Terminal device verification method and device

Abstract

An embodiment of the present application provides a terminal device verification method and apparatus, the method comprising: a first network device receiving a first message from a first terminal device; and then the first network device verifying the pairing relationship between the first terminal device and the second terminal device. After the pairing relationship between the first terminal device and the second terminal device is verified, the first network device sends a second message to the first terminal device, the second message may include first indication information, and the first indication information is used to indicate the pairing result of the first terminal device and the second terminal device. By verifying the pairing relationship between the first terminal device and the second terminal device, the first terminal device and the second terminal device can be securely paired, thereby improving the use security of the first terminal device and the second terminal device.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method and apparatus for verifying a terminal device. Background Art

[0002] An unmanned aerial system (UAS) generally consists of two devices: an unmanned aerial vehicle (UAV) and a remote control (UAV controller, UAVC). The UAV can fly autonomously or by receiving and following commands from a remote control. Furthermore, the UAV and remote control can transmit data to each other. For example, the UAV can send photos and / or videos from aerial photography to the remote control (which also includes data reception and storage capabilities). Communication between the remote control and the UAS (including control and / or data transmission) is typically achieved via a direct point-to-point wireless connection.

[0003] The idea of ​​using mobile communication networks to facilitate communication between drones and remote controllers has recently garnered widespread attention. Mobile communication networks offer numerous commercial advantages, such as wide coverage, high reliability, and support for high-speed movement. Using network connectivity, drone systems can achieve beyond-line-of-sight (BLOSCOP) and highly reliable flight. Furthermore, mobile communication networks offer regulators a more reliable means of oversight, preventing incidents such as drones interfering with aircraft operations or launching terrorist attacks.

[0004] Therefore, how to introduce drone systems into mobile communication networks to ensure the safety of drone systems and the reliability of supervision is an urgent problem to be solved. Summary of the Invention

[0005] The present application provides a terminal device verification method and apparatus, which can effectively verify the pairing relationship between a first terminal device and a second terminal device, thereby improving the security of terminal device use.

[0006] In a first aspect, the present application provides a terminal device verification method, the method comprising: a first network device receives a first message from a first terminal device; wherein the first message includes an identity identifier of the first terminal device and / or an identity identifier of a second terminal device paired with the first terminal device; the first network device verifies the pairing relationship between the first terminal device and the second terminal device based on the identity identifier of the first terminal device and / or the identity identifier of the second terminal device; after the pairing relationship between the first terminal device and the second terminal device is verified, the first network device sends a second message to the first terminal device; wherein the second message includes first indication information, and the first indication information is used to indicate the pairing result of the first terminal device and the second terminal device.

[0007] In an embodiment of the present application, the first terminal device may be a drone, and the second terminal device may be a remote controller; alternatively, the first terminal device may be a remote controller, and the second terminal device may be a drone. The first network device may be a UAV traffic management (UTM) device, a UAS service provider (USS) device, or an authentication authorization accounting (AAA) server. The first message may also be used to request verification of the pairing relationship between the first terminal device and the second terminal device.

[0008] In this embodiment of the present application, only after the first network device has successfully verified the pairing relationship between the first terminal device and the second terminal device will the first network device authorize the first terminal device to use the mobile network device to control the second terminal device. This, on the one hand, prevents unauthorized first terminal devices from arbitrarily controlling the second terminal device, thereby improving the security of the pairing between the first and second terminal devices. On the other hand, it prevents arbitrary terminal devices from accessing the mobile communication network and affecting the use of other terminal devices, effectively ensuring the security and reliability of the first and second terminal devices' access to the mobile communication network.

[0009] It is understandable that, depending on the different roles of the first terminal device and the second terminal device, the second terminal device may also control the first terminal device.

[0010] In one possible implementation, the first message also includes a digital signature of the pairing relationship between the first terminal device and the second terminal device; the first network device verifies the pairing relationship between the first terminal device and the second terminal device based on the identity of the first terminal device and / or the identity of the second terminal device, including: the first network device verifies the digital signature based on the identity of the first terminal device and / or the identity of the second terminal device and the first public key, and the first public key is a public key pre-stored in the first network device.

[0011] In the embodiment of the present application, the first network device successfully verifies the digital signature, which can be understood as: the first network device successfully verifies the pairing relationship between the first terminal device and the second terminal device. In other words, in the embodiment of the present application, the digital signature is a digital signature for the pairing relationship between the first terminal device and the second terminal device.

[0012] Optionally, the verification method of the terminal device provided in this application may also be replaced by:

[0013] The first network device receives a first message from the first terminal device; the first network device responds to the first message and verifies the pairing relationship between the first terminal device and the second terminal device; after the pairing relationship between the first terminal device and the second terminal device is verified, the first network device sends a second message to the first terminal device; wherein the second message includes first indication information, and the first indication information is used to indicate the pairing result of the first terminal device and the second terminal device.

[0014] Optionally, the first message may further include the identity of the first terminal device and / or the identity of the second terminal device.

[0015] Optionally, the first message also includes a digital signature of the pairing relationship between the first terminal device and the second terminal device; the first network device verifies the pairing relationship between the first terminal device and the second terminal device, including: the first network device verifies the digital signature based on the first public key, and the first public key is a public key pre-stored in the first network device.

[0016] In a possible implementation manner, the first message further includes an identifier of the first public key, where the identifier of the first public key is used to identify the first public key.

[0017] If the first network device stores two or more public keys, the inclusion of the identifier of the first public key in the first message allows the first network device to clearly identify which public key to use for verifying the digital signature. This improves the efficiency of pairing verification by the first network device while ensuring the security of the pairing between the first and second terminal devices.

[0018] In a possible implementation, the first message includes the credentials of the first terminal device, and the pairing relationship between the first terminal device and the second terminal device is included in the credentials of the first terminal device.

[0019] In this embodiment of the present application, the credentials of the first terminal device may include a certificate or token of the first terminal device. The certificate or token of the first terminal device may include a digital signature, an identity identifier of the first terminal device, and an identity identifier of the second terminal device. In other words, the certificate or token of the first terminal device may include a digital signature and a pairing relationship between the first terminal device and the second terminal device.

[0020] In a possible implementation, the first message includes the credentials of the first terminal device and the credentials of the second terminal device, and the credentials of the first terminal device and the credentials of the second terminal device are used to indicate a pairing relationship between the first terminal device and the second terminal device.

[0021] In this embodiment of the present application, the credentials of the first terminal device may include any one of the first terminal device's certificate, token, or public key. The credentials of the second terminal device may include any one of the second terminal device's certificate, token, or public key. In this case, the first network device verifies the digital signature, which can be understood as the first network device verifying the digital signature of the first terminal device's certificate and the digital signature of the second terminal device's certificate.

[0022] In a possible implementation, the first message includes the credentials of the first terminal device or the credentials of the second terminal device, and part of the content of the credentials of the first terminal device and the credentials of the second terminal device are the same.

[0023] In an embodiment of the present application, part of the content may be content pre-agreed upon by the first terminal device and the second terminal device. For example, the key, password, passphrase or verification code included in the credentials of the first terminal device and the credentials of the second terminal device are the same. It can be understood that the key, password, passphrase or verification code shown above can also be understood as symmetric / shared key or shared password, etc. In this case, the embodiment of the present application does not limit whether the credentials of the first terminal device or the credentials of the second terminal device include a digital signature. If the credentials of the first terminal device or the credentials of the second terminal device do not include a digital signature, the first message may additionally include a digital signature. In this case, the first network device can verify the digital signature included in the first message. It should be noted that the credentials of the first terminal device or the credentials of the second terminal device indicate the pairing relationship between the first terminal device and the second terminal device.

[0024] In a possible implementation, the first message includes an identifier of the credentials of the first terminal device or an identifier of the credentials of the second terminal device, and the identifier of the credentials of the first terminal device is the same as the identifier of the credentials of the second terminal device.

[0025] In the embodiment of the present application, the digital signature of the pairing relationship between the first terminal device and the second terminal device can be understood as: the digital signature of the identifier of the credential of the first terminal device or the digital signature of the identifier of the credential of the second terminal device.

[0026] In one possible implementation, the first message includes an identifier of the credentials of the first terminal device and an identifier of the credentials of the second terminal device, and the identifier of the credentials of the first terminal device and the identifier of the credentials of the second terminal device are used to indicate the pairing relationship between the first terminal device and the second terminal device.

[0027] In the embodiment of the present application, the digital signature of the pairing relationship between the first terminal device and the second terminal device can be understood as: the digital signature of the identifier of the credential of the first terminal device and the digital signature of the identifier of the credential of the second terminal device.

[0028] In a possible implementation, the credential includes any one or more of a certificate, a public key, or a token.

[0029] In the embodiment of the present application, the credentials of the first terminal device include any one or more of the certificate of the first terminal device, the public key of the first terminal device, or the token of the first terminal device.

[0030] In a possible implementation, after the pairing relationship between the first terminal device and the second terminal device is verified, the method further includes: the first network device storing the identity of the first terminal device and the identity of the second terminal device.

[0031] In a possible implementation, after the pairing relationship between the first terminal device and the second terminal device is verified, the above method also includes: the first network device stores the identity of the second terminal device in the context of the first terminal device; the first network device stores the identity of the first terminal device in the context of the second terminal device.

[0032] Alternatively, in one possible implementation, the first network device stores the identity of the first terminal device and the identity of the second terminal device, including: the first network device stores the identity of the second terminal device in the context of the first terminal device; the first network device stores the identity of the first terminal device in the context of the second terminal device.

[0033] In one possible implementation, after the pairing relationship between the first terminal device and the second terminal device is verified, the above method also includes: the first network device sends a third message to the second network device; wherein the third message includes the identity of the first terminal device and the identity of the second terminal device, and the identity of the first terminal device and the identity of the second terminal device are used to indicate that the first terminal device and the second terminal device have a pairing relationship.

[0034] In this embodiment of the present application, the first network device sends a third message to the second network device, causing the second network device to store the identity of the first terminal device and the identity of the second terminal device paired with the first terminal device. In other words, the second network device can store the pairing relationship between the first terminal device and the second terminal device. Consequently, when the first terminal device and the second terminal device subsequently need to pair, verification can be directly performed through the second network device, improving pairing efficiency between the first and second terminal devices.

[0035] In a second aspect, the present application provides a terminal device verification method, the method comprising: a second network device receives a fourth message from a first terminal device; wherein the fourth message includes an identity identifier of the first terminal device and / or an identity identifier of a second terminal device paired with the first terminal device; the second network device verifies the pairing relationship between the first terminal device and the second terminal device; after the pairing relationship between the first terminal device and the second terminal device is verified, the second network device sends a fifth message to the first terminal device; wherein the fifth message includes second indication information, and the second indication information is used to indicate the pairing result of the first terminal device and the second terminal device.

[0036] In one possible implementation, before the second network device verifies the pairing relationship between the first terminal device and the second terminal device, the above method also includes: the second network device receives a third message sent by the first network device; wherein the third message includes the identity of the first terminal device and the identity of the second terminal device, and the identity of the first terminal device and the identity of the second terminal device are used to indicate that the first terminal device and the second terminal device have a pairing relationship.

[0037] The beneficial effects of the second aspect can be referred to the beneficial effects of the first aspect, and will not be repeated here.

[0038] In a third aspect, the present application provides a terminal device verification method, the method comprising: a server receives a sixth message; wherein the sixth message includes a first identity identifier and a second identity identifier of a first terminal device; the server determines the authority of the first terminal device based on the first identity identifier of the first terminal device; if the authority of the first terminal device is passed, the server sends a seventh message to the first network device; wherein the seventh message includes the second identity identifier of the first terminal device and the third identity identifier of the second terminal device paired with the first terminal device; or, the seventh message includes the first identity identifier of the first terminal device and the fourth identity identifier of the second terminal device paired with the first terminal device.

[0039] In a possible implementation, before the server sends the seventh message to the first network device, the method further includes: the server authenticating the first terminal device according to the first identity identifier of the first terminal device.

[0040] In a possible implementation, the server stores the second identity of the first terminal device and the third identity of the second terminal device that have a pairing relationship; or the server stores the first identity of the first terminal device and the fourth identity of the second terminal device that have a pairing relationship.

[0041] In one possible implementation, before the server sends the seventh message to the first network device, the above method also includes: the server obtains the fourth identity identifier of the second terminal device paired with the first terminal device based on the first identity identifier of the first terminal device; or, the server obtains the third identity identifier of the second terminal device paired with the first terminal device based on the second identity identifier of the first terminal device.

[0042] In an embodiment of the present application, after the server successfully verifies the pairing relationship between the first terminal device and the second terminal device, the server may send the pairing relationship to the first network device, thereby enabling the first network device to perform a pairing process on the first terminal device and the second terminal device. For example, the first network device may store the identity of the first terminal device in the context of the second terminal device; and store the identity of the second terminal device in the context of the first terminal device. Furthermore, the first network device may send a pairing result to the first terminal device. Simultaneously, the first network device may also send the pairing relationship to the second network device, thereby enabling the second network device to perform the method described in the second aspect.

[0043] The specific implementations of the first network device and the second network device can refer to the methods shown in the first aspect or the second aspect, and will not be described in detail here.

[0044] In a fourth aspect, the present application provides a communication device for executing the method in the first aspect or any possible implementation of the first aspect. Specifically, the communication device includes a corresponding unit for executing the method in the first aspect or any possible implementation of the first aspect.

[0045] For example, the communication device includes a transceiver unit and a processing unit.

[0046] In a fifth aspect, the present application provides a communication device for executing the method in the second aspect or any possible implementation of the second aspect. Specifically, the communication device includes a corresponding unit for executing the method in the second aspect or any possible implementation of the second aspect.

[0047] For example, the communication device includes a transceiver unit and a processing unit.

[0048] In a sixth aspect, the present application provides a communication device, which includes a transceiver unit and a processing unit; the transceiver unit is used to receive a sixth message; wherein the sixth message includes a first identity identifier and a second identity identifier of a first terminal device; the processing unit is used to determine the authority of the first terminal device based on the first identity identifier of the first terminal device; the transceiver unit is also used to send a seventh message to the first network device if the authority of the first terminal device is passed; wherein the seventh message includes the second identity identifier of the first terminal device and the third identity identifier of the second terminal device paired with the first terminal device; or, the seventh message includes the first identity identifier of the first terminal device and the fourth identity identifier of the second terminal device paired with the first terminal device.

[0049] In a possible implementation, the processing unit is further configured to authenticate the first terminal device according to the first identity identifier of the first terminal device.

[0050] In a possible implementation, the server stores the second identity of the first terminal device and the third identity of the second terminal device that have a pairing relationship; or the server stores the first identity of the first terminal device and the fourth identity of the second terminal device that have a pairing relationship.

[0051] In one possible implementation, the processing unit is further used to obtain the fourth identity of the second terminal device paired with the first terminal device based on the first identity of the first terminal device; or to obtain the third identity of the second terminal device paired with the first terminal device based on the second identity of the first terminal device.

[0052] It is understandable that the communication device may be a server or the like.

[0053] In the seventh aspect, the present application provides a communication device, which includes a processor for executing a program stored in a memory. When the program is executed, the communication device executes the method shown in the first aspect or any possible implementation of the first aspect.

[0054] In a possible implementation, the memory is located outside the communication device.

[0055] In an eighth aspect, the present application provides a communication device, which includes a processor for executing a program stored in a memory. When the program is executed, the communication device executes the method shown in the second aspect or any possible implementation of the second aspect.

[0056] In a possible implementation, the memory is located outside the communication device.

[0057] In the ninth aspect, the present application provides a communication device, which includes a processor for executing a program stored in a memory. When the program is executed, the communication device executes the method shown in the third aspect or any possible implementation of the third aspect.

[0058] In a possible implementation, the memory is located outside the communication device.

[0059] In the tenth aspect, the present application provides a communication device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed, the communication device executes the method as shown in the first aspect or any possible implementation of the first aspect.

[0060] In the eleventh aspect, the present application provides a communication device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed, the communication device executes the method as shown in the second aspect or any possible implementation of the second aspect.

[0061] In the twelfth aspect, the present application provides a communication device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed, the communication device executes the method as shown in the third aspect or any possible implementation of the third aspect.

[0062] In a thirteenth aspect, the present application provides a communication device, which includes a processor, a memory and a transceiver, the transceiver is used to receive or send signals; the memory is used to store computer code; the processor is used to execute computer code, so that the communication device executes the method shown in the above-mentioned first aspect or any possible implementation of the first aspect.

[0063] In a fourteenth aspect, the present application provides a communication device, which includes a processor, a memory and a transceiver, wherein the transceiver is used to receive or send signals; the memory is used to store computer code; and the processor is used to execute the computer code so that the communication device executes the method shown in the above-mentioned second aspect or any possible implementation of the second aspect.

[0064] In the fifteenth aspect, the present application provides a communication device, which includes a processor, a memory and a transceiver, the transceiver is used to receive or send signals; the memory is used to store computer code; the processor is used to execute the computer code, so that the communication device executes the method shown in the third aspect or any possible implementation of the third aspect.

[0065] In the sixteenth aspect, the present application provides a communication device, which includes a processing circuit and an interface circuit; wherein the interface circuit is used to obtain a first message; wherein the first message includes the identity of the first terminal device and / or the identity of the second terminal device paired with the first terminal device; the processing circuit is used to verify the pairing relationship between the first terminal device and the second terminal device based on the identity of the first terminal device and / or the identity of the second terminal device; the interface circuit is also used to output a second message after the pairing relationship between the first terminal device and the second terminal device is verified; wherein the second message includes first indication information, and the first indication information is used to indicate the pairing result of the first terminal device and the second terminal device.

[0066] In a possible implementation, the processing circuit is further configured to store the identity of the first terminal device and the identity of the second terminal device.

