Key updating method, device, equipment and storage medium

Abstract

The present application discloses a key update method, device, equipment and storage medium, which belongs to the field of communication technology. The method includes: when the first multicast service group is updated, the core network device sends a key update message to the first terminal device, the key update message is used to update the security key used by the first terminal device in the first multicast service group, and the first multicast service group is used to perform the first multicast service; the first terminal device updates the security key according to the key update message. The embodiment of the present application enriches the functions corresponding to the multicast service, ensures the security of the multicast service carried out in the updated multicast service group, and improves the security guarantee mechanism of the multicast service.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and in particular to a key updating method, apparatus, device and storage medium. Background Art

[0002] With the rapid development of network communication technology, people's demand for mobile communications is no longer limited to telephone and message sending and receiving services, and a large number of multimedia service requirements are constantly emerging.

[0003] Some of these multimedia services require multiple UEs (User Equipment) to receive the same data at the same time, such as video on demand, TV broadcasting, online education, in-vehicle communications, etc. Compared with general data, these multimedia services have the characteristics of large data volume and long duration. In order to effectively utilize mobile network resources and better provide services for UEs, multicast services are generated. For V2X (Vehicle to Everything) or ProSe (Proximity Service), multicast services refer to a UE sending the same information content to UEs in the multicast service group from point to multipoint; for MBMS (Multimedia Broadcast / Multicast Service) services, multicast services refer to wireless networks sending the same information content to UEs in the multicast service group from point to multipoint. Multicast services can realize network resource sharing, improve the utilization of network resources, especially air interface resources, and efficiently provide users with high-speed and stable multimedia services.

[0004] However, how to securely send multicast service-related information to users requires further discussion and research. Summary of the invention

[0005] The present application provides a key update method, device, equipment and storage medium. The technical solution is as follows:

[0006] On the one hand, an embodiment of the present application provides a key update method, which is applied to a terminal device, and the method includes:

[0007] Receiving a key update message from a network device;

[0008] According to the key update message, a security key used by the first terminal device in a first multicast service group is updated, where the first multicast service group is used to perform a first multicast service.

[0009] On the other hand, an embodiment of the present application provides a key update method, which is applied to a core network device, and the method includes:

[0010] When the first multicast service group is updated, a key update message is sent to the first terminal device, wherein the key update message is used to update the security key used by the first terminal device in the first multicast service group, and the first multicast service group is used to perform the first multicast service.

[0011] On the other hand, an embodiment of the present application provides a key updating device, which is arranged in a terminal device, and the device includes:

[0012] A message receiving module, used for receiving a key update message from a network device;

[0013] A key update module is used to update the security key used by the first terminal device in the first multicast service group according to the key update message, and the first multicast service group is used to perform the first multicast service.

[0014] On the other hand, an embodiment of the present application provides a key update device, which is arranged in a core network device, and the device includes:

[0015] A message sending module is used to send a key update message to a first terminal device when the first multicast service group is updated. The key update message is used to update the security key used by the first terminal device in the first multicast service group. The first multicast service group is used to perform a first multicast service.

[0016] In another aspect, an embodiment of the present application provides a terminal device, the terminal device comprising: a processor, and a transceiver connected to the processor; wherein:

[0017] The transceiver is used to receive a key update message from a network device;

[0018] The processor is configured to update, according to the key update message, a security key used by the first terminal device in a first multicast service group, where the first multicast service group is used to perform a first multicast service.

[0019] In another aspect, an embodiment of the present application provides a core network device, the core network device comprising: a processor, and a transceiver connected to the processor; wherein:

[0020] The transceiver is used to send a key update message to the first terminal device when the first multicast service group is updated, and the key update message is used to update the security key used by the first terminal device in the first multicast service group, and the first multicast service group is used to perform the first multicast service.

[0021] On the other hand, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. The computer program is used to be executed by a processor of a terminal device to implement the key update method on the first terminal device side as described above.

[0022] On the other hand, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. The computer program is used to be executed by a processor of a core network device to implement the core network device side key update method as described above.

[0023] On the other hand, an embodiment of the present application provides a chip, which includes a programmable logic circuit and / or program instructions. When the chip runs on a terminal device, it is used to implement the key update method on the first terminal device side as mentioned above.

[0024] On the other hand, an embodiment of the present application provides a chip, which includes a programmable logic circuit and / or program instructions. When the chip runs on a core network device, it is used to implement the key update method on the core network device side as described above.

[0025] On the other hand, an embodiment of the present application provides a computer program product. When the computer program product is run on a terminal device, the computer executes the first terminal device side key update method as described above.

[0026] On the other hand, an embodiment of the present application provides a computer program product, which, when executed on a core network device, enables a computer to execute the core network device side key update method as described above.

[0027] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0028] When a certain multicast service group managed by the core network device is updated, the core network device sends a key update message to the terminal devices included in the updated multicast service group, so as to timely respond to the update of the multicast service group, thereby enriching the functions corresponding to the multicast service. Moreover, after receiving the key update message, the terminal devices included in the updated multicast service group timely update the security key used in the multicast service group, thereby ensuring the security of the multicast service carried out in the updated multicast service group, and improving the security guarantee mechanism of the multicast service. In addition, the core network device sends the key update message to the terminal devices included in the updated multicast service group, that is, if a certain terminal device uses the multicast service provided by the multicast service group before the multicast service group is updated, but the multicast service group is updated because the terminal device exits the multicast service group, then the updated multicast service group does not include the terminal device, and since the terminal devices in the updated multicast service group have updated the security key, the exited terminal device does not receive the key update message, and thus cannot obtain the updated security key, thereby providing good security guarantee for the remaining terminal devices in the multicast service group to carry out multicast services. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 is a schematic diagram of a system architecture provided by an embodiment of the present application;

[0031] Figure 2 is a schematic diagram of a multicast communication system architecture provided by an embodiment of the present application;

[0032] Figure 3 is a schematic diagram of a multicast communication process provided by an embodiment of the present application;

[0033] Figure 4 is a schematic diagram of a multicast communication process provided by another embodiment of the present application;

[0034] Figure 5 is a schematic diagram of a key system provided by an embodiment of the present application;

[0035] Figure 6 is a schematic diagram of a key system provided by another embodiment of the present application;

[0036] Figure 7 is a flowchart of a key updating method provided by an embodiment of the present application;

[0037] Figure 8 It is a schematic diagram of a multicast service group updating method provided by an embodiment of the present application;

[0038] Fig. 9 is a flowchart of a key updating method provided by another embodiment of the present application;

[0039] Fig.10 is a block diagram of a key updating device provided by an embodiment of the present application;

[0040] Fig.11 is a block diagram of a key updating device provided by another embodiment of the present application;

[0041] Fig.12 is a block diagram of a key updating device provided by another embodiment of the present application;

[0042] Fig.13 is a block diagram of a terminal device provided by an embodiment of the present application;

[0043] Fig.14 This is a block diagram of a core network device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0045] The network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art can appreciate that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0046] Please refer to Figure 1 , which shows a schematic diagram of a system architecture provided by an embodiment of the present application. The system architecture 100 may include: a terminal device 10, an access network device 20, and a core network device 30.

