changes.

[0345] Step 704: UE generates CAG-MAC-I AUSF ', and compare CAG-MAC-I AUSF and CAG-MAC-I AUSF '.

[0346] 1) If CAG-MAC-I AUSF and CAG-MAC-I AUSF ' are equal, it is considered that AMF has not tampered with the CAGInformation list information sent by UDM.

[0347] The UE may further generate CAG-MAC-I UE , and execute step 305.

[0348] The UE's processing of the newly received CAG Information list that has been successfully checked is the same as the existing protocol.

[0349] 2) Same as step 604 2)

[0350] Step 705: The UE sends a UL NAS transmission message to the AMF.

[0351] In specific implementation, the UL NAS transmission message includes CAG-MAC-I UE '.

[0352] Step 706: AMF sends CAG-MAC-I UE 'Send to UDM.

[0353] UDM can check the received CAG-MAC-I UE'With the CAG-MAC-I generated locally by UDM UE If they are equal, it is considered that the UE has successfully received the CAG Information List and that the current AMF has not tampered with the information. If they are not equal, it is considered that either the UE has not successfully received the CAG Information List, or that the current AMF has tampered with the UE's feedback information. Furthermore, UDM can decide to trigger the UE to leave the current AMF.

[0354] In the second embodiment, a type is added in the Payload container type value, which is parallel to the SORtransparent container and the UE parameters update transparent container: CAG Information List data CONTAINER, to indicate that the CAG information is transmitted in the Payload container IE.

[0355] Embodiment 3: security packet.

[0356] In this embodiment, if the CAG Information list related information is stored in the USIM card, the CAG INFO added in the UE "parameters update transparent container" in the Payload container type of the DL NAS TRANSPORT message in the first embodiment is replaced by adding a Security packet, and the security packet is protected by the UDM.

[0357] The CAG information processing method of this embodiment can be found in Figure 8 .like Figure 8 As shown, the following steps may be included:

[0358] Steps 801-803 are the same as steps 601-603.

[0359] Step 804a: The UE checks whether the received security packet has been tampered with or deleted by the VPLMN.

[0360] That is, the UE checks whether the received security packet is sent by the HPLMN.

[0361] If the check fails, that is, it is tampered with or deleted by the VPLMN, the check failure is processed in step 604. If the check succeeds, the process proceeds to step 804b.

[0362] Step 804b: The UE sends the received security packet with successful check to the USIM for processing.

[0363] Step 804c: After the USIM processes the security packet successfully, it sends a refresh command to the UE.

[0364] The refresh command instructs the UE to update the CAG Information list information;

[0365] Step 804d: The UE processes the newly received CAG Information list of successful inspection.

[0366] Same as existing agreement.

[0367] Steps 805-806 are the same as steps 605-606.

[0368] Embodiment 4: CAG information is placed in a container of SOR for transmission, that is, transmitted as a SOR parameter.

[0369] The CAG information processing method of this embodiment can be found in Fig. 9 .like Fig. 9 As shown, the following steps may be included:

[0370] Step 901: UDM finds that the CAG information list is updated.

[0371] Step 902: UDM sends the first SOR information to AUSF.

[0372] To request AUSF to protect the first SOR information, where the first SOR information includes CAG information.

[0373] Step 903: AUSF sends the protection information of the first SOR information to UDM.

[0374] In specific implementation, after AUSF protects the first SOR information, it sends the protection information of the first SOR information to the HPLMN UDM;

[0375] Step 904: UDM sends the first indication information to AMF.

[0376] Step 905: AMF sends a DL NAS transmission message to the UE.

[0377] Step 906: UE generates SOR-MAC-I AUSF' , and compared with SOR-MAC-I AUSF With SOR-MAC-I AUSF' .

[0378] Step 907: The UE sends a UL NAS transmission message to the AMF.

[0379] In specific implementation, if UDM requires feedback, and the UE checks the protection successfully and confirms that the SOR (including CAG information) information has not been tampered with, then SOR_MAC_IUE is fed back to the network; the uplink code stream remains unchanged. However, the meaning of the indicated information is changed from only indicating the reception of the SOR parameters to indicating the reception of the SOR (including CAG information) information.

[0380] Step 908: AMF sends UPU-MAC-I UE' Sent to UDM.

[0381] Step 909: UDM compares UPU-MAC-I UE' and SOR_XMAC_I stored locally by UDM UE , and decides the behavior based on the comparison result.

[0382] For details, refer to the behavior after the UDM comparison results in Examples 1 and 2.

[0383] In the embodiment of the present invention, after the UE successfully registers, when the HPLMN notifies the UE of new CAG information, the UE can know whether the received CAG information is tampered by the VPLMN. In this way, the UE can execute services on the correct network indicated by the HPLMN and avoid executing services on the wrong network.

