Secure communication method and device, communication equipment, and storage medium

Abstract

The present disclosure relates to the field of mobile communication technology, and specifically to a secure communication method and apparatus, a communication device, and a storage medium. The method comprises: receiving a first communication message from a core network element of a network to which a terminal device belongs; wherein the first communication message includes an original user number corresponding to the terminal device; encrypting the user number in the first communication message to obtain an encrypted number, and generating a second communication message according to the encrypted number; sending the second communication message to a core network element of a visited network of the terminal device through a security edge protection agent, so that the visited network core network element processes the second communication message. The scheme of the present disclosure can modify the relevant information elements in the 5GC signaling message during the roaming service interaction to hide sensitive user information.

Description

Technical Field

[0001] The present disclosure relates to the field of mobile communication technology, and in particular to a secure communication method, a secure communication device, a communication equipment, and a storage medium.

[0002] Frequency shift method. Background Art

[0003] In the 5G SA inter-network roaming or international roaming scenario, for the sake of communication security and user information security, operators generally do not want to expose sensitive information such as the user's MDN (Mobile Directory Number) to the visited network; that is, the 5GC signaling sent to the visited network cannot carry the real MDN information of the roaming user, namely the MSISDN (Mobile Station international ISDN number). However, there is a lack of effective technical means to hide sensitive information such as user MDN in the 5G SA roaming architecture in the relevant field.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the present disclosure is to provide a secure communication method, a secure communication device, a communication equipment, and a storage medium; thereby overcoming the defects caused by the limitations and defects of related technologies to a certain extent at least, and to modify the relevant information elements in the 5GC signaling message during the roaming service interaction, so as to hide the user's sensitive information.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to a first aspect of the present disclosure, there is provided a secure communication method, comprising:

[0008] Receive a first communication message from a core network element of a home network of a terminal device; wherein the first communication message includes an original user number corresponding to the terminal device;

[0009] Encrypting the user number in the first communication message to obtain an encrypted number, and generating a second communication message according to the encrypted number;

[0010] The second communication message is sent to a visited network core network element of the terminal device through a security edge protection agent, so that the visited network core network element processes the second communication message.

[0011] In an exemplary embodiment of the present disclosure, after receiving the first communication message from the core network element of the home network of the terminal device, the method further includes:

[0012] Determine whether the first communication message contains the original user number, or identify the message type of the first communication message, so as to encrypt the user number in the first communication message when determining that the first communication message contains the original user number or identifying the first communication message as a communication message of the target type.

[0013] In an exemplary embodiment of the present disclosure, the method further includes:

[0014] Receiving a third communication message from a visited network core network element through the security edge protection agent; wherein the third communication message includes the encrypted number;

[0015] Decrypting the encrypted number contained in the third communication message to obtain the original user number, and generating a fourth communication message according to the original number;

[0016] The fourth communication message is sent to a home network core element.

[0017] In an exemplary embodiment of the present disclosure, after receiving the third communication message of the visited network core network element, the method further includes:

[0018] Determine whether the third communication message contains an encrypted encryption number, or identify the message type of the third communication message, so as to decrypt the encryption number when determining that the third communication message contains an encrypted encryption number or identifying that the third communication message is a communication message of the target type.

[0019] In an exemplary embodiment of the present disclosure, the home network core network element is a unified data management function UDM network element of the home network, and the visited network core network element is an access and mobility management function network element of the visited network;

[0020] The first communication message is a first response message sent by the UDM network element of the home network and is triggered when the terminal device roams to the visited network; wherein the first communication message includes the original user number corresponding to the terminal device.

[0021] In an exemplary embodiment of the present disclosure, the visited network core network element is a session management function V-SMF network element of the visited network, and the home network core network element is a session management function H-SMF network element of the home network;

[0022] The third communication message is a second request message sent by the V-SMF network element and is triggered during the process of creating a PDU session; wherein the third communication message includes an encrypted number corresponding to the user number.

