Pre-master key generation method and device for data packet transmission layer security protocol dtls

Abstract

The present disclosure provides a pre-master key generation method, device and equipment of a data packet transmission layer security protocol DTLS and a storage medium, and belongs to the technical field of communication. The method comprises receiving a DTLS message sent by a terminal device, wherein the DTLS message comprises a shared key PSK identifier supported by the terminal device; selecting a PSK identifier from the shared key PSK identifier supported by the terminal device; obtaining a key according to the selected PSK identifier; and generating a pre-master key of the DTLS according to the obtained key. The present disclosure provides a processing method for the case of "pre-master key generation of a data packet transmission layer security protocol DTLS", and generates a pre-master key corresponding to the selected PSK identifier, so that the DTLS can support the security requirements of the Ua interface for GBA and the Ua* interface for AKMA, and the security during communication can be improved.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of communication technology, and particularly relates to a pre-master key generation method, device and equipment of a data packet transmission layer security protocol DTLS and a storage medium. BACKGROUND

[0002] In a communication system, Authentication and Key management for Applications based on 3GPP credentials (AKMA) specification and Generic Bootstrapping Architecture (GBA) specification enable a User Equipment (UE) and an Application Function (AF) / Network Application Function (NAF) to share a common key after an application session establishment process. SUMMARY

[0003] The present disclosure provides a pre-master key generation method, device and equipment of a data packet transmission layer security protocol DTLS and a storage medium, which generates a pre-master key corresponding to a selected PSK identifier, so that the DTLS can support the security requirements of a Ua interface for GBA and a Ua* interface for AKMA, and improve the security during communication.

[0004] An aspect of the present disclosure provides a pre-master key generation method of a data packet transmission layer security protocol DTLS, applied to a first entity, and the method comprises:

[0005] Confirming a PSK identifier, the PSK identifier being one of shared key PSK identifiers supported by a terminal device, the terminal device being associated with the first entity;

[0006] Obtaining a key according to the selected PSK identifier;

[0007] Generating a pre-master key (premaster secret) of the DTLS according to the obtained key.

[0008] Another aspect of the present disclosure provides a pre-master key generation method of a data packet transmission layer security protocol DTLS, applied to a first entity, and the method comprises:

[0009] receiving a DTLS message sent by a terminal device, wherein the DTLS message comprises a PSK (Pre-Shared Key) identity supported by the terminal device;

[0010] selecting a PSK identity from the PSK identities supported by the terminal device;

[0011] obtaining a key according to the selected PSK identity;

[0012] generating a pre-master key of the DTLS according to the obtained key.

[0013] In another aspect, embodiments of the present disclosure provide a method for generating a pre-master key of a DTLS (Datagram Transport Layer Security) protocol, applied to a first entity, the method comprising:

[0014] receiving a DTLS message sent by a terminal device, wherein the DTLS message comprises a PSK-based cipher suite supported by the terminal device;

[0015] in response to the first entity supporting the PSK-based cipher suite, sending a PSK (Pre-Shared Key) hint to the terminal device through a DTLS message;

[0016] receiving a PSK identity sent by the terminal device;

[0017] obtaining a key according to the received PSK identity;

[0018] generating a pre-master key of the DTLS according to the obtained key.

[0019] In another aspect, embodiments of the present disclosure provide a method for generating a pre-master key of a DTLS (Datagram Transport Layer Security) protocol, applied to a terminal device, the method comprising:

[0020] sending a DTLS message to a first entity, wherein the DTLS message comprises a PSK (Pre-Shared Key) identity supported by the terminal device.

[0021] In another aspect, embodiments of the present disclosure provide a method for generating a pre-master key of a DTLS (Datagram Transport Layer Security) protocol, applied to a terminal device, the method comprising:

[0022] sending a DTLS message to a first entity, wherein the DTLS message comprises a PSK-based cipher suite supported by the terminal device;

[0023] in response to the first entity supporting the PSK-based cipher suite, receiving a PSK (Pre-Shared Key) hint sent by the first entity;

[0024] sending a PSK identity to the first entity.

[0025] An embodiment of the present disclosure provides a pre-master key generation device of a DTLS, which is arranged at a first entity side and comprises:

[0026] a transceiver configured to receive a DTLS message sent by a terminal device, wherein the DTLS message comprises a PSK identity supported by the terminal device;

[0027] a processing module configured to select a PSK identity from the PSK identities supported by the terminal device;

[0028] the processing module is further configured to obtain a key according to the selected PSK identity;

[0029] the processing module is further configured to generate a pre-master key of the DTLS according to the obtained key.

