Method, device, equipment and medium for data communication based on shared key

Abstract

The present disclosure provides a method, apparatus, device and medium for data communication based on a shared key, wherein the method includes: obtaining identification information of a remote terminal device; generating a terminal application identifier according to the identification information of the remote terminal device; generating a corresponding application key according to the terminal application identifier and the application platform key; feeding back the terminal application identifier, the application key and the application key identifier to the remote terminal device, the remote terminal device is configured to send the application key identifier and the terminal application identifier to the relay application management platform through an application session request, so that the relay application management platform is configured to generate the corresponding application key according to the terminal application identifier and the application platform key, and the terminal and the relay application management platform communicate data based on the application key. Through the embodiments of the present disclosure, the security communication requirements of the remote UE and the application management platform are met without upgrading the core network, and the application scenarios in near-domain communication are expanded.

Description

Background Art

[0002] Currently, 3GPP has introduced the AKMA (authentication and key management for applications) mechanism in the 5G system.

[0003] In the related art, a shared key (denoted as K) between the terminal and the network generated during the initial network authentication and key negotiation process can be used. AUSF ), and generate a shared key K between the APP end and the application background AF .

[0004] However, in some near-field communication scenarios, when a remote UE (User Equipment) accesses a mobile core network to use data services via a relay UE, the remote UE and the application platform cannot directly use the AKMA mechanism to generate a shared key at the application layer.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0006] The purpose of the present disclosure is to provide a method, apparatus, device and medium for data communication based on a shared key, which is used to overcome the problem of poor communication reliability between a remote UE and an application platform due to limitations and defects of related technologies, at least to a certain extent.

[0007] According to a first aspect of an embodiment of the present disclosure, a method for data communication based on a shared key is provided, comprising: obtaining identification information of a remote terminal device; generating a terminal application identifier according to the identification information of the remote terminal device; generating a corresponding application key according to the terminal application identifier and an application platform key; feeding back the terminal application identifier, the application key and the application key identifier to the remote terminal device, the remote terminal device being configured to send an application key identifier and a terminal application identifier to a relay application management platform via an application session request, so that the relay application management platform is configured to generate a corresponding application key according to the terminal application identifier and the application platform key, and the remote terminal device and the relay application management platform perform data communication based on the application key.

[0008] In an exemplary embodiment of the present disclosure, before obtaining the identification information of the remote terminal device, it also includes: performing a main authentication with the application layer and generating an anchor key; generating an application platform key and the application key identifier based on the anchor key; requesting to establish an application session with the relay application management platform; sending the application key identifier to the relay application management platform, the relay application management platform is configured to send the application key identifier and the application platform identifier to the application layer authentication and key management anchor function, the application layer authentication and key management anchor function is configured to determine the application platform key based on the anchor key, and feedback the application platform key, the validity period of the application platform key and the terminal universal public user identifier to the relay application management platform; and performing data communication with the relay application management platform through the shared application platform key.

[0009] In an exemplary embodiment of the present disclosure, generating a corresponding application key according to a terminal application identifier and an application platform key includes: substituting the terminal application identifier and the application platform key into a key derivation function for calculation; and determining a corresponding application key according to the key derivation function.

[0010] In an exemplary embodiment of the present disclosure, the expression of the key derivation function includes: K-APP=HMAC-SHA-256(K AF , S); S = FC||P0||L0, wherein the HMAC-SHA-256 (K AF , S) represents a key derivation function with the Kaf and the S as parameters, the Kaf represents the application platform key, the K-APP represents the application key, the S represents an intermediate parameter, the FC represents a reserved field of 3GPP, the P0 represents the terminal application identifier, and the L0 represents the character length of the terminal application identifier.

[0011] In an exemplary embodiment of the present disclosure, it also includes: obtaining a communication identifier of a remote terminal device; generating an IPv6 interface identifier based on the communication identifier, and determining identification information of a corresponding remote terminal device based on the IPv6 interface identifier; and allocating the IPv6 interface identifier to the corresponding remote terminal device.

[0012] In an exemplary embodiment of the present disclosure, it also includes: obtaining a communication identifier of a remote terminal device; generating an IPv6 interface identifier based on the communication identifier, and determining identification information of the corresponding remote terminal device based on the IPv6 interface identifier; in response to receiving a data stream from the remote terminal device, replacing the IPv6 interface identifier in the data stream with the generated IPv6 interface identifier.

[0013] In an exemplary embodiment of the present disclosure, the communication identifier includes at least one of MSISDN, GPSI, IMSI, SUPI, and MAC address.