[0384] See also Fig.10 , Fig.10 is a structural diagram of a terminal provided by an embodiment of the present invention. Fig.10 As shown, the terminal 1000 includes:

[0385] The first receiving module 1001 is used to receive update information sent by a first network element of a visited public land mobile network VPLMN when the terminal is successfully registered in the public land mobile network PLMN, wherein the update information includes target information, header information, counter information and first protection information corresponding to the target information;

[0386] The operation module 1002 is configured to perform a first operation when the first protection information is different from the second protection information, wherein the first operation includes at least one of the following: discarding the target information; reducing the priority of the first object; leaving the first object; and giving up sending feedback information corresponding to the target information to the home public land mobile network HPLMN.

[0387] The second protection information is generated based on the target information, the header information, the counter information and the key information stored in the terminal; the target information is any one of the following: the updated CAG information, the first security package corresponding to the updated CAG information, the first roaming control SOR information including the updated CAG information, and the second security package corresponding to the first SOR information; the first object is any one of the following: the VPLMN, the tracking area TA in the VPLMN, the CAG cell in the VPLMN, and the non-CAG cell in the VPLMN.

[0388] Optionally, the update information is carried in a first container of a downlink non-access layer NAS transmission message; or, the update information is carried in a first CAG information container.

[0389] Optionally, the first CAG information container is a newly added container of the downlink NAS transmission message.

[0390] Optionally, the first container is: a terminal parameter update UPU transparent container, or a SOR transparent container.

[0391] Optionally, the target information is carried in a UPU list in the UPU transparent container, or the target information is carried in a SOR list in the SOR transparent container.

[0392] Optionally, the target information is carried in a target data group in the UPU list or the SOR list, and the type of the target data group is newly added with a CAG information type.

[0393] Optionally, when the first protection information is the same as the second protection information, the terminal 1000 further includes:

[0394] Optionally, the feedback information is used to indicate that the terminal has successfully received the updated CAG information.

[0395] Optionally, the feedback information is carried in a second container of an uplink NAS transmission message; or, the feedback information is carried in a second CAG information container.

[0396] Optionally, the second CAG information container is a container newly added to the uplink NAS transmission message.

[0397] Optionally, the second container is: a UPU transparent container, or a SOR transparent container.

[0398] Optionally, when the target information is the first security package or the second security package, and the first protection information is the same as the second protection information, the terminal 1000 further includes:

[0399] A second sending module is used to send the target information to a universal user identity card USIM;

[0400] The second receiving module is used to receive the updated CAG information sent by the USIM.

[0401] Optionally, the second receiving module is specifically configured to:

[0402] A first refresh command sent by the USIM is received, where the first refresh command carries updated CAG information.

[0403] Optionally, the terminal 1000 further includes:

[0404] A third receiving module is configured to receive a second refresh command sent by the USIM, where the second refresh command instructs the terminal to obtain updated CAG information;

[0405] A third sending module, configured to send a first request message to the USIM, where the first request message is used to request the updated CAG information;

[0406] The second receiving module is specifically used for:

[0407] A first request response message sent by the USIM is received, where the first request response message includes the updated CAG information.

[0408] Optionally, when the target information is the first security package or the second security package, and the first protection information is the same as the second protection information, the terminal further includes:

[0409] A processing module is used to unpack the target information to obtain the updated CAG information.

[0410] Optionally, the operation module 1002 is specifically used for at least one of the following:

[0411] When the first object enters an idle state, leaving the first object;

[0412] When a first command is received, the terminal leaves the first object, where the first command is used to instruct the terminal to leave the first object.

[0413] Terminal 1000 can implement various processes that can be implemented by the terminal in the embodiment of the method of the present invention, and achieve the same beneficial effects. To avoid repetition, it will not be described here.

[0414] See also Fig.11 , Fig.111 is one of the structural diagrams of the network element provided in the embodiment of the present invention. The network element 1100 is the first network element of the VPLMN. Fig.11 As shown, the network element 1100 includes:

[0415] The fourth receiving module 1101 is used to receive first indication information sent by a second network element of the HPLMN when the terminal is successfully registered in the PLMN, wherein the first indication information includes update information and is used to instruct the first network element to forward the update information to the terminal;

[0416] The fourth sending module 1102 is used to send the update information to the terminal;

[0417] The update information includes target information, header information, counter information and first protection information corresponding to the target information, and the target information is any one of the following: updated CAG information, a first security package corresponding to the updated CAG information, a first roaming control SOR information including the updated CAG information, and a second security package corresponding to the first SOR information.

[0418] Optionally, the update information is carried in a first container of a downlink non-access layer NAS transmission message; or, the update information is carried in a first CAG information container.

[0419] Optionally, the first CAG information container is a newly added container of the downlink NAS transmission message.

[0420] Optionally, the first container is: a terminal parameter update UPU transparent container, or a SOR transparent container.

[0421] Optionally, the target information is carried in a UPU list in the UPU transparent container, or the target information is carried in a SOR list in the SOR transparent container.

[0422] Optionally, the target information is carried in a target data group in the UPU list or the SOR list, and the type of the target data group is newly added with a CAG information type.