[0067] In a possible implementation, the processing circuit is further configured to store the identity of the second terminal device in the context of the first terminal device; and store the identity of the first terminal device in the context of the second terminal device.

[0068] In one possible implementation, the interface circuit is further used to output a third message; wherein the third message includes the identity of the first terminal device and the identity of the second terminal device, and the identity of the first terminal device and the identity of the second terminal device are used to indicate that the first terminal device and the second terminal device have a pairing relationship.

[0069] It is understandable that for the description of digital signatures and credentials, please refer to the first aspect and will not be described in detail here.

[0070] In the seventeenth aspect, the present application provides a communication device, which includes a processing circuit and an interface circuit; wherein the interface circuit is used to obtain a fourth message; wherein the fourth message includes the identity of the first terminal device and / or the identity of the second terminal device paired with the first terminal device; the processing circuit is used to verify the pairing relationship between the first terminal device and the second terminal device; the interface circuit is also used to output a fifth message; wherein the fifth message includes second indication information, and the second indication information is used to indicate the pairing result of the first terminal device and the second terminal device.

[0071] In one possible implementation, the interface circuit is further used to obtain a third message; wherein the third message includes the identity of the first terminal device and the identity of the second terminal device, and the identity of the first terminal device and the identity of the second terminal device are used to indicate that the first terminal device and the second terminal device have a pairing relationship.

[0072] In the eighteenth aspect, the present application provides a communication device, which includes a processing circuit and an interface circuit; wherein the interface circuit is used to obtain a sixth message; wherein the sixth message includes a first identity identifier and a second identity identifier of a first terminal device; the processing circuit is used to determine the authority of the first terminal device based on the first identity identifier of the first terminal device; the interface circuit is also used to output a seventh message; wherein the seventh message includes the second identity identifier of the first terminal device and the third identity identifier of the second terminal device paired with the first terminal device; or, the seventh message includes the first identity identifier of the first terminal device and the fourth identity identifier of the second terminal device paired with the first terminal device.

[0073] In a possible implementation, the processing circuit is further configured to authenticate the first terminal device according to the first identity identifier of the first terminal device.

[0074] In a possible implementation, the server stores the second identity of the first terminal device and the third identity of the second terminal device that have a pairing relationship; or the server stores the first identity of the first terminal device and the fourth identity of the second terminal device that have a pairing relationship.

[0075] In one possible implementation, the processing circuit is further used to obtain the fourth identity of the second terminal device paired with the first terminal device based on the first identity of the first terminal device; or to obtain the third identity of the second terminal device paired with the first terminal device based on the second identity of the first terminal device.

[0076] In the nineteenth aspect, the present application provides a computer-readable storage medium for storing a computer program. When the computer program runs on a computer, the method shown in the above-mentioned first aspect or any possible implementation of the first aspect is executed.

[0077] In the twentieth aspect, the present application provides a computer-readable storage medium for storing a computer program. When the computer program runs on a computer, the method shown in the above-mentioned second aspect or any possible implementation of the second aspect is executed.

[0078] In the twenty-first aspect, the present application provides a computer-readable storage medium for storing a computer program. When the computer program runs on a computer, the method shown in the above-mentioned third aspect or any possible implementation of the third aspect is executed.

[0079] In a twenty-second aspect, the present application provides a computer program product, which, when executed on a computer, enables the method shown in the above-mentioned first aspect or any possible implementation of the first aspect to be executed.

[0080] In one possible implementation, the computer program product includes a computer program or computer code, and when the computer program or computer code is executed, the method shown in the first aspect or any possible implementation of the first aspect is implemented.

[0081] In a twenty-third aspect, the present application provides a computer program product, which, when run on a computer, enables the method shown in the above-mentioned second aspect or any possible implementation of the second aspect to be executed.

[0082] In one possible implementation, the computer program product includes a computer program or computer code, and when the computer program or computer code is executed, the method shown in the second aspect or any possible implementation of the second aspect is implemented.

[0083] In a twenty-fourth aspect, the present application provides a computer program product, which, when run on a computer, enables the method shown in the third aspect or any possible implementation of the third aspect to be executed.

[0084] In one possible implementation, the computer program product includes a computer program or computer code, and when the computer program or computer code is executed, the method shown in the third aspect or any possible implementation of the third aspect is implemented.

[0085] In the twenty-fifth aspect, the present application provides a computer program for implementing the method shown in the above-mentioned first aspect or any possible implementation of the first aspect.

[0086] Alternatively, when the computer program runs on a computer, the method shown in the above-mentioned first aspect or any possible implementation of the first aspect is executed.

[0087] In the twenty-sixth aspect, the present application provides a computer program for implementing the method shown in the above second aspect or any possible implementation of the second aspect.

[0088] Alternatively, when the computer program runs on a computer, the method shown in the above-mentioned second aspect or any possible implementation of the second aspect is executed.

[0089] In the twenty-seventh aspect, the present application provides a computer program for implementing the method shown in the third aspect or any possible implementation of the third aspect.

[0090] Alternatively, when the computer program runs on a computer, the method shown in the third aspect or any possible implementation of the third aspect is executed.

[0091] In aspect 28, the present application provides a wireless communication system, which includes a first network device and a first terminal device, and the first network device is used to execute the method shown in the above-mentioned first aspect or any possible implementation of the first aspect.

[0092] In a possible implementation, the wireless communication system further includes a second network device, which is configured to execute the method shown in the above second aspect or any possible implementation of the second aspect.

[0093] In a possible implementation, the wireless communication system further includes a server, which is configured to execute the method shown in the third aspect or any possible implementation of the third aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0094] Figure 1 is a system diagram of a mobile communication network provided by an embodiment of the present application;

[0095] Figure 2 This is a schematic diagram of the architecture of a drone system based on a mobile communication network provided in an embodiment of the present application;

[0096] Figure 3 This is a flow chart of a terminal device verification method provided in an embodiment of the present application;

[0097] Figure 4This is a flow chart of a terminal device verification method provided in an embodiment of the present application;

[0098] Figure 5 This is a flow chart of a terminal device verification method provided in an embodiment of the present application;

[0099] Figure 6 This is a flow chart of a terminal device verification method provided in an embodiment of the present application;

[0100] Figure 7 This is a flow chart of a terminal device verification method provided in an embodiment of the present application;

[0101] Figure 8 This is a flow chart of a terminal device verification method provided in an embodiment of the present application;

[0102] Figure 9 This is a schematic structural diagram of a communication device provided in an embodiment of the present application;

[0103] Figure 10 This is a schematic structural diagram of a communication device provided in an embodiment of the present application;

[0104] Figure 11 It is a structural diagram of a circuit system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0105] In order to make the purpose, technical solutions and advantages of this application clearer, this application will be further described in detail below with reference to the accompanying drawings.

[0106] The terms "first" and "second" and the like in the specification, claims, and drawings of this application are used to distinguish between different objects, not to describe a particular order. Furthermore, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or elements is not limited to the listed steps or elements, but may optionally include steps or elements not listed, or may optionally include other steps or elements inherent to the process, method, product, or apparatus.

[0107] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0108] In this application, "at least one (item)" means one or more, "more than one" means two or more, "at least two (items)" means two or three and more than three, and "and / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c".

[0109] The following first introduces the communication system used in this application:

[0110] The technical solution provided in this application can be applied to various communication systems, such as: long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (TDD) system, universal mobile telecommunication system (UMTS), world-wide interoperability for microwave access (WiMAX) communication system, fifth generation (5G) communication system or new radio (NR) and other future communication systems such as 6G.

[0111] For example, taking the application of this application to a 5G communication system as an example, the network functions in the 5G system are described below:

[0112] See Figure 1 , Figure 1 The network architecture shown is based on the 5G network architecture based on the service-oriented architecture defined in the 3rd Generation Partnership Project (3GPP) standardization process. Figure 1 As shown, the network architecture may include at least three parts, namely, a terminal device part, an operator network part, and a data network (DN) part.

[0113] The terminal device part may include a terminal device 110, which may also be referred to as user equipment (UE). The terminal device 110 in this application is a device with wireless transceiver functions, which can communicate with one or more core network (CN) devices (or may also be referred to as core devices) via an access network device (or may also be referred to as an access device) in an access network (AN) 140. The terminal device 110 may also be referred to as an access terminal, terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, wireless network device, user agent or user device, etc. In one possible implementation, the terminal device 110 may be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it may also be deployed on water (such as ships, etc.); it may also be deployed in the air (such as airplanes, balloons and satellites, etc.). In one possible implementation, the terminal device 110 can be a handheld device with wireless communication capabilities, a vehicle-mounted device, a wearable device, a drone device, or a terminal in the Internet of Things, the Internet of Vehicles, a 5G network, or any form of terminal in future networks, etc. This application does not limit this.

[0114] In the embodiments of the present application, the terminal devices include a first terminal device and a second terminal device; wherein the first terminal device is a drone and the second terminal device is a remote control; or, alternatively, the first terminal device is a remote control and the second terminal device is a drone. It is understood that the methods provided in this application that are applicable to the first terminal device are also applicable to the second terminal device. It is understood that the drone in this application can be any type of drone, or any type of drone in a future network, etc. Similarly, the remote control in this application can be any type of remote control, or any type of remote control in a future network, etc.

[0115] Among them, the part of various communication systems operated by the operator can be called the operator network. The operator network can also be called the public land mobile network (PLMN) network, which is a network established and operated by the government or an operator approved by the government for the purpose of providing land mobile communication services to the public. The operator network is mainly a public network in which mobile network operators (MNOs) provide mobile broadband access services to users. Exemplarily, the operator network or PLMN network in this application can also be a network that meets the requirements of the 3GPP standard, referred to as the 3GPP network. Generally, 3GPP networks can be operated by operators, including but not limited to the fifth-generation mobile communication (5th-generation, 5G) network (referred to as 5G network), the fourth-generation mobile communication (4th-generation, 4G) network (referred to as 4G network), etc.

[0116] With the expansion of mobile broadband access services, operator networks will also develop in order to better support diversified business models and meet the needs of more diversified application services and more industries. For example, in order to provide better and more complete services to more industries, the 5G network has also made network architecture adjustments relative to the 4G network. For example, the 5G network splits the mobility management entity (MME) in the 4G network into multiple network functions including the access and mobility management function (AMF) (also referred to as the AMF network function or the AMF network function entity) and the session management function (SMF) (also referred to as the SMF network function or the SMF network function entity). Therefore, the network architecture shown in this application should not be understood as a limitation of this application.

[0117] like Figure 1As shown, the operator network may include at least unified data management (UDM) 134 (also known as UDM network function or UDM network function entity), authentication server function (AUSF) 136 (also known as AUSF network function or AUSF network function entity), AMF 137, SMF 138, user plane function (UPF) 139 (also known as UPF network function or UPF network function entity) and (radio) access network (R)AN 140, etc. In the above-mentioned operator network, the part other than the (radio) access network 140 may be referred to as the core network (CN) part or the core network part.

[0118] The data network DN 120, which may also be referred to as a packet data network (PDN), is typically a network located outside the operator network, such as a third-party network. Exemplarily, the operator network can access multiple data networks DN 120, and a variety of services can be deployed on the data network DN 120, thereby providing data and / or voice services to the terminal device 110. The terminal device 110 can establish a connection with the operator network through an interface (such as N1, etc.) provided by the operator network, and use the data and / or voice services provided by the operator network. The terminal device 110 can also access the data network DN 120 through the operator network, use the operator services deployed on the data network DN 120, and / or services provided by a third party. The third party may be a service provider other than the operator network and the terminal device 110, and the service provider may provide other data and / or voice services to the terminal device 110. The specific form of the above-mentioned third party can be determined according to the actual application scenario and is not limited here.

[0119] For example, the following briefly introduces the network functions in the operator network.

[0120] (R)AN 140 is a subnetwork of the operator network and serves as the implementation system between service nodes in the operator network and terminal device 110. To access the operator network, terminal device 110 first passes through (R)AN 140, and then connects to the network function of the operator network through (R)AN 140. The access network device (R)AN device in the embodiment of the present application is a device that provides wireless communication functions for the terminal device 110, and may also be referred to as a network device or access device, etc. The (R)AN device includes but is not limited to: the next generation node basestation (gNB) in the 5G system, the evolved node B (eNB) in the LTE system, the radio network controller (RNC), the node B (NB), the base station controller (BSC), the base transceiver station (BTS), the home evolved nodeB (HNB), the base band unit (BBU), the transmission and receiving point (TRP), the transmitting point (TP), the small base station device (pico), the mobile switching center, or the network device in the future network, etc. It can be understood that the present application does not limit the specific type of access network device. In systems using different wireless access technologies, the names of devices with access network device functions may be different. For the convenience of description, in all embodiments of the present application, the devices that provide wireless communication functions for the terminal device 110 are collectively referred to as access network devices.

[0121] AMF 137 is a control plane network function provided by the operator network, responsible for access control and mobility management of the terminal device 110 to the operator network, including, for example, mobility status management, allocation of temporary user identities, authentication and authorization of users, and other functions.

[0122] SMF138 is a control plane network function provided by the operator network, responsible for managing the protocol data unit (PDU) session of the terminal device 110. A PDU session is a channel for transmitting PDUs. The terminal device needs to transmit PDUs to and from the DN 120 through the PDU session. The PDU session can be established, maintained, and deleted by SMF138. SMF138 includes session management (such as session establishment, modification, and release, including tunnel maintenance between UPF 139 and (R)AN140), selection and control of UPF139, service and session continuity (SSC) mode selection, roaming, and other session-related functions.

[0123] UPF 139 is a gateway provided by the operator, serving as the gateway for communication between the operator network and DN 120. UPF 139 includes user-plane-related functions such as packet routing and transmission, packet inspection, service usage reporting, Quality of Service (QoS) processing, legal monitoring, uplink packet inspection, and downlink packet storage.

[0124] UDM 134 is a control plane function provided by the operator and is responsible for storing information such as the subscriber permanent identifier (SUPI), credentials, security context, and subscription data of subscribers in the operator network. The information stored in UDM 134 can be used to authenticate and authorize the terminal device 110 to access the operator network. The SUPI is encrypted during transmission. The encrypted SUPI is called a hidden subscription identifier (SUCI). Subscribers on the operator network can specifically be users who use services provided by the operator network, such as users using China Telecom or China Mobile terminal device SIM cards. For example, the subscriber's SUPI can be the terminal device SIM card number. The subscriber's credentials and security context can be the encryption key of the terminal device SIM card or information related to the encryption of the terminal device SIM card. The security context can be data (cookies) or tokens stored locally on the terminal device (e.g., a mobile phone). The subscriber's subscription data can be services associated with the terminal device SIM card, such as the mobile phone SIM card's data plan or network usage.

[0125] AUSF136 is a control plane function provided by the operator, and is usually used for level one authentication, that is, authentication between the terminal device 110 (subscriber) and the operator network. It is understandable that in some deployments of the present application, AUSF 136 can be deployed together with UDM 134, such as integrating AUSF 136 and UDM 134 in one network element. In other deployments of the present application, AUSF 136 and UDM 134 can also be deployed separately, such as deploying AUSF 136 and UDM 134 in different network elements. The present application does not limit the specific deployment method of the AUSF 136 and the UDM 134. For ease of description, only UDM 134 is shown in the embodiments shown below, but the relationship between the UDM 134 and AUSF 136 is not limited in the embodiments of the present application.

[0126] Figure 1 Nausf, Nudm, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface serial numbers. For example, the meaning of the above interface serial numbers can be found in the meaning defined in the 3GPP standard protocol. This application does not limit the meaning of the above interface serial numbers. It should be noted that, Figure 1 In the example, only the terminal device 110 is used as the UE. Figure 1 The interface names between the various network functions in the system architecture are only examples. In specific implementations, the interface names of the system architecture may also be other names, which are not limited in this application. Figure 1 The operator network portion shown may also include other network functions, such as a network repository function (NRF) and / or a policy control function (PCF), etc., which is not limited in this application.

[0127] The mobility management network function in the embodiment of the present application can be Figure 1 The AMF 137 shown may also be other network functions in future communication systems having the above-mentioned AMF 137. Alternatively, the mobility management network function in this application may also be an MME in an LTE system.

[0128] For the convenience of explanation, the verification method of the terminal device provided in the embodiment of the present application is described by taking the mobility management network function as AMF137 as an example. Furthermore, in the embodiment of the present application, AMF137 is referred to as AMF, the unified data management UDM134 is referred to as UDM, and the terminal device 110 is referred to as UE, that is, the AMF described later in the embodiment of the present application can be replaced with the mobility management network function, the UDM can be replaced with the unified data management, and the UE can be replaced with the terminal device. It can be understood that the replacement method is also applicable to other network functions not shown.

[0129] Figure 1 The network architecture shown in the figure (such as the 5G network architecture) adopts a service-based architecture and universal interfaces. The traditional network element functions are split into several self-contained, self-managed, and reusable network function service modules based on network function virtualization (NFV) technology. Figure 1 The network architecture diagram shown in the figure can be understood as a service-based 5G network architecture diagram in a non-roaming scenario. For roaming scenarios, this application is also applicable.

[0130] The following is an introduction to the system architecture of this application:

[0131] See Figure 2 , Figure 2 This is a schematic diagram of the architecture of a drone system based on a mobile communication network provided by an embodiment of the present application. Figure 2 As shown, the UAV system architecture includes at least a UAV, a UAV remote controller (hereinafter referred to as the remote controller), a radio access network (RAN), a core network (CN), and a first network device. The first network device can be deployed within the operator network, or the first network device can also be deployed outside the operator network.

[0132] RAN1 and RAN2 can serve the remote controller and drone, respectively. If the remote controller and drone are covered by the same RAN, then the two RANs (RAN1 and RAN2) can also refer to the same RAN. Similarly, CN1 and CN2 can serve RAN1 and RAN2, respectively. If the RANs accessed by the drone and remote controller (RAN1 and RAN2 can be the same or different) are served by the same CN, then the two core networks (CN1 and CN2) can also refer to the same core network.