[0023] In an exemplary embodiment of the present disclosure, the home network core network element includes an access and mobility management function S-AMF network element of the home network, and the visited network core network element is an access and mobility management function T-AMF network element of the visited network;

[0024] The first communication message is a third request message sent by the S-AMF network element and is triggered after the terminal device initiates a network switching request; wherein the third communication message includes the encrypted number corresponding to the user number.

[0025] According to a second aspect of the present disclosure, there is provided a secure communication device, comprising:

[0026] A first communication message receiving module, configured to receive a first communication message from a core network element of a home network of a terminal device; wherein the first communication message includes an original user number corresponding to the terminal device;

[0027] A number encryption processing module, used to encrypt the user number in the first communication message to obtain an encrypted number, and generate a second communication message according to the encrypted number;

[0028] The second communication message sending module is used to send the second communication message to the visited network core network element of the terminal device through a security edge protection agent, so that the visited network core network element processes the second communication message.

[0029] According to a third aspect of the present disclosure, a communication device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform a secure communication method as described in any one of the above embodiments by executing the executable instructions.

[0030] According to a fourth aspect of the present disclosure, a storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the secure communication method as described in any one of the above embodiments is implemented.

[0031] In a secure communication method provided by an embodiment of the present disclosure, when the home network corresponding to the terminal device sends a communication message to the visited network, if the communication message contains the original user number corresponding to the terminal device, the original user number will be encrypted to obtain the corresponding encrypted number and replace the original user number in the communication message; then the communication message with the replaced encrypted number will be sent to the core network element of the visited network. As a result, the core network element of the visited network cannot obtain the real original user number of the terminal device in the process of processing roaming services, thereby effectively protecting the user's privacy information and avoiding exposing the original user number to the visited network.

[0032] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0034] Figure 1 A schematic diagram schematically illustrates a secure communication method in an exemplary embodiment of the present disclosure;

[0035] Figure 2 A schematic diagram schematically illustrates a network architecture of a communication system to which a secure communication method is applied in an exemplary embodiment of the present disclosure;

[0036] Figure 3 A schematic diagram schematically illustrates a secure communication method in an exemplary embodiment of the present disclosure;

[0037] Figure 4 A schematic diagram schematically illustrates a signaling interaction in a user registration process in an exemplary embodiment of the present disclosure;

[0038] Figure 5 A schematic diagram schematically illustrates a signaling interaction in a process of creating a PDU session in an exemplary embodiment of the present disclosure;

[0039] Figure 6 A schematic diagram schematically illustrates a signaling encryption process in a network switching process in an exemplary embodiment of the present disclosure;

[0040] Figure 7 A schematic diagram schematically illustrates a signaling decryption process in a network switching process in an exemplary embodiment of the present disclosure;

[0041] Figure 8A schematic diagram schematically illustrates a secure communication device in an exemplary embodiment of the present disclosure;

[0042] Fig. 9 The diagram schematically shows a communication device in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0043] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0044] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0045] In the related existing technologies, in the 5G SA inter-network roaming or international roaming scenarios, operators do not want to expose sensitive information such as the user's MDN to the visited network to avoid adverse effects such as user loss. That is, the 5GC signaling sent to the visited network cannot carry the real MDN of the roaming user, that is, the MSISDN. At present, there is no related technology in the 5G SA roaming architecture to hide sensitive information such as the user's MDN number.

[0046] In this example implementation, in order to solve the technical defects existing in the prior art, a secure communication method is first provided. Figure 1 As shown in , the secure communication method may specifically include:

[0047] Step S11, receiving a first communication message from a core network element of a home network of a terminal device; wherein the first communication message includes an original user number corresponding to the terminal device;

[0048] Step S12, encrypting the user number in the first communication message to obtain an encrypted number, and generating a second communication message according to the encrypted number;

[0049] Step S13: Send the second communication message to the visited network core network element of the terminal device through a security edge protection agent, so that the visited network core network element processes the second communication message.