[0423] Optionally, when the first protection information is the same as the second protection information, the network element 1100 further includes:

[0424] a fifth receiving module, configured to receive feedback information corresponding to the target information sent by the terminal, wherein the feedback information is used to indicate that the terminal has successfully received the updated CAG information;

[0425] The fifth sending module is used to send the feedback information to the second network element.

[0426] Optionally, the feedback information is carried in a second container of an uplink NAS transmission message; or, the feedback information is carried in a second CAG information container.

[0427] Optionally, the second CAG information container is a container newly added to the uplink NAS transmission message.

[0428] Optionally, the second container is: a UPU transparent container, or a SOR transparent container.

[0429] Optionally, the network element 1100 further includes:

[0430] A sixth receiving module, configured to receive second indication information sent by the second network element, where the second indication information is used to instruct the first network element to trigger the terminal to leave the first object;

[0431] a sixth sending module, configured to send a first command to the terminal, wherein the first command is used to instruct the terminal to leave the first object;

[0432] The first object is any one of the following: the VPLMN, a tracking area TA in the VPLMN, a CAG cell in the VPLMN, and a non-CAG cell in the VPLMN.

[0433] Network element 1100 can implement various processes that the network element in the embodiment of the method of the present invention can implement, and achieve the same beneficial effects. To avoid repetition, it will not be described here.

[0434] See also Fig.12 , Fig.12 FIG. 12 is a second structural diagram of a network element provided in an embodiment of the present invention. Network element 1200 is a second network element of the HPLMN. Fig.12 As shown, the network element 1200 includes:

[0435] The seventh sending module 1201 is used to send first indication information to a first network element of the VPLMN when the terminal is successfully registered in the PLMN and the CAG information is updated, wherein the first indication information includes update information and is used to instruct the first network element to forward the update information to the terminal;

[0436] The update information includes target information, header information, counter information and first protection information corresponding to the target information, and the target information is any one of the following: updated CAG information, a first security package corresponding to the updated CAG information, a first roaming control SOR information including the updated CAG information, and a second security package corresponding to the first SOR information.

[0437] Optionally, the first indication information is the i-th first indication information, where i is a positive integer less than or equal to N, and N is a positive integer; after sending the first indication information to the first network element of the VPLMN, the network element 1200 further includes an eighth sending module, and the eighth sending module is used for at least one of the following:

[0438] When the first condition is met, sending (i+1)th first indication information to the first network element;

[0439] When the second condition is met, second indication information is sent to the first network element, where the second indication information is used to instruct the first network element to trigger the terminal to leave a first object, where the first object is any one of the following: the VPLMN, a tracking area TA in the VPLMN, a CAG cell in the VPLMN, and a non-CAG cell in the VPLMN;

[0440] The first condition satisfies at least one of the following: feedback information corresponding to the target information is not received, and i is less than N; the received feedback information is different from the verification information stored in the second network element, and i is less than N;

[0441] The second condition satisfies at least one of the following items: the feedback information is not received, and i is equal to N; the received feedback information is different from the verification information stored in the second network element, and i is equal to N.

[0442] Optionally, the network element 1200 further includes:

[0443] a ninth sending module, configured to send second request information to a third network element of the HPLMN, wherein the second request information includes the target information and is used to request the third network element to protect the target information;

[0444] A seventh receiving module is used to receive second request response information sent by the third network element, where the second request response information includes the first protection information.

[0445] Network element 1200 can implement various processes that the network element in the embodiment of the method of the present invention can implement, and achieve the same beneficial effects. To avoid repetition, it will not be repeated here.

[0446] See also Fig.13 , Fig.13 is a structural diagram of a USIM provided by an embodiment of the present invention. Fig.13 As shown, USIM1300 includes:

[0447] An eighth receiving module 1301 is configured to receive security package information sent by a terminal, where the security package information includes a first security package corresponding to the updated CAG information or a second security package corresponding to the first SOR information, where the first SOR information includes the updated CAG information;

[0448] The tenth sending module 1302 is used to send the updated CAG information to the terminal, where the updated CAG information is obtained by unpacking the security package information.

[0449] Optionally, the tenth sending module 1301 is specifically configured to:

[0450] A first refresh command is sent to the terminal, where the first refresh command carries the updated CAG information.

[0451] Optionally, the USIM 1300 further includes:

[0452] an eleventh sending module, configured to send a second refresh command to the terminal, wherein the second refresh command is used to instruct the terminal to obtain the updated CAG information;

[0453] a ninth receiving module, configured to receive first request information sent by the terminal, where the first request information is used to request the updated CAG information;

[0454] The tenth sending module 1302 is specifically configured to:

[0455] Sending first request response information to the terminal, where the first request response information includes the updated CAG information.

[0456] USIM1300 can implement various processes that the USIM in the method embodiment of the present invention can implement, and achieve the same beneficial effects. To avoid repetition, it will not be described again here.

[0457] See also Fig.14 , Fig.14 is a structural diagram of a communication device provided by an embodiment of the present invention, such as Fig.14 As shown, the communication device 1400 includes: a processor 1401, a memory 1402, a transceiver 1403 and a bus interface.