[0133] exist Figure 2In the drone system shown, the remote controller can control the drone through the network and communicate with the drone. For example, the command issued by the remote controller can reach the drone through RAN2, CN2, CN1, and RAN1. Figure 1 When the 5G communication network (or 5G communication system) shown in FIG. Figure 2 The drone and remote controller shown in the figure correspond to Figure 1 Two different terminal devices 110 in. Figure 2 RAN1 and RAN2 shown correspond to Figure 1 Two (R)AN140.

[0134] Among them, the first network device can be located within the operator network or outside the operator network. Exemplarily, the first network device can be a UAV system traffic management (UAS traffic management, UTM) device, a UAS service suppliers (UAS service suppliers, USS) device or an authentication authorization accounting (AAA) server, etc. Exemplarily, the first network device can be used to store relevant information of the UAV system (including the UAV and / or remote control), such as the authentication information of the UAV system. Based on the authentication information, the first network device can perform identity authentication on the UAV and / or remote control. The regulatory department of the UAV system can also supervise the operation of the UAV system through the first network device to ensure the safety of the UAV flight control and public safety.

[0135] The drone may also be referred to as an unmanned aerial vehicle or aircraft, and the remote controller may be a device specifically manufactured for remotely controlling the drone, or may be any of the terminal devices 110 described above, such as a smartphone or a wearable device. This application does not limit the specific form of the remote controller.

[0136] in addition, Figure 2 The core network shown may also include a second network device, which may be a network function in the core network responsible for and participating in terminal device registration, mobility management, session management, and other functions. For example, the second network device may be an AMF, SMF, UPF, etc. and Figure 2 The core network shown may further include a third network device, which may be a network function for storing subscription and registration information of terminal devices, such as UDM.

[0137] Figure 2 The UAV system architecture shown is based on Figure 1 As for the 5G communication system shown, in other communication systems, Figure 2 The UAV system architecture shown can also be applied. Alternatively, in other communication systems, Figure 2 The drone architecture shown can vary depending on the deployment of the access network, core network and first network equipment.

[0138] To improve the security of drones and / or remote controls accessing or using mobile communication networks, in addition to authenticating and authorizing terminal devices in drone systems using mobile communication networks, the pairing relationship between drones and remote controls must also be authorized to prevent unauthorized remote controls from controlling the drone. However, the 3GPP standard for improving communication services for drone systems using 5G networks has only just begun, and has yet to define how to pair drones with remote controls or how to inject these pairing relationships into the network. Furthermore, drones and remote controls are often paired point-to-point using short-range wireless access technologies, such as non-3GPP mobile communication networks (i.e., non-3GPP access technologies) such as wireless fidelity (WiFi) or Bluetooth. For example, when pairing devices using Bluetooth, one terminal device (e.g., a drone) typically displays its identity or password on its display. A second terminal device (e.g., a remote control) selects or enters this identity or password with human assistance and returns it to the first terminal device (e.g., a drone), completing the pairing process.

[0139] As can be seen from the above process of pairing terminal devices using non-3GPP mobile communication networks (also known as non-3GPP access technologies), the pairing method between terminal devices is not under the control of the 3GPP network operator, and the drone and remote control can be paired at will. In addition, the pairing relationship between terminal devices is not registered with the mobile communication network, making it impossible for the mobile communication network to understand or control the pairing between terminal devices.

[0140] Therefore, the present application provides a verification method for a terminal device, which can be used to verify the pairing relationship between the remote control and the drone. Only after the verification of the pairing relationship between the remote control and the drone is passed, the remote control and the drone can be authorized to use the mobile communication network to operate, remotely control or communicate with the drone, etc., thereby improving the security of the pairing relationship between the remote control and the drone; further, effectively ensuring the security of the drone system. At the same time, the verified and authorized pairing relationship between the drone and the remote control can be stored in the mobile communication network, avoiding the need for re-verification, authorization, etc. in subsequent operations of the drone system. It can be understood that the network shown below in this application can be understood as a mobile communication network.

[0141] The following describes in detail the terminal device verification method provided by this application.

[0142] See Figure 3 , Figure 3 This is a flow chart of a terminal device verification method provided by an embodiment of the present application. For example, the method can be applied to Figure 1 The mobile communication network shown, and the method can also be applied to Figure 2 The UAV system architecture is shown in Figure 1. Figure 3 As shown, the verification method of the terminal device at least includes:

[0143] 301. A first terminal device sends a first message to a first network device; accordingly, the first network device receives a first message from the first terminal device; wherein the first message includes an identity of the first terminal device and / or an identity of a second terminal device paired with the first terminal device.

[0144] In the embodiment of the present application, the first terminal device is a drone and the second terminal device is a remote controller; or the first terminal device is a remote controller and the second terminal device is a drone. The first network device can be a UTM device, a USS device, or an AAA server.

[0145] In embodiments of the present application, the pairing method (also referred to as the pairing type) between a first terminal device and a second terminal device may include any one or more of the following: one first terminal device corresponds to one second terminal device; or one first terminal device corresponds to multiple second terminal devices; or multiple first terminal devices correspond to one second terminal device. For example, one remote control controls one drone; or one remote control controls multiple drones; or one drone can be jointly controlled by multiple remote controls. That is, when a first terminal device is paired with multiple second terminal devices, the first message may include the identity of the first terminal device and the identities of one or more of the multiple second terminal devices. For example, when a first terminal device is paired with two second terminal devices, the first message may include the identity of the first terminal device and the identities of one or both of the two second terminal devices. Furthermore, when multiple first terminal devices are paired with one second terminal device, the first message may be sent by any one of the multiple first terminal devices. Embodiments of the present application do not limit the number of second terminal devices that are paired with the first terminal device. In one possible implementation, the pairing relationship between the first terminal device and the second terminal device may be determined by the manufacturer when the drone and / or remote controller leaves the factory, or by a service provider when providing drone system services. Optionally, the pairing relationship between the first terminal device and the second terminal device may also be determined by a drone system service provider, or by an entity such as a vertical industry. This embodiment of the application does not limit how the pairing relationship between the first terminal device and the second terminal device is determined.

[0146] In the embodiments of the present application, the identity identifier may include an identity identifier in the network and / or an identity identifier in the drone system. For example, the identity identifier of the first terminal device includes the identity identifier of the first terminal device in the network and / or the identity identifier of the first terminal device in the drone system. The identity identifier of the second terminal device includes the identity identifier of the second terminal device in the network and / or the identity identifier of the second terminal device in the drone system.

[0147] Exemplarily, the identity identifier of the first terminal device in the drone system may include the product serial number of the first terminal device, the certificate serial number of the first terminal device, the public key of the first terminal device, the physical address of the first terminal device, the Internet Protocol (IP) address of the first terminal device, the media access control (MAC) address of the first terminal device, the session address of the first terminal device, etc., which is not limited in this application. The product serial number of the first terminal device can be a code provided by the manufacturer when the first terminal device is produced. This code is mainly used for product production process control, production quality management, material inventory tracking, product after-sales service, copyright control, etc. The product serial number may also comply with certain standards and specifications, for example, such as the small drone system serial number standard "ANSI / CTA-2063-A" formulated by the American National Standards Institute (ANSI), etc. The embodiments of this application do not limit this standard and specification. Similarly, the identity of the second terminal device in the drone system may include the product serial number of the second terminal device, the certificate serial number of the second terminal device, the public key of the second terminal device, the physical address of the second terminal device, the IP address of the second terminal device, the MAC address of the second terminal device, the session address of the second terminal device, etc., which are not limited in this application. It is understood that the serial number shown above can also be referred to as an identifier, etc.

[0148] Exemplarily, the identity of the first terminal device in the network may have different forms in different network elements or network functions. For example, when the first terminal device sends a first message to the second network device, the identity of the first terminal device may be a globally unique temporary UE identity (GUTI) or a hidden subscription identifier (SUCI). When the second network device receives the first message, it may convert the GUTI or SUCI of the first terminal device into the SUPI of the first terminal device. Similarly, the identity of the second terminal device in the network may also have different forms in different network elements or network functions. It is understandable that the specific description of the identity of the second terminal device can refer to the description of the identity of the first terminal device, which will not be described in detail here.

[0149] It is understandable that the identity identifications listed above are only examples and should not be understood as limiting the embodiments of the present application.

[0150] In an embodiment of the present application, the process of the first terminal device sending the first message to the first network device, for example, the first message can be sent to the first network device through the access network and the second network device in the core network. For another example, the first message can also be sent to the first network device through the access network and other network devices (such as UPF). The network elements or network functions that may be passed through during the transmission of the first message can be determined according to the policy in the mobile communication network; or can be determined according to the standard protocol, etc., and this application does not limit this.

[0151] In an embodiment of the present application, after the first message is sent from the first terminal device, when it passes through different network elements or network functions, the first message may have different forms. For example, when the first message passes through the second network device, the second network device may re-encapsulate the first message, such as directly encapsulating the first message in the eleventh message, and then sending it to the first network device. Alternatively, the second network device may also parse the identity of the first terminal device and the identity of the second terminal device from the first message, thereby encapsulating the identity of the first terminal device and the identity of the second terminal device in the twelfth message, and then sending it to the first network device. Therefore, the embodiment of the present application does not limit the sending process of the first message. Optionally, the first message can be sent via a non-access stratum (NAS) message (signaling plane or data plane) or an access stratum (AS) message (data plane). Optionally, the first message can also be encrypted or integrity protected. The embodiment of the present application does not limit how to encrypt or integrity protect the first message.

[0152] 302. The first network device verifies the pairing relationship between the first terminal device and the second terminal device according to the identity identifier of the first terminal device and the identity identifier of the second terminal device.

[0153] In one implementation of the embodiment of the present application, the first network device may verify the pairing relationship between the first terminal device and the second terminal device based on a digital signature. In another implementation of the embodiment of the present application, the first network device may verify the pairing relationship between the first terminal device and the second terminal device based on a subscriber identification module (SIM) card.

[0154] The method for the first network device to verify the pairing relationship between the first terminal device and the second terminal device based on the digital signature is as follows:

[0155] In an embodiment of the present application, the first message also includes a digital signature of the pairing relationship between the first terminal device and the second terminal device. For example, a digital signature can be a mathematical method or algorithm used to verify the authenticity and integrity of a message, software, or electronic document. In an embodiment of the present application, the digital signature can be used to verify the authenticity or integrity of the pairing relationship between the first terminal device and the second terminal device. In other words, the digital signature in an embodiment of the present application is not simply a digital signature of the first terminal device or the second terminal device, but rather a digital signature of the pairing relationship between the first terminal device and the second terminal device.

[0156] In one possible implementation, the first network device may verify the digital signature based on the first public key; or the first network device may verify the digital signature based on the identity identifier of the first terminal device, the identity identifier of the second terminal device, and the first public key. The first public key is a public key pre-stored in the first network device. For example, the first public key may be a public key (V-Pubkey) provided by a manufacturer, service provider, or other vertical industry, and thus stored in the first network device. Exemplarily, a manufacturer or service provider may sign a contract with a network operator before using a mobile communication network. When signing the contract, the manufacturer or service provider may hand over the first public key to the operator. The operator may input or copy the first public key into the first network device. It is understandable that the first public key handed over by the manufacturer or service provider to the operator may be one or more. It is understandable that the embodiments of the present application do not limit how to generate the first public key or how to input the first public key into the first network device.

[0157] For example, if the pairing relationship between the drone and the remote control is determined by the manufacturer, and the customer who signs a contract with the network operator is also the manufacturer, the manufacturer can directly send the manufacturer's first public key (or certificate) to the first network device; or, if the pairing relationship between the drone and the remote control is determined by the manufacturer, and the customer who signs a contract with the network operator is a service provider (or vertical industry), the service provider (or vertical industry) can send the service provider's (or vertical industry's) first public key (or certificate) and the manufacturer's first public key (or certificate) signed by the service provider (or vertical industry) to the first network device; or, if the pairing relationship between the drone and the remote control is determined by the service provider (or vertical industry), and the customer who signs a contract with the network operator is also the service provider (or vertical industry), the service provider (or vertical industry) can send the service provider's (or vertical industry's) first public key (or certificate) to the first network device.

[0158] For different representations of the pairing relationship between the first terminal device and the second terminal device, the embodiment of the present application further provides the following five implementation methods.

[0159] Implementation method 1:

[0160] In one possible implementation, the first message includes a credential of the first terminal device, and the pairing relationship between the first terminal device and the second terminal device is included in the credential of the first terminal device. The credential includes any one or more of a certificate or a token.

[0161] In an embodiment of the present application, when the first message includes the credentials of the first terminal device, the credentials of the first terminal device may include a digital signature and the pairing relationship between the first terminal device and the second terminal device. In other words, the first network device verifies the digital signature based on the identity identifier of the first terminal device, the identity identifier of the second terminal device and the first public key, which can be understood as: the first network device verifies the credentials of the first terminal device based on the first public key, and the credentials of the first terminal device include the digital signature and the pairing relationship between the first terminal device and the second terminal device. In other words, the digital signature for the pairing relationship between the first terminal device and the second terminal device can be understood as: the digital signature for the credentials of the first terminal device, and the credentials of the first terminal device include the digital signature and the pairing relationship between the first terminal device and the second terminal device.

[0162] Exemplarily, when the credentials of a first terminal device include a certificate of the first terminal device, the certificate of the first terminal device may include the identity of the first terminal device, the identity of the second terminal device paired with the first terminal device, and a digital signature (Vsig) of the certificate of the first terminal device. The identity of the first terminal device may include one or more of the certificate serial number of the first terminal device, the product serial number of the first terminal device, the public key of the first terminal device, the IP address or MAC address of the first terminal device, and the like. The identity of the second terminal device may include one or more of the public key of the second terminal device, the certificate serial number of the second terminal device, the product serial number of the second terminal device, the IP address or MAC address of the second terminal device, and the like. For example, if there are two second terminal devices paired with the first terminal device, the first message may include the certificate serial numbers of both second terminal devices. It is understood that, if there are multiple second terminal devices paired with the first terminal device, the embodiments of the present application do not limit whether the identities of the multiple second terminal devices are of the same type. For example, the first message may include the certificate serial number of the first second terminal device paired with the first terminal device and the public key of the second second terminal device paired with the first terminal device.

[0163] Optionally, the certificate of the first terminal device may also include an identifier of the first public key. The identifier of the first public key enables the first network device to determine the first public key used to verify the digital signature from one or more stored first public keys. For implementation method one, the manufacturer or service provider (or vertical industry) can pre-place the certificate issued for the first terminal device in the first terminal device, so that when the first terminal device needs to access the mobile communication network to communicate with the second terminal device, the first terminal device can directly send the certificate of the first terminal device to the first network device through the first message.

[0164] For example, taking the format of an X.509 certificate as an example, part of the content of the certificate may be as follows:

[0165] Some of the contents in the certificate of the first terminal device are as follows:

[0166] serialnumber:10:ea:1c:…: represents the certificate serial number of the first terminal device;

[0167] X509v3 extensions: indicates the newly added items in the certificate of the first terminal device;

[0168] X509v3 Paired devices: indicates the certificate serial number of the second terminal device paired with the first terminal device;

[0169] Critical: indicates that the pairing relationship is a required parameter;

[0170] 00:da:1c:…: indicates the certificate serial number of the second terminal device paired with the first terminal device;

[0171] 00:1c:2d:…: indicates the certificate serial number of the second terminal device paired with the first terminal device.

[0172] Some of the content in the certificate of the second terminal device is as follows:

[0173] serial number:00:da:1c:…: indicates the certificate serial number of the second terminal device;

[0174] X509v3 extensions: indicates the new items in the certificate of the second terminal device;

[0175] X509v3 Paired devices: indicates the certificate serial number of the first terminal device paired with the second terminal device;

[0176] Critical: indicates that the pairing relationship is a required parameter;

[0177] 10:ea:1c:…: indicates the certificate serial number of the first terminal device paired with the second terminal device;

[0178] 00:11:dd:…: indicates the certificate serial number of another terminal device paired with the second terminal device.

[0179] Among them, the new items (extensions) in the above-mentioned certificate clearly indicate the pairing information of the first terminal device and the second terminal device. The "critical" parameter represents an item that must be met for the pairing relationship. Optionally, if it is not required to be met in the drone system or network, this parameter is not included in the certificate. Taking the certificate of the first terminal device as an example, the number after "critical" represents the certificate serial number, public key, address, ID or other identity identifier of the second terminal device paired with the first terminal device. It can be understood that in the certificate example shown above, the pairing relationship is shown in the certificate serial number (serial number), such as the certificate serial number of the first terminal device is: 10:ea:1c:... The certificate serial number of the second terminal device is: 00:da:1c:... However, the certificate serial number shown above is only an example, and the last few digits of the certificate serial number are omitted in the certificate serial number shown in the embodiment of the present application. In actual applications, the certificate serial number may have more ways of expression, and this application does not limit this.

[0180] In addition, the certificate of the first terminal device also indicates the certificate serial number of the second terminal device paired with the first terminal device: 00:1c:2d:…. For example, if the first terminal device is a drone and the second terminal device is a remote control, the drone can be controlled by both remote controls. For another example, if the first terminal device is a remote control and the second terminal device is a drone, the remote control can control both drones. Furthermore, the certificate of the second terminal device also displays the certificate serial number of the second paired terminal device: 00:11:dd:….

[0181] For example, when the credential includes a token, the token may include the identity of the first terminal device, the identity of the second terminal device paired with the first terminal device, or a digital signature of the token. It is understood that the description of the identity of the first terminal device and the identity of the second terminal device can be referred to in the description of Implementation Method 1 and will not be detailed here. It is understood that the token in the embodiments of the present application may also be referred to as a security token, etc.