[0050] In the secure communication method provided by this example implementation, when the home network corresponding to the terminal device sends a communication message to the visited network, if the communication message contains the original user number corresponding to the terminal device, the original user number will be encrypted to obtain the corresponding encrypted number and replace the original user number in the communication message; then the communication message with the replaced encrypted number will be sent to the core network element of the visited network. As a result, the core network element of the visited network cannot obtain the real original user number of the terminal device in the process of processing roaming services, thereby effectively protecting the user's privacy information and avoiding exposing the original user number to the visited network.

[0051] Below, each step of the secure communication method in this example implementation will be described in more detail with reference to the accompanying drawings and embodiments.

[0052] In step S11, a first communication message from a core network element of a home network of a terminal device is received; wherein the first communication message includes an original user number corresponding to the terminal device.

[0053] In this example implementation, a number hiding proxy platform can be pre-deployed in the core network, and the number hiding proxy platform can be used as a proxy platform based on http2 and belong to the operator. For example, the number hiding proxy platform can be attached to the Security Edge Protection Proxies (SEPP) network element. The above method can be executed by the number hiding proxy platform attached to the SEPP network element to process the 5GC roaming signaling between the terminal device's home operator and the visited operator; and to realize the encryption and decryption of the number.

[0054] Specifically, refer to Figure 2In the architecture diagram shown, the home network 221 may be the Home Public Land Mobile Network (Home PLMN) of the home network, and may include: the Unified Data Management (UDM) network element of the home network, i.e., the H-UDM network element 224; the Session Management Function (SMF) network element of the home network, i.e., the H-SMF network element 225; the Security Edge Protection Proxy network element of the home network, i.e., the H-SEPP network element 222; and the http2 Proxy platform 223 hanging in the H-SEPP network element 222. On the side of the visited network 211, it may be the Visited Public Land Mobile Network (Visited PLMN) of the home network, and may include at least: the Access and Mobility Management Function (AMF) network element, i.e., the V-AMF network element 212, the Session Management Function network element of the visited network, i.e., the V-SMF network element 213; and the SEPP network element of the visited network, i.e., the V-SEPP network element 214.

[0055] Specifically, in some service processes, the signaling message sent by the core network element of the home network to the core network element of the visited network can be first sent to the above-mentioned number hiding proxy platform. For example, in the process of roaming service, the visited network can be a mobile network, and the home network can be a telecommunications network; for example, when the terminal device initiates a roaming user registration process to the visited network, the core network element of the home network can send a first communication message containing the original user number of the terminal device to the core network element of the visited network. The core network element of the home network can first send the first communication message to the number hiding proxy platform, so that the number hiding proxy platform can be used to process the first communication message.

[0056] Alternatively, in some exemplary embodiments, the number hiding proxy platform may also be an independent core network element. That is, a newly added core network element may be deployed in the core network, and the newly added core network element may be used to execute the above-mentioned secure communication method. For example, a number hiding protection network element may be newly added in the existing core network. Other core network elements of the home network may first send the first communication message to the newly added number hiding protection network element, and use the newly added number hiding protection network element to process the first communication message.

[0057] In step S12, the user number in the first communication message is encrypted to obtain an encrypted number, and a second communication message is generated according to the encrypted number.

[0058] In this example implementation, for the number hiding proxy platform, after receiving the first communication message sent by the core network element of the home network, the original user number in the message can be extracted, and the original user number can be encrypted to obtain the corresponding encrypted number, and then the encrypted number can be added to the original first communication message to obtain a second communication message containing the encrypted number.

[0059] Specifically, after receiving the first communication message, the number hiding agent platform can unpack the data packet of the signaling message, extract the original user number in the data packet, and encrypt the original user number to obtain the encrypted number, thereby hiding the real MDN. For example, a symmetric encryption algorithm can be used to encrypt the original user number to obtain the corresponding encrypted number. After that, the encrypted number replaces the original user number in the original data packet to obtain a signaling message with the encrypted number replaced, that is, the second communication message mentioned above. For example, the GPSI=MSISDN contained in the first communication message is 8613312345678; after encryption, the external identifier (externalidentifier) ​​of GPSI is username2domainID; wherein username is the string result after encrypting MSISDN.