[0047] The terminal device 10 may refer to a UE, an access terminal, a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a wireless communication device, a user agent or a user device. Optionally, the terminal device may also be a cellular phone, a cordless phone, a SIP (Session Initiation Protocol) phone, a WLL (Wireless Local Loop) station, a PDA (Personal Digital Assistant), a handheld device with a wireless communication function, a computing device or other processing devices connected to a wireless modem, a vehicle-mounted device, a wearable device, a terminal device in 5G (5th-Generation, the fifth generation of mobile communication technology) or a terminal device in a future evolved PLMN (Public Land Mobile Network, public land mobile communication network), etc., and the embodiments of the present application are not limited to this. For the convenience of description, the above-mentioned devices are collectively referred to as terminal devices. The number of terminal devices 10 is usually multiple, and one or more terminal devices 10 can be distributed in the cell managed by each access network device 20.

[0048] The access network device 20 is a device deployed in the access network to provide wireless communication functions for the terminal device 10. The access network device 20 may include various forms of macro base stations, micro base stations, relay stations, access points, etc. In systems using different wireless access technologies, the names of devices with access network device functions may be different. For example, in the 5G NR (New Radio) system, it is called gNodeB or gNB. With the evolution of communication technology, the name "access network device" may change. For the convenience of description, in the embodiments of the present application, the above-mentioned devices that provide wireless communication functions for the terminal device 10 are collectively referred to as access network devices. Optionally, a communication relationship can be established between the terminal device 10 and the core network device 30 through the access network device 20. Exemplarily, in an LTE (Long Term Evolution) system, the access network device 20 may be an EUTRAN (Evolved Universal Terrestrial Radio Access Network) or one or more eNodeBs (evolved Node Bs) in the EUTRAN; in a 5G NR system, the access network device 20 may be a RAN (Radio Access Network) or one or more gNBs in the RAN.

[0049] The functions of the core network device 30 are mainly to provide user connection, user management and service bearing, and to provide an interface to the external network as a bearer network. For example, the core network device 30 in the 5G NR system may include devices such as an AMF (Access and Mobility Management Function) entity, a UPF (UserPlane Function) entity and a SMF (Session Management Function) entity.

[0050] In one example, the access network device 20 and the core network device 30 communicate with each other via some air technology, such as the NG interface in the 5G NR system. The access network device 20 and the terminal device 10 communicate with each other via some air technology, such as the Uu interface.

[0051] As can be seen from the above description, some multimedia services require multiple UEs to receive the same data at the same time. Compared with general data, these multimedia services have the characteristics of large data volume and long duration. In order to effectively utilize mobile network resources and better provide services to UEs, multicast services are generated. Multicast service types include: a UE sends the same information content to UEs in the multicast service group point-to-multipoint (such as multicast services in V2X and multicast services in ProSe), and a wireless network (application server) sends the same information content to UEs in the multicast service group point-to-multipoint (such as MBMS).

[0052] Please refer to Figure 2 , which shows a schematic diagram of a multicast communication system architecture provided by an embodiment of the present application. The multicast communication system architecture includes: an application server 210 and a terminal device 220.

[0053] The application server 210 refers to the server corresponding to the multicast service. For example, in the LTE system, the application server 210 can be BM-SC; in the 5G system, the application server 210 can be MBSF (Multimedia Broadcast Service Function) and MBSU (Multimedia Broadcast Service Userplane). Optionally, the application server can be located outside the mobile network, that is, the application server is independent of the core network device. When the application server is located outside the mobile network, optionally, the interaction between the application server and the terminal device can be implemented through an application layer protocol, such as the HTTP (Hyper Text Transfer Protocol) protocol. Optionally, the application server can also be located within the mobile network, that is, the function of the application server is implemented by the core network device (or network element) and / or the access network device (such as a base station) in the core network, such as the function of the application server MBSF is implemented by the core network device SMF, and the function of the application server MBSU is implemented by the core network device UPF or the access network device (such as a base station). When the application server is located within the mobile network, optionally, the interaction between the application server and the terminal device can be carried out through the control plane and / or the user plane, wherein the control plane interaction can be implemented using NAS (Non-Access-Stratum) messages; the user plane interaction can be implemented through the wireless bearer of the air interface and / or the GTP (GPRS Tunneling Protocol) of the core network. Optionally, the above interaction may include messages related to group establishment, service request or service cancellation between the terminal device and the application server, such as identity authentication request, key acquisition request or service cancellation request in the following embodiments.

[0054] In one example, the multicast communication system includes at least one multicast service group. Optionally, each multicast service group corresponds to a different application server 210, that is, the number of application servers 210 in the multicast communication system is the same as the number of multicast service groups; or, each multicast service group corresponds to the same application server 210, that is, the multicast communication system includes an application server 210, and the application server 210 is used to provide multicast services for different multicast service groups in the multicast communication system. Optionally, each multicast service group includes at least two terminal devices 220, and the device types of the terminal devices 220 in each multicast service group can be the same (such as all handheld devices) or different (such as some are handheld devices and some are vehicle-mounted devices). Optionally, the multicast service types of the multicast services in the same multicast communication system are the same, for example, all send the same information content to the remaining UEs in the multicast service group point-to-multipoint for one UE.

[0055] Optionally, when information transmission is required in a multicast service group, the transmitted information may be encrypted to ensure the security and accuracy of the transmitted information. Optionally, in order to improve the security of the transmitted information, different keys are used in the information encryption process in different multicast service groups. The following describes the keys used in the information encryption process for several typical multicast communication systems.

[0056] V2X multicast communication system: The terminal device applies to the application server (V2X Application Server) in V2X to join the multicast service group and obtain group service authorization. At this time, the terminal device will obtain the GID (Group Identifier). After the terminal device obtains the GID, the KMF (Key Management Function) in V2X securely distributes the group key to the terminal device. Furthermore, in the multicast service group that the terminal device applies to join, each terminal device builds a secure connection with the assistance of the group key and some other keys, ID (Identity), etc., to achieve safe and accurate multicast communication.

[0057] ProSe multicast communication system: Figure 3As shown, the terminal device implements group service authorization with the ProSe Function and the ProSe KMF. The terminal device sends a key acquisition request to the ProSe KMF, which includes the GID and the security capability of the terminal device. After checking the key acquisition request, the ProSe KMF uses the MIKEY (Multimedia Network Encryption) protocol to encrypt and send the group key (PGK), the group key ID and the expiration time of the group key (or send the group member ID, the master key (PMK), the master key ID and other information). Secondly, the terminal device uses the information sent by the ProSe KMF to implement a secure and accurate multicast service with the other terminal devices in the multicast service group. The terminal device calculates the encryption key (PEK) and the integrity protection key (PIK) and other keys according to the information sent by the ProSe KMF to protect the information transmitted in the multicast service. After receiving the information, the terminal device receiving the transmitted information checks the second layer header of the information to obtain the LC (Logic Channel) ID, the group identifier and the group member identifier. Then, the terminal device receiving the transmitted information identifies which group key is used by the terminal device sending the information, and checks whether the group key is valid, and then further calculates the encryption key and the integrity protection key to process the received message. Optionally, the multicast communication process of the V2X multicast communication system may refer to the multicast communication process of the ProSe multicast communication system.