[0182] The following uses JWT tokens (JSON Web Tokens, or JSON Web tokens) as an example to illustrate tokens. For example, a JWT token may include at least: a header part, a payload part, and a digital signature part. Among them, the header part can be used to indicate the type of the JWT token and the security algorithm used; the payload part can include the declaration of the JWT token; and the digital signature part includes the digital signature of the issuer of the JWT token. It should be noted that other types of tokens can also be used in the embodiments of the present application. It is understandable that the issuer of the JWT token can be a manufacturer, service provider, or vertical industry entity, etc., and this application does not limit this.

[0183] For example, the pairing relationship between the first terminal device and the second terminal device may be written into the payload as a declaration of a JWT token. Part of the content of the JWT token may be as follows:

[0184] {…(Other declarations omitted)

[0185] "sub":"uav": indicates that the first terminal device is a drone;

[0186] "sn":"08WU…": indicates the product serial number of the first terminal device;

[0187] "prd":"08QU…","0ASD…": indicates a list of product serial numbers of two second terminal devices paired with the first terminal device;

[0188] …(Other statements omitted)

[0189] }

[0190] Among them, the claims in the JWT token are used to represent the pairing information of the first terminal device and the second terminal device. It can be understood that in the part of the content included in the JWT token shown above, the identity identification of the first terminal device and the identity identification of the second terminal device are shown as product serial numbers. For example, the product serial number of the first terminal device is: 08WU..., and the product serial number of the second terminal device paired with the first terminal is: "08QU..." or "0ASD...". However, the embodiment of the present application can also use other identifiers to represent the identity identification of the first terminal device and the second terminal device. It can also be seen from the part of the content of the JWT token shown above that the first terminal device is a drone, the second terminal device is a remote control, and the drone can be controlled by two remote controls.

[0191] It should be noted that the declaration items "sn", "prd" or declaration content "uav" shown above are just examples and can also be replaced by other declaration items or contents, etc. This application does not impose any restrictions on this.

[0192] For implementation method one, the certificate or token sent by the first terminal device includes the identities of both the paired first and second terminal devices. This means that the identity of the paired second terminal device is displayed as a new item in the certificate or a declared item in the token. This avoids the need to use multiple certificates or tokens to indicate the identities of the paired first and second terminal devices, effectively saving signaling overhead. Furthermore, by including a digital signature for the certificate of the first terminal device in the first message, the first network device can verify the digital signature using the first public key, ensuring that the pairing relationship between the first and second terminal devices has not been tampered with, thereby improving the security of the pairing relationship between the first and second terminal devices.

[0193] Implementation method 2:

[0194] In one possible implementation, the first message includes credentials for the first terminal device and the second terminal device, and the credentials for the first terminal device and the second terminal device are used to indicate a pairing relationship between the first and second terminal devices. In other words, the first message may include both the credentials for the first and second terminal devices, which are paired. The credentials include any one or more of a certificate, a token, or a public key.

[0195] In an embodiment of the present application, when the first message includes the credentials of the first terminal device and the credentials of the second terminal device, the first network device verifies the digital signature based on the identity identifier of the first terminal device, the identity identifier of the second terminal device, and the first public key. This can be understood as: the first network device verifies the credentials of the first terminal device and the credentials of the second terminal device based on the first public key. In other words, the digital signature of the pairing relationship between the first terminal device and the second terminal device can be understood as: the digital signature of the credentials of the first terminal device and the credentials of the second terminal device.

[0196] Exemplarily, when the credential includes a certificate, the first message may include the certificate of the first terminal device and the certificate of the second terminal device. It is understandable that in implementation method two, the certificate of the first terminal device and the certificate of the second terminal device may not include the new items shown in implementation method one. Optionally, the certificate of the first terminal device may include an identifier of the first public key, and the certificate of the second terminal device may also include an identifier of the first public key. As to whether the identifier of the first public key included in the certificate of the first terminal device is the same as the identifier of the first public key included in the certificate of the second terminal device, this embodiment of the application does not limit it. In other words, there are one or more first public keys, and the first public key used to verify the digital signature of the credential of the first terminal device and the first public key used to verify the digital signature of the credential of the second terminal device may be the same or different, and this embodiment of the application does not limit it.

[0197] For example, taking the format of an X.509 certificate as an example, part of the content of the certificate may be as follows:

[0198] Some of the contents in the certificate of the first terminal device are as follows:

[0199] Certificate(UAV): indicates that the first terminal device is a drone;

[0200] …(some content omitted);

[0201] Serial Number:10:ea:1c:…: indicates the certificate serial number of the first terminal device;

[0202] …(some content omitted);

[0203] Public Key:00:c1:11:19:…: represents the public key of the first terminal device;

[0204] …(some content omitted).

[0205] Some of the content in the certificate of the second terminal device is as follows:

[0206] Certificate (UAV Controller): indicates that the second terminal device is a remote controller;

[0207] …(some content omitted);

[0208] Serial Number:00:da:1c:…: indicates the certificate serial number of the second terminal device;

[0209] …(some content omitted);

[0210] Public Key:00:dd:31:2e:…: represents the public key of the second terminal device;

[0211] …(some content omitted).

[0212] Compared to implementation method one, by including both the certificate of the first terminal device and the certificate of the second terminal device in the first message, the first network device can learn the pairing relationship between the first terminal device and the second terminal device based on the first message. This also avoids modifying the certificate type or format of either the first terminal device or the second terminal device, simplifying the implementation. Furthermore, the first network device verifies the digital signatures of the first terminal device's certificate and the second terminal device's certificate using the first public key, preventing other devices from modifying or tampering with the pairing relationship and ensuring the security of the pairing relationship between the first and second terminal devices.

[0213] For example, when the credential includes a token, the first message may include the token of the first terminal device and the token of the second terminal device. Furthermore, the token of the first terminal device may include the identity of the first terminal device and / or the digital signature of the token of the first terminal device; the token of the second terminal device may include the identity of the second terminal device and / or the digital signature of the token of the second terminal device. It is understood that for further explanation of tokens, please refer to Implementation Method 1 and will not be detailed here.

[0214] For example, part of the content in the JWT token may be as follows:

[0215] Part of the content in the token of the first terminal device is as follows:

[0216] {…(Other declarations omitted)

[0217] "sub":"uav": indicates that the first terminal device is a drone;

[0218] "sn":"08WU…": indicates the product serial number of the first terminal device;

[0219] …(other declarations omitted)}.

[0220] Part of the content in the token of the second terminal device is as follows:

[0221] {…(Other declarations omitted)

[0222] "sub":"uav controller": indicates that the second terminal device is a remote control;

[0223] "sn":"08QU…": indicates the product serial number of the second terminal device;

[0224] …(other declarations omitted)}.

[0225] Part of the content in the token of the second terminal device is as follows:

[0226] {…(Other declarations omitted)

[0227] "sub":"uav controller": indicates that the second terminal device is a remote control;

[0228] "sn":"0ASD…": indicates the product serial number of the second terminal device;

[0229] …(other declarations omitted)}.

[0230] It is understandable that for the relevant description of the token in implementation method 2, please refer to the description of the token in implementation method 1, and no further details will be given here.

[0231] Exemplarily, when the credential includes a public key, the first message may include the public key of the first terminal device, the public key of the second terminal device, and a digital signature.

[0232] Exemplarily, when the credential includes an identity of the drone system, the first message may include an identity of the first terminal device, an identity of the second terminal device, and a digital signature; the identity is the identity of the drone system.

[0233] It should be understood that in the embodiments of the present application, the credentials may include or not include a digital signature depending on the type of the credentials, which may include a certificate, a token, or a public key.

[0234] Implementation method three:

[0235] In a possible implementation, the first message includes the credentials of the first terminal device or the credentials of the second terminal device, and part of the content of the credentials of the first terminal device and the credentials of the second terminal device are the same.

[0236] In an embodiment of the present application, some of the content may be pre-agreed upon between the first terminal device and the second terminal device. For example, the key, password, or verification code included in the credentials of the first terminal device may be the same as the key, password, or verification code included in the credentials of the second terminal device. For another example, the pairing identifier included in the credentials of the first terminal device may be the same as the pairing identifier included in the credentials of the second terminal device. In other words, regardless of the type of the credentials, the key, password, verification code, or pairing identifier included in the credentials of the first terminal device may be the same as the key, password, verification code, or pairing identifier included in the credentials of the second terminal device.

[0237] Furthermore, the first message also includes a digital signature, so that the first network device can verify the digital signature using the first public key. For implementation method three, whether the digital signature is included in the credential is not limited in this embodiment of the present application. And the first message also includes the identity of the first terminal device and the identity of the second terminal device. In other words, whether the credential of the first terminal device includes the identity of the first terminal device and / or the identity of the second terminal device is not limited in this embodiment of the present application. And whether the credential of the second terminal device includes the identity of the first terminal device and / or the identity of the second terminal device is not limited in this embodiment of the present application. And the first message may also include an identifier of the first public key, and the identifier of the first public key can enable the first network device to determine the first public key used to verify the digital signature from one or more stored first public keys.

[0238] In an embodiment of the present application, the first network device verifies the digital signature based on the identity identifier of the first terminal device, the identity identifier of the second terminal device and the first public key. It can be understood that: the first network device verifies the digital signature based on the first public key; and the credentials of the first terminal device or the credentials of the second terminal device indicate the pairing relationship between the first terminal device and the second terminal device.

[0239] Implementation method 4:

[0240] In a possible implementation, the first message includes an identifier of the credentials of the first terminal device or an identifier of the credentials of the second terminal device, and the identifier of the credentials of the first terminal device is the same as the identifier of the credentials of the second terminal device.

[0241] In implementation method four, the first message may include the identity of the first terminal device and / or the identity, digital signature, and identifier of the second terminal device. It is understandable that in order for the first network device to know which first public key to use to verify the identifier of the credential of the first terminal device or the identifier of the credential of the second terminal device, the first message may also include an identifier of the first public key. The identifier of the first public key can enable the first network device to determine the first public key used to verify the digital signature from one or more stored first public keys. It is understandable that the embodiment of the present application does not limit the specific form of the identifier of the credential.

[0242] With respect to implementation manner three and implementation manner four, after the first network device verifies the digital signature according to the first public key, it can use the same part of the credential to perform the pairing process.

[0243] Implementation method 5:

[0244] In one possible implementation, the first message includes an identifier of the credentials of the first terminal device and an identifier of the credentials of the second terminal device, and the identifier of the credentials of the first terminal device and the identifier of the credentials of the second terminal device are used to indicate the pairing relationship between the first terminal device and the second terminal device.

[0245] In this embodiment of the present application, the first network device verifies the digital signature based on the identity of the first terminal device, the identity of the second terminal device, and the first public key. This can be understood as the first network device verifying the identifier of the first terminal device's credential and the identifier of the second terminal device's credential based on the first public key. In other words, the digital signature of the pairing relationship between the first terminal device and the second terminal device can be understood as the digital signature of the identifier of the first terminal device's credential and the identifier of the second terminal device's credential.

[0246] For the specific description of implementation method five, please refer to implementation method four or implementation method three, which will not be described in detail here.

[0247] It can be understood that the first network device described in the embodiment of the present application verifies the digital signature based on the identity identifier of the first terminal device, the identity identifier of the second terminal device and the first public key, and it can also be replaced by the first network device verifying the digital signature based on the first public key.

[0248] The method for the first network device to verify the pairing relationship between the first terminal device and the second terminal device based on the subscriber identification module (SIM) card is as follows:

[0249] In one possible implementation, the first message may not include a digital signature, and the identity of the first terminal device includes the subscribed user identity SUPI or GPSI of the first terminal device in the network, and the identity of the second terminal device includes the subscribed user identity SUPI or GPSI of the second terminal device in the network.

[0250] In this case, the operator can pre-configure the terminal device identity identifier of the SIM card with a pairing relationship, such as SUPI, to the first network device, so that when the first network device receives the first message, the first network device can determine the pairing relationship between the first terminal device and the second terminal device based on the SUPI of the first terminal device and / or the SUPI of the second terminal device.

[0251] In this implementation, the first terminal device and the second terminal device access the mobile communication network by using a SIM card (SUPI or GPSI), which is simple to implement and makes the pairing method of the first terminal device and the second terminal device more flexible.

[0252] 303. After the pairing relationship between the first terminal device and the second terminal device is verified, the first network device sends a second message to the first terminal device, where the second message includes first indication information, and the first indication information is used to indicate the pairing result of the first terminal device and the second terminal device.

[0253] The process of the first network device sending the second message to the first terminal device can refer to the process of sending the first message, which will not be described in detail here.

[0254] In the embodiment of the present application, the first indication information may be used to indicate the pairing result of the first terminal device and the second terminal device. The pairing result may include a result that the pairing of the first terminal device and the second terminal device is successful; or, alternatively, a result that the pairing of the first terminal device and the second terminal device is unsuccessful. It is understood that the embodiment of the present application does not limit the specific form or type of the first message and / or second message shown above.

[0255] In one possible implementation, when the first message shown above is carried in a registration request message, the second message may be carried in a registration response message. That is, if the registration response message includes the first indication information, and the first indication information indicates a successful pairing result, the first indication information may also be used to indicate that the registration request of the first terminal device has been approved. Alternatively, if the first indication information indicates a failed pairing result, the first indication information may also be used to indicate that the registration request of the first terminal device has been rejected.

[0256] In a possible implementation, after the first network device verifies the pairing relationship between the first terminal device and the second terminal device, the first network device may further pair the first terminal device with the second terminal device. The pairing process is as follows:

[0257] The first network device searches the first network device to see if the context of the second terminal device is stored therein. If the context of the second terminal device is not found, it indicates that the second terminal device has not yet connected to the mobile communication network; or, it indicates that the second terminal device has not yet successfully paired with the first terminal device. In this case, the first network device may store the identity of the first terminal device and the identity of the second terminal device. The first network device then waits for the second terminal device to connect to the mobile communication network; or, the first network device may also send a notification message to the first terminal device. Optionally, the notification message may be used to notify the second terminal device that it has not yet connected to the mobile communication network. Furthermore, after the second terminal device connects to the mobile communication network, for example, after the second terminal device sends a first message to the first network device, and after the first network device successfully verifies the pairing relationship between the first terminal device and the second terminal device based on the first message, the first network device may store information such as the identity of the first terminal device in the context of the second terminal device, and store information such as the identity of the second terminal device in the context of the first terminal device.

[0258] If the first network device finds the context of the second terminal device, it indicates that the second terminal device has connected to the mobile communication network; or, it indicates that the second terminal device also needs to be paired with the first terminal device. In this case, the first network device can store the identity of the second terminal device and other information in the context of the first terminal device. And store the identity of the first terminal device and other information in the context of the second terminal device.

[0259] Optionally, in addition to storing the identity of the first terminal device in the context of the second terminal device, the first network device may also store the context of the first terminal device in the context of the second terminal device. Furthermore, in addition to storing the identity of the second terminal device in the context of the first terminal device, the first network device may also store the context of the second terminal device in the context of the first terminal device.

[0260] It can be understood that the pairing process is also applicable to the following embodiments.

[0261] Optionally, for Implementation Methods 3 and 4 above, the first network device may perform the pairing process based on the same portion of the credentials. For example, if the first terminal device and the second terminal device have the same secret key, the identity of the first terminal device and other information may be stored in the context of the second terminal device, and vice versa.

[0262] In one possible implementation, Figure 3The illustrated method further includes:

[0263] 304. The first network device sends a third message to the second network device. The third message includes an identity of the first terminal device and an identity of the second terminal device. The identity of the first terminal device and the identity of the second terminal device are used to indicate that the first terminal device and the second terminal device are paired. In response, the second network device receives the third message.

[0264] In an embodiment of the present application, after a first network device successfully verifies the pairing relationship between a first terminal device and a second terminal device, the first network device may send a third message to the second network device, causing the second network device to store the identity identifiers of the first terminal device and the second terminal device, which are in a paired relationship. Consequently, when the first terminal device and / or the second terminal device subsequently need to access a mobile communication network for pairing, the first terminal device and / or the second terminal device may directly send a fourth message to the second network device. This fourth message may be used to request access to the mobile communication network and / or may be used to request pairing.

[0265] 305. The first terminal device sends a fourth message to the second network device, and accordingly, the second network device receives the fourth message from the first terminal device; wherein the fourth message includes the identity of the first terminal device and / or the identity of the second terminal device paired with the first terminal device.

[0266] 306. The second network device verifies the pairing relationship between the first terminal device and the second terminal device.

[0267] In this embodiment of the present application, since the first network device has sent the identity identifier of the first terminal device and the identity identifier of the second terminal device that have a pairing relationship to the second network device, after the second network device receives the fourth message, it can determine whether the first terminal device and the second terminal device have a pairing relationship based on the identity identifier in the fourth message.

[0268] Optionally, the pairing relationship between the first terminal device and the second terminal device stored in the second network device may have a certain time limit. In this case, the first network device may periodically send the third message to the second network device; or the first network device may send the third message to the second network device when the pairing relationship between the first terminal device and the second terminal device changes, etc., which is not limited in this embodiment of the present application.

[0269] 307. After the pairing relationship between the first terminal device and the second terminal device is verified, the second network device sends a fifth message to the first terminal device, where the fifth message includes second indication information, and the second indication information is used to indicate the pairing result of the first terminal device and the second terminal device.

[0270] It can be understood that for the fifth message and the second indication information, reference can be made to the second message and the first indication information shown above, which will not be described in detail here.

[0271] It should be noted that the terminal devices in the embodiments of the present application may also be other types of terminals. For example, when the first terminal device is a drone, the second terminal may also be an audit device or other authorized third-party device (TPAE). These devices may be authorized to remotely control and communicate with the first device (drone).