[0014] According to a second aspect of an embodiment of the present disclosure, there is provided an apparatus for data communication based on a shared key, comprising: an acquisition module, configured to acquire identification information of a remote terminal device; a generation module, configured to generate a terminal application identifier according to the identification information of the remote terminal device; the generation module, configured to generate a corresponding application key according to the terminal application identifier and an application platform key; an interaction module, configured to feed back the terminal application identifier, the application key and the application key identifier to the remote terminal device, the remote terminal device being configured to send the application key identifier and the terminal application identifier to a relay application management platform via an application session request, so that the relay application management platform is configured to generate the corresponding application key according to the terminal application identifier and the application platform key, and the remote terminal device and the relay application management platform perform data communication based on the application key.

[0015] According to a third aspect of the present disclosure, there is provided an electronic device, comprising: a memory; and a processor coupled to the memory, wherein the processor is configured to execute any one of the methods described above based on instructions stored in the memory.

[0016] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a program is stored, and when the program is executed by a processor, the method for performing data communication based on a shared key as described in any one of the above is implemented.

[0017] In the disclosed embodiment, identification information of a remote terminal device is obtained, and a terminal application identifier is generated according to the identification information of the remote terminal device, and then a corresponding application key is generated according to the terminal application identifier and an application platform key, and finally the terminal application identifier, the application key and the application key identifier are fed back to the remote terminal device. The remote terminal device is configured to send an application key identifier and a terminal application identifier to a relay application management platform through an application session request, so that the relay application management platform is configured to generate a corresponding application key according to the terminal application identifier and the application platform key. The remote terminal device and the relay application management platform perform data communication based on the application key, and the secure communication requirements of the remote UE and the application management platform are met without upgrading or modifying the core network, thereby expanding the application scenarios in near-domain communications.

[0018] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0020] Figure 1 A schematic diagram showing an exemplary system architecture to which a solution for performing data communication based on a shared key according to an embodiment of the present invention can be applied;

[0021] Figure 2 is a schematic diagram of a 3GPP application layer authentication and key management architecture applied to an external application platform AF in an exemplary embodiment of the present disclosure;

[0022] Figure 3 is a schematic diagram of an authentication and key agreement process in an exemplary embodiment of the present disclosure;

[0023] Figure 4 is an interactive schematic diagram of data communication based on a shared key in an exemplary embodiment of the present disclosure;

[0024] Figure 5 is an interactive schematic diagram of an application layer key derivation process in an exemplary embodiment of the present disclosure;

[0025] Figure 6 is a flow chart of a method for data communication based on a shared key in an exemplary embodiment of the present disclosure;

[0026] Figure 7 is a flow chart of another method for data communication based on a shared key in an exemplary embodiment of the present disclosure;

[0027] Figure 8 is a flow chart of another method for data communication based on a shared key in an exemplary embodiment of the present disclosure;

[0028] Fig. 9 is a flow chart of another method for data communication based on a shared key in an exemplary embodiment of the present disclosure;

[0029] Fig.10 is a flow chart of another method for data communication based on a shared key in an exemplary embodiment of the present disclosure;

[0030] Fig.11 A schematic diagram showing an application layer key derivation process to which an embodiment of the present invention can be applied;

[0031] Fig.12A schematic diagram showing a system architecture of a data communication solution based on a shared key to which an embodiment of the present invention can be applied;

[0032] Fig.13 A schematic diagram showing a scheme for data communication based on a shared key to which an embodiment of the present invention can be applied;

[0033] Fig.14 A schematic diagram showing a data communication interaction process based on a shared key to which an embodiment of the present invention can be applied;

[0034] Fig.15 is a block diagram of an apparatus for performing data communication based on a shared key in an exemplary embodiment of the present disclosure;

[0035] Fig.16 is a block diagram of an electronic device in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0036] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0037] In addition, the accompanying drawings are only schematic diagrams of the present disclosure, and the same reference numerals in the drawings represent the same or similar parts, so their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities, which do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0038] Figure 1 The diagram shows an exemplary system architecture to which a solution for performing data communication based on a shared key according to an embodiment of the present invention can be applied.

[0039] like Figure 1As shown, the system architecture 100 may include one or more of terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0040] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided as required. For example, a wireless network may have other network functions in addition to existing functions, and the server 105 may be a server cluster composed of multiple servers.