[0058] MBMS multicast communication system: First, the MBMS server (MBSF) authenticates the terminal device, and the terminal device can send an identity authentication request to the MBSF. After the terminal device is successfully authenticated, the MBSF stores the device information of the terminal device. After that, the terminal device may initiate a key acquisition request to the MBSF. The key acquisition request is used to request the acquisition of the service key (MSK). Optionally, the key acquisition request includes the Key Domain ID and the MSK ID. The server authenticates the key authentication request, and after the authentication is passed, the distribution of the service key (MSK) and the traffic key (MTK) is performed in sequence. Among them, the service key (MSK) is encrypted and sent using the MIKEY message protected by the user key (MUK), and the service key (MSK) is identified by the Key Domain ID and the MSK ID; the traffic key (MTK) is encrypted and sent using the MIKEY message protected by the service key (MSK), and the traffic key (MTK) is identified by the Key domain ID, the MSK ID, and the MTK ID. It should be noted that in order to reduce the signaling exchanges between the terminal device and the MBSF, the terminal device can send an identity authentication request and a key acquisition request to the MBSF at the same time, that is, the identity authentication request and the key authentication request can be carried in the same message, such as Figure 4As shown. Optionally, the identity authentication request and the key authentication request are NAS messages. Afterwards, each terminal device in the multicast service group joined by the terminal device can establish a secure connection through the service key and the traffic key to protect the transmitted multicast information. It should be noted that MBMS can also be called MBS (Multicast Broadcast Service) in the 5G system, and those skilled in the art should understand its meaning.

[0059] In one example, the application server uses the MIKEY protocol to send keys to the terminal device, that is, the message carrying the key sent by the application server to the terminal device can be called a MIKEY message. The MIKEY message can protect the confidentiality and integrity of the key. Optionally, the encryption algorithm used by MIKEY is AES (Advanced Encryption Standard)-CM-128 or AES-KW-128, and the message authentication code is HMAC (Hash-based Message Authentication Code)-SHA (Secure Hash Algorithm)-1-160. The following takes MBMS as an example to introduce the MIKEY message.

[0060] From the above description of the MBMS multicast communication system, it can be seen that after the terminal device is successfully authenticated, the application server distributes the service key (MSK) and the traffic key (MTK) in sequence.

[0061] Common HDR EXT (Extended Payload) TS MIKEY RAND (Random) IDi IDR {SP (Security Policy)} KEMAC

[0062] As shown in Table 1 above, the logical structure of the MIKEY message of the MSK protected by MUK provided by an embodiment of the present application is shown.

[0063] EXT: contains the MSK ID, MSK type, and the key domain ID where the MSK is located;

[0064] IDi: ID of the application server (BM-SC);

[0065] IDr: ID of the terminal device;

[0066] MIKEY RAND: used to generate encryption keys and authentication keys to handle traffic keys (MTK) that need to be protected;

[0067] {SP}: used in multicast data services, and may include: information related to security protocols (such as the algorithm used, the length of the key, the initial value of the algorithm, etc.);

[0068] KEMAC: includes the MSK ciphertext encrypted by MUK and the MAC (Media Access Control) of MSK, and the rest is plain text.

[0069] Common HDR EXT (Extended Payload) TS KEMAC

[0070] As shown in Table 2 above, the logical structure of the MIKEY message sent by the application server to MTK according to one embodiment of the present application is shown. Since the key derived from the MIKEY RAND in the MIKEY message sent to MSK is used to protect MTK, the MIKEY RAND is not required in the MTK message structure. Among them:

[0071] EXT: includes MTK, ID, type and key domain ID of MSK used to protect MTK;

[0072] KEMAC: Includes MTK ciphertext and MAC encrypted with the key derived from MSK.

[0073] From the above introduction, it can be seen that the key used for encryption and integrity protection of multicast service information in multicast services is derived layer by layer through the root key according to the key system. The following introduces the generation of keys for encryption and integrity protection of multicast service information based on the key system in the V2X multicast communication system.

[0074] Please refer to Figure 5 , which shows a schematic diagram of a key system in MBMS provided by an embodiment of the present application. Figure 5 It can be seen that in MBMS, the key system consists of the following three layers: MUK (user key), MSK (service key), and MTK (traffic key). The user key (MUK) is used to protect the issuance of the service key (MSK), and the service key (MSK) is used to protect the issuance of the traffic key (MTK). Among them, the service key (MSK) can be derived from the user key (MUK), or it can be selected and issued by the application server; the traffic key (MTK) can be derived from the service key (MSK), or it can be selected and issued by the application server. It should be understood that Figure 5 In the key system shown, the connection between MUK and MSK, and the connection between MSK and MTK are only used to indicate the protection relationship, and are not used to limit the derivation relationship.

[0075] Please refer to Figure 6 , which shows a schematic diagram of a key system in a V2X multicast communication system provided by an embodiment of the present application. Figure 6It can be seen that in the V2X multicast communication system, the key system consists of the following three layers: VGK (group key), PTK (traffic key), PEK (encryption key) and PIK (integrity protection key). It should be understood that in the V2X multicast communication system, the traffic key, encryption key and integrity protection key use the names in the ProSe multicast communication system. With the evolution of the communication protocol, other names may be generated, such as the traffic key is called VTK, the encryption key is called VEK, the integrity protection key is called VIK, etc. These evolved names should also fall within the scope of protection of this application. Among them:

[0076] VGK: also known as root key, which occupies 256 bits.

[0077] PTK: also known as the service key, which occupies 256 bits and is calculated by the terminal device after decrypting the MIKEY message sent by the application server.

[0078] PEK and PIK: used in confidentiality and integrity algorithms to protect multicast service information. PEK and PIK are generated by terminal devices using PTK.

[0079] KDF Input Parameters Specific value FC 0X4A P0 Group Member Identity L0 P0 Length P1 PTK Identity L1 P1 length P2 Group Identity L2 P2 length Input Key 256-bit VGK

[0080] As shown in Table 3 above, it shows the input parameters required when deriving PTK provided by an embodiment of the present application. In one example, PTK can be updated by updating VGK.

[0081] Table 4 PEK and PIK derived input parameters

[0082]

[0083]

[0084] As shown in Table 4 above, it shows the input parameters required for deriving PEK and PIK provided by an embodiment of the present application. In one example, PEK and PIK are updated by updating PTK.

[0085] By encrypting and integrity protecting the multicast service information as described above, the security of the multicast service information and the multicast communication system can be improved. However, the above example only considers the security when the terminal device joins the multicast service group, but does not consider how to ensure the security of the multicast service information transmitted between the remaining terminal devices in the multicast service group when the terminal device exits the multicast service group. Based on this, an embodiment of the present application provides a key update method, which can be used to ensure the security of the multicast service information transmitted between the remaining terminal devices when the terminal device exits the multicast service group, thereby reducing security risks. Below, the technical solution of the present application is introduced and explained through several exemplary embodiments.

[0086] Please refer to Figure 7 , which shows a flowchart of a key update method provided by an embodiment of the present application, which can be applied to Figure 1 and Figure 2 In the system architecture shown, the method may include the following steps (710-720):

[0087] Step 710: When the first multicast service group is updated, the core network device sends a key update message to the first terminal device. The key update message is used to update the security key used by the first terminal device in the first multicast service group. The first multicast service group is used to perform the first multicast service.

[0088] The core network device refers to a device that can provide multicast service for the first terminal device. Optionally, the core network device is a server for the multicast service (i.e., an application server). For other descriptions of the application server, please refer to the above embodiment, which will not be described here. The first multicast service group is used to perform the first multicast service. In the embodiment of the present application, the core network device can provide at least one multicast service, that is, the core network device manages at least one multicast service group. Optionally, the number of terminal devices in the first multicast service group is greater than or equal to 2.

[0089] As the service requirements of the terminal device change, the first multicast service group will also be updated. The embodiment of the present application does not limit the situation in which the first multicast service group is updated. Optionally, the update of the first multicast service group is manifested as the exit (or revocation) of a terminal device in the first multicast service group. Please refer to the following embodiment, which will not be described in detail here; or, the update of the first multicast service group is manifested as a change in the security requirements of the terminal devices in the first multicast service group for the multicast service, such as the terminal devices have more stringent security requirements for the multicast service, and it is expected to achieve the purpose of strictly protecting the multicast service related information by continuously updating the security key; or, the update of the first multicast service group is manifested as the core network device revoking a terminal device in the first multicast service group. For example, when the core network device determines that the subscription service of a terminal device for the first multicast service has expired, the terminal device is revoked from the first multicast service group, or the core network device actively revokes the terminal device in the first multicast service group when the security policy for the first multicast service group is updated.