[0060] In addition, in some exemplary embodiments, after receiving a first communication message from a core network element of a network to which the terminal device belongs, the method may further include: determining whether the first communication message contains the original user number, or identifying the message type of the first communication message, so as to encrypt the user number in the first communication message when determining that the first communication message contains the original user number or identifying the first communication message as a communication message of the target type.

[0061] Specifically, for the home network, the signaling messages sent by each core network element to the visited network can be first sent to the number hiding proxy platform. The number hiding proxy platform can first determine whether the received signaling message contains the original user number. If the original user number exists, it will be encrypted and then sent to the SEPP network element; if the original user number does not exist, it will not be processed, and will be directly pushed to the SEPP network element, and then sent to the core network element of the visited network by using the SEPP network element. Alternatively, on the number hiding proxy platform side, the message types that need to be encrypted can be pre-configured, and the original user number is included in these specified message types. After receiving the signaling message sent by the core network element of the home network, the number hiding proxy platform can identify its message type; if the current signaling message belongs to the preset message type, it will be encrypted and then sent to the SEPP network element; if it does not belong to the pre-configured message type, it will not be processed, and will be directly pushed to the SEPP network element, and then sent to the core network element of the visited network by using the SEPP network element.

[0062] In step S13, the second communication message is sent to a visited network core network element of the terminal device through a security edge protection agent, so that the visited network core network element processes the second communication message.

[0063] In this example implementation, after the number hiding proxy platform encrypts the original user number in the first communication message to generate the second communication message, the second communication message can be sent to the SEPP network element, and then the SEPP network element is used to send the second communication message to the visited network core network element. For example, it can be sent to the SEPP network element of the visited network, and then the SEPP network element of the visited network sends the second communication message to the corresponding visited network core network element. In this way, the sensitive data of the terminal device is encrypted in the home network, and the encryption result will not affect the normal processing of the related signaling messages by the visited network.

[0064] Specifically, the signaling messages sent by each core network element to the visited network can be first sent to the number hiding proxy platform. The number hiding proxy platform can first determine whether the received signaling message contains the original user number. If the original user number exists, it will be encrypted and then sent to the SEPP network element; if the original user number does not exist, it will not be processed and directly pushed to the SEPP network element, and then sent to the core network element of the visited network by using the SEPP network element. Alternatively, on the number hiding proxy platform side, the message types that need to be encrypted can be pre-configured, and these specified message types all include the original user number. After receiving the signaling message sent by the core network element of the home network, the number hiding proxy platform can identify its message type; if the current signaling message belongs to the preset message type, it will be encrypted and then sent to the SEPP network element; if it does not belong to the pre-configured message type, it will not be processed and directly pushed to the SEPP network element, and then sent to the core network element of the visited network by using the SEPP network element.

[0065] Based on the above content, in some exemplary implementations, a newly added core network element may be deployed in the core network, and the newly added core network element may be used to execute the above secure communication method. For example, a number hiding protection network element may be added to the existing core network; the signaling message sent by the core network element of the home network to the visited network is first sent to the number hiding protection network element, which is used to encrypt the original user number in the signaling message, and then sent to the SEPP network element, and then sent to the visited network using the SEPP network element.

[0066] In this example implementation, reference Figure 3 As shown, the above method may further include:

[0067] Step S31, receiving a third communication message from a visited network core element through the security edge protection agent; wherein the third communication message includes the encryption number;

[0068] Step S32, decrypting the encrypted number contained in the third communication message to obtain the original user number, and generating a fourth communication message according to the original number;

[0069] Step S33: Send the fourth communication message to the home network core element.

[0070] Specifically, for the signaling message fed back by the visited network in response to the signaling message of the core network element of the home network, on the home network side, the SEPP network element of the home network may receive the third communication message fed back by the core network element of the visited network. For example, the third communication message may be generated by the core network element of the visited network in response to the above-mentioned second communication message and after processing. That is, the third communication message includes the corresponding encrypted number in the second communication message.