[0272] In this embodiment of the present application, only after the first network device has successfully verified the pairing relationship between the first terminal device and the second terminal device will the first network device authorize the first terminal device to use the mobile network device to control the second terminal device. This, on the one hand, prevents unauthorized first terminal devices from arbitrarily controlling the second terminal device, thereby improving the security of the pairing between the first and second terminal devices. On the other hand, it prevents arbitrary terminal devices from accessing the mobile communication network and affecting the use of other terminal devices, effectively ensuring the security and reliability of the first and second terminal devices' access to the mobile communication network.

[0273] Understandable, Figure 3 The verification method of the terminal device shown is also applicable to the second terminal device. This application performs Figure 3 The steps of the method shown will not be described in detail one by one.

[0274] For a more vivid understanding of the embodiments of this application Figure 3 The method shown below will take the first terminal device as a drone, the second terminal device as a remote control, the first network device as a UTM, the second network device as an AMF, and the third network device as a UDM as an example to illustrate in more detail the verification method of the terminal device provided in the embodiment of the present application. It can be understood that in the following embodiments, the credentials are explained as certificates as an example. And for the following embodiments, the UTM can be deployed within the operator network or outside the operator network, and the embodiment of the present application does not limit this.

[0275] See Figure 4 , Figure 4 This is a flow chart of a terminal device verification method provided by an embodiment of the present application. Figure 3The verification method of the terminal device shown in the embodiment of the present application can be roughly divided into two stages. The first stage is the stage of pre-setting the certificate (including the pairing relationship), and the second stage is to register the certificate to the network.

[0276] In the first stage, if the manufacturer or service provider pre-installs certificates for the drone and remote control, that is, the manufacturer or service provider can store the certificate issued for the drone in the drone device and the certificate issued for the remote control in the remote control. For example, the drone's certificate may include the drone's public key (i.e., the drone's identity), a list of public keys of paired drones and remote controls (i.e., the identities of paired drones and remote controls), and the manufacturer's or service provider's digital signature on the drone's certificate. It is understood that the public key list shown above is only an example. In specific implementations, the public key list can also be understood as a public key set, an identifier (ID) list, etc., and this is not limited in this embodiment of the present application.

[0277] At the same time, the manufacturer or service provider can also configure a first public key (V-pubkey) for the drone or remote controller, and store the first public key in the UTM.

[0278] like Figure 4 As shown, the verification method of the terminal device includes:

[0279] In one possible implementation, Figure 4 The method shown may include steps 401 to 403 .

[0280] 401. The drone sends a registration request to the network, such as sending a registration request to the AMF through the access network device.

[0281] 402. Primary authentication is performed between the drone and the network to establish a security context.

[0282] 403. The network sends a registration response message to the drone, such as the AMF sending a registration accept message to the drone.

[0283] For example, for the authentication process between the drone and the network, those skilled in the art can refer to relevant standards or protocol materials for reference. The specific implementation of steps 401 to 403 is not limited in this embodiment of the application. It is understandable that Figure 4 The network elements or network functions involved in the main authentication process between the drone and the network are only examples, and the network functions or network elements shown should not be understood as limitations on the embodiments of the present application.

[0284] 404. The drone sends a first message to the AMF, where the first message includes the drone's certificate. Accordingly, the AMF receives the first message.

[0285] For example, the drone's certificate includes the drone's public key (UAV pub key), the public key list or ID list of the drone and remote controller (paired control pub key / ID list), and the manufacturer or service provider's digital signature (vsig) on ​​the drone's certificate.

[0286] It is understandable that for the specific form of the certificate, please refer to Figure 3 The method shown will not be described in detail here.

[0287] 405. The AMF sends the first message to the UTM. Correspondingly, the UTM receives the first message.

[0288] Optionally, the first message may also include the identity of the drone in the network, such as the SUPI of the drone. It is understandable that when the UTM is deployed within the core network, after the AMF receives the GUTI of the drone, it can convert the GUTI of the drone into the SUPI of the drone. When the UTM is deployed outside the core network (operator network), after the AMF receives the GUTI of the drone, it can convert the GUTI of the drone into the publicly available contract identifier (generic public subscription identifier, GPSI) of the drone.

[0289] 406. The UTM verifies whether the digital signature of the drone's certificate is valid based on the first public key (V-pubkey). If the digital signature of the drone's certificate is valid, then execute step 407; otherwise, the UTM may send a failure message to the drone ( Figure 4 not shown).

[0290] Among them, the UTM verifies whether the digital signature of the drone's certificate is valid, which can be understood as: the UTM verifies the digital signature of the pairing relationship between the drone and the remote control.

[0291] The embodiment of the present application does not limit the method for the UTM to verify whether the digital signature is valid.

[0292] It is understandable that after the UTM sends a failure message to the drone, the drone can also re-initiate the registration request; or, the drone can also re-send the first message, etc.

[0293] In one possible implementation, step 404 can be replaced by: the drone sends a first message to the AMF, where the first message includes the drone's certificate and the remote controller's certificate. In response, the AMF receives the first message. For example, the drone's certificate includes the drone's public key and the manufacturer's or service provider's digital signature on the drone's certificate. The remote controller's certificate includes the remote controller's public key and the manufacturer's or service provider's digital signature on the remote controller's certificate.

[0294] In this case, step 406 can also be replaced by the UTM verifying the validity of the digital signatures of the paired drone's certificate and the remote controller's certificate using the first public key. If both the digital signatures of the drone's certificate and the remote controller's certificate are valid, step 407 is executed; otherwise, the UTM sends a failure message to the drone.

[0295] It is understood that the embodiments of the present application do not limit how the drone's certificate and the remote controller's certificate are encapsulated in the first message. In other words, the embodiments of the present application do not limit the order in which the drone's certificate and the remote controller's certificate are placed in the first message. Optionally, assuming that a drone is paired with multiple remote controllers, the first message may contain the drone's certificate first, followed by the multiple remote controllers' certificates in sequence; alternatively, the first message may contain the multiple remote controllers' certificates in sequence first, followed by the drone's certificate, and so on.

[0296] 407. The UTM stores relevant content in the drone's certificate, such as the drone's public key, the drone's SUPI, and the public key list for pairing the drone and the remote controller.

[0297] 408. The UTM checks whether the UTM has stored the context of the remote controller paired with the drone. If the UTM has stored the context of the remote controller paired with the drone, the UTM pairs the drone with the remote controller. The pairing process of the drone and the remote controller is as follows: the UTM stores the drone's identity and other information in the remote controller's context; the UTM stores the remote controller's identity and other information in the drone's context.

[0298] If the UTM does not store the context of the remote controller paired with the drone, it waits for the remote controller to access the mobile communication network. After the remote controller accesses the mobile communication network, the UTM pairs the drone with the remote controller.

[0299] It can be understood that for the pairing process shown in step 408, Figure 4 The UTM performs the pairing process instead. For how the UTM performs the pairing process, please refer to Figure 3 Description or Figure 4 Step 408 in .

[0300] In one possible implementation, Figure 4 The method shown may further include step 409 and step 410 .

[0301] 409. The UTM sends a third message to the AMF, which includes the SUPI (or GPSI) of the paired drone and the SUPI (or GPSI) of the remote controller. The AMF receives the third message. Optionally, if the AMF receives the GPSI, it converts the GPSI to the SUPI.

[0302] Optionally, the UTM may further send the third message to the UDM. After receiving the third message, the UDM stores the SUPI of the paired drone and the SUPI of the remote controller.

[0303] Optionally, the UTM may also send the third message to the AMF. After receiving the third message, the AMF may also send the third message to the UDM.

[0304] Optionally, the UTM may also send the third message to the UDM. After receiving the third message, the UDM may also send the third message to the AMF.

[0305] 410. The AMF stores the SUPI of the paired drone and the SUPI of the remote controller.

[0306] For example, the AMF may store the SUPI pair of the paired drone and remote controller in the drone context and the remote controller context respectively.

[0307] Alternatively, the above 410 may be replaced by: the AMF may also store the GUTI pair of the paired drone and remote controller in the context of the drone and the context of the remote controller respectively.

[0308] 411. The UTM sends a second message to the drone, where the second message includes first indication information. The first indication information can be used to indicate a pairing result between the drone and the remote controller. Accordingly, the drone receives the second message.

[0309] Optionally, the UTM may send the second message to the AMF, and the AMF may send the second message to the drone.

[0310] Optionally, the process of UTM sending the second message to the drone can refer to Figure 3 The method shown will not be described in detail here.

[0311] In one possible implementation, the first message may be carried in a registration request, and the second message may be carried in a registration response message. That is, the above-mentioned step 404 and the above-mentioned step 401 may be combined into one step. The above-mentioned step 403 and the above-mentioned step 411 may be combined into one step. For example, when a drone sends a registration request to a network, the registration request may include the first message. Then the drone and the network perform primary authentication and establish a security context. The UTM then executes step 406 and so on. After the UTM executes the pairing process, the UTM sends a second message to the AMF, and then the AMF sends a registration response message to the drone, and the registration response message includes the second message. It is understandable that for this description, the following embodiments are also applicable.

[0312] By implementing Figure 4 According to the method shown, the drone and the remote control can transmit data to each other. However, the drone and the remote control may not always maintain a communication state, such as the communication state between the drone and the remote control may be disconnected. In the case that the drone and / or the remote control needs to re-access the mobile communication network, the drone may not send a certificate to the UTM. For example, the drone may send a fourth message to the AMF, and the fourth message includes the identity of the drone and / or the remote control. After the AMF receives the fourth message, it can verify the pairing relationship between the drone and the remote control based on the stored pairing relationship (such as the SUPI list, GUTI list, etc.). After the AMF verifies the pairing relationship between the drone and the remote control, the AMF sends a fifth message to the drone, and the fifth message includes the second indication information. It can be understood that the specific implementation method of the second indication information can refer to the first indication information, which will not be described in detail here.

[0313] It is understandable that the certificates of the drone and / or remote controller may be updated. After the certificates of the drone and / or remote controller are updated by the manufacturer or service provider, the drone can also directly send the updated drone certificates to the network. Figure 4 The method shown updates or stores the drone's certificate, etc.

[0314] In an embodiment of the present application, the first terminal device can enable the first network device to verify the pairing relationship by sending a first message. After the verification is successful, the pairing relationship is automatically stored in the first network device and can continue to be used before the pairing relationship is updated. This method avoids the need for mobile communication network administrators to configure and store the pairing relationship between the first device and the second device, so that the pairing relationship can be automatically registered in the network. And after the pairing relationship is verified, the first terminal device can be connected to the mobile communication network to achieve communication with the second terminal device. That is to say, in an embodiment of the present application, only remote controllers and drones that have passed the verification can be authorized to use the mobile communication network for drone operation, remote control, communication, etc. Therefore, in scenarios beyond visual range and with high security requirements, the network can restrict and authorize the use of drones or remote controllers, thereby improving the safety of drones or remote controllers.

[0315] See Figure 5 , Figure 5 This is a flow chart of a terminal device verification method provided by an embodiment of the present application. Figure 3 The method shown in the embodiment of the present application can still be divided into two stages. In the first stage, if the manufacturer or service provider presets a symmetric key or shared password for the drone and the remote control, the relevant equipment (such as UTM or AMF, etc.) can determine the pairing relationship between the drone and the remote control through the symmetric key or shared password. For example, the manufacturer or service provider can preset a shared key ID or password ID or token ID, etc. for the drone and the remote control with a pairing relationship, and then store the symmetric key or shared key in the drone and the remote control respectively. At the same time, the manufacturer or service provider can also configure a first public key (V-pubkey) for the network, and the first public key is stored in the UTM.

[0316] It can be understood that the symmetric / shared key or shared password in the embodiments of the present application can be understood as the password, passcode or verification code in the above-mentioned implementation method three; or the identifier of the certificate in implementation method four.

[0317] like Figure 5 As shown, the verification method of the terminal device includes:

[0318] 501. The drone sends a registration request to the network, such as the drone sends a registration request to the AMF through the access network device.

[0319] 502. The drone and the network perform primary authentication and establish a security context.

[0320] 503. The network sends a registration response message to the drone, such as the AMF sends a registration acceptance message to the drone.

[0321] For example, those skilled in the art can refer to relevant standards or protocol materials for the authentication process between the drone and the network. The specific implementation of steps 501 to 503 is not limited in this embodiment of the application.

[0322] 504. The drone sends a first message to the AMF. The first message includes the drone's identity, shared password, and digital signature. Correspondingly, the AMF receives the first message.

[0323] 505. The AMF sends the first message to the UTM. Correspondingly, the UTM receives the first message.

[0324] 506. The UTM verifies whether the digital signature of the drone is valid based on the first public key (V-pubkey). If the digital signature is valid, execute step 507; otherwise, the UTM may send a failure message to the drone ( Figure 5 not shown).

[0325] 507. The UTM searches the shared password to see if it has stored the context of the remote controller paired with the drone. If the UTM has stored the context of the remote controller paired with the drone (using the same shared password), the UTM pairs the drone with the remote controller. The pairing process between the drone and the remote controller is as follows: the UTM stores the drone's identity in the remote controller's context; the UTM stores the remote controller's identity in the drone's context.

[0326] If the context of the remote controller paired with the drone is not stored in the UTM, the remote controller waits for the remote controller to access the mobile communication network. After the remote controller accesses the mobile communication network, the UTM pairs the drone with the remote controller.

[0327] In one possible implementation, Figure 5 The method shown may further include step 508 and step 509 .

[0328] 508. The UTM sends a third message to the AMF, where the third message includes the SUPI of the paired drone and the SUPI of the remote controller. Accordingly, the AMF receives the third message.

[0329] 509. The AMF stores the SUPI of the paired drone and the SUPI of the remote controller.

[0330] 510. The UTM sends a second message to the drone, where the second message includes first indication information. The first indication information can be used to indicate a pairing result between the drone and the remote controller. Accordingly, the drone receives the second message.

[0331] Understandably, for Figure 5 The method shown can be referred to Figure 4 The method shown, for example, for step 508, reference may be made to the relevant description of step 409; for another example, for step 509, reference may be made to step 410, etc., and no further details will be given here.

[0332] See Figure 6 , Figure 6 This is a flow chart of a terminal device verification method provided in an embodiment of the present application. In this embodiment, the network operator participates in setting up the pairing relationship between the drone and the remote control. This embodiment can be divided into two phases. In the first phase, the network operator can set up a SIM card with a pairing relationship. For example, the identity identifiers of the SIM card with a pairing relationship may include SUPI1 and SUPI2. As long as the paired SIM card is used, the drone and remote control can be confirmed to be paired.

[0333] Furthermore, the identity of the paired SIM card can be stored in the network, for example, in the UDM or UTM. For another example, the identity of the paired SIM card can be stored in the UDM, which can then send the identity of the paired SIM card to the UTM, causing the UTM to store the identity of the paired SIM card. For another example, the identity of the paired SIM card can be directly stored in the UTM. It will be appreciated that the UTM can be deployed inside or outside the network. If the UTM is deployed outside the network, the pairing identity can use the GPSI instead of the SUPI.

[0334] like Figure 6 As shown, the verification method of the terminal device includes:

[0335] 601. The drone sends a registration request to the network, such as the drone sends a registration request to the AMF through the access network device.

[0336] 602. Perform primary authentication between the drone and the network to establish a security context.

[0337] 603. The network sends a registration acceptance message to the drone, such as the AMF sends a registration acceptance message to the drone.

[0338] For example, those skilled in the art can refer to relevant standards or protocol materials for the authentication process between the drone and the network. The specific implementation of steps 601 to 603 is not limited in this embodiment of the application.

[0339] 604. The drone sends a first message to the AMF. The first message includes the identity of the drone and the identity of the remote controller. Accordingly, the AMF receives the first message.

[0340] 605. The AMF sends the first message to the UTM. Correspondingly, the UTM receives the first message.

[0341] 606. The UTM verifies the pairing relationship between the drone and the remote controller based on the stored drone identity and the remote controller identity. If the pairing relationship between the drone and the remote controller is verified, step 607 is executed. Otherwise, the UTM may send a failure message to the drone ( Figure 6 not shown).

[0342] Illustratively, the identity of the drone includes the SUPI of the drone; and the identity of the remote controller includes the SUPI of the remote controller.

[0343] 607. The UTM checks whether the UTM has stored the context of the remote controller paired with the drone. If the UTM has stored the context of the remote controller paired with the drone, the UTM pairs the drone with the remote controller. The pairing process of the drone and the remote controller is as follows: the UTM stores the drone's identity and other information in the remote controller's context; the UTM stores the identity and other information in the drone's context.

[0344] If the UTM does not store the context of the remote controller paired with the drone, it waits for the remote controller to access the mobile communication network. After the remote controller accesses the mobile communication network, the UTM pairs the drone with the remote controller.

[0345] 608. The UTM sends a second message to the drone, where the second message includes the first indication information. The first indication information can be used to indicate the pairing result of the drone and the remote controller. Accordingly, the drone receives the second message.

[0346] In the embodiment of the present application, the drone and the remote controller are connected to the mobile communication network by using a SIM card (SUPI or GPSI), which is simple to implement and makes the pairing method of the drone and the remote controller more flexible.

[0347] In one possible implementation, Figure 6 The illustrated method further includes:

[0348] The UTM sends a third message to the AMF, which includes the SUPI of the paired drone and the SUPI of the remote controller. The AMF receives the third message.

[0349] The AMF stores the SUPI of the paired drone and the SUPI of the remote controller.

[0350] for Figure 6 The method shown can also be referred to Figure 3-Figure 5 The method shown will not be described in detail here.

[0351] It is understood that the method shown above uses the first network device as an example to illustrate how to verify the pairing relationship. The embodiment of the present application also provides a terminal device verification method. The terminal device verification method can verify the pairing relationship between the first terminal device and the second terminal device through the UTM and the server. Figure 7 As shown, the verification method of the terminal device includes:

[0352] 701. The server receives a sixth message; wherein the sixth message includes a first identity identifier and a second identity identifier of a first terminal device.