[0090] When determining that the first multicast service group is updated, the core network device generates a key update message and sends the key update message to the first terminal device in the first multicast service group to promptly respond to the update of the first multicast service group. Wherein, when the update of the first multicast service group is manifested as the revocation of a terminal device, the first terminal device is the remaining terminal device in the first multicast service group except the revoked terminal device. The key update message is used to update the security key used by the first terminal device in the first multicast service group, and the security key is used to encrypt and integrity protect the information related to the first multicast service. Optionally, the key update message is a MIKEY message, that is, the key update message is sent by the core network device to the first terminal device through the MIKEY protocol. The embodiment of the present application does not limit the specific content of the key update message. Optionally, the key update message includes the random number required to derive the security key or the root key of the derived security key, etc. For an introduction to the content of the key update message, please refer to the following embodiment, which will not be repeated here.

[0091] Step 720: The first terminal device updates the security key according to the key update message.

[0092] After receiving the key update message, the first terminal device parses the key update message to extract the update content carried in the key update message, and updates the security key according to the update content. Optionally, when the key update message is a MIKEY message, the first terminal device needs to use the encryption key of the key update message to parse the key update message. For example, in MBMS, the key update message is encrypted by the user key (MUK). Since the key update message carries the content required to derive the security key, after parsing the key update message to obtain the update content, the first terminal device can re-derive a new security key according to the update content.

[0093] In summary, the technical solution provided by the embodiment of the present application enriches the functions corresponding to the multicast service by sending a key update message to the terminal devices included in the updated multicast service group when a certain multicast service group managed by the core network device is updated, so as to promptly respond to the update of the multicast service group. In addition, after receiving the key update message, the terminal devices included in the updated multicast service group promptly update the security key used in the multicast service group, thereby ensuring the security of the multicast service carried out in the updated multicast service group and improving the security guarantee mechanism of the multicast service. In addition, the core network equipment sends a key update message to the terminal devices included in the updated multicast service group. That is, if a terminal device uses the multicast service provided by the multicast service group before the multicast service group is updated, but the multicast service group is updated because the terminal device exits the multicast service group, the terminal device is not included in the updated multicast service group. Since the terminal devices in the updated multicast service group have updated the security keys, the exited terminal device does not receive the key update message and cannot obtain the updated security keys, thereby providing good security protection for the remaining terminal devices in the multicast service group to carry out multicast services.

[0094] The following is an introduction to the security key update process.

[0095] In one example, the above step 720 includes the following steps:

[0096] Step 722: The first terminal device updates the service key corresponding to the first multicast service according to the key update message.

[0097] From the introduction of the above key system, it can be seen that the security key is not directly issued by the core network device to the terminal device, but is derived layer by layer by the terminal device based on the root key issued by the core network device. In order to be compatible with the established key system, in the embodiment of the present application, after receiving the key update message from the core network device, the first terminal device first updates the service key corresponding to the first multicast service, and then further updates the security key based on the service key.

[0098] In different multicast service communication systems, the names of service keys are different. For example, when the first multicast service includes a multicast service in V2X or a multicast service in ProSe, the service key is called a service key; when the first multicast service includes MBMS, the service key can be called a service key or a service key. It should be understood that during the evolution of the communication protocol, the service key may have new names, but they all perform the same functions, and these new names should also fall within the scope of protection of this application.

[0099] Referring to Table 3 above, the parameters used in the derivation process of the service key include the group key (or root key) and the key calculation parameter. Optionally, the key calculation parameter includes a random number. For example, in the embodiment of the present application, for the service key (PTK) in the V2X multicast communication system, the original P0 is designed as a random number in its derived input parameter. That is, based on Table 3 above, P0 (group member identifier) ​​is modified to (Nonce_1), as shown in Table 5 below.

[0100] KDF Input Parameters Specific value FC 0X4A P0 Nonce_1 (random number) L0 P0 Length P1 PTK Identity L1 P1 length P2 Group Identity L2 P2 length Input Key 256-bit VGK

[0101] Among them, P0 (Nonce_1) is a random number, and L0 represents the length of the random number Nonce_1. It can be seen from the above Table 5 that in order to update the service key, it is necessary to update the parameters used in the service key derivation process. Based on this, in an example, the key update message includes at least one of the following: updated key calculation parameters, updated group key.

[0102] Since updating the group key requires more computing resources than updating the key calculation parameters, in order to reduce the computing resources required for the core network device to calculate the updated group key and avoid frequent updating of the group key, in one example, when the first multicast service group is updated, the core network device checks whether the group key corresponding to the first multicast service group has expired. Optionally, the core network device sets a usage time limit for the group key. When the group key is outside the usage time limit, it indicates that the group key has expired; when the group key is within the usage time limit, it indicates that the group key has not expired; when the group key corresponding to the first multicast service group expires, the core network device generates an updated group key and sends it to the first terminal device, that is, the key update message includes the updated group key; when the group key corresponding to the first multicast service has not expired, the core network device generates an updated key calculation parameter and sends it to the first terminal device, that is, the key update message includes the updated key calculation parameter.

[0103] Step 724: The first terminal device updates the security key according to the updated service key.

[0104] After the first terminal device derives the updated service key according to the key update message, it further updates the security key according to the updated service key to be compatible with the established key system. The way in which the first terminal device updates the security key according to the updated service key can be seen in Table 4 above, which is not described in detail here.

[0105] In different multicast service communication systems, the content and name of the security key are different. For example, when the first multicast service includes a multicast service in V2X or a multicast service in ProSe, the security key includes at least one of the following: an encryption key, an integrity protection key; when the first multicast service includes MBMS, the security key may include a traffic key, and may also include at least one of the following: an encryption key, an integrity protection key. It should be understood that during the evolution of the communication protocol, the service key may have a new name, but they all perform the same function, and these new names should also fall within the scope of protection of this application.

[0106] In summary, the technical solution provided by the embodiment of the present application is effectively compatible with the key system established in the multicast service by deriving the updated service key according to the key update message by the terminal device included in the updated multicast service group, and further deriving the updated security key from the updated service key. In addition, in the embodiment of the present application, the core network device adopts different key update methods according to whether the group key corresponding to the multicast service expires. When the group key expires, the group key is updated, and when the group key has not expired, the key calculation parameters are updated. Since the computing resources required to update the key calculation parameters are less than the computing resources required to update the group key, the embodiment of the present application proposes a lightweight key update method, which helps to reduce the computing overhead of the core network device to generate the updated content, and reduce the computing overhead of the terminal device to derive the security key.

[0107] The following describes the situation where the first multicast service group is updated. As can be seen from the description of the above embodiment, the first multicast service group is updated including at least one of the following possibilities: a UE actively exits the first multicast service group, and a core network device cancels a terminal device in the first multicast service group. These situations are described below.

[0108] In one example, if Figure 8 As shown, the above method also includes the following steps:

[0109] Step 801: The second terminal device sends a service cancellation request to the core network device.

[0110] The second terminal device refers to a terminal device that has a multicast service cancellation requirement in the first multicast service group before the update. The second terminal device can send a service cancellation request to the core network device to request to exit the first multicast service group. Optionally, the service cancellation request is a NAS message. The embodiment of the present application does not limit the content of the service cancellation request. Optionally, the service cancellation request includes at least one of the following: a multicast service group identifier (GID) and an identifier of the first terminal device.