[0071] The SEPP network element of the home network can first send the received third communication message to the number hiding proxy platform; the number hiding proxy platform decrypts the encrypted number in the third communication message to obtain the original user number corresponding to the encrypted number, and then writes the original user number back into the communication message to obtain the fourth communication message, and then sends the fourth communication message containing the original user number to the corresponding core network element, so that the core network element of the home network can normally process the signaling message of the visited network. For example, the encrypted characters username are decrypted and restored to obtain the corresponding original number 8613312345678, and the fourth communication message is generated using the original number.

[0072] In addition, in some exemplary embodiments, for the home network, after receiving the third communication message from the core network element of the visited network, the method further includes: determining whether the third communication message contains an encrypted encryption number, or identifying the message type of the third communication message, so as to decrypt the encryption number when determining that the third communication message contains an encrypted encryption number or identifying the third communication message as a communication message of the target type.

[0073] Specifically, for the number hiding proxy platform of the home network, all signaling messages of the visited network can be received through the SEPP network element. The number hiding proxy platform can identify each signaling message sent by the core network element of the visited network and determine whether its data packet contains relevant sensitive information, such as an encrypted number. If an encrypted number exists, the encrypted number can be decrypted to obtain the corresponding original user number, and the original user number is written back into the data packet, so that the core network element of the home network can process the relevant signaling according to the original user number.

[0074] In this example implementation, the above-mentioned home network core network element can be a unified data management function UDM network element of the home network, and the visited network core network element can be an access and mobility management function AMF network element of the visited network; the first communication message is a first response message issued by the UDM network element of the home network, which is triggered when the terminal device roams to the visited network; wherein, the first communication message includes the original user number corresponding to the terminal device.

[0075] Specifically, in the roaming user registration process, the UDM network element of the home network returns the user's AM subscription information to the AMF network element of the visited network through the response message of Nudm_SDM_Get, including the GPSI (Generic Public Subscription Identifier), that is, the user's real MDN number. The number hiding proxy platform can encrypt and hide the GPSI contained in the AM subscription information and forward the signaling message to the SEPP network element, and finally the signaling message is forwarded to the AMF network element of the visited network.

[0076] refer to Figure 4 As shown, it is a user registration process triggered by a roaming user in a visited network. In step 401, the user's terminal equipment initiates a registration request and authentication process to the visited network; in step 402, the UDM network element of the home network returns the user AM subscription information, including the GPSI, to the AMF network element of the visited network through the response message of Nudm_SDM_Get; in step 403, the number hiding agent platform encrypts the GPSI therein; in step 404, the number hiding agent platform forwards the encrypted signaling message to the H-SEPP network element, and finally the signaling message is forwarded to the V-AMF network element of the visited network; in step 405, the subsequent registration process is executed.

[0077] In this example implementation, the visited network core network element is a session management function V-SMF network element of the visited network, and the home network core network element is a session management function H-SMF network element of the home network; the third communication message is a second request message sent by the V-SMF network element triggered during the PDU session creation process; wherein the third communication message includes an encrypted number corresponding to the user number.

[0078] Specifically, it can be applied to the PDU session establishment process, and the signaling sent by the visited network V-SMF network element to the home network H-SMF network element.

[0079] refer to Figure 5 As shown, the process of creating a PDU session for a roaming user, step 501, the UE triggers the process of establishing a PDU session after registering in the visited network; step 502, the V-SMF network element of the visited network sends an Nsmf_PDUSession_Create request message to the H-SMF network element of the home network, which includes the GPSI (the encrypted and hidden MDN number); step 503, the number hiding agent platform decrypts and restores the GPSI; step 504, the decrypted and restored signaling message is forwarded to the H-SMF network element of the home network; step 505, the home network core network element, the visited network core network element, and the UE execute the subsequent PDU session establishment process.

[0080] In this example implementation, the home network core network element includes the access and mobility management function S-AMF network element of the home network, and the visited network core network element is the access and mobility management function T-AMF network element of the visited network; the first communication message is the third request message sent by the S-AMF network element after the terminal device initiates a network switching request; wherein the third communication message includes the encrypted number corresponding to the user number.