[0458] In this embodiment of the present invention, the communication device 1400 further includes: a program or instruction stored in the memory 1402 and executable on the processor 1401 .

[0459] 1. The communication device 1400 is a terminal.

[0460] In this case, the program or instruction is executed by the processor 1401 to implement the following steps:

[0461] When the terminal successfully registers in the public land mobile network PLMN, receiving update information sent by a first network element of a visited public land mobile network VPLMN through the transceiver 1403, the update information including target information, header information, counter information and first protection information corresponding to the target information;

[0462] In the case where the first protection information is different from the second protection information, performing a first operation, the first operation comprising at least one of the following: discarding the target information; reducing the priority of the first object; leaving the first object; giving up sending feedback information corresponding to the target information to the home public land mobile network HPLMN;

[0463] The second protection information is generated based on the target information, the header information, the counter information and the key information stored in the terminal; the target information is any one of the following: the updated CAG information, the first security package corresponding to the updated CAG information, the first roaming control SOR information including the updated CAG information, and the second security package corresponding to the first SOR information; the first object is any one of the following: the VPLMN, the tracking area TA in the VPLMN, the CAG cell in the VPLMN, and the non-CAG cell in the VPLMN.

[0464] Optionally, the update information is carried in a first container of a downlink non-access layer NAS transmission message; or, the update information is carried in a first CAG information container.

[0465] Optionally, the first CAG information container is a newly added container of the downlink NAS transmission message.

[0466] Optionally, the first container is: a terminal parameter update UPU transparent container, or a SOR transparent container.

[0467] Optionally, the target information is carried in a UPU list in the UPU transparent container, or the target information is carried in a SOR list in the SOR transparent container.

[0468] Optionally, the target information is carried in a target data group in the UPU list or the SOR list, and the type of the target data group is newly added with a CAG information type.

[0469] Optionally, when the first protection information is the same as the second protection information, the following steps may be further implemented when the program or instruction is executed by the processor 1401:

[0470] The feedback information is sent to the HPLMN through the transceiver 1403, where the feedback information is used to indicate that the terminal has successfully received the updated CAG information.

[0471] Optionally, the feedback information is carried in a second container of an uplink NAS transmission message; or, the feedback information is carried in a second CAG information container.

[0472] Optionally, the second CAG information container is a container newly added to the uplink NAS transmission message.

[0473] Optionally, the second container is: a UPU transparent container, or a SOR transparent container.

[0474] Optionally, when the target information is the first security package or the second security package, and the first protection information is the same as the second protection information, the following steps may be further implemented when the program or instruction is executed by the processor 1401:

[0475] Sending the target information to a universal subscriber identity card USIM through the transceiver 1403;

[0476] The updated CAG information sent by the USIM is received through the transceiver 1403.

[0477] Optionally, when the program or instruction is executed by the processor 1401, the following steps may also be implemented:

[0478] A first refresh command sent by the USIM is received through the transceiver 1403, where the first refresh command carries updated CAG information.

[0479] Optionally, when the program or instruction is executed by the processor 1401, the following steps may also be implemented:

[0480] receiving, by the transceiver 1403, a second refresh command sent by the USIM, where the second refresh command instructs the terminal to obtain updated CAG information;

[0481] Sending first request information to the USIM through the transceiver 1403, where the first request information is used to request the updated CAG information;

[0482] A first request response message sent by the USIM is received, where the first request response message includes the updated CAG information.

[0483] Optionally, when the target information is the first security package or the second security package, and the first protection information is the same as the second protection information, the following steps may be further implemented when the program or instruction is executed by the processor 1401:

[0484] The target information is unpacked to obtain the updated CAG information.

[0485] Optionally, when the program or instruction is executed by the processor 1401, at least one of the following may be implemented:

[0486] When the first object enters an idle state, leaving the first object;

[0487] When a first command is received, the terminal leaves the first object, where the first command is used to instruct the terminal to leave the first object.

[0488] The communication device 1400 can implement each process that the terminal can implement in the above method embodiment, and to avoid repetition, it will not be repeated here.

[0489] 2. The communication device 1400 is the first network element of the VPLMN.

[0490] In this case, the program or instruction is executed by the processor 1401 to implement the following steps:

[0491] When the terminal successfully registers in the PLMN, receiving, through the transceiver 1403, first indication information sent by the second network element of the HPLMN, wherein the first indication information includes update information and is used to instruct the first network element to forward the update information to the terminal;

[0492] Sending the update information to the terminal through the transceiver 1403;

[0493] The update information includes target information, header information, counter information and first protection information corresponding to the target information, and the target information is any one of the following: updated CAG information, a first security package corresponding to the updated CAG information, a first roaming control SOR information including the updated CAG information, and a second security package corresponding to the first SOR information.

[0494] Optionally, the update information is carried in a first container of a downlink non-access layer NAS transmission message; or, the update information is carried in a first CAG information container.

[0495] Optionally, the first CAG information container is a newly added container of the downlink NAS transmission message.