[0111] Step 803: The core network device cancels the second terminal device from the first multicast service group according to the service cancellation request.

[0112] After receiving the service withdrawal request from the second terminal device, the core network device parses the service withdrawal request to determine the terminal device requesting to exit the multicast service, i.e., the second terminal device, and determines the multicast service group to which the second terminal device belongs, i.e., the first multicast service group. Thus, the core network device withdraws the second terminal device from the first multicast service group in response to the service withdrawal request from the second terminal device. Optionally, the core network device withdraws the second terminal device from the first multicast service group including: deleting information related to the second terminal device, such as the identifier of the second terminal device, from the member list corresponding to the first multicast service group.

[0113] In order to make the second terminal device clear whether it has successfully exited the multicast service after sending the service cancellation request, optionally, after the above step 803, step 805 is also included: the core network device sends a service cancellation response to the second terminal device, and the service cancellation response is used to indicate that the second terminal device has completed the withdrawal from the first multicast service group. In the embodiment of the present application, in order to reduce the signaling exchanges between the core network device and the terminal device and reduce the signaling overhead of the core network device, the core network device may not send a service cancellation response to the second terminal device. Since the remaining terminal devices in the multicast service group after subsequent update have updated their security keys, the second terminal device cannot use its clear security key to continue the multicast service. Optionally, after sending the service cancellation request, the second terminal device defaults to exiting the multicast service, that is, defaults to withdrawing from the first multicast service group; or, if the second terminal device does not receive a response message to the service cancellation request from the core network device within a period of time after sending the service cancellation request, it defaults to exiting the multicast service. For example, the second terminal device can start a timer when sending the service cancellation request or at a certain time after sending the service cancellation request. If the second terminal device receives a service cancellation response from the core network device within the working time of the timer, it is determined that it is withdrawn from the first multicast service group. If the second terminal device has not received a service cancellation response from the core network device when the timer times out, it is defaulted to withdraw from the first multicast service group. Optionally, if the second terminal device has not received a service cancellation response from the core network device when the timer times out, it can also be defaulted that it has not been withdrawn from the first multicast service group. At this time, the second terminal device can resend the service cancellation request to the core network device.

[0114] In another example, Figure 8 As shown, the above method also includes the following steps:

[0115] Step 802: When the subscription service of the third terminal device to the first multicast service expires, the core network device removes the third terminal device from the first multicast service group.

[0116] The third terminal device refers to the terminal device in the first multicast service group before the update. In the process of providing multicast services to the terminal devices in the first multicast service group, the core network device determines whether the subscription service of each terminal device for the first multicast service has expired. Optionally, the core network device determines in real time whether the subscription service of each terminal device has expired; or, the core network device determines at preset intervals whether the subscription service of each terminal device has expired. When the core network device determines that the subscription service of the third terminal device in the first multicast service group has expired, the third terminal device is revoked from the first multicast service group.

[0117] Optionally, the embodiment of the present application sets a subscription duration or a subscription termination time for each terminal device to subscribe to the first multicast service, so that the core network device can determine whether each terminal device can obtain the first multicast service. For example, when each terminal device has a corresponding subscription duration, the core network device determines whether the duration for each terminal device to obtain the first multicast service reaches the subscription duration. If the subscription duration is reached, it is determined that the subscription service of the terminal device for the first multicast service has expired. For another example, when each terminal device has a corresponding subscription termination time, the core network device determines whether the current time for each terminal device to obtain the first multicast service reaches the subscription termination time. If the subscription termination time is reached, it is determined that the subscription service of the terminal device for the first multicast service has expired. Optionally, the same subscription duration or subscription termination time is set for each terminal device in the first multicast service group; or, different subscription durations or subscription termination times are set for different terminal devices in the first multicast service group, for example, a longer subscription duration is set for terminal devices that pay more fees.

[0118] In order to enable the terminal device whose subscription service has expired to promptly clarify the expiration of the subscription service for the first multicast service, so as to facilitate the timely restoration of the first multicast service, optionally, after the above step 802, step 804 is also included: the core network device sends a revocation prompt message to the third terminal device, and the revocation prompt message is used to indicate that the third terminal device has completed the revocation from the first multicast service group. In order to enable the third terminal device to further clarify the reason for its revocation from the first multicast service group, optionally, the core network device sends a service revocation reason to the third terminal device, and the service revocation reason is used to indicate the reason why the core network device revoked the third terminal device from the first multicast service group, such as the service revocation reason is that the subscription service of the third terminal device for the first multicast service has expired. Optionally, the service revocation reason is carried in the revocation prompt message to reduce the signaling exchanges between the core network device and the terminal device, and reduce the signaling overhead of the core network device.

[0119] In summary, the technical solution provided by the embodiment of the present application enriches the functions of the multicast service and achieves the purpose of flexibly exiting the multicast service by sending a service cancellation request to the core network device when there is a demand for multicast service cancellation to exit the multicast service group in which the terminal device is located. In addition, in the embodiment of the present application, after the core network device cancels the terminal device that sent the service cancellation request from the multicast service group, it sends a service cancellation response to the terminal device, so that the terminal device can clearly understand whether it has successfully exited the multicast service.

[0120] In addition, the technical solution provided in the embodiment of the present application determines whether the subscription service for the multicast service of each terminal device in the multicast service group has expired through the core network device, and promptly cancels the terminal devices whose subscription service has expired, so as to prevent these terminal devices from obtaining the multicast service for free, thereby avoiding unnecessary losses to the multicast service provider. In addition, in the embodiment of the present application, after canceling the terminal device whose subscription service has expired, the core network device further sends a cancellation prompt message to the terminal device, so as to promptly notify the terminal device, so as to facilitate the terminal device to promptly grasp the situation that it cannot obtain the multicast service, so as to promptly deal with the situation to restore the multicast service.

[0121] Below, the technical solution of the present application is introduced and explained by taking the V2X multicast communication system as an example. It should be understood that Fig. 9 The V2X multicast communication system is used as an example only, and does not constitute a limitation on the technical solution of the present application. Those skilled in the art will understand Fig. 9 After reading the technical solution shown, it will be easy to think of Fig. 9 The technical solution shown is adaptable to other multicast communication systems, such as MBMS (or MBS), which should all fall within the protection scope of this application.

[0122] Please refer to Fig. 9, which shows a flowchart of a key update method provided by an embodiment of the present application, which can be applied to Figure 1 and Figure 2 In the system architecture shown, the method may include the following steps:

[0123] Step 910: The second terminal device sends a service cancellation request to the core network device. The second terminal device refers to a terminal device in the first multicast service group that has a multicast service cancellation requirement. The service cancellation request is used to request to exit the first multicast service group. Optionally, the service cancellation request includes at least one of the following: a multicast service group identifier, an identifier of the first terminal device.

[0124] Step 920: The core network device removes the second terminal device from the first multicast service group according to the service removal request. Optionally, the core network device removes the second terminal device from the first multicast service group including: deleting information related to the second terminal device, such as an identifier of the second terminal device, from a member list corresponding to the first multicast service group.

[0125] Step 930: The core network device sends a service revocation response to the second terminal device. The service revocation response is used to indicate that the second terminal device has completed the revocation from the first multicast service group. Optionally, the core network device directly revokes the second terminal device from the first multicast service group without sending a service revocation response to the second terminal device (without executing step 930).