[0041] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Terminal devices 101, 102, 103 can be various electronic devices with display screens, including but not limited to smart phones, tablet computers, portable computers, desktop computers, etc. The terminal devices described here, in addition to the software and hardware functions of the terminal itself, can also include application APP software to realize the above functions.

[0042] In some embodiments, the method for performing data communication based on a shared key provided in the embodiments of the present invention is generally executed by a network element in a communication network. Accordingly, the device for performing data communication based on a shared key is generally arranged in the network element.

[0043] The following describes the terms and concepts involved in the embodiments of the present disclosure.

[0044] UDM: Unified Data Management, unified data management functions, 3GPP AKA authentication, user identification, access authorization, registration, mobility, subscription, SMS management, etc.

[0045] AUSF: Authentication Server Function, authentication server function, implements 3GPP and non-3GPP access authentication.

[0046] AMF: Access and Mobility Management Function, which performs registration, connection, reachability, and mobility management.

[0047] NEF: Network Exposure Function, network exposure function, opens the capabilities of each NF, converts internal and external information, and can also be used in edge computing scenarios.

[0048] AF: Application Function, application function, various application platforms.

[0049] UE: User Equipment, refers to various user terminal devices.

[0050] RAN: Radio Access Network.

[0051] HPLMN: Home Public Land Mobile Network, local public land mobile network.

[0052] ME:Mobile Equipment, mobile equipment.

[0053] IPv6: Internet Protocol Version 6, the abbreviation of Internet Protocol Version 6, is the next-generation IP protocol designed by the Internet Engineering Task Force to replace IPv4.

[0054] AAnf: Application layer authentication and key management anchor function.

[0055] Figure 2 3GPP application layer authentication and key management architecture applied to an external application platform AF in an exemplary embodiment of the present disclosure.

[0056] refer to Figure 2 The 3GPP application layer authentication and key management architecture 200 applied to the external application platform AF includes UDM, AUSF, AMF, RAN, NEF, UE, AF and AAnf, and performs application layer authentication and key management in the manner shown in the figure.

[0057] Figure 3 It is a schematic diagram of the authentication and key negotiation process in an exemplary embodiment of the present disclosure.

[0058] refer to Figure 3 The 3GPP application layer authentication and key management architecture 300 applied to the internal application platform AF includes UDM, AUSF, AMF, RAN, UE, AF and AAnf, and is as follows: Figure 3 Application layer authentication and key management are performed in the manner shown.

[0059] Figure 4 It is a schematic diagram of interaction for data communication based on a shared key in an exemplary embodiment of the present disclosure.

[0060] refer to Figure 4The interactive process 400 for data communication based on a shared key includes two parts: HPLMN and ServingNetwork. K is determined in HPLMN. AUSF In the Serving Network, according to K SEAF Determine K AMF , and based on K AMF Determine K N3IWF , K gNB，NH , K NASint and K NASenc , and then by K gNB，NH Determine K RRCint , K RRCenc , K UPint , K UPenc .

[0061] Figure 5 It is an interactive schematic diagram of the application layer key derivation process in the exemplary embodiment of the present disclosure.

[0062] refer to Figure 5 The application layer key derivation process 500 includes: AUSF Determine K AKMA , followed by K AKMA Determine K AF These two processes.

[0063] The exemplary embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0064] Figure 6 The present invention is a flowchart of a method for performing data communication based on a shared key in an exemplary embodiment of the present disclosure.

[0065] refer to Figure 6 , the method for data communication based on a shared key may include:

[0066] Step S602: Acquire identification information of the remote terminal device.

[0067] Step S604: Generate a terminal application identifier according to the identifier information of the remote terminal device.

[0068] Step S606: Generate a corresponding application key according to the terminal application identifier and the application platform key.

[0069] Step S608, the terminal application identifier, the application key and the application key identifier are fed back to the remote terminal device, the remote terminal device is configured to send the application key identifier and the terminal application identifier to the relay application management platform through an application session request, so that the relay application management platform is configured to generate a corresponding application key according to the terminal application identifier and the application platform key, and the remote terminal device and the relay application management platform perform data communication based on the application key.

[0070] In the disclosed embodiment, identification information of a remote terminal device is obtained, and a terminal application identifier is generated according to the identification information of the remote terminal device, and then a corresponding application key is generated according to the terminal application identifier and an application platform key, and finally the terminal application identifier, the application key and the application key identifier are fed back to the remote terminal device. The remote terminal device is configured to send an application key identifier and a terminal application identifier to a relay application management platform through an application session request, so that the relay application management platform is configured to generate a corresponding application key according to the terminal application identifier and the application platform key. The remote terminal device and the relay application management platform perform data communication based on the application key, and the secure communication requirements of the remote UE and the application management platform are met without upgrading or modifying the core network, thereby expanding the application scenarios in near-domain communications.