[0496] Optionally, the first container is: a terminal parameter update UPU transparent container, or a SOR transparent container.

[0497] Optionally, the target information is carried in a UPU list in the UPU transparent container, or the target information is carried in a SOR list in the SOR transparent container.

[0498] Optionally, the target information is carried in a target data group in the UPU list or the SOR list, and the type of the target data group is newly added with a CAG information type.

[0499] Optionally, when the first protection information is the same as the second protection information, the following steps may be further implemented when the program or instruction is executed by the processor 1401:

[0500] Receiving, through the transceiver 1403, feedback information corresponding to the target information sent by the terminal, wherein the feedback information is used to indicate that the terminal has successfully received the updated CAG information;

[0501] The feedback information is sent to the second network element through the transceiver 1403.

[0502] Optionally, the feedback information is carried in a second container of an uplink NAS transmission message; or, the feedback information is carried in a second CAG information container.

[0503] Optionally, the second CAG information container is a container newly added to the uplink NAS transmission message.

[0504] Optionally, the second container is: a UPU transparent container, or a SOR transparent container.

[0505] Optionally, when the program or instruction is executed by the processor 1401, the following steps may also be implemented:

[0506] receiving, by the transceiver 1403, second indication information sent by the second network element, where the second indication information is used to instruct the first network element to trigger the terminal to leave the first object;

[0507] Sending a first command to the terminal through the transceiver 1403, where the first command is used to instruct the terminal to leave the first object;

[0508] The first object is any one of the following: the VPLMN, a tracking area TA in the VPLMN, a CAG cell in the VPLMN, and a non-CAG cell in the VPLMN.

[0509] The communication device 1400 can implement various processes that can be implemented by the first network element of the VPLMN in the above method embodiment, and will not be described again here to avoid repetition.

[0510] 3. The communication device 1400 is the second network element in the HPLMN.

[0511] In this case, the program or instruction is executed by the processor 1401 to implement the following steps:

[0512] When the terminal successfully registers in the PLMN and the CAG information is updated, first indication information is sent to a first network element of the VPLMN through the transceiver 1403, where the first indication information includes update information and is used to instruct the first network element to forward the update information to the terminal;

[0513] The update information includes target information, header information, counter information and first protection information corresponding to the target information, and the target information is any one of the following: updated CAG information, a first security package corresponding to the updated CAG information, a first roaming control SOR information including the updated CAG information, and a second security package corresponding to the first SOR information.

[0514] Optionally, the first indication information is the i-th first indication information, i is a positive integer less than or equal to N, and N is a positive integer; when the program or instruction is executed by the processor 1401, at least one of the following may be implemented:

[0515] When the first condition is met, sending the (i+1)th first indication information to the first network element through the transceiver 1403;

[0516] When the second condition is met, second indication information is sent to the first network element through the transceiver 1403, where the second indication information is used to instruct the first network element to trigger the terminal to leave the first object, where the first object is any one of the following: the VPLMN, a tracking area TA in the VPLMN, a CAG cell in the VPLMN, and a non-CAG cell in the VPLMN;

[0517] The first condition satisfies at least one of the following: feedback information corresponding to the target information is not received, and i is less than N; the received feedback information is different from the verification information stored in the second network element, and i is less than N;

[0518] The second condition satisfies at least one of the following items: the feedback information is not received, and i is equal to N; the received feedback information is different from the verification information stored in the second network element, and i is equal to N.

[0519] Optionally, when the program or instruction is executed by the processor 1401, the following steps may also be implemented:

[0520] Sending second request information to a third network element of the HPLMN through the transceiver 1403, where the second request information includes the target information and is used to request the third network element to protect the target information;

[0521] The second request response information sent by the third network element is received through the transceiver 1403, where the second request response information includes the first protection information.

[0522] The communication device 1400 can implement various processes that can be implemented by the second network element in the HPLMN in the above method embodiment, and will not be described again here to avoid repetition.

[0523] 4. The communication device 1400 is a USIM.

[0524] In this case, the program or instruction is executed by the processor 1401 to implement the following steps:

[0525] Optionally, when the program or instruction is executed by the processor 1401, the following steps may also be implemented:

[0526] Receiving, by the transceiver 1403, security package information sent by the terminal, the security package information including a first security package corresponding to the updated CAG information or a second security package corresponding to the first SOR information, the first SOR information including the updated CAG information;

[0527] The updated CAG information is sent to the terminal through the transceiver 1403, and the updated CAG information is obtained by unpacking the security package information.

[0528] Optionally, when the program or instruction is executed by the processor 1401, the following steps may also be implemented:

[0529] A first refresh command is sent to the terminal via the transceiver 1403 , where the first refresh command carries the updated CAG information.

[0530] Optionally, when the program or instruction is executed by the processor 1401, the following steps may also be implemented:

[0531] Sending a second refresh command to the terminal through the transceiver 1403, where the second refresh command is used to instruct the terminal to obtain the updated CAG information;

[0532] receiving, by the transceiver 1403, first request information sent by the terminal, where the first request information is used to request the updated CAG information;

[0533] The first request response information is sent to the terminal through the transceiver 1403, where the first request response information includes the updated CAG information.