[0126] In step 940, the core network device determines whether the group key corresponding to the first multicast service group has expired. Optionally, the core network device sets a usage time limit for the group key. When the group key is outside the usage time limit, it indicates that the group key has expired. When the group key is within the usage time limit, it indicates that the group key has not expired. It should be noted that the embodiment of the present application does not limit the execution order of step 940 and step 930. Fig. 9 For ease of description only, step 940 is performed after step 930 .

[0127] Step 950, the core network device sends a key update message to the first terminal device. The first terminal device refers to the terminal device included in the updated first multicast service group, that is, the first terminal device is the remaining terminal device in the first multicast service group except the revoked terminal device (second terminal device). The key update message is used to update the security key used by the first terminal device in the first multicast service group. In the case where the group key corresponding to the first multicast service group expires, the key update message includes the updated group key; in the case where the group key corresponding to the first multicast service has not expired, the key update message includes the updated key calculation parameter. Optionally, the key calculation parameter includes a random number. Optionally, the core network device directly sends the key update information to the first terminal device when it is determined that the first multicast service group has been updated (such as receiving a service revocation request from the second terminal device). That is, the core network device does not need to determine whether the group key corresponding to the first multicast service group has expired (no need to perform the above step 940). At this time, the key update message can carry the updated group key by default, or the updated key calculation parameter by default. One thing that needs to be explained is that the embodiment of the present application does not limit the execution timing of step 950. Optionally, step 950 is executed after step 910; or, step 950 is executed after step 920; or, step 950 and step 920 are executed simultaneously.

[0128] Step 960: The first terminal device updates the service key (PTK) corresponding to the first multicast service according to the key update message; and updates the security keys (PEK and PIK) according to the updated service key (PTK).

[0129] It should be noted that in the above method embodiment, the key update method provided by the present application is mainly introduced and explained from the perspective of the interaction between the first terminal device, the second terminal device and the core network device. The above steps performed by the first terminal device can be independently implemented as a key update method on the first terminal device side; the above steps performed by the core network device can be independently implemented as a key update method on the core network device side.

[0130] The following are device embodiments of the present application, which can be used to execute the method embodiments of the present application. For details not disclosed in the device embodiments of the present application, please refer to the method embodiments of the present application.

[0131] Please refer to Fig.10 , which shows a block diagram of a key update device provided by an embodiment of the present application. The device has the function of implementing the above-mentioned first terminal device side method example, and the function can be implemented by hardware, or by hardware executing corresponding software. The device can be the terminal device described above, or it can be set in the terminal device. Fig.10As shown, the device 1000 may include: a message receiving module 1010 and a key updating module 1020 .

[0132] The message receiving module 1010 is used to receive a key update message from a network device.

[0133] The key updating module 1020 is used to update the security key used by the first terminal device in the first multicast service group according to the key updating message, where the first multicast service group is used to perform the first multicast service.

[0134] In one example, the key update module is used to: update the service key corresponding to the first multicast service according to the key update message; and update the security key according to the updated service key.

[0135] In an example, the key update message includes at least one of the following: an updated key calculation parameter, an updated group key.

[0136] In one example, the key calculation parameter includes a random number.

[0137] In one example, when the group key corresponding to the first multicast service expires, the key update message includes the updated group key; when the group key corresponding to the first multicast service has not expired, the key update message includes the updated key calculation parameter.

[0138] In an example, the first multicast service includes any one of the following: a multicast service in V2X, a multicast service in ProSe, and MBMS.

[0139] In one example, the business key includes a service key; and the first multicast service includes MBMS.

[0140] In one example, the security key includes at least one of the following: an encryption key, an integrity protection key; the first multicast service includes any one of the following: a multicast service in V2X, a multicast service in ProSe, and MBMS.

[0141] In one example, the security key includes a traffic key; and the first multicast service includes MBMS.

[0142] In summary, the technical solution provided by the embodiment of the present application enriches the functions corresponding to the multicast service by sending a key update message to the terminal devices included in the updated multicast service group when a certain multicast service group managed by the core network device is updated, so as to promptly respond to the update of the multicast service group. In addition, after receiving the key update message, the terminal devices included in the updated multicast service group promptly update the security key used in the multicast service group, thereby ensuring the security of the multicast service carried out in the updated multicast service group and improving the security guarantee mechanism of the multicast service. In addition, the core network equipment sends a key update message to the terminal devices included in the updated multicast service group. That is, if a terminal device uses the multicast service provided by the multicast service group before the multicast service group is updated, but the multicast service group is updated because the terminal device exits the multicast service group, the terminal device is not included in the updated multicast service group. Since the terminal devices in the updated multicast service group have updated the security keys, the exited terminal device does not receive the key update message and cannot obtain the updated security keys, thereby providing good security protection for the remaining terminal devices in the multicast service group to carry out multicast services.

[0143] Please refer to Fig.11 , which shows a block diagram of a key update device provided by an embodiment of the present application. The device has the function of implementing the above-mentioned core network device side method example, and the function can be implemented by hardware, or by hardware executing corresponding software. The device can be the core network device described above, or it can be set in the core network device. Fig.11 As shown, the device 1100 may include: a message sending module 1110.

[0144] The message sending module 1110 is used to send a key update message to the first terminal device when the first multicast service group is updated. The key update message is used to update the security key used by the first terminal device in the first multicast service group, and the first multicast service group is used to perform the first multicast service.

[0145] In an example, the key update message includes at least one of the following: an updated key calculation parameter, an updated group key.

[0146] In one example, the key calculation parameter includes a random number.

[0147] In one example, when the group key corresponding to the first multicast service expires, the key update message includes the updated group key; when the group key corresponding to the first multicast service has not expired, the key update message includes the updated key calculation parameter.

[0148] In one example, the security key includes at least one of the following: an encryption key, an integrity protection key; the first multicast service includes any one of the following: a multicast service in V2X, a multicast service in ProSe, and MBMS.

[0149] In one example, the security key includes a traffic key; and the first multicast service includes MBMS.

[0150] In one example, if Fig.12 As shown, the apparatus 1100 further includes: a request receiving module 1120, configured to receive a service cancellation request from a second terminal device; and a device cancellation module 1130, configured to cancel the second terminal device from the first multicast service group according to the service cancellation request.

[0151] In an example, the service revocation request includes at least one of the following: a multicast service group identifier and an identifier of the first terminal device.

[0152] In one example, if Fig.12 As shown, the apparatus 1100 further includes: a response sending module 1140, configured to send a service withdrawal response to the second terminal device, wherein the service withdrawal response is used to indicate that the second terminal device has completed withdrawal from the first multicast service group.

[0153] In summary, the technical solution provided by the embodiment of the present application enriches the functions corresponding to the multicast service by sending a key update message to the terminal devices included in the updated multicast service group when a certain multicast service group managed by the core network device is updated, so as to promptly respond to the update of the multicast service group. In addition, after receiving the key update message, the terminal devices included in the updated multicast service group promptly update the security key used in the multicast service group, thereby ensuring the security of the multicast service carried out in the updated multicast service group and improving the security guarantee mechanism of the multicast service. In addition, the core network equipment sends a key update message to the terminal devices included in the updated multicast service group. That is, if a terminal device uses the multicast service provided by the multicast service group before the multicast service group is updated, but the multicast service group is updated because the terminal device exits the multicast service group, the terminal device is not included in the updated multicast service group. Since the terminal devices in the updated multicast service group have updated the security keys, the exited terminal device does not receive the key update message and cannot obtain the updated security keys, thereby providing good security protection for the remaining terminal devices in the multicast service group to carry out multicast services.