[0071] The following describes in detail the steps of the method for performing data communication based on a shared key.

[0072] In an exemplary embodiment of the present disclosure, Figure 7 As shown, before obtaining the identification information of the remote terminal device, it also includes:

[0073] Step S702: Perform primary authentication with the application layer and generate an anchor key.

[0074] Step S704: Generate an application platform key and the application key identifier based on the anchor key.

[0075] Step S706: Request to establish an application session with the relay application management platform.

[0076] Step S708: Send the application key identifier to the relay application management platform. The relay application management platform is configured to send the application key identifier and the application platform identifier to the application layer authentication and key management anchor function. The application layer authentication and key management anchor function is configured to determine the application platform key based on the anchor key, and feed back the application platform key, the validity period of the application platform key and the terminal universal public user identifier to the relay application management platform.

[0077] Step S710: Perform data communication with the relay application management platform through the shared application platform key.

[0078] In an exemplary embodiment of the present disclosure, Figure 8 As shown, generating a corresponding application key according to the terminal application identifier and the application platform key includes:

[0079] Step S802: Substitute the terminal application identifier and the application platform key into a key derivation function for calculation.

[0080] Step S804: determining a corresponding application key according to the key derivation function.

[0081] In an exemplary embodiment of the present disclosure, the expression of the key derivation function includes: K-APP=HMAC-SHA-256(K AF , S), S = FC||P0||L0, wherein the HMAC-SHA-256 (K AF , S) represents a key derivation function with the Kaf and the S as parameters, the K AF represents the application platform key, the K-APP represents the application key, the S represents the intermediate parameter, the FC represents the reserved field of 3GPP, the P0 represents the terminal application identifier (UE-APP-ID), and the L0 represents the character length of the terminal application identifier.

[0082] In the above embodiment, the definition of the key derivation function is specifically described in 3GPP TS33.220, and 3GPP refers to "HMAC: Keyed-Hashing for Message Authentication" in IETF RFC 2104 and "Information Technology-Security techniques-Hash-functions-Part 3: Dedicated hash-functions" in ISO / IEC10118-3:2004.

[0083] In the above embodiment, the above parameter expression can also be used in the following manner:

[0084] FC: You can select one of the fields 0xF0-0xFE (0xF0 and 0xFE are both hexadecimal) reserved by 3GPP;

[0085] P0 = UE-APP-ID;

[0086] L0 = length of UE_APP_ID;

[0087] Among them, UE-APP-ID = UE-ID || AF FQDN || Ua*security protocol ID.

[0088] In the above embodiment, HMAC is a method of constructing a message authentication code using a one-way hash function, wherein the H in HMAC means Hash.

[0089] The one-way hash function used in HMAC is not limited to one type. Any high-strength one-way hash function can be used for HMAC. If a new one-way hash function is designed in the future, it can also be used.

[0090] HMAC constructed using SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512 are called HMAC-SHA1, HMAC-SHA-224, HMAC-SHA-384, and HMAC-SHA-512, respectively.

[0091] The calculation steps of HMAC include:

[0092] 1. Key padding: If the key is shorter than the one-way hash function block length, it is necessary to fill the end with 0 until its length reaches the one-way hash function block length. If the key is longer than the block length, a one-way hash function is used to calculate the hash value of the key, and then this hash value is used as the HMAC key.

[0093] 2. XOR of padded key and ipad: XOR the padded key with a bit sequence called ipad. ipad is a bit sequence formed by repeatedly looping the bit sequence 00110110 until the packet length is reached, where i in ipad means inner. The value obtained by the XOR operation is a bit sequence with the same packet length as the one-way hash function and related to the key. This bit sequence is called ipadkey.

[0094] 3. Combine with message: Combine ipadkey with the message, that is, append the bit sequence (ipadkey) related to the key to the beginning of the message.

[0095] 4. Calculate the hash value: Input the result of 3 into the one-way hash function and calculate the hash value.

[0096] 5. XOR of the padded key and opad: Perform an XOR operation on the padded key and a bit sequence called opad. opad is a bit sequence formed by repeatedly repeating the bit sequence 01011100 until the packet length is reached, where the "o" in opad stands for "outer". The result of the XOR operation is also a bit sequence with the same packet length as the one-way hash function and related to the key. This bit sequence is called opadkey.