[0534] The communication device 1400 can implement each process that the USIM in the above method embodiment can implement, and to avoid repetition, it will not be repeated here.

[0535] exist Fig.14 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically one or more processors represented by processor 1401 and various circuits of memory represented by memory 1402 are linked together. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 1404 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. For different user devices, the user interface 1403 may also be an interface capable of externally and internally connecting required devices, and the connected devices include but are not limited to a keypad, a display, a speaker, a microphone, a joystick, and the like.

[0536] The processor 1401 is responsible for managing the bus architecture and general processing, and the memory 1402 can store data used by the processor 2601 when performing operations.

[0537] The embodiment of the present invention further provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, each process of the above-mentioned CAG information processing method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0538] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned information sending method embodiment or the above-mentioned CAG information processing method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0539] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0540] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0541] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0542] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A closed access group CAG information processing method, applied to a terminal, characterized in that: The method comprises: When the terminal successfully registers in a public land mobile network PLMN, receiving update information sent by a first network element of a visited public land mobile network VPLMN, the update information including target information, header information, counter information and first protection information corresponding to the target information; In the case where the first protection information is different from the second protection information, performing a first operation, the first operation comprising at least one of the following: discarding the target information; reducing the priority of the first object; leaving the first object; giving up sending feedback information corresponding to the target information to the home public land mobile network HPLMN; The second protection information is generated based on the target information, the header information, the counter information and the key information stored in the terminal; the target information is any one of the following: the updated CAG information, the first security package corresponding to the updated CAG information, the first roaming control SOR information including the updated CAG information, and the second security package corresponding to the first SOR information; the first object is any one of the following: the VPLMN, the tracking area TA in the VPLMN, the CAG cell in the VPLMN, and the non-CAG cell in the VPLMN.

2. The method according to claim 1, characterized in that The update information is carried in a first container of a downlink non-access layer NAS transmission message; or, the update information is carried in a first CAG information container.

3. The method according to claim 2, characterized in that The first CAG information container is a newly added container of the downlink NAS transmission message.

4. The method according to claim 2, characterized in that: The first container is: a terminal parameter update UPU transparent container, or a SOR transparent container.

5. The method according to claim 4, characterized in that The target information is carried in a UPU list of the UPU transparent container, or the target information is carried in a SOR list of the SOR transparent container.

6. The method according to claim 5, characterized in that The target information is carried in the target data group of the UPU list or the SOR list, and the type of the target data group is newly added with a CAG information type.

7. The method according to claim 1, characterized in that In a case where the first protection information is the same as the second protection information, the method further includes: The feedback information is sent to the HPLMN, where the feedback information is used to indicate that the terminal has successfully received the updated CAG information.

8. The method according to claim 7, characterized in that The feedback information is carried in a second container of an uplink NAS transmission message; or, the feedback information is carried in a second CAG information container.

9. The method according to claim 8, characterized in that The second CAG information container is a newly added container of the uplink NAS transmission message.

10. The method according to claim 8, characterized in that The second container is: a UPU transparent container, or a SOR transparent container.

11. The method according to claim 1, characterized in that: In a case where the target information is the first security package or the second security package, and the first protection information is the same as the second protection information, the method further includes: Sending the target information to a universal subscriber identity card USIM; Receive updated CAG information sent by the USIM.

12. The method according to claim 11, characterized in that The receiving updated CAG information sent by the USIM includes: A first refresh command sent by the USIM is received, where the first refresh command carries updated CAG information.

13. The method according to claim 11, characterized in that After sending the target information to a universal subscriber identity card USIM and before receiving the updated CAG information sent by the USIM, the method further includes: receiving a second refresh command sent by the USIM, where the second refresh command instructs the terminal to obtain updated CAG information; Sending a first request message to the USIM, where the first request message is used to request the updated CAG information; The receiving updated CAG information sent by the USIM includes: A first request response message sent by the USIM is received, where the first request response message includes the updated CAG information.

14. The method according to claim 1, characterized in that In a case where the target information is the first security package or the second security package, and the first protection information is the same as the second protection information, the method further includes: The target information is unpacked to obtain the updated CAG information.

15. The method according to claim 1, characterized in that The leaving the first object includes at least one of the following: When the first object enters an idle state, leaving the first object; When a first command is received, the terminal leaves the first object, where the first command is used to instruct the terminal to leave the first object.