[0154] One point that needs to be explained is that the device provided in the above embodiment only uses the division of the above-mentioned functional modules as an example to implement its functions. In actual applications, the above-mentioned functions can be assigned to different functional modules according to actual needs, that is, the content structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0155] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0156] Please refer to Fig.13 , which shows a schematic diagram of the structure of a terminal device 130 provided in an embodiment of the present application. For example, the terminal device can be used to execute the above-mentioned first terminal device side key update method. Specifically, the terminal device 130 may include: a processor 131, and a transceiver 132 connected to the processor 131; wherein:

[0157] The processor 131 includes one or more processing cores. The processor 131 executes various functional applications and information processing by running software programs and modules.

[0158] The transceiver 132 includes a receiver and a transmitter. Optionally, the transceiver 132 is a communication chip.

[0159] In one example, the terminal device 130 further includes: a memory and a bus. The memory is connected to the processor via the bus. The memory can be used to store a computer program, and the processor is used to execute the computer program to implement the various steps performed by the first terminal device in the above method embodiment.

[0160] In addition, the memory may be implemented by any type of volatile or non-volatile storage device or a combination thereof, including but not limited to: RAM (Random-Access Memory) and ROM (Read-Only Memory), EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other solid-state storage technology, CD-ROM (Compact Disc Read-Only Memory), DVD (Digital Video Disc) or other optical storage, tape cassettes, magnetic tapes, disk storage or other magnetic storage devices. Among them:

[0161] The transceiver 132 is used to receive a key update message from a network device.

[0162] The processor 131 is configured to update, according to the key update message, a security key used by the first terminal device in a first multicast service group, where the first multicast service group is used to perform a first multicast service.

[0163] In one example, the processor 131 is configured to: update the service key corresponding to the first multicast service according to the key update message; and update the security key according to the updated service key.

[0164] In an example, the key update message includes at least one of the following: an updated key calculation parameter, an updated group key.

[0165] In one example, the key calculation parameter includes a random number.

[0166] In one example, when the group key corresponding to the first multicast service expires, the key update message includes the updated group key; when the group key corresponding to the first multicast service has not expired, the key update message includes the updated key calculation parameter.

[0167] In an example, the first multicast service includes any one of the following: a multicast service in V2X, a multicast service in ProSe, and MBMS.

[0168] In one example, the business key includes a service key; and the first multicast service includes MBMS.

[0169] In one example, the security key includes at least one of the following: an encryption key, an integrity protection key; the first multicast service includes any one of the following: a multicast service in V2X, a multicast service in ProSe, and MBMS.

[0170] In one example, the security key includes a traffic key; and the first multicast service includes MBMS.

[0171] Please refer to Fig.14 , which shows a schematic diagram of the structure of a core network device 1413 provided by an embodiment of the present application. For example, the core network device can be used to execute the above-mentioned core network device side key update method. Specifically, the core network device 1413 may include: a processor 141, and a transceiver 142 connected to the processor 141; wherein:

[0172] The processor 141 includes one or more processing cores. The processor 141 executes various functional applications and information processing by running software programs and modules.

[0173] The transceiver 142 includes a receiver and a transmitter. Optionally, the transceiver 142 is a communication chip.

[0174] In one example, the core network device 1413 further includes: a memory and a bus. The memory is connected to the processor via the bus. The memory can be used to store a computer program, and the processor is used to execute the computer program to implement each step performed by the core network device in the above method embodiment.

[0175] Furthermore, the memory may be implemented by any type of volatile or non-volatile storage device or combination thereof, including but not limited to: RAM and ROM, EPROM, EEPROM, flash memory or other solid state storage technology, CD-ROM, DVD or other optical storage, cassette, magnetic tape, disk storage or other magnetic storage device. Among them:

[0176] The transceiver 142 is used to send a key update message to the first terminal device when the first multicast service group is updated. The key update message is used to update the security key used by the first terminal device in the first multicast service group, and the first multicast service group is used to perform the first multicast service.

[0177] In an example, the key update message includes at least one of the following: an updated key calculation parameter, an updated group key.

[0178] In one example, the key calculation parameter includes a random number.

[0179] In one example, when the group key corresponding to the first multicast service expires, the key update message includes the updated group key; when the group key corresponding to the first multicast service has not expired, the key update message includes the updated key calculation parameter.

[0180] In one example, the security key includes at least one of the following: an encryption key, an integrity protection key; the first multicast service includes any one of the following: a multicast service in V2X, a multicast service in ProSe, and MBMS.

[0181] In one example, the security key includes a traffic key; and the first multicast service includes MBMS.

[0182] In an example, the transceiver 142 is used to receive a service withdrawal request from a second terminal device; the processor 141 is used to withdraw the second terminal device from the first multicast service group according to the service withdrawal request.

[0183] In an example, the service revocation request includes at least one of the following: a multicast service group identifier and an identifier of the first terminal device.

[0184] In an example, the transceiver 142 is used to send a service withdrawal response to the second terminal device, where the service withdrawal response is used to indicate that the second terminal device has completed withdrawal from the first multicast service group.

[0185] An embodiment of the present application also provides a computer-readable storage medium, in which a computer program is stored. The computer program is used to be executed by a processor of a terminal device to implement the key update method on the first terminal device side as described above.

[0186] An embodiment of the present application also provides a computer-readable storage medium, in which a computer program is stored. The computer program is used to be executed by a processor of a core network device to implement the core network device side key update method as described above.

[0187] An embodiment of the present application also provides a chip, which includes a programmable logic circuit and / or program instructions. When the chip runs on a terminal device, it is used to implement the key update method on the first terminal device side as mentioned above.

[0188] An embodiment of the present application also provides a chip, which includes a programmable logic circuit and / or program instructions. When the chip runs on a core network device, it is used to implement the key update method on the core network device side as described above.

[0189] The embodiment of the present application also provides a computer program product. When the computer program product is run on a terminal device, the computer executes the first terminal device side key updating method as described above.

[0190] An embodiment of the present application also provides a computer program product. When the computer program product runs on a core network device, the computer executes the core network device side key update method as described above.

[0191] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the embodiments of the present application can be implemented with hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein the communication media include any media that facilitates the transmission of a computer program from one place to another. The storage medium can be any available medium that a general or special-purpose computer can access.

[0192] The above description is only an exemplary embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A key updating method, characterized in that: Applied in a first terminal device, the method includes: Receiving a key update message from a network device; updating, according to the key update message, a security key used by the first terminal device in a first multicast service group, where the first multicast service group is used to perform a first multicast service; The updating, according to the key update message, of a security key used by the first terminal device in the first multicast service group includes: updating a service key corresponding to the first multicast service according to the key update message, wherein the key update message includes an updated group key; The security key is updated according to the updated service key, wherein the service key is different from the security key.

2. The method according to claim 1, characterized in that The key update message also includes updated key calculation parameters.

3. The method according to claim 2, characterized in that The key calculation parameters include random numbers.

4. The method according to claim 2, characterized in that: In a case where the group key corresponding to the first multicast service expires, the key update message includes the updated group key; In a case where the group key corresponding to the first multicast service has not expired, the key update message includes updated key calculation parameters.

5. The method according to any one of claims 1 to 4, characterized in that: The first multicast service includes any one of the following: a multicast service in vehicle wireless communication technology V2X, a multicast service in short-range communication service ProSe, and a multimedia broadcast multicast service MBMS.

6. The method according to any one of claims 1 to 4, characterized in that: The business key includes a service key; and the first multicast service includes MBMS.