[0097] 6. Combine with hash value: Put the hash value of 4 after opadkey.

[0098] 7. Calculate the hash value: Input the result of step 6 into the one-way hash function and calculate the hash value, which is the final MAC value. From the above process, it can be seen that the final MAC value must be a bit sequence of fixed length that is related to the input message and the key.

[0099] In an exemplary embodiment of the present disclosure, Fig. 9 As shown, the method for performing data communication based on a shared key also includes:

[0100] Step S902: Acquire the communication identifier of the remote terminal device.

[0101] Step S904: Generate an IPv6 interface identifier according to the communication identifier, and determine identification information of the corresponding remote terminal device according to the IPv6 interface identifier.

[0102] Step S906: Allocate the IPv6 interface identifier to the corresponding remote terminal device.

[0103] In the above embodiment, after the remote UE and the relay UE complete authentication, the relay UE needs to obtain the ID of the remote UE, where the ID of the remote UE can be MSISDN / GPSI, IMSI / SUPI, MAC address, etc. The relay UE can generate an IPv6 interface ID using the remote UE ID and then allocate the IPv6 interface ID to the remote UE.

[0104] In an exemplary embodiment of the present disclosure, Fig.10 As shown, the method for performing data communication based on a shared key also includes:

[0105] Step S1002: Acquire the communication identifier of the remote terminal device.

[0106] Step S1004: Generate an IPv6 interface identifier according to the communication identifier, and determine identification information of the corresponding remote terminal device according to the IPv6 interface identifier.

[0107] Step S1006: In response to the received data stream of the remote terminal device, the generated IPv6 interface identifier is used to replace the IPv6 interface identifier in the data stream.

[0108] In the above embodiment, if the relay UE does not allocate an interface ID to the remote UE, it is necessary to replace the source IPv6 interface ID with an IPv6 interface ID generated using the remote UE ID in the data flow of the remote UE.

[0109] In the above embodiment, while realizing data communication between the remote terminal device and the relay application management platform based on the application key, the core network needs to count the traffic of different source IPv6 interface IDs separately, generate traffic records separately, and send them to the IT system for billing.

[0110] In an exemplary embodiment of the present disclosure, the communication identifier includes at least one of MSISDN, GPSI, IMSI, SUPI, and MAC address.

[0111] Among them, IMSI is the International Mobile Subscriber Identification Number, which is a symbol to distinguish mobile users. It is stored in the EF-IMSI file of the SIM card and can be used to distinguish the valid information of mobile users. IMSI is the ID number of the SIM card, which can distinguish each SIM card. IMSI consists of a string of decimal numbers with a maximum length of 15 digits. The length of most IMSIs actually used is 15 digits.

[0112] Among them, MSISDN (Mobile Subscriber International ISDN number) is the mobile station international user identification code, that is, the ISDN number of the mobile user. It is the number that can only identify the mobile user in the public switched telephone network switching network numbering plan, commonly known as the mobile phone number. The MSISDN number consists of the following three parts:

[0113] (1) CC: Country Code. China’s country code is 86.

[0114] (2) NDC: National Destination Code, also known as Network Access Code, is assigned to each network operator by the communications authorities of each country. China Mobile's network access codes are 134-139, 150-152, 188, etc., China Unicom's are 130-132, 185-186, etc., and China Telecom's are 133, 153, 180, 189, etc.

[0115] (3) SN: Subscriber Number, customer number, assigned by the network operator.

[0116] SUPI: Subscription Permanent Identifier, user permanent identification, similar to IMSI in 4G. The real identity of the mobile phone is called SUPI (SUbscription Permanent Identifier) ​​in 5G, similar to IMSI. The ciphertext encrypted by the public key is called SUCI (Subscription Concealed Identifier). After SUCI is transmitted to the base station, the base station directly uploads it to the core network.

[0117] GPSI: Generic Public Subscription Identifier, equivalent to 4G MSISDN. There is not necessarily a one-to-one correspondence between SUPI and GPSI. If a user accesses different data networks, there will be multiple GPSI identifiers. The network needs to establish a relationship between the external network GPSI and SUPI. NEF can achieve a mapping relationship between External GPSI and InterGPSI, and the mapping relationship between Internal GPSI and SUPI is saved on UDR.