[0353] In the embodiment of the present application, the first identity identifier is the identity identifier of the first terminal device in the drone system; the second identity identifier is the identity identifier of the first terminal device in the network. For example, the identity identifier of the first terminal device in the drone system may be the drone ID (UAV-ID) or the remote control ID (UAV control-ID). For another example, the identity identifier of the first terminal device in the network may be the GPSI of the drone or the SUPI of the drone; alternatively, the identity identifier of the first terminal device in the network may be the GPSI of the remote control or the SUPI of the remote control.

[0354] In one possible implementation, the server receiving the sixth message can be understood as: the server receiving the sixth message from the first terminal device. In this case, the sending process of the sixth message may be as follows: the first terminal device sends the sixth message to the second network device, wherein the sixth message may include the first identity identifier of the first terminal device and the second identity identifier of the first terminal device encapsulated in the sixth message; then the second network device converts the second identity identifier and sends the sixth message to the server. Exemplarily, when the second identity identifier of the first terminal device includes the GUTI of the first terminal device, the second network device may convert the GUTI of the first terminal device into GPSI and send it to the server after receiving the sixth message. It is understandable that Figure 7 What is shown is that the server receives the sixth message from the first terminal device, but this application does not limit the sending process of the sixth message.

[0355] It is understandable that the embodiments of the present application do not limit the sending process of the sixth message. Regardless of which of the above implementations is used, as long as it can ensure that the sixth message received by the server includes the first identity identifier and the second identity identifier of the first terminal device, it falls within the scope of protection of this application.

[0356] 702. The server determines the authority of the first terminal device according to the first identity identifier of the first terminal device.

[0357] In an embodiment of the present application, the server may pre-store the contractual relationship of the drone system, etc., so that the server can perform authentication, authorization, etc. based on the contractual relationship. Specifically, the manufacturer or server may store the pairing relationship between the first terminal device and the second terminal device in the server, so that after receiving the sixth message, the server can directly determine the authority of the first terminal device based on the stored pairing relationship. Optionally, the server determines the authority of the first terminal device, which can also be understood as the server determining the pairing authority of the first terminal device. If the authority of the first terminal device is passed, it means that the first terminal device has pairing authority, for example, the first terminal device can be paired with the second terminal device.

[0358] 703. When the permission of the first terminal device is approved, the server sends a seventh message to the first network device; wherein the seventh message includes the second identity identifier of the first terminal device and the third identity identifier of the second terminal device paired with the first terminal device; or, the seventh message includes the first identity identifier of the first terminal device and the fourth identity identifier of the second terminal device paired with the first terminal device.

[0359] Correspondingly, the first network device receives the seventh message from the server.

[0360] In this embodiment of the present application, the third identity identifier is the identity identifier of the first terminal device in the network; the fourth identity identifier is the identity identifier of the first terminal device in the drone system.

[0361] In an embodiment of the present application, after a manufacturer, service provider, or vertical industry entity determines the pairing relationship between the first terminal device and the second terminal device, the manufacturer, service provider, or vertical industry entity may send the pairing identity identifiers of the first terminal device and the second terminal device to a server.

[0362] Furthermore, the server may pre-store the second identity of the first terminal device and the third identity of the second terminal device that are paired; alternatively, the server may pre-store the first identity of the first terminal device and the fourth identity of the second terminal device that are paired. In other words, the server may store the identities of the first terminal device and the second terminal device that are paired in the drone system, or their identities in the network.

[0363] Furthermore, after receiving the sixth message, the server can obtain the fourth identity identifier of one or more second terminal devices paired with the first terminal device stored in the server based on the first identity identifier of the first terminal device; or, obtain the third identity identifier of one or more second terminal devices paired with the first terminal device stored in the server based on the second identity identifier of the first terminal device.

[0364] It is understood that the pairing relationship between the first terminal device and the second terminal device can be referred to Figure 3 The implementation method shown will not be described in detail here.

[0365] In an embodiment of the present application, by distinguishing the identity of the first terminal device in the network and the identity in the drone system, the privacy of the first terminal device in different devices can be effectively guaranteed, and the security of the storage of the identity of the first terminal device can be improved.

[0366] 704. The first network device performs a pairing process on the first terminal device and the second terminal device according to the first identity of the first terminal device and the fourth identity of the second terminal device, or the second identity of the first terminal device and the third identity of the second terminal device.

[0367] In the embodiment of the present application, the first network device can pair the first terminal device and the second terminal device according to the first identity identifier of the first terminal device and the fourth identity identifier of the second terminal device.

[0368] As for the pairing process of the first terminal device and the second terminal device, please refer to Figure 3 The pairing process shown is not described in detail here.

[0369] 705. The first network device sends an eighth message to the first terminal device, where the eighth message includes third indication information, and the third indication information is used to indicate a pairing result between the first terminal device and the second terminal device.

[0370] For the implementation of the eighth message and the third indication information, please refer to Figure 3 The second message and the first indication information shown are not described in detail here.

[0371] In one possible implementation, Figure 7 As shown, Figure 7 The method shown may further include steps 706 to 709 .

[0372] 706. The first network device sends a third message to the second network device. The third message includes the identity of the first terminal device and the identity of the second terminal device. The identity of the first terminal device and the identity of the second terminal device are used to indicate that the first terminal device and the second terminal device are paired. In response, the second network device receives the third message.

[0373] Optionally, the third message may include the second identity of the first terminal device and the third identity of the second terminal device.

[0374] 707. The first terminal device sends a fourth message to the second network device, and accordingly, the second network device receives the fourth message from the first terminal device; wherein the fourth message includes the identity of the first terminal device and / or the identity of the second terminal device paired with the first terminal device.

[0375] 708. The second network device verifies the pairing relationship between the first terminal device and the second terminal device.

[0376] Optionally, the second network device may verify the pairing relationship between the second identity identifier of the first terminal device and the third identity identifier of the second terminal device.

[0377] 709. After the pairing relationship between the first terminal device and the second terminal device is verified, the second network device sends a fifth message to the first terminal device, where the fifth message includes second indication information, and the second indication information is used to indicate the pairing result of the first terminal device and the second terminal device.

[0378] For the specific implementation of steps 706 to 709, please refer to Figure 3 Steps 304 to 307 are shown and will not be described in detail here.

[0379] In an embodiment of the present application, by storing the pairing relationship between the first terminal device and the second terminal device in the server (that is, the identity identifier of the first terminal device and the identity identifier of the second terminal device are stored in the server), the server can determine the authority of the first terminal device according to the pairing relationship, and then send the seventh message to the first network device after the authority of the first terminal device is passed. The implementation of this application avoids the situation where any terminal device can access the network, and ensures the security of the first terminal device accessing the mobile communication network. Furthermore, by sending the pairing relationship to the second network device, the first terminal device or the second terminal device can quickly determine the authority of the first terminal device or the second terminal device when the first terminal device or the second terminal device needs to access the mobile communication network later, thereby improving the efficiency of the first terminal device or the second terminal device accessing the mobile communication network, and the security of the pairing of the first terminal device and the second terminal device.

[0380] For a vivid understanding of the embodiments of this application Figure 7 The method shown below will take the first terminal device as a drone, the second terminal device as a remote control, the first network device as a UTM, the second network device as an AMF, and the server as an AAA server as an example to more vividly illustrate the verification method of the terminal device provided in the embodiment of the present application.

[0381] See Figure 8 , Figure 8This is a flow chart of a terminal device verification method provided in an embodiment of the present application. Figure 8 The terminal device verification method shown can be roughly divided into two stages: the first stage is the configuration information stage, and the second stage is the pairing stage. In the first stage of the embodiment of the present application, the manufacturer or service provider pre-sets certificates for the drone and / or remote control. That is, the manufacturer or service provider can store the certificate issued for the drone in the drone device and the certificate issued for the remote control in the remote control device. For example, the drone's certificate may include the drone's public key, a list of public keys or IDs of paired drones and remote controls, and the manufacturer's or service provider's digital signature on the drone's certificate. At the same time, the manufacturer or service provider also needs to configure the AAA server's routing information for the drone and / or remote control. For example, the AAA server's routing information may include the AAA server's ID or address. The manufacturer or service provider then configures the AAA server's routing information into the network. For example, the AAA server's routing information can be configured into the UDM and / or UTM.

[0382] In other words, the AAA server stores the identities of the first terminal device and the second terminal device that have a pairing relationship, and the UDM and / or UTM stores the routing information of the AAA server.

[0383] like Figure 8 As shown, the verification method of the terminal device includes:

[0384] In one possible implementation, Figure 8 The method shown may include steps 801 to 803 .

[0385] 801. The drone sends a registration request to the network, such as the drone sends a registration request to the AMF through the access network device.

[0386] 802. Perform primary authentication between the drone and the network to establish a security context.

[0387] 803. The network sends a registration response message to the drone, such as the AMF sends a registration acceptance message to the drone.

[0388] For example, those skilled in the art can refer to relevant standards or protocol materials for the authentication process between the drone and the network. The specific implementation of steps 801 to 803 is not limited in this embodiment of the application.

[0389] 804. The UAV sends a sixth message to the AMF. The sixth message includes the routing information of the AAA server and the identity of the UAV. Accordingly, the AMF receives the sixth message sent by the UAV.

[0390] It is understandable that in the embodiment of the present application, there is no limitation on whether the sixth message includes the drone's certificate or token, etc.

[0391] 805. The AMF determines the corresponding AAA server according to the routing information of the AAA server.

[0392] 806. The AMF sends a sixth message to the determined AAA server. Correspondingly, the AAA server receives the sixth message.

[0393] In an embodiment of the present application, when the AMF sends the sixth message to the AAA server, the identity of the drone included in the sixth message may include the GPSI of the drone.

[0394] In one possible implementation, Figure 8 The illustrated method may further include step 807 .

[0395] 807. A bidirectional or unidirectional authentication (or authorization) process is performed between the AAA server and the drone.

[0396] Illustratively, the authentication process may adopt an authentication process based on the extensible authentication protocol (EAP), etc., which is not limited in the embodiments of the present application.

[0397] 808. The AAA server determines the authority of the drone based on the drone's identity. If the drone is authorized, the AAA server can determine the identity of the remote controller paired with the drone based on the drone's identity.

[0398] In other words, step 808 may be: the AAA server determines the authority of the drone and the identity of the remote controller paired with the drone according to the identity of the drone.

[0399] 809. The AAA server sends a seventh message to the UTM, where the seventh message includes the identities of the first terminal device and the second terminal device that are in a paired relationship. Correspondingly, the UTM receives the seventh message.

[0400] Optionally, the AAA server may send the seventh message directly to the UTM, or the AAA server may first send the seventh message to the AMF, and the AMF forwards the seventh message to the UTM.

[0401] 810. The UTM checks whether the remote controller context that is paired with the drone is stored in the UTM. If the remote controller context that is paired with the drone is stored in the UTM, the UTM pairs the drone with the remote controller. The pairing process of the drone and the remote controller is as follows: the UTM stores the drone's identity and other information in the remote controller context; the UTM stores the remote controller's identity and other information in the drone context.

[0402] If the UTM does not store the context of the remote controller paired with the drone, it waits for the remote controller to access the mobile communication network. After the remote controller accesses the mobile communication network, the UTM pairs the drone with the remote controller.

[0403] 811. The UTM sends an eighth message to the drone, where the eighth message includes third indication information, where the third indication information is used to indicate the pairing result between the drone and the remote controller. Accordingly, the drone receives the eighth message.

[0404] In one possible implementation, Figure 8 The illustrated method may further include:

[0405] The UTM sends a third message to the AMF, which includes the SUPI or GPSI of the paired drone and the SUPI or GPSI of the remote controller; accordingly, the AMF receives the third message.

[0406] The AMF stores the SUPI of the paired drone and the SUPI of the remote controller.

[0407] In one possible implementation, Figure 8 The illustrated method may further include:

[0408] The drone sends a fourth message to the AMF, which includes the identity of the drone and / or remote controller. Accordingly, the AMF receives the fourth message.

[0409] The AMF verifies the pairing relationship between the drone and the remote controller, and after the verification is successful, sends a fifth message to the drone, where the fifth message includes the second indication information.

[0410] It is understandable that the method shown above is Figure 8 For a detailed description of the above method, please refer to Figure 3-Figure 7 The method shown will not be described in detail here.

[0411] Understandable, Figure 8 The method shown is described using a drone as an example, and the embodiments of the present application are also applicable to remote controllers.

[0412] Understandably, for Figure 8For detailed instructions on the verification method of the terminal device shown, please refer to Figure 3-Figure 7 The method shown will not be described in detail here.

[0413] Optionally, in each of the above embodiments, when a network element or network function deployed or affiliated with a network performs relevant steps based on the identity of a terminal device, the identity of the terminal device may be its identity within the network. When a device or apparatus deployed outside the network or affiliated with a drone system performs relevant steps based on the identity of a terminal device, the identity of the terminal device may be its identity within the drone system. The terminal devices include a first terminal device and a second terminal device. Alternatively, the relevant network element or network function may not distinguish between identities within the drone system or network.

[0414] It is understood that each of the above embodiments has its own focus. For implementation methods not described in detail in one embodiment, reference can be made to other embodiments, and no further description is given here. Furthermore, the various embodiments described herein may be independent solutions or combined according to internal logic, and all of these solutions fall within the scope of protection of this application.

[0415] The above describes the embodiments of the present application in detail. The following describes a communication device applicable to the verification method of the terminal device provided by the present application.

[0416] Figure 9 is a schematic diagram of the structure of a communication device provided in an embodiment of the present application, which can be used to perform the operations performed by the first network device in the above method embodiment. For example, the communication device can be used to perform Figure 3-Figure 8 The operations performed by the first network device or UTM in the method embodiment shown. Figure 9 As shown, the communication device includes a transceiver unit 901 and a processing unit 902.

[0417] The transceiver unit 901 is configured to receive a first message from a first terminal device; wherein the first message includes an identity identifier of the first terminal device and / or an identity identifier of a second terminal device paired with the first terminal device;

[0418] A processing unit 902 is configured to verify a pairing relationship between the first terminal device and the second terminal device according to an identity identifier of the first terminal device and / or an identity identifier of the second terminal device;

[0419] The transceiver unit 901 is used to send a second message to the first terminal device after the pairing relationship between the first terminal device and the second terminal device is verified; wherein the second message includes first indication information, and the first indication information is used to indicate the pairing result of the first terminal device and the second terminal device.

[0420] In a possible implementation, the processing unit 902 is further configured to store the identity of the first terminal device and the identity of the second terminal device.

[0421] In a possible implementation, the processing unit 902 is further configured to store the identity of the second terminal device in the context of the first terminal device; and store the identity of the first terminal device in the context of the second terminal device.

[0422] In one possible implementation, the transceiver unit 901 is used to send a third message to the second network device; wherein the third message includes the identity of the first terminal device and the identity of the second terminal device, and the identity of the first terminal device and the identity of the second terminal device are used to indicate that the first terminal device and the second terminal device have a pairing relationship.

[0423] For example, the transceiver unit 901 can also be used to perform Figure 4 Step 405 (perform a receiving operation), step 409 (perform a sending operation) or step 411 (perform a sending operation) in the embodiment of the present invention. For another example, the transceiver unit 901 can also be used to perform Figure 5 Step 505, step 508 or step 510 etc. In another example, the transceiver unit 901 can also be used to perform Figure 6 Step 605 and / or step 608 in the embodiment. For another example, the transceiver unit 901 can also be used to perform Figure 7 Step 703 and / or step 705 in the embodiment. For another example, the transceiver unit 901 can also be used to perform Figure 8 Step 809 and / or step 811 in the embodiment. For example, the processing unit 902 may be configured to execute Figure 4 Steps 406 to 408 in FIG. 406 and ... Figure 5 Step 506 and / or step 507 in the above embodiment. For another example, the processing unit 902 can also be used to execute Figure 6 Step 606 and / or step 607 in the above embodiment. For another example, the processing unit 902 can also be used to execute Figure 7 Step 704 in the above example. For another example, the processing unit 902 can also be used to execute Figure 8 Step 810 etc.

[0424] It is understood that the methods performed by the above-mentioned units are only examples. For the specific steps performed by the units, please refer to Figure 3-Figure 8 The method shown.

[0425] It should be understood that when the above-mentioned communication device is the first network device or a component in the first network device that implements the above-mentioned functions, the processing unit 902 can be one or more processors, the transceiver unit 901 can be a transceiver, or the transceiver unit 901 can also be a sending unit and a receiving unit, the sending unit can be a transmitter, the receiving unit can be a receiver, and the sending unit and the receiving unit are integrated into one device, such as a transceiver.

[0426] When the communication device is a chip, the processing unit 902 may be one or more processors, and the transceiver unit 901 may be an input / output interface, or a communication interface, or an interface circuit, or an interface, etc. Alternatively, the transceiver unit 901 may be a transmitting unit and a receiving unit, where the transmitting unit may be an output interface and the receiving unit may be an input interface, and the transmitting unit and the receiving unit may be integrated into one unit, such as an input / output interface.

[0427] The communication device of the embodiment of the present application can execute any function performed by the first network device in the above method embodiment. The specific executable steps and / or functions can be referred to the detailed description in the above method embodiment. Only a brief overview is given here and no further details are given.

[0428] Reuse Figure 9 , Figure 9 This is a schematic diagram of the structure of a communication device provided in an embodiment of the present application. The communication device can be used to perform the operations performed by the second network device in the above method embodiment. For example, the communication device can be used to perform Figure 3-Figure 8 The operations performed by the second network device or AMF in the method embodiment shown. Figure 9 As shown, the communication device includes a transceiver unit 901 and a processing unit 902.