16. A CAG information processing method, applied to a first network element of a VPLMN, characterized in that: The method comprises: When the terminal successfully registers in the PLMN, receiving first indication information sent by a second network element of the HPLMN, wherein the first indication information includes update information and is used to instruct the first network element to forward the update information to the terminal; Sending the update information to the terminal, so that the terminal performs the first operation when the first protection information is different from the second protection information; The update information includes target information, header information, counter information, and first protection information corresponding to the target information, and the target information is any one of the following: updated CAG information, a first security package corresponding to the updated CAG information, a first roaming control SOR information including the updated CAG information, and a second security package corresponding to the first SOR information; The first operation includes at least one of the following: discarding the target information; lowering the priority of the first object; leaving the first object; abandoning sending feedback information corresponding to the target information to the home public land mobile network HPLMN; wherein the second protection information is generated based on the target information, the header information, the counter information and the key information stored in the terminal; the first object is any one of the following: the VPLMN, the tracking area TA in the VPLMN, the CAG cell in the VPLMN, and the non-CAG cell in the VPLMN.

17. The method according to claim 16, characterized in that The update information is carried in a first container of a downlink non-access layer NAS transmission message; or, the update information is carried in a first CAG information container.

18. The method according to claim 17, characterized in that The first CAG information container is a newly added container of the downlink NAS transmission message.

19. The method according to claim 17, characterized in that The first container is: a terminal parameter update UPU transparent container, or a SOR transparent container.

20. The method according to claim 19, characterized in that The target information is carried in a UPU list of the UPU transparent container, or the target information is carried in a SOR list of the SOR transparent container.

21. The method according to claim 20, characterized in that The target information is carried in the target data group of the UPU list or the SOR list, and the type of the target data group is newly added with a CAG information type.

22. The method according to claim 16, characterized in that In a case where the first protection information is the same as the second protection information, the method further includes: receiving feedback information corresponding to the target information sent by the terminal, where the feedback information is used to indicate that the terminal has successfully received the updated CAG information; Send the feedback information to the second network element.

23. The method according to claim 22, characterized in that The feedback information is carried in a second container of an uplink NAS transmission message; or, the feedback information is carried in a second CAG information container.

24. The method according to claim 23, characterized in that The second CAG information container is a newly added container of the uplink NAS transmission message.

25. The method according to claim 23, characterized in that The second container is: a UPU transparent container, or a SOR transparent container.

26. The method according to claim 16, characterized in that After sending the update information to the terminal, the method further includes: receiving second indication information sent by the second network element, where the second indication information is used to instruct the first network element to trigger the terminal to leave the first object; Sending a first command to the terminal, where the first command is used to instruct the terminal to leave the first object; The first object is any one of the following: the VPLMN, a tracking area TA in the VPLMN, a CAG cell in the VPLMN, and a non-CAG cell in the VPLMN.

27. A CAG information processing method, applied to a second network element in a HPLMN, characterized in that: The method comprises: When the terminal successfully registers in the PLMN and the CAG information is updated, sending first indication information to a first network element of the VPLMN, the first indication information includes update information and is used to instruct the first network element to forward the update information to the terminal, so that the terminal performs a first operation when the first protection information is different from the second protection information; The update information includes target information, header information, counter information, and first protection information corresponding to the target information, and the target information is any one of the following: updated CAG information, a first security package corresponding to the updated CAG information, a first roaming control SOR information including the updated CAG information, and a second security package corresponding to the first SOR information; The first operation includes at least one of the following: discarding the target information; lowering the priority of the first object; leaving the first object; abandoning sending feedback information corresponding to the target information to the home public land mobile network HPLMN; wherein the second protection information is generated based on the target information, the header information, the counter information and the key information stored in the terminal; the first object is any one of the following: the VPLMN, the tracking area TA in the VPLMN, the CAG cell in the VPLMN, and the non-CAG cell in the VPLMN.

28. The method according to claim 27, characterized in that The first indication information is the i-th first indication information, i is a positive integer less than or equal to N, and N is a positive integer; after sending the first indication information to the first network element of the VPLMN, the method further includes at least one of the following: When the first condition is met, sending (i+1)th first indication information to the first network element; When the second condition is met, second indication information is sent to the first network element, where the second indication information is used to instruct the first network element to trigger the terminal to leave a first object, where the first object is any one of the following: the VPLMN, a tracking area TA in the VPLMN, a CAG cell in the VPLMN, and a non-CAG cell in the VPLMN; The first condition satisfies at least one of the following: feedback information corresponding to the target information is not received, and i is less than N; the received feedback information is different from the verification information stored in the second network element, and i is less than N; The second condition satisfies at least one of the following items: the feedback information is not received, and i is equal to N; the received feedback information is different from the verification information stored in the second network element, and i is equal to N.

29. The method according to claim 27, characterized in that Before sending the first indication information to the first network element of the VPLMN, the method further includes: Sending second request information to a third network element of the HPLMN, where the second request information includes the target information and is used to request the third network element to protect the target information; Receive second request response information sent by the third network element, where the second request response information includes the first protection information.

30. A CAG information processing method, applied to USIM, characterized in that: The method comprises: receiving security package information sent by the terminal when the first protection information and the second protection information are the same, the security package information including the first security package corresponding to the updated CAG information or the second security package corresponding to the first SOR information, the first SOR information including the updated CAG information; Sending the updated CAG information to the terminal, where the updated CAG information is obtained by unpacking the security package information; Among them, the first protection information is the protection information corresponding to the security package information, and the second protection information is generated based on the security package information, header information, counter information and key information stored in the terminal.