[0118] MAC: Medium / Media Access Control address, used to represent the identifier of each site on the Internet, expressed in hexadecimal, a total of six bytes (48 bits). Among them, the first three bytes are codes (high 24 bits) assigned to different manufacturers by the IEEE registration management agency RA, also known as "Organizationally Unique Identifier", and the last three bytes (low 24 bits) are assigned by each manufacturer to the adapter interface produced, called extended identifier (uniqueness). One address block can generate 2 different addresses. The MAC address is actually the adapter address or adapter identifier.

[0119] Fig.11 A schematic diagram of an application layer key derivation process to which an embodiment of the present invention can be applied is shown.

[0120] like Fig.11 As shown, the application layer key derivation process 1100 includes: adding K AF The KAPP is derived (the required number is determined according to the number of remote UEs), and the KAPPn is generated by the relay ME ad hoc network and sent to the remote UEn for secure communication between the application platform AF and MEn.

[0121] Fig.12 A schematic diagram of a system architecture of a data communication solution based on a shared key to which an embodiment of the present invention can be applied is shown.

[0122] like Fig.12 As shown, the system architecture may include a remote terminal device 1202, a relay terminal device 1204, a wireless network and the Internet 1210. The wireless network is used to provide a medium for a communication link between the terminal device and the server. The wireless network may include a base station 1206, a user plane function 1208, an access and mobility management function 1212, and a session management function 1214. The connection type of the wireless network includes a wired, wireless communication link or an optical fiber cable, but is not limited thereto.

[0123] Fig.13 The diagram shows a scheme for performing data communication based on a shared key to which an embodiment of the present invention can be applied.

[0124] like Fig.13 As shown, the scheme for data communication based on a shared key includes the following processes:

[0125] Step S1302: The relay UE completes the primary authentication and generates a shared key K AUSF , based on K AUSF Generate anchor key K AKMA , application key identification A-KID, and complete K AF negotiation and generation.

[0126] Step S1304: the remote UE establishes a connection with the relay UE, and the relay UE obtains the remote UE ID.

[0127] Step S1306: The relay UE generates a UE-APP-ID for the remote UE and uses the UE-APP-ID and K AF Generate K-app.

[0128] Step S1308: The relay UE sends the UE-APP-ID, the application key K-app and the A-KID to the remote UE.

[0129] Step S1310, the application platform AF uses the UE-APP-ID and the application platform key K AF Generate application key K-app.

[0130] Step S1312: The remote UE and the platform AF perform secure communication using K-app.

[0131] Fig.14 A schematic diagram of a data communication interaction process based on a shared key to which an embodiment of the present invention can be applied is shown.

[0132] like Fig.14 As shown, the data communication interaction process based on the shared key mainly involves the remote UE 1402, the relay UE 1404, the authentication server function 1406, the application layer authentication and key management anchor function (AAnf) 1408, the network open function (NEF) 1410 and the relay application management platform (AF) 1412. The relay UE 1404 performs the main authentication and K between the application layer authentication and key management anchor function (AAnf) 1408. AKMA Key establishment, relay UE1404 generates A-KID and K AF , between the relay UE 1404 and the relay application management platform (AF) 1412, the relay application management platform AF 1412 sends A-KID and AF_ID, and obtains K from AAnF via NEF AF , K AF Validity period, mobile phone number GPSI, etc., the application session establishment response between relay UE1404 and relay application management platform (AF) 1412, relay UE1404 uses the shared key K AF To perform secure communication, the secure communication between the remote UE and the relay application management platform (AF) 1412 is mainly implemented through the following steps:

[0133] 1. The remote UE 1402 establishes a secure connection with the relay UE 1404 , and the relay UE 1404 obtains the ID of the remote UE 1402 .

[0134] 2. The relay UE 1404 generates a UE_APP_ID using the ID of the remote UE 1402 .

[0135] 3. Relay UE 1404 uses UE_APP_ID and K AF Generate K_app.

[0136] 4. The relay UE 1404 sends UE_APP_ID, K_app, and A-KID to the remote UE 1402 .

[0137] 5. Application session establishment request between remote UE 1402 and relay application management platform (AF) 1412 (A-KID, UE_APP_ID).

[0138] 6. The relay application management platform (AF) 1412 uses UE_APP_ID and K AF Generate K_app.

[0139] 7. An application session establishment response is sent between the remote UE 1402 and the relay application management platform (AF) 1412 .

[0140] 8. The remote UE 1402 and the relay application management platform (AF) 1412 use the shared key K_app for secure communication.