[0030] An embodiment of the present disclosure provides a pre-master key generation device of a DTLS, which is arranged at a first entity side and comprises:

[0031] a transceiver configured to receive a DTLS message sent by a terminal device, wherein the DTLS message comprises a PSK-based cipher suite supported by the terminal device;

[0032] the transceiver is further configured to send a PSK prompt to the terminal device through a DTLS message in response to the fact that the first entity supports the PSK-based cipher suite;

[0033] the transceiver is further configured to receive a PSK identity sent by the terminal device;

[0034] a processing module configured to obtain a key according to the received PSK identity;

[0035] the processing module is further configured to generate a pre-master key of the DTLS according to the obtained key.

[0036] An embodiment of the present disclosure provides a pre-master key generation device of a DTLS, which is arranged at a terminal device side and comprises:

[0037] a transceiver configured to send a DTLS message to a first entity, wherein the DTLS message comprises a PSK identity supported by the terminal device.

[0038] The pre-master key generation device of the DTLS (Datagram Transport Layer Security) protocol according to another aspect of the embodiments of the present disclosure is arranged at a terminal device, and comprises:

[0039] The transceiver module is configured to send a DTLS message to the first entity, wherein the DTLS message comprises a PSK-based cipher suite supported by the terminal device.

[0040] The transceiver module is further configured to receive a PSK prompt sent by the first entity in response to the first entity supporting the PSK-based cipher suite.

[0041] The transceiver module is further configured to send a PSK identifier to the first entity.

[0042] The first entity according to another aspect of the embodiments of the present disclosure comprises a processor and a memory, wherein the memory stores a computer program, and the processor executes the computer program stored in the memory, so that the device executes the method according to the above aspect of the embodiments.

[0043] The terminal device according to another aspect of the embodiments of the present disclosure comprises a processor and a memory, wherein the memory stores a computer program, and the processor executes the computer program stored in the memory, so that the device executes the method according to the above aspect of the embodiments.

[0044] The pre-master key generation system of the DTLS (Datagram Transport Layer Security) protocol according to another aspect of the embodiments of the present disclosure comprises:

[0045] The first entity is configured to execute the method according to the above aspect of the embodiments.

[0046] The terminal device is configured to execute the method according to the above aspect of the embodiments.

[0047] The communication device according to another aspect of the embodiments of the present disclosure comprises a processor and an interface circuit.

[0048] The interface circuit is configured to receive code instructions and transmit the code instructions to the processor.

[0049] The processor is configured to run the code instructions to execute the method according to the aspect of the embodiments.

[0050] The computer readable storage medium according to another aspect of the embodiments of the present disclosure is used to store instructions, and when the instructions are executed, the method according to the aspect of the embodiments is implemented.

[0051] In the embodiments of the present disclosure, a DTLS message sent by a terminal device is received, wherein the DTLS message includes a shared key PSK identifier supported by the terminal device; one PSK identifier is selected from the shared key PSK identifiers supported by the terminal device; a key is obtained according to the selected PSK identifier; and a pre-master key of DTLS is generated according to the obtained key. In the embodiments of the present disclosure, by generating a pre-master key corresponding to the selected PSK identifier, the DTLS can support the security requirements of the Ua interface for GBA and the Ua* interface for AKMA, and the security during communication can be improved. The present disclosure provides a processing method for the case of "pre-master key generation of data packet transmission layer security protocol DTLS", and by using the DTLS message including the pre-master key through the Ua interface for GBA and the Ua* interface for AKMA to authenticate the terminal device and the first entity, the messages carried through the Ua* interface and the Ua interface can be protected, and the security during communication can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0052] The above and / or additional aspects and advantages of the present disclosure will become apparent and more readily appreciated from the following description of the embodiments, taken in conjunction with the accompanying drawings in which:

[0053] Figure 1 A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS provided by an embodiment of the present disclosure;

[0054] Figure 2 A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS provided by another embodiment of the present disclosure;

[0055] Figure 3 A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS provided by another embodiment of the present disclosure;

[0056] Figure 4 A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS provided by another embodiment of the present disclosure;

[0057] Figure 5 A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS provided by another embodiment of the present disclosure;

[0058] Figure 6 A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS provided by another embodiment of the present disclosure;

[0059] Figure 7A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS according to another embodiment of the present disclosure is shown in FIG. 6;

[0060] Figure 8 A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS according to another embodiment of the present disclosure is shown in FIG. 6;