[0081] Specifically, it may be the signaling sent by the S-AMF of the home network to the T-AMF of the visited network during the switching process of the UE from the home network to the visited network.

[0082] refer to Figure 6 The figure shows the network switching process. In step 601, the UE initiates a network switching request. In step 602, the H-AMF network element of the home network sends a Namf Communication Create UE Context request message to the V-AMF network element of the visited network. The UE Context includes the GPSI (the user's real MDN number). The request message is sent to the number hiding proxy platform, and the number hiding proxy platform encrypts and hides the GPSI. In step 603, the number hiding proxy platform encrypts the GPSI. In step 604, the encrypted Namf Communication Create UE Context request message is sent to the SEPP network element, and the final signaling message is forwarded to the V-AMF network element of the visited network. In step 605, the subsequent network switching process is executed.

[0083] refer to Figure 7The present invention is a process of network switching from a visited network to a home network by a terminal device, and a process of restoring the user's real MDN number by signaling sent by a visited network V-AMF network element to a home network H-AMF network element in an inter-PLMNN14 interface; specifically, step 701, the UE initiates a network switching request; step 702, the visited network V-AMF network element sends a Namf Communication Create UE Context Request message to the home network H-AMF network element, wherein the UEContext includes the GPSI (the encrypted and hidden MDN number), and the request message passes through the visited network V-SEPP network element and the home network H-SEPP network element to reach the number hiding agent platform; step 703, the number hiding agent platform decrypts and restores the GPSI in the request message; step 704, the number hiding agent platform sends the Namf CommunicationCreate UE ContextRequest message after GPSI restoration to the home network H-AMF network element; step 705, executing the subsequent network switching process.

[0084] The secure communication method provided by the disclosed embodiment adds a number hiding proxy platform in the core network of the home network. For the signaling message containing user sensitive information sent by the home network to the visited network, it can be first sent to the number hiding proxy platform, and the user number and other sensitive information can be encrypted by the number hiding platform, and then sent to the corresponding visited network core network element; for the signaling message containing encrypted information sent by the visited network core network element to the home network core network element, it can be first sent to the number hiding proxy platform to decrypt the sensitive information, and then send the decrypted signaling message to the home network core network element, so as to achieve the hiding and restoration of sensitive information such as the user's MDN number by modifying the relevant information elements in the HTTP signaling message exchanged between the roaming parties. In addition, the number hiding proxy platform can be hung beside the SEPP network element, or added to the core network in the form of a new independent core network element, so as to avoid the loss caused by the leakage of sensitive information such as the user's MDN number in 5G SA roaming. This solution can be used for 5GSA co-construction and sharing and cross-network roaming. It is very practical and can also process 5G SA international roaming 5GC signaling messages accordingly according to the operator's business needs.

[0085] It should be noted that the above figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0086] For further reference, Figure 8 As shown, in the implementation of this example, a secure communication device 80 is also provided, and the device 80 includes: a first communication message receiving module 801, a number encryption processing module 802, and a second communication message sending module 803; wherein,

[0087] The first communication message receiving module 801 can be used to receive a first communication message from a core network element of a network to which a terminal device belongs; wherein the first communication message includes an original user number corresponding to the terminal device.

[0088] The number encryption processing module 802 may be configured to encrypt the user number in the first communication message to obtain an encrypted number, and generate a second communication message according to the encrypted number.

[0089] The second communication message sending module 803 may be configured to send the second communication message to a visited network core network element of the terminal device through a security edge protection agent, so that the visited network core network element processes the second communication message.

[0090] In some exemplary embodiments, the apparatus further comprises: a first sensitive information identification module.

[0091] The first sensitive information identification module can be used to determine whether the first communication message contains the original user number, or to identify the message type of the first communication message, so as to encrypt the user number in the first communication message when determining that the first communication message contains the original user number or identifying the first communication message as a communication message of the target type.

[0092] In some exemplary embodiments, the device further includes: a third communication message receiving module, a number decryption processing module, and a fourth communication message sending module.