[0141] Corresponding to the above method embodiments, the present disclosure also provides a device for performing data communication based on a shared key, which can be used to execute the above method embodiments.

[0142] Fig.15 It is a block diagram of an apparatus for performing data communication based on a shared key in an exemplary embodiment of the present disclosure.

[0143] refer to Fig.15 , the apparatus 1500 for performing data communication based on a shared key may include:

[0144] The acquisition module 1502 is configured to acquire identification information of a remote terminal device.

[0145] The generating module 1504 is configured to generate a terminal application identifier according to the identifier information of the remote terminal device.

[0146] The generating module 1504 is configured to generate a corresponding application key according to the terminal application identifier and the application platform key.

[0147] The interaction module 1506 is configured to feed back the terminal application identifier, the application key and the application key identifier to the remote terminal device. The remote terminal device is configured to send the application key identifier and the terminal application identifier to the relay application management platform through an application session request, so that the relay application management platform is configured to generate a corresponding application key based on the terminal application identifier and the application platform key. The remote terminal device and the relay application management platform perform data communication based on the application key.

[0148] In an exemplary embodiment of the present disclosure, the interaction module 1506 is also configured to: perform primary authentication with the application layer and generate an anchor key; generate an application platform key and the application key identifier based on the anchor key; request to establish an application session with the relay application management platform; send the application key identifier to the relay application management platform, and the relay application management platform is configured to send the application key identifier and the application platform identifier to the application layer authentication and key management anchor function, and the application layer authentication and key management anchor function is configured to determine the application platform key based on the anchor key, and feedback the application platform key, the validity period of the application platform key and the terminal universal public user identifier to the relay application management platform; and perform data communication with the relay application management platform through the shared application platform key.

[0149] In an exemplary embodiment of the present disclosure, the generating module 1504 is further configured to: substitute the terminal application identifier and the application platform key into a key derivation function for calculation; and determine a corresponding application key according to the key derivation function.

[0150] In an exemplary embodiment of the present disclosure, the expression of the key derivation function includes: K-APP=HMAC-SHA-256(K AF , S); S = FC||P0||L0, wherein the HMAC-SHA-256 (K AF , S) characterized by the K AF and S is a key derivation function with parameters, K AF represents the application platform key, the K-APP represents the application key, the S represents the intermediate parameter, the FC represents the reserved field of 3GPP, the P0 represents the terminal application identifier, and the L0 represents the character length of the terminal application identifier.

[0151] In an exemplary embodiment of the present disclosure, the interaction module 1506 is also configured to: obtain a communication identifier of a remote terminal device; generate an IPv6 interface identifier based on the communication identifier, and determine identification information of a corresponding remote terminal device based on the IPv6 interface identifier; and assign the IPv6 interface identifier to the corresponding remote terminal device.

[0152] In an exemplary embodiment of the present disclosure, the interaction module 1506 is also configured to: obtain a communication identifier of a remote terminal device; generate an IPv6 interface identifier based on the communication identifier, and determine the identification information of the corresponding remote terminal device based on the IPv6 interface identifier; in response to receiving a data stream from the remote terminal device, replace the IPv6 interface identifier in the data stream with the generated IPv6 interface identifier.

[0153] In an exemplary embodiment of the present disclosure, the communication identifier includes at least one of MSISDN, GPSI, IMSI, SUPI, and MAC address.

[0154] Since the functions of the device 1500 for performing data communication based on a shared key have been described in detail in the corresponding method embodiments, the present disclosure will not elaborate on them here.

[0155] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0156] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0157] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0158] Refer to the following Fig.16 16A and 16B are used to describe the electronic device 1600 according to this embodiment of the present invention. Fig.16 The electronic device 1600 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0159] like Fig.16 As shown, the electronic device 1600 is in the form of a general computing device. The components of the electronic device 1600 may include but are not limited to: at least one processing unit 1610, at least one storage unit 1620, and a bus 1630 connecting different system components (including the storage unit 1620 and the processing unit 1610).

[0160] The storage unit stores program codes, which can be executed by the processing unit 1610, so that the processing unit 1610 performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit 1610 can perform the method shown in the embodiment of the present disclosure.

[0161] The storage unit 1620 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 16201 and / or a cache storage unit 16202 , and may further include a read-only storage unit (ROM) 16203 .