31. The method according to claim 30, characterized in that The sending the updated CAG information to the terminal includes: A first refresh command is sent to the terminal, where the first refresh command carries the updated CAG information.

32. The method according to claim 30, characterized in that After receiving the security packet corresponding to the updated CAG information sent by the terminal and before sending the updated CAG information to the terminal, the method further includes: Sending a second refresh command to the terminal, where the second refresh command is used to instruct the terminal to obtain the updated CAG information; receiving first request information sent by the terminal, where the first request information is used to request the updated CAG information; The sending the updated CAG information to the terminal includes: Sending first request response information to the terminal, where the first request response information includes the updated CAG information.

33. A terminal, characterized in that: The terminal comprises: A first receiving module is used to receive update information sent by a first network element of a visited public land mobile network VPLMN when the terminal is successfully registered in the public land mobile network PLMN, wherein the update information includes target information, header information, counter information and first protection information corresponding to the target information; an operation module, configured to perform a first operation when the first protection information is different from the second protection information, wherein the first operation includes at least one of the following: discarding the target information; reducing the priority of the first object; leaving the first object; and giving up sending feedback information corresponding to the target information to a home public land mobile network HPLMN; The second protection information is generated based on the target information, the header information, the counter information and the key information stored in the terminal; the target information is any one of the following: the updated CAG information, the first security package corresponding to the updated CAG information, the first roaming control SOR information including the updated CAG information, and the second security package corresponding to the first SOR information; the first object is any one of the following: the VPLMN, the tracking area TA in the VPLMN, the CAG cell in the VPLMN, and the non-CAG cell in the VPLMN.

34. A network element, characterized in that: The network element is a first network element of a VPLMN, and the network element includes: a fourth receiving module, configured to receive, when the terminal successfully registers in the PLMN, first indication information sent by a second network element of the HPLMN, wherein the first indication information includes update information and is configured to instruct the first network element to forward the update information to the terminal; A fourth sending module, configured to send the update information to the terminal, so that the terminal performs the first operation when the first protection information is different from the second protection information; The update information includes target information, header information, counter information, and first protection information corresponding to the target information, and the target information is any one of the following: updated CAG information, a first security package corresponding to the updated CAG information, a first roaming control SOR information including the updated CAG information, and a second security package corresponding to the first SOR information; The first operation includes at least one of the following: discarding the target information; lowering the priority of the first object; leaving the first object; abandoning sending feedback information corresponding to the target information to the home public land mobile network HPLMN; wherein the second protection information is generated based on the target information, the header information, the counter information and the key information stored in the terminal; the first object is any one of the following: the VPLMN, the tracking area TA in the VPLMN, the CAG cell in the VPLMN, and the non-CAG cell in the VPLMN.

35. A network element, characterized in that: The network element is a second network element in the HPLMN, and the network element includes: a seventh sending module, configured to send first indication information to a first network element of the VPLMN when the terminal successfully registers in the PLMN and the CAG information is updated, wherein the first indication information includes update information and is configured to instruct the first network element to forward the update information to the terminal, so that the terminal performs a first operation when the first protection information is different from the second protection information; The update information includes target information, header information, counter information, and first protection information corresponding to the target information, and the target information is any one of the following: updated CAG information, a first security package corresponding to the updated CAG information, a first roaming control SOR information including the updated CAG information, and a second security package corresponding to the first SOR information; The first operation includes at least one of the following: discarding the target information; lowering the priority of the first object; leaving the first object; abandoning sending feedback information corresponding to the target information to the home public land mobile network HPLMN; wherein the second protection information is generated based on the target information, the header information, the counter information and the key information stored in the terminal; the first object is any one of the following: the VPLMN, the tracking area TA in the VPLMN, the CAG cell in the VPLMN, and the non-CAG cell in the VPLMN.

36. A USIM, characterized in that: The USIM includes: An eighth receiving module, configured to receive security package information sent by the terminal when the first protection information and the second protection information are the same, the security package information including the first security package corresponding to the updated CAG information or the second security package corresponding to the first SOR information, and the first SOR information including the updated CAG information; a tenth sending module, configured to send the updated CAG information to the terminal; Among them, the first protection information is the protection information corresponding to the security package information, and the second protection information is generated based on the security package information, header information, counter information and key information stored in the terminal.

37. A communication device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the CAG information processing method as described in at least one of claims 1 to 15, or implements the steps of the CAG information processing method as described in at least one of claims 16 to 26, or implements the steps of the CAG information processing method as described in at least one of claims 27 to 29, or implements the steps of the CAG information processing method as described in at least one of claims 30 to 32.

38. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by the processor, it implements the steps of the CAG information processing method as described in at least one of claims 1 to 15, or implements the steps of the CAG information processing method as described in at least one of claims 16 to 26, or implements the steps of the CAG information processing method as described in at least one of claims 27 to 29, or implements the steps of the CAG information processing method as described in at least one of claims 30 to 32.

Images