[0093] The third communication message receiving module may be configured to receive a third communication message from a core network element of a visited network through the security edge protection agent; wherein the third communication message includes the encrypted number.

[0094] The number decryption processing module may be used to decrypt the encrypted number contained in the third communication message to obtain the original user number, and generate a fourth communication message according to the original number.

[0095] The fourth communication message sending module may be configured to send the fourth communication message to a home network core element.

[0096] In some exemplary embodiments, the apparatus further comprises: a second sensitive information identification module.

[0097] The second sensitive information identification module can be used to determine whether the third communication message contains an encrypted encryption number, or to identify the message type of the third communication message, so as to decrypt the encrypted number when determining that the third communication message contains an encrypted encryption number or identifying that the third communication message is a communication message of the target type.

[0098] In some exemplary embodiments, the home network core network element is a unified data management function UDM network element of the home network, and the visited network core network element is an access and mobility management function network element of the visited network;

[0099] The first communication message is a first response message sent by the UDM network element of the home network and is triggered when the terminal device roams to the visited network; wherein the first communication message includes the original user number corresponding to the terminal device.

[0100] In some exemplary embodiments, the visited network core network element is a session management function V-SMF network element of the visited network, and the home network core network element is a session management function H-SMF network element of the home network;

[0101] The third communication message is a second request message sent by the V-SMF network element and is triggered during the process of creating a PDU session; wherein the third communication message includes an encrypted number corresponding to the user number.

[0102] In some exemplary embodiments, the home network core network element includes an access and mobility management function S-AMF network element of the home network, and the visited network core network element is an access and mobility management function T-AMF network element of the visited network;

[0103] The first communication message is a third request message sent by the S-AMF network element and is triggered after the terminal device initiates a network switching request; wherein the third communication message includes the encrypted number corresponding to the user number.

[0104] For further reference, Fig. 9 As shown, in the implementation of this example, a communication device 90 is also provided. The communication device 90 may include: a processor 901 and a memory 902. Among them, the memory 902 is used to store executable instructions of the processor; the processor 901 is configured to execute the secure communication method described in the above embodiment by executing the executable instructions.

[0105] The specific details of each module in the above-mentioned communication equipment and secure communication device have been described in detail in the corresponding secure communication method, so they will not be repeated here.

[0106] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0107] Furthermore, in the embodiment of this example, a computer program product containing instructions is also provided, including computer readable code, or a non-volatile computer readable storage medium carrying computer readable code, when the computer readable code is executed on a computer, the computer executes the above method, as described above Figure 1 The method in .

[0108] It should be noted that, as another aspect, the present application also provides a storage medium as a computer-readable medium, which can be included in a communication device; or it can exist independently without being installed in a communication device. The above-mentioned computer-readable medium carries one or more programs, and when the above-mentioned one or more programs are executed by an electronic device, the communication device implements the method described in the above-mentioned embodiment. For example, the communication device can implement the following Figure 1 The steps shown.

[0109] Computer readable storage medium can be a tangible device that can hold and store instructions used by an instruction execution device. Computer readable storage medium can be, for example, - but not limited to - an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (non-exhaustive list) of computer readable storage medium include: a portable computer disk, a hard disk, a random access memory (Random Access Memory, RAM), a read-only memory (Read Only Memory, ROM), an erasable programmable read-only memory (Electrically Programmable Read-Only-Memory, EPROM or flash memory), a static random access memory (Static Random-Access Memory, SRAM), a portable compact disc read-only memory (Compact Disc Read-Only Memory, CD-ROM), a digital versatile disk (Digital Video Disc, DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a protruding structure in a groove on which instructions are stored, and any suitable combination thereof.

[0110] The computer-readable program instructions or codes described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0111] The computer program instructions for performing the operation of the present application may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, by utilizing the state information of computer-readable program instructions to personalize an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA), the electronic circuit can execute the computer-readable program instructions to implement various aspects of the present application.