[0162] The storage unit 1620 may also include a program / utility 16204 having a set (at least one) of program modules 16205, such program modules 16205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0163] Bus 1630 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0164] The electronic device 1600 may also communicate with one or more external devices 1640 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1600, and / or communicate with any device that enables the electronic device 1600 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1650. Furthermore, the electronic device 1600 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 1660. As shown, the network adapter 1660 communicates with other modules of the electronic device 1600 via a bus 1630. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0165] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0166] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of the present specification.

[0167] The program product for implementing the above method according to an embodiment of the present invention can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0168] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0169] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0170] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0171] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0172] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0173] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are to be considered exemplary only, and the true scope and concept of the present disclosure are indicated by the claims.

Claims

1. A method for data communication based on a shared key, characterized in that: Applicable to a relay terminal device, the method for performing data communication based on a shared key includes: By performing master authentication with the application layer and generating anchor keys; Generate an application platform key and an application key identifier based on the anchor key; Request to establish an application session with the relay application management platform; Sending the application key identifier to the relay application management platform, the relay application management platform is configured to send the application key identifier and the application platform identifier to the application layer authentication and key management anchor function, the application layer authentication and key management anchor function is configured to determine the application platform key according to the anchor key, and feed back the application platform key, the validity period of the application platform key and the terminal universal public user identifier to the relay application management platform; Performing data communication with the relay application management platform through the shared application platform key; Obtain identification information of a remote terminal device; Generate a terminal application identifier according to the identification information of the remote terminal device; Generating a corresponding application key according to the terminal application identifier and the application platform key includes: Substituting the terminal application identifier and the application platform key into a key derivation function for calculation; Determine a corresponding application key according to the key derivation function; The terminal application identifier, the application key and the application key identifier are fed back to the remote terminal device, and the remote terminal device is configured to send the application key identifier and the terminal application identifier to the relay application management platform through an application session request, so that the relay application management platform is configured to generate a corresponding application key according to the terminal application identifier and the application platform key, and the remote terminal device and the relay application management platform perform data communication based on the application key.

2. The method for data communication based on a shared key according to claim 1, characterized in that: Also includes: Obtaining a communication identifier of a remote terminal device; Generate an IPv6 interface identifier according to the communication identifier, and determine identification information of a corresponding remote terminal device according to the IPv6 interface identifier; The IPv6 interface identifier is allocated to the corresponding remote terminal device.

3. The method for data communication based on a shared key according to claim 1, characterized in that: Also includes: Obtaining a communication identifier of a remote terminal device; Generate an IPv6 interface identifier according to the communication identifier, and determine identification information of a corresponding remote terminal device according to the IPv6 interface identifier; In response to the received data stream of the remote terminal device, the generated IPv6 interface identifier is used to replace the IPv6 interface identifier in the data stream.

4. The method for data communication based on a shared key according to claim 2 or 3, characterized in that: The communication identifier includes at least one of MSISDN, GPSI, IMSI, SUPI, and MAC address.

5. A device for data communication based on a shared key, characterized in that: include: The acquisition module is configured to generate an anchor key by performing a master authentication with the application layer; Generate an application platform key and an application key identifier based on the anchor key; Request to establish an application session with the relay application management platform; Sending the application key identifier to the relay application management platform, the relay application management platform is configured to send the application key identifier and the application platform identifier to the application layer authentication and key management anchor function, the application layer authentication and key management anchor function is configured to determine the application platform key according to the anchor key, and feed back the application platform key, the validity period of the application platform key and the terminal universal public user identifier to the relay application management platform; Performing data communication with the relay application management platform through the shared application platform key; Obtain identification information of a remote terminal device; A generating module, configured to generate a terminal application identifier according to the identification information of the remote terminal device; The generating module is configured to generate a corresponding application key according to the terminal application identifier and the application platform key, including: Substituting the terminal application identifier and the application platform key into a key derivation function for calculation; Determine a corresponding application key according to the key derivation function; The interaction module is configured to feed back the terminal application identifier, the application key and the application key identifier to a remote terminal device, wherein the remote terminal device is configured to send the application key identifier and the terminal application identifier to the relay application management platform through an application session request, so that the relay application management platform is configured to generate a corresponding application key according to the terminal application identifier and the application platform key, and the remote terminal device and the relay application management platform perform data communication based on the application key.

6. An electronic device, characterized in that: include: Memory; as well as A processor coupled to the memory, the processor being configured to execute the method for data communication based on a shared key according to any one of claims 1 to 4 based on instructions stored in the memory.

7. A computer-readable storage medium having a program stored thereon, wherein when the program is executed by a processor, the method for performing data communication based on a shared key as claimed in any one of claims 1 to 4 is implemented.

Images