7. The method according to any one of claims 1 to 4, characterized in that: The security key includes at least one of the following: an encryption key, an integrity protection key; the first multicast service includes any one of the following: a multicast service in V2X, a multicast service in ProSe, and MBMS.

8. The method according to any one of claims 1 to 4, characterized in that: The security key includes a traffic key; and the first multicast service includes MBMS.

9. A key updating method, characterized in that: Applied in a core network device, the method comprises: In the event that the first multicast service group is updated, a key update message is sent to the first terminal device, wherein the key update message is used to update the security key used by the first terminal device in the first multicast service group, and the first multicast service group is used to perform a first multicast service, wherein the key update message is specifically used for the first terminal device to update the service key corresponding to the first multicast service according to the key update message, wherein the key update message includes the updated group key; and then the security key is updated according to the updated service key, wherein the service key is different from the security key.

10. The method according to claim 9, characterized in that The key update message also includes updated key calculation parameters.

11. The method according to claim 10, characterized in that The key calculation parameters include random numbers.

12. The method according to claim 10, characterized in that In a case where the group key corresponding to the first multicast service expires, the key update message includes the updated group key; In a case where the group key corresponding to the first multicast service has not expired, the key update message includes updated key calculation parameters.

13. The method according to any one of claims 9 to 12, characterized in that: The security key includes at least one of the following: an encryption key, an integrity protection key; the first multicast service includes any one of the following: a multicast service in vehicle wireless communication technology V2X, a multicast service in short-range communication service ProSe, and a multimedia broadcast multicast service MBMS.

14. The method according to any one of claims 9 to 12, characterized in that: The security key includes a traffic key; and the first multicast service includes MBMS.

15. The method according to any one of claims 9 to 12, characterized in that: The method further comprises: receiving a service cancellation request from a second terminal device; The second terminal device is deregistered from the first multicast service group according to the service deregistration request.

16. The method according to claim 15, characterized in that The service cancellation request includes at least one of the following: a multicast service group identifier and an identifier of the first terminal device.

17. The method according to claim 9, characterized in that The method further comprises: A service withdrawal response is sent to the second terminal device, where the service withdrawal response is used to indicate that the second terminal device has completed withdrawal from the first multicast service group.

18. The method according to any one of claims 9 to 12, characterized in that: The method further comprises: When the subscription service of the third terminal device to the first multicast service expires, the third terminal device is removed from the first multicast service group.

19. The method according to claim 18, characterized in that After the third terminal device is removed from the first multicast service group, the method further includes: Sending revocation prompt information to the third terminal device, where the revocation prompt information is used to indicate that the revocation of the third terminal device from the first multicast service group is complete.

20. A key updating device, characterized in that: Set in a first terminal device, the device includes: A message receiving module, used for receiving a key update message from a network device; A key updating module, configured to update a security key used by the first terminal device in a first multicast service group according to the key updating message, wherein the first multicast service group is used to perform a first multicast service; Wherein, the key update module is used to: updating a service key corresponding to the first multicast service according to the key update message, wherein the key update message includes an updated group key; The security key is updated according to the updated service key, wherein the service key is different from the security key.

21. The device according to claim 20, characterized in that The key update message also includes updated key calculation parameters.

22. The device according to claim 21, characterized in that The key calculation parameters include random numbers.

23. The device according to claim 21, characterized in that In a case where the group key corresponding to the first multicast service expires, the key update message includes the updated group key; In a case where the group key corresponding to the first multicast service has not expired, the key update message includes updated key calculation parameters.

24. The device according to any one of claims 20 to 23, characterized in that The first multicast service includes any one of the following: a multicast service in vehicle wireless communication technology V2X, a multicast service in short-range communication service ProSe, and a multimedia broadcast multicast service MBMS.

25. The device according to any one of claims 20 to 23, characterized in that The business key includes a service key; and the first multicast service includes MBMS.

26. The device according to any one of claims 20 to 23, characterized in that The security key includes at least one of the following: an encryption key, an integrity protection key; the first multicast service includes any one of the following: a multicast service in V2X, a multicast service in ProSe, and MBMS.

27. The device according to any one of claims 20 to 23, characterized in that The security key includes a traffic key; and the first multicast service includes MBMS.

28. A key updating device, characterized in that: Set in a core network device, the device includes: A message sending module is used to send a key update message to a first terminal device when a first multicast service group is updated, wherein the key update message is used to update a security key used by the first terminal device in the first multicast service group, and the first multicast service group is used to perform a first multicast service, wherein the key update message is specifically used for the first terminal device to update a service key corresponding to the first multicast service according to the key update message, wherein the key update message includes an updated group key; and then the security key is updated according to the updated service key, wherein the service key is different from the security key.

29. The device according to claim 28, characterized in that The key update message also includes updated key calculation parameters.

30. The device according to claim 29, characterized in that The key calculation parameters include random numbers.

31. The device according to claim 29, characterized in that In a case where the group key corresponding to the first multicast service expires, the key update message includes the updated group key; In a case where the group key corresponding to the first multicast service has not expired, the key update message includes updated key calculation parameters.

32. The device according to any one of claims 28 to 31, characterized in that The security key includes at least one of the following: an encryption key, an integrity protection key; the first multicast service includes any one of the following: a multicast service in V2X, a multicast service in ProSe, and MBMS.

33. The device according to any one of claims 28 to 31, characterized in that The security key includes a traffic key; or the first multicast service includes MBMS.

34. The device according to any one of claims 28 to 31, characterized in that The device also includes: A request receiving module, used for receiving a service cancellation request from a second terminal device; The first device revoking module is used to revoke the second terminal device from the first multicast service group according to the service revocation request.

35. The device according to claim 34, characterized in that The service cancellation request includes at least one of the following: a multicast service group identifier and an identifier of the first terminal device.

36. The device according to claim 34, characterized in that The device also includes: A response sending module is used to send a service withdrawal response to the second terminal device, where the service withdrawal response is used to indicate that the second terminal device has completed withdrawal from the first multicast service group.

37. The device according to any one of claims 28 to 31, characterized in that The device also includes: The second device revoking module is used to revoke the third terminal device from the first multicast service group when the subscription service of the third terminal device to the first multicast service expires.

38. The device according to claim 37, characterized in that The device also includes: The prompt information sending module is used to send revocation prompt information to the third terminal device, and the revocation prompt information is used to indicate that the third terminal device has completed revocation from the first multicast service group.

39. A terminal device, characterized in that: The terminal device comprises: a processor, and a transceiver connected to the processor; wherein: The transceiver is used to receive a key update message from a network device; The processor is used to update the security key used by the terminal device in the first multicast service group according to the key update message, and the first multicast service group is used to perform a first multicast service, wherein the processor updates the service key corresponding to the first multicast service according to the key update message, wherein the key update message includes the updated group key; and updates the security key according to the updated service key, wherein the service key is different from the security key.

40. A core network device, characterized in that: The core network device includes: a processor, and a transceiver connected to the processor; wherein: The transceiver is used to send a key update message to the first terminal device when the first multicast service group is updated, and the key update message is used to update the security key used by the first terminal device in the first multicast service group, and the first multicast service group is used to perform a first multicast service, wherein the key update message is specifically used for the first terminal device to update the service key corresponding to the first multicast service according to the key update message, wherein the key update message includes the updated group key; and then update the security key according to the updated service key, wherein the service key is different from the security key.

41. A computer-readable storage medium, characterized in that The storage medium stores a computer program, and the computer program is used to be executed by a processor of a terminal device to implement the key updating method according to any one of claims 1 to 8.

42. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and the computer program is used to be executed by a processor of a core network device to implement the key update method as described in any one of claims 9 to 19.

Images