[0429] The transceiver unit 901 is configured to receive a fourth message from the first terminal device; wherein the fourth message includes an identity identifier of the first terminal device and / or an identity identifier of a second terminal device paired with the first terminal device;

[0430] A processing unit 902 is configured to verify the pairing relationship between the first terminal device and the second terminal device;

[0431] The transceiver unit 901 is used to send a fifth message to the first terminal device after the pairing relationship between the first terminal device and the second terminal device is verified; wherein the fifth message includes second indication information, and the second indication information is used to indicate the pairing result of the first terminal device and the second terminal device.

[0432] In one possible implementation, the transceiver unit 901 is also used to receive a third message sent by the first network device; wherein the third message includes the identity of the first terminal device and the identity of the second terminal device, and the identity of the first terminal device and the identity of the second terminal device are used to indicate that the first terminal device and the second terminal device have a pairing relationship.

[0433] For example, the transceiver unit 901 can also be used to perform Figure 4 Step 401 (perform a receiving operation), step 403 (perform a sending operation), step 404 (perform a receiving operation), step 405 (perform a sending operation) or step 409 (perform a receiving operation) in the embodiment of the present invention. For another example, the transceiver unit 901 can also be used to perform Figure 5 Step 501, step 503-step 505 or step 508 etc. In another example, the transceiver unit 901 can also be used to perform Figure 6 Step 601, step 603-step 605, etc. For another example, the transceiver unit 901 can also be used to perform Figure 7 Step 706, step 707 or step 709 in the above embodiment. For another example, the transceiver unit 901 can also be used to perform Figure 8 Step 801, step 803, step 804 or step 806, etc. in the embodiment. For example, the processing unit 902 can be used to perform Figure 4 Step 410 in the above example. For another example, the processing unit 902 can also be used to execute Figure 5 Step 509 in the above example. For another example, the processing unit 902 can also be used to execute Figure 7 Step 709 in the above example. For another example, the processing unit 902 can also be used to execute Figure 8 Step 805 etc.

[0434] It is understandable that the processing unit 902 and / or the transceiver unit 901 can also execute the steps of performing primary authentication between the drone and the network and establishing a security context.

[0435] It is understood that the specific implementation of the transceiver unit 901 and the processing unit 902 can be referred to Figure 3-Figure 8 The method shown.

[0436] It should be understood that when the above-mentioned communication device is a second network device or a component in the second network device that implements the above-mentioned functions, the processing unit 902 can be one or more processors, the transceiver unit 901 can be a transceiver, or the transceiver unit 901 can also be a sending unit and a receiving unit, the sending unit can be a transmitter, the receiving unit can be a receiver, and the sending unit and the receiving unit are integrated into one device, such as a transceiver.

[0437] When the communication device is a chip, the processing unit 902 may be one or more processors, and the transceiver unit 901 may be an input / output interface, or a communication interface, or an interface circuit, or an interface, etc. Alternatively, the transceiver unit 901 may be a transmitting unit and a receiving unit, where the transmitting unit may be an output interface and the receiving unit may be an input interface, and the transmitting unit and the receiving unit may be integrated into one unit, such as an input / output interface.

[0438] The communication device of the embodiment of the present application can execute any function performed by the second network device in the above method embodiment. The specific executable steps and / or functions can refer to the detailed description in the above method embodiment. Only a brief overview is given here and no further details are given.

[0439] Reuse Figure 9 , Figure 9 This is a schematic diagram of the structure of a communication device provided in an embodiment of the present application. The communication device can be used to perform the operations performed by the server in the above method embodiment. For example, the communication device can be used to perform Figure 7-Figure 8 The operations performed by the server or AAA server in the method embodiment shown. Figure 9 As shown, the communication device includes a transceiver unit 901 and a processing unit 902.

[0440] The transceiver unit 901 is configured to receive a sixth message; wherein the sixth message includes a first identity identifier and a second identity identifier of a first terminal device;

[0441] A processing unit 902 is configured to determine the authority of the first terminal device according to the first identity identifier of the first terminal device;

[0442] The transceiver unit 901 is also used to send a seventh message to the first network device when the authority of the first terminal device is approved; wherein the seventh message includes the second identity identifier of the first terminal device and the third identity identifier of the second terminal device paired with the first terminal device; or, the seventh message includes the first identity identifier of the first terminal device and the fourth identity identifier of the second terminal device paired with the first terminal device.

[0443] In a possible implementation, the processing unit 902 is further configured to authenticate the first terminal device according to the first identity identifier of the first terminal device.

[0444] In a possible implementation, the server stores the second identity of the first terminal device and the third identity of the second terminal device that have a pairing relationship; or the server stores the first identity of the first terminal device and the fourth identity of the second terminal device that have a pairing relationship.

[0445] In one possible implementation, the processing unit 902 is further used to obtain the fourth identity of the second terminal device paired with the first terminal device based on the first identity of the first terminal device; or to obtain the third identity of the second terminal device paired with the first terminal device based on the second identity of the first terminal device.

[0446] For example, the transceiver unit 901 can also be used to perform Figure 8 Step 806 (perform receiving operation) and / or step 809 (perform sending operation) in the process.

[0447] For example, the processing unit 902 may also be used to execute Figure 8 Step 807 and / or step 808, etc.

[0448] It is understood that the specific implementation of the transceiver unit 901 and the processing unit 902 can be referred to Figure 7-Figure 8 The method shown.

[0449] It should be understood that when the above-mentioned communication device is a server or a component in the server that implements the above-mentioned functions, the processing unit 902 can be one or more processors, the transceiver unit 901 can be a transceiver, or the transceiver unit 901 can also be a sending unit and a receiving unit, the sending unit can be a transmitter, the receiving unit can be a receiver, and the sending unit and the receiving unit are integrated into one device, such as a transceiver.

[0450] When the communication device is a chip, the processing unit 902 may be one or more processors, and the transceiver unit 901 may be an input / output interface, or a communication interface, or an interface circuit, or an interface, etc. Alternatively, the transceiver unit 901 may be a transmitting unit and a receiving unit, where the transmitting unit may be an output interface and the receiving unit may be an input interface, and the transmitting unit and the receiving unit may be integrated into one unit, such as an input / output interface.

[0451] The communication device of the embodiment of the present application can execute any function performed by the server in the above method embodiment. The specific executable steps and / or functions can refer to the detailed description in the above method embodiment. Only a brief overview is given here and no further details are given.

[0452] In a possible implementation, the communication device may be the first network device in each of the above method embodiments. In this case, the processing unit 902 may be implemented by a processor, and the transceiver unit 901 may be implemented by a transceiver. Figure 10 As shown, the communication device 100 includes one or more processors 1020 and a transceiver 1010. The processor and transceiver can be used to perform the functions or operations performed by the first network device.

[0453] For example, a processor may be used to execute Figure 3 The transceiver can be used to perform the operation of step 302. Figure 3 The operations shown in step 301, step 303 or step 304 in .

[0454] For example, the processor can be used to execute Figure 4 The transceiver can also be used to perform steps 406-408 in the embodiment of the present invention. Figure 4 Step 405 (perform a receiving operation), step 409 (perform a sending operation) or step 411 (perform a sending operation) in the process.

[0455] For example, the processor can be used to execute Figure 5 The transceiver can be used to perform steps 506 and / or 507 in the embodiment. Figure 5 Step 505, step 508 or step 510, etc.

[0456] For example, the processor can be used to execute Figure 6 The transceiver can be used to perform steps 606 and / or 607 in the embodiment. Figure 6 Step 605 and / or step 608, etc.

[0457] For example, the processor can be used to execute Figure 7 The transceiver can be used to perform step 704 in the embodiment of the present invention. Figure 7 Step 703 and / or step 705, etc.

[0458] For example, the processor can be used to execute Figure 8 The transceiver can be used to perform step 810, etc. Figure 8 Step 809 and / or step 811, etc.

[0459] In a possible implementation, the communication device may be the second network device in each of the above method embodiments. In this case, the processing unit 902 may be implemented by a processor, and the transceiver unit 901 may be implemented by a transceiver. Figure 10 As shown, the communication device 100 includes one or more processors 1020 and a transceiver 1010. The processor and transceiver can be used to perform the functions or operations performed by the second network device.

[0460] For example, a processor may be used to execute Figure 3 The transceiver can be used to perform step 306, etc. Figure 3 Step 304, step 305 or step 307, etc.

[0461] For example, the processor can be used to execute Figure 4 The transceiver can be used to perform step 410, etc. Figure 4 Step 401 (perform a receiving operation), step 403 (perform a sending operation), step 404 (perform a receiving operation), step 405 (perform a sending operation) or step 409 (perform a receiving operation), etc.

[0462] For example, the processor can be used to execute Figure 5 The transceiver can be used to perform step 509, etc. Figure 5 Step 501, step 503-step 505 or step 508, etc.

[0463] For another example, the transceiver can be used to perform Figure 6 Step 601, step 603-step 605, etc.

[0464] For example, the processor can be used to execute Figure 7 Step 709 in the embodiment. The transceiver can be used to perform Figure 7 Step 706, step 707 or step 709, etc.

[0465] For example, the processor can be used to execute Figure 8 The transceiver can be used to perform step 805, etc. Figure 8 Step 801, step 803, step 804 or step 806, etc.

[0466] In a possible implementation, the communication device may be a server in each of the above method embodiments. In this case, the processing unit 902 may be implemented by a processor, and the transceiver unit 901 may be implemented by a transceiver. Figure 10 As shown, the communication device 100 includes one or more processors 1020 and a transceiver 1010. The processor and transceiver can be used to perform the functions or operations performed by the above-mentioned server.

[0467] For example, a processor may be used to execute Figure 7 The transceiver can be used to perform step 702, etc. Figure 7 Step 701, step 703 or step 705, etc.

[0468] For example, the processor can also be used to execute Figure 8 The transceiver can be used to perform steps 807 and 808 in the embodiment of the present invention. Figure 8 806 and / or step 809, etc.

[0469] exist Figure 10In various implementations of the communication device shown, the transceiver may include a receiver and a transmitter, wherein the receiver is configured to perform a receiving function (or operation) and the transmitter is configured to perform a transmitting function (or operation). The transceiver is configured to communicate with other devices / devices via a transmission medium. The processor 1020 utilizes the transceiver 1010 to transmit and receive data and / or signaling, and is configured to implement the above method embodiments. Figure 3-Figure 8 The corresponding method described.

[0470] Optionally, the communication device 100 may further include at least one memory 1030 for storing program instructions and / or data. The memory 1030 is coupled to the processor 1020. Coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units, or modules, which may be electrical, mechanical, or other forms, and is used for information exchange between devices, units, or modules. The processor 1020 may operate in conjunction with the memory 1030. The processor 1020 may execute program instructions stored in the memory 1030. At least one of the at least one memory may be included in the processor.

[0471] The specific connection medium between the transceiver 1010, the processor 1020 and the memory 1030 is not limited in the embodiment of the present application. Figure 10 The memory 1030, the processor 1020 and the transceiver 1010 are connected via a bus 1040. Figure 10 The connections between the other components are shown in bold lines, which are only for illustration and are not intended to be limiting. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, Figure 10 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0472] In the embodiments of the present application, the processor may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc., and may implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of the present application may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor, etc.

[0473] In another possible implementation, the communication device may be a circuit system in the first network device. In this case, the processing unit 902 may be implemented as a processing circuit, and the transceiver unit 901 may be implemented as an interface circuit. Figure 11As shown, the communication device may include a processing circuit 1101 and an interface circuit 1102. The processing circuit 1101 may be a chip, a logic circuit, an integrated circuit, a processing circuit, or a system on chip (SoC) chip, etc. The transceiver circuit 1102 may be a communication interface, and the communication interface may be an interface circuit, an input / output interface, etc.

[0474] For example, the interface circuit can be used to obtain the first message. The processing circuit can be used to verify the pairing relationship between the first terminal device and the second terminal device. The interface circuit can also be used to output the second message.

[0475] For another example, the interface circuit may also output a second message and / or a third message, etc. Furthermore, the processing circuit may be used to perform a pairing process and store the drone's certificate, etc. Optionally, the processing circuit may be used to control the memory to store the drone's certificate.

[0476] For another example, the interface circuit may also obtain a seventh message and output an eighth message, and so on.

[0477] It is understood that for the specific implementation of the processing circuit and the interface circuit, please refer to Figure 3-Figure 8 The method embodiment shown will not be described in detail here.

[0478] In another possible implementation, the communication device may be a circuit system in the second network device. In this case, the processing unit 902 may be implemented as a processing circuit, and the transceiver unit 901 may be implemented as an interface circuit. Figure 11 As shown, the communication device may include a processing circuit 1101 and an interface circuit 1102. The processing circuit 1101 may be a chip, a logic circuit, an integrated circuit, a processing circuit, or a system on chip (SoC) chip, etc. The transceiver circuit 1102 may be a communication interface, and the communication interface may be an interface circuit, an input / output interface, etc.

[0479] For example, the interface circuit can be used to obtain the third message and / or the fourth message, etc. The processing circuit can be used to verify the pairing relationship between the first terminal device and the second terminal device. And the interface circuit can also be used to output the fifth message, etc.

[0480] For another example, the interface circuit can also receive a registration request and output a registration response message. For another example, the processing circuit can also be used to store the SUPI of a paired drone and the SUPI of a remote controller. Optionally, the processing circuit can be used to control the memory to store the SUPI of a paired drone and the SUPI of a remote controller.

[0481] For another example, the processing circuit may be further configured to determine the AAA server according to the routing information of the AAA server, etc. The interface circuit may also obtain the sixth message and / or output the sixth message, etc.

[0482] It is understood that for the specific implementation of the processing circuit and the interface circuit, please refer to Figure 3-Figure 8 The method embodiment shown will not be described in detail here.

[0483] In another possible implementation, the communication device may be a circuit system in a server. In this case, the processing unit 902 may be implemented as a processing circuit, and the transceiver unit 901 may be implemented as an interface circuit. Figure 11 As shown, the communication device may include a processing circuit 1101 and an interface circuit 1102. The processing circuit 1101 may be a chip, a logic circuit, an integrated circuit, a processing circuit, or a system on chip (SoC) chip, etc. The transceiver circuit 1102 may be a communication interface, and the communication interface may be an interface circuit, an input / output interface, etc.

[0484] For example, the processing circuit may be configured to determine the authority of the first terminal device according to the first identity identifier of the first terminal device, etc. The interface circuit may be configured to output the seventh message, etc.

[0485] For another example, the processing circuit may also execute a bidirectional or unidirectional authentication process. Optionally, the processing circuit may also control the interface circuit to execute a bidirectional or unidirectional authentication process.

[0486] It is understood that for the specific implementation of the processing circuit and the interface circuit, please refer to Figure 3-Figure 8 The method embodiment shown will not be described in detail here.

[0487] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or can be electrical, mechanical or other forms of connection.

[0488] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the technical effects of the solutions provided in the embodiments of the present application.

[0489] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0490] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a readable storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned readable storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and other media that can store program code.

[0491] In addition, the present application also provides a computer program, which is used to implement the operations and / or processing performed by the first network device in the terminal device verification method provided in the present application.

[0492] The present application also provides a computer program, which is used to implement the operations and / or processing performed by the second network device in the terminal device verification method provided by the present application.

[0493] The present application also provides a computer program, which is used to implement the operations and / or processing performed by the server in the terminal device verification method provided by the present application.

[0494] The present application also provides a computer-readable storage medium, which stores computer code. When the computer code runs on a computer, the computer executes the operations and / or processing performed by the first network device in the terminal device verification method provided by the present application.

[0495] The present application also provides a computer-readable storage medium, which stores computer code. When the computer code runs on a computer, it enables the computer to execute the operations and / or processing performed by the second network device in the terminal device verification method provided by the present application.

[0496] The present application also provides a computer-readable storage medium having computer code stored therein. When the computer code runs on a computer, the computer executes the operations and / or processing performed by the server in the terminal device verification method provided in the present application.

[0497] The present application also provides a computer program product, which includes computer code or computer program. When the computer code or computer program runs on a computer, the operations and / or processing performed by the first network device in the terminal device verification method provided by the present application are implemented.

[0498] The present application also provides a computer program product, which includes computer code or computer program. When the computer code or computer program runs on a computer, the operations and / or processing performed by the second network device in the terminal device verification method provided by the present application are implemented.

[0499] The present application also provides a computer program product, which includes computer code or computer program. When the computer code or computer program is run on a computer, the operations and / or processing performed by the server in the terminal device verification method provided by the present application are implemented.

[0500] The present application also provides a wireless communication system, comprising the first terminal device and the first network device in the embodiments of the present application. Optionally, the wireless communication system further comprises the second network device in the embodiments of the present application. Optionally, the wireless communication system further comprises the server in the embodiments of the present application.

[0501] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A terminal device verification method, characterized in that: The method comprises: The first network device receives a first message from the first terminal device; wherein the first message includes an identity of the first terminal device in the mobile communication network, an identity of the first terminal device in the drone system, and an identity of a second terminal device paired with the first terminal device; The first network device verifies a pairing relationship between the first terminal device and the second terminal device based on an identity identifier of the first terminal device in the drone system and an identity identifier of the second terminal device, wherein the verification of the pairing relationship is used to authorize the second terminal device to control the first terminal device via the mobile communication network, where the first terminal device is a drone and the second terminal device is a remote controller, or the verification of the pairing relationship is used to authorize the first terminal device to control the second terminal device via the mobile communication network, where the first terminal device is a remote controller and the second terminal device is a drone; After the pairing relationship between the first terminal device and the second terminal device is verified, the first network device sends a second message to the first terminal device; wherein the second message includes first indication information, and the first indication information is used to indicate the pairing result of the first terminal device and the second terminal device.

2. The method according to claim 1, characterized in that The first message also includes a digital signature of the pairing relationship between the first terminal device and the second terminal device; The first network device verifies the pairing relationship between the first terminal device and the second terminal device according to the identity identifier of the first terminal device and the identity identifier of the second terminal device, including: The first network device verifies the digital signature according to the identity identifier of the first terminal device, the identity identifier of the second terminal device, and a first public key, where the first public key is a public key pre-stored in the first network device.