[0112] Various aspects of the present application are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0113] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0114] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0115] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the device, system, method and computer program product according to multiple embodiments of the present application. In this regard, each square frame in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the logical function of the specification. In some alternative implementations, the functions marked in the square frame can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square frames can actually be executed substantially in parallel, and they can also be executed in reverse order sometimes, depending on the functions involved.

[0116] It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented by hardware (such as a circuit or ASIC (Application Specific Integrated Circuit)) that performs the corresponding function or action, or can be implemented by a combination of hardware and software, such as firmware.

[0117] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0118] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and examples are to be considered as exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

[0119] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A secure communication method, characterized in that: include: Receive a first communication message from a core network element of a home network of a terminal device; wherein the first communication message includes an original user number corresponding to the terminal device; the core network is pre-deployed with a number hiding proxy platform, and the number hiding proxy platform is attached to a security edge protection proxy network element; Encrypting the user number in the first communication message to obtain an encrypted number, and generating a second communication message according to the encrypted number; Sending the second communication message to a visited network core network element of the terminal device through a security edge protection agent, so that the visited network core network element processes the second communication message; The method further comprises: Receiving a third communication message from a visited network core element through the security edge protection agent; wherein the third communication message includes the encrypted number; decrypting the encrypted number contained in the third communication message to obtain an original user number, and generating a fourth communication message according to the original user number; The fourth communication message is sent to a home network core element.

2. The secure communication method according to claim 1, characterized in that: After receiving the first communication message from the core network element of the home network of the terminal device, the method further includes: Determine whether the first communication message contains the original user number, or identify the message type of the first communication message, so as to encrypt the user number in the first communication message when determining that the first communication message contains the original user number or identifying the first communication message as a communication message of the target type.

3. The secure communication method according to claim 1, characterized in that: After receiving the third communication message from the visited network core network element, the method further includes: Determine whether the third communication message contains an encrypted encryption number, or identify the message type of the third communication message, so as to decrypt the encryption number when determining that the third communication message contains an encrypted encryption number or identifying that the third communication message is a communication message of the target type.

4. The secure communication method according to claim 1, characterized in that: The home network core network element is a unified data management function UDM network element of the home network, and the visited network core network element is an access and mobility management function network element of the visited network; The first communication message is a first response message sent by the UDM network element of the home network and is triggered when the terminal device roams to the visited network; wherein the first communication message includes the original user number corresponding to the terminal device.

5. The secure communication method according to claim 1, characterized in that: The visited network core network element is a session management function V-SMF network element of the visited network, and the home network core network element is a session management function H-SMF network element of the home network; The third communication message is a second request message sent by the V-SMF network element and is triggered during the process of creating a PDU session; wherein the third communication message includes an encrypted number corresponding to the user number.

6. The secure communication method according to claim 1, characterized in that: The home network core network element includes an access and mobility management function S-AMF network element of the home network, and the visited network core network element is an access and mobility management function T-AMF network element of the visited network; The first communication message is a third request message sent by the S-AMF network element and is triggered after the terminal device initiates a network switching request; wherein the third communication message includes the encrypted number corresponding to the user number.

7. A secure communication device, characterized in that: include: A first communication message receiving module is used to receive a first communication message from a core network element of a network to which a terminal device belongs; wherein the first communication message includes an original user number corresponding to the terminal device; the core network is pre-deployed with a number hiding proxy platform, and the number hiding proxy platform is hung in a security edge protection proxy network element; A number encryption processing module, used to encrypt the user number in the first communication message to obtain an encrypted number, and generate a second communication message according to the encrypted number; A second communication message sending module, configured to send the second communication message to a visited network core network element of the terminal device through a security edge protection agent, so that the visited network core network element processes the second communication message; The device is also configured to: Receiving a third communication message from a visited network core element through the security edge protection agent; wherein the third communication message includes the encrypted number; decrypting the encrypted number contained in the third communication message to obtain an original user number, and generating a fourth communication message according to the original user number; The fourth communication message is sent to a home network core element.

8. A communication device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the secure communication method according to any one of claims 1 to 6 by executing the executable instructions.

9. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the secure communication method according to any one of claims 1 to 6 is implemented.

Images