3. The method according to claim 2, characterized in that The first message also includes an identifier of the first public key, where the identifier of the first public key is used to identify the first public key.

4. The method according to any one of claims 1 to 3, characterized in that The first message includes the credentials of the first terminal device, and the pairing relationship between the first terminal device and the second terminal device is included in the credentials of the first terminal device; or, The first message includes the credentials of the first terminal device and the credentials of the second terminal device, and the credentials of the first terminal device and the credentials of the second terminal device are used to indicate a pairing relationship between the first terminal device and the second terminal device; or The first message includes the credentials of the first terminal device or the credentials of the second terminal device, and the credentials of the first terminal device and the credentials of the second terminal device have partially the same content; or The first message includes an identifier of the credentials of the first terminal device or an identifier of the credentials of the second terminal device, and the identifier of the credentials of the first terminal device is the same as the identifier of the credentials of the second terminal device; or The first message includes an identifier of the credentials of the first terminal device and an identifier of the credentials of the second terminal device, and the identifier of the credentials of the first terminal device and the identifier of the credentials of the second terminal device are used to indicate a pairing relationship between the first terminal device and the second terminal device.

5. The method according to claim 4, characterized in that The credentials include: any one or more of a certificate, a public key or a token.

6. The method according to any one of claims 1 to 3, characterized in that After the pairing relationship between the first terminal device and the second terminal device is verified, the method further includes: The first network device stores the identity of the first terminal device and the identity of the second terminal device.

7. The method according to claim 6, characterized in that The first network device storing the identity of the first terminal device and the identity of the second terminal device includes: The first network device stores the identity of the second terminal device in the context of the first terminal device; The first network device stores the identity of the first terminal device in the context of the second terminal device.

8. The method according to any one of claims 1 to 3, characterized in that After the pairing relationship between the first terminal device and the second terminal device is verified, the method further includes: The first network device sends a third message to the second network device; wherein the third message includes the identity of the first terminal device and the identity of the second terminal device, and the identity of the first terminal device and the identity of the second terminal device are used to indicate that the first terminal device and the second terminal device have a pairing relationship.

9. A terminal device verification method, characterized in that: The method comprises: The second network device receives a fourth message from the first terminal device; wherein the fourth message includes an identity of the first terminal device in the mobile communication network, an identity of the first terminal device in the drone system, and an identity of a second terminal device paired with the first terminal device; The second network device verifies a pairing relationship between the first terminal device and the second terminal device, where the verification of the pairing relationship is used to authorize the second terminal device to control the first terminal device via the mobile communication network, where the first terminal device is a drone and the second terminal device is a remote controller; or the verification of the pairing relationship is used to authorize the first terminal device to control the second terminal device via the mobile communication network, where the first terminal device is a remote controller and the second terminal device is a drone; After the pairing relationship between the first terminal device and the second terminal device is verified, the second network device sends a fifth message to the first terminal device; wherein the fifth message includes second indication information, and the second indication information is used to indicate the pairing result of the first terminal device and the second terminal device.

10. The method according to claim 9, characterized in that Before the second network device verifies the pairing relationship between the first terminal device and the second terminal device, the method further includes: The second network device receives a third message sent by the first network device; wherein the third message includes the identity of the first terminal device and the identity of the second terminal device, and the identity of the first terminal device and the identity of the second terminal device are used to indicate that the first terminal device and the second terminal device have a pairing relationship.

11. A communication device, characterized in that: The device comprises: A transceiver unit, configured to receive a first message from a first terminal device; wherein the first message includes an identity of the first terminal device in the mobile communication network, an identity of the first terminal device in the drone system, and an identity of a second terminal device paired with the first terminal device; a processing unit, configured to verify a pairing relationship between the first terminal device and the second terminal device based on an identity identifier of the first terminal device in the drone system and an identity identifier of the second terminal device, wherein the verification of the pairing relationship is used to authorize the second terminal device to control the first terminal device via the mobile communication network, where the first terminal device is a drone and the second terminal device is a remote controller, or the verification of the pairing relationship is used to authorize the first terminal device to control the second terminal device via the mobile communication network, where the first terminal device is a remote controller and the second terminal device is a drone; The transceiver unit is used to send a second message to the first terminal device after the pairing relationship between the first terminal device and the second terminal device is verified; wherein the second message includes first indication information, and the first indication information is used to indicate the pairing result of the first terminal device and the second terminal device.

12. The device according to claim 11, characterized in that The first message also includes a digital signature of the pairing relationship between the first terminal device and the second terminal device; The processing unit is specifically configured to verify the digital signature based on the identity identifier of the first terminal device, the identity identifier of the second terminal device, and a first public key, where the first public key is a public key pre-stored in the communication device.

13. The device according to claim 12, characterized in that The first message also includes an identifier of the first public key, where the identifier of the first public key is used to identify the first public key.

14. The device according to any one of claims 11 to 13, characterized in that The first message includes the credentials of the first terminal device, and the pairing relationship between the first terminal device and the second terminal device is included in the credentials of the first terminal device; or, The first message includes the credentials of the first terminal device and the credentials of the second terminal device, and the credentials of the first terminal device and the credentials of the second terminal device are used to indicate a pairing relationship between the first terminal device and the second terminal device; or The first message includes the credentials of the first terminal device or the credentials of the second terminal device, and the credentials of the first terminal device and the credentials of the second terminal device have partially the same content; or The first message includes an identifier of the credentials of the first terminal device or an identifier of the credentials of the second terminal device, and the identifier of the credentials of the first terminal device is the same as the identifier of the credentials of the second terminal device; or The first message includes an identifier of the credentials of the first terminal device and an identifier of the credentials of the second terminal device, and the identifier of the credentials of the first terminal device and the identifier of the credentials of the second terminal device are used to indicate a pairing relationship between the first terminal device and the second terminal device.

15. The device according to claim 14, characterized in that The credentials include: any one or more of a certificate, a public key or a token.

16. The device according to any one of claims 11 to 13, characterized in that The processing unit is further configured to store the identity of the first terminal device and the identity of the second terminal device.

17. The device according to claim 16, characterized in that The processing unit is further configured to store the identity of the second terminal device in the context of the first terminal device; and store the identity of the first terminal device in the context of the second terminal device.

18. The device according to any one of claims 11 to 13, characterized in that The transceiver unit is used to send a third message to the second network device; wherein the third message includes the identity of the first terminal device and the identity of the second terminal device, and the identity of the first terminal device and the identity of the second terminal device are used to indicate that the first terminal device and the second terminal device have a pairing relationship.

19. A communication device, characterized in that: The device comprises: a transceiver unit, configured to receive a fourth message from the first terminal device; wherein the fourth message includes an identity of the first terminal device in the mobile communication network, an identity of the first terminal device in the drone system, and an identity of a second terminal device paired with the first terminal device; a processing unit, configured to verify a pairing relationship between the first terminal device and the second terminal device, wherein the verification of the pairing relationship is used to authorize the second terminal device to control the first terminal device via the mobile communication network, where the first terminal device is a drone and the second terminal device is a remote controller, or wherein the verification of the pairing relationship is used to authorize the first terminal device to control the second terminal device via the mobile communication network, where the first terminal device is a remote controller and the second terminal device is a drone; The transceiver unit is used to send a fifth message to the first terminal device after the pairing relationship between the first terminal device and the second terminal device is verified; wherein the fifth message includes second indication information, and the second indication information is used to indicate the pairing result of the first terminal device and the second terminal device.

20. The device according to claim 19, characterized in that The transceiver unit is also used to receive a third message sent by the first network device; wherein the third message includes the identity of the first terminal device and the identity of the second terminal device, and the identity of the first terminal device and the identity of the second terminal device are used to indicate that the first terminal device and the second terminal device have a pairing relationship.

21. A communication device, characterized in that: The device comprises: An interface circuit configured to obtain a first message; wherein the first message includes an identity of the first terminal device in the mobile communication network, an identity of the first terminal device in the drone system, and an identity of a second terminal device paired with the first terminal device; a processing circuit, configured to verify a pairing relationship between the first terminal device and the second terminal device based on an identity identifier of the first terminal device in the drone system and an identity identifier of the second terminal device, wherein the verification of the pairing relationship is used to authorize the second terminal device to control the first terminal device via the mobile communication network, where the first terminal device is a drone and the second terminal device is a remote controller, or the verification of the pairing relationship is used to authorize the first terminal device to control the second terminal device via the mobile communication network, where the first terminal device is a remote controller and the second terminal device is a drone; The interface circuit is further used to output a second message after the pairing relationship between the first terminal device and the second terminal device is verified; wherein the second message includes first indication information, and the first indication information is used to indicate the pairing result of the first terminal device and the second terminal device.

22. The device according to claim 21, characterized in that The first message also includes a digital signature of the pairing relationship between the first terminal device and the second terminal device; The processing circuit is specifically used to verify the digital signature according to the identity identifier of the first terminal device, the identity identifier of the second terminal device and a first public key, where the first public key is a public key pre-stored in the communication device.

23. The device according to claim 22, characterized in that The first message also includes an identifier of the first public key, where the identifier of the first public key is used to identify the first public key.

24. The device according to any one of claims 21 to 23, characterized in that The first message includes the credentials of the first terminal device, and the pairing relationship between the first terminal device and the second terminal device is included in the credentials of the first terminal device; or, The first message includes the credentials of the first terminal device and the credentials of the second terminal device, and the credentials of the first terminal device and the credentials of the second terminal device are used to indicate a pairing relationship between the first terminal device and the second terminal device; or The first message includes the credentials of the first terminal device or the credentials of the second terminal device, and the credentials of the first terminal device and the credentials of the second terminal device have partially the same content; or The first message includes an identifier of the credentials of the first terminal device or an identifier of the credentials of the second terminal device, and the identifier of the credentials of the first terminal device is the same as the identifier of the credentials of the second terminal device; or The first message includes an identifier of the credentials of the first terminal device and an identifier of the credentials of the second terminal device, and the identifier of the credentials of the first terminal device and the identifier of the credentials of the second terminal device are used to indicate a pairing relationship between the first terminal device and the second terminal device.

25. The device according to claim 24, characterized in that The credentials include: any one or more of a certificate, a public key or a token.

26. The device according to any one of claims 21 to 23, characterized in that The processing circuit is further configured to store the identity of the first terminal device and the identity of the second terminal device.

27. The device according to any one of claims 21 to 23, characterized in that The processing circuit is further configured to store the identity of the second terminal device in the context of the first terminal device; and store the identity of the first terminal device in the context of the second terminal device.

28. The device according to claim 27, characterized in that The interface circuit is also used to output a third message; wherein the third message includes the identity of the first terminal device and the identity of the second terminal device, and the identity of the first terminal device and the identity of the second terminal device are used to indicate that the first terminal device and the second terminal device have a pairing relationship.

29. A communication device, characterized in that: The device comprises: An interface circuit configured to obtain a fourth message; wherein the fourth message includes an identity of the first terminal device in the mobile communication network, an identity of the first terminal device in the drone system, and an identity of a second terminal device paired with the first terminal device; a processing circuit, configured to verify a pairing relationship between the first terminal device and the second terminal device, wherein the verification of the pairing relationship is used to authorize the second terminal device to control the first terminal device via the mobile communication network, where the first terminal device is a drone and the second terminal device is a remote controller; or wherein the verification of the pairing relationship is used to authorize the first terminal device to control the second terminal device via the mobile communication network, where the first terminal device is a remote controller and the second terminal device is a drone; The interface circuit is further configured to output a fifth message; wherein the fifth message includes second indication information, and the second indication information is configured to indicate a pairing result between the first terminal device and the second terminal device.

30. The device according to claim 29, characterized in that The interface circuit is also used to obtain a third message; wherein the third message includes the identity of the first terminal device and the identity of the second terminal device, and the identity of the first terminal device and the identity of the second terminal device are used to indicate that the first terminal device and the second terminal device have a pairing relationship.

31. A communication device, characterized in that: include: The processor is configured to execute a program stored in the memory, and when the program is executed, the apparatus executes the method according to any one of claims 1 to 10.

32. The device according to claim 31, characterized in that The memory is located external to the device.

33. A communication device, characterized in that: include: A processor, a memory, and a program stored in the memory and executable on the processor, which enables the communication device to execute the method according to any one of claims 1 to 10 when the program is executed.

34. A computer-readable storage medium, characterized in that The method comprises a computer program, and when the computer program is run on a computer, the method according to any one of claims 1 to 10 is executed.

35. A computer program product, characterized in that The computer program product comprises a computer program or a computer code, and when the computer program or the computer code is run on a computer, the method according to any one of claims 1 to 10 is performed.

36. A terminal device verification method, characterized in that: The method comprises: The first terminal device sends a first message to the first network device, wherein the first message includes an identity of the first terminal device in the mobile communication network, an identity of the first terminal device in the drone system, and an identity of a second terminal device paired with the first terminal device; The first network device receives the first message from the first terminal device; The first network device verifies a pairing relationship between the first terminal device and the second terminal device based on an identity identifier of the first terminal device in the drone system and an identity identifier of the second terminal device, wherein the verification of the pairing relationship is used to authorize the second terminal device to control the first terminal device via the mobile communication network, where the first terminal device is a drone and the second terminal device is a remote controller, or the verification of the pairing relationship is used to authorize the first terminal device to control the second terminal device via the mobile communication network, where the first terminal device is a remote controller and the second terminal device is a drone; After the pairing relationship between the first terminal device and the second terminal device is verified, the first network device sends a second message to the first terminal device; wherein the second message includes first indication information, and the first indication information is used to indicate the pairing result of the first terminal device and the second terminal device; The first terminal device receives the second message from the first network device.

37. The method according to claim 36, wherein The first message also includes a digital signature of the pairing relationship between the first terminal device and the second terminal device; The first network device verifies the pairing relationship between the first terminal device and the second terminal device according to the identity identifier of the first terminal device and the identity identifier of the second terminal device, including: The first network device verifies the digital signature according to the identity identifier of the first terminal device, the identity identifier of the second terminal device, and a first public key, where the first public key is a public key pre-stored in the first network device.

38. The method according to claim 36, wherein The first message also includes an identifier of the first public key, where the identifier of the first public key is used to identify the first public key.

39. The method according to claim 36 or 37, characterized in that The first message includes the credentials of the first terminal device, and the pairing relationship between the first terminal device and the second terminal device is included in the credentials of the first terminal device; or, The first message includes the credentials of the first terminal device and the credentials of the second terminal device, and the credentials of the first terminal device and the credentials of the second terminal device are used to indicate a pairing relationship between the first terminal device and the second terminal device; or The first message includes the credentials of the first terminal device or the credentials of the second terminal device, and the credentials of the first terminal device and the credentials of the second terminal device have partially the same content; or The first message includes an identifier of the credentials of the first terminal device or an identifier of the credentials of the second terminal device, and the identifier of the credentials of the first terminal device is the same as the identifier of the credentials of the second terminal device; or The first message includes an identifier of the credentials of the first terminal device and an identifier of the credentials of the second terminal device, and the identifier of the credentials of the first terminal device and the identifier of the credentials of the second terminal device are used to indicate a pairing relationship between the first terminal device and the second terminal device.

40. The method according to claim 39, wherein The credentials include: any one or more of a certificate, a public key or a token.

41. The method according to any one of claims 36 to 38, wherein: After the pairing relationship between the first terminal device and the second terminal device is verified, the method further includes: The first network device stores the identity of the first terminal device and the identity of the second terminal device.

42. The method according to claim 41, wherein The first network device storing the identity of the first terminal device and the identity of the second terminal device includes: The first network device stores the identity of the second terminal device in the context of the first terminal device; The first network device stores the identity of the first terminal device in the context of the second terminal device.

43. The method according to any one of claims 36 to 38, characterized in that After the pairing relationship between the first terminal device and the second terminal device is verified, the method further includes: The first network device sends a third message to the second network device; wherein the third message includes an identity identifier of the first terminal device and an identity identifier of the second terminal device, and the identity identifier of the first terminal device and the identity identifier of the second terminal device are used to indicate that the first terminal device and the second terminal device have a pairing relationship; The second network device receives the third message.

44. A terminal device verification method, characterized in that: The method comprises: The first terminal device sends a fourth message to the second network device, wherein the fourth message includes an identity of the first terminal device in the mobile communication network, an identity of the first terminal device in the drone system, and an identity of the second terminal device paired with the first terminal device; The second network device receives the fourth message; The second network device verifies a pairing relationship between the first terminal device and the second terminal device, where the verification of the pairing relationship is used to authorize the second terminal device to control the first terminal device via the mobile communication network, where the first terminal device is a drone and the second terminal device is a remote controller; or the verification of the pairing relationship is used to authorize the first terminal device to control the second terminal device via the mobile communication network, where the first terminal device is a remote controller and the second terminal device is a drone; After the pairing relationship between the first terminal device and the second terminal device is verified, the second network device sends a fifth message to the first terminal device; wherein the fifth message includes second indication information, and the second indication information is used to indicate the pairing result of the first terminal device and the second terminal device; The first terminal device receives the fifth message.

45. The method according to claim 44, wherein The method further comprises: The first network device sends a third message to the second network device, wherein the third message includes an identity identifier of the first terminal device and an identity identifier of the second terminal device, and the identity identifier of the first terminal device and the identity identifier of the second terminal device are used to indicate that the first terminal device and the second terminal device have a pairing relationship; The second network device receives the third message.

46. ​​A communication system, characterized in that The method comprises a first network device and a first terminal device, wherein the first network device is used to execute the method according to any one of claims 1 to 8.

47. A communication system, characterized in that It comprises a second network device and a first terminal device, wherein the second network device is used to execute the method according to any one of claims 9-10.

Images