[0061] Figure 9 A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS according to another embodiment of the present disclosure is shown in FIG. 6;

[0062] Figure 10 A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS according to another embodiment of the present disclosure is shown in FIG. 6;

[0063] Figure 11 A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS according to another embodiment of the present disclosure is shown in FIG. 6;

[0064] Figure 12 A structural diagram of a pre-master key generation device of a data packet transmission layer security protocol DTLS according to an embodiment of the present disclosure is shown in FIG. 7;

[0065] Figure 13 A structural diagram of a pre-master key generation device of a data packet transmission layer security protocol DTLS according to another embodiment of the present disclosure is shown in FIG. 7;

[0066] Figure 14 A structural diagram of a pre-master key generation device of a data packet transmission layer security protocol DTLS according to another embodiment of the present disclosure is shown in FIG. 7;

[0067] Figure 15 A structural diagram of a pre-master key generation device of a data packet transmission layer security protocol DTLS according to another embodiment of the present disclosure is shown in FIG. 7;

[0068] Figure 16 A structural diagram of a pre-master key generation system of a data packet transmission layer security protocol DTLS according to an embodiment of the present disclosure is shown in FIG. 8;

[0069] Figure 17 A block diagram of a terminal device according to an embodiment of the present disclosure is shown in FIG. 9;

[0070] Figure 18 A block diagram of a network side device according to an embodiment of the present disclosure is shown in FIG. 10. DETAILED DESCRIPTION

[0071] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The following description is made with reference to the accompanying drawings in which like reference numerals refer to like elements, unless the context of use indicates otherwise. The following description of exemplary embodiments is not representative of all embodiments consistent with the present disclosure. Rather, it is merely an example of apparatus and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0072] The terminology used in the present disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the present disclosure. As used in the present disclosure and the appended claims, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0073] It is to be understood that the singular forms "a," "an," and "the" include plural referents unless the context clearly dictates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. It will be further understood that the terms "if" and / or "when," as used herein, can be interpreted to mean "upon" or "in response to determining" terms used herein.

[0074] In the present disclosure, a network element or a network function can be implemented by a standalone hardware device or by software in a hardware device, and the present disclosure does not limit the implementation.

[0075] In a communication system, Authentication and Key management for Applications based on 3GPP credentials (AKMA) specification and Generic Bootstrapping Architecture (GBA) specification enable a User Equipment (UE) and an Application Function (AF) / Network Application Function (NAF) to share a common key after an application session establishment procedure.

[0076] To protect the application layer interface Ua* (for AKMA) and Ua (for GBA) between the UE and the AF, various security protocols can be used, such as the Transport Layer Security (TLS) protocol.

[0077] One option for an Internet of Things friendly protocol is the Internet Engineering Task Force (IETF) Datagram Transport Layer Security (DTLS) specified in IETF Request for Comments (RFC) 7252 [4], which uses the IETF Constrained Application Protocol (CoAP) as the underlying transport layer.

[0078] In the SEAL specification, the communication security of CoAP is based on DTLS or Object Security for Constrained RESTful Environments (OSCORE) for RESTful environments. The security of CoAP based on DTLS is specified in RFC 6347 [6]. IETF DTLS is currently specified as one option for providing security for the Open Mobile Alliance (OMA) Lightweight Machine-to-Machine / Man (M2M) standards. However, how to use DTLS to support the security of the Ua interface for GBA and the Ua* interface for AKMA has not been specified.

[0079] A method, apparatus, device and storage medium for generating a pre-master key of a Datagram Transport Layer Security (DTLS) protocol are described below with reference to the accompanying drawings.

[0080] One embodiment of the present disclosure provides a method for generating a pre-master key of a Datagram Transport Layer Security (DTLS) protocol, which is applied to a first entity. The method can include the following steps:

[0081] 001. Confirming a PSK identifier, the PSK identifier being one of shared key PSK identifiers supported by a terminal device, the terminal device being associated with the first entity;

[0082] 002. Obtaining a key according to the selected PSK identifier;

[0083] 003、generate a premaster secret of DTLS according to the obtained key.

[0084] In an embodiment of the present disclosure, the first entity can receive a DTLS message sent by the terminal device, the DTLS message comprising a shared key PSK identity supported by the terminal device, and the first entity can select a PSK identity from the shared key PSK identity. The first entity can receive a message from the terminal device, that is, the first entity is associated with the terminal device.

[0085] In an embodiment of the present disclosure, the first entity can be an AF entity or a NAF entity. At this time, the first entity can receive a DTLS message sent by the terminal device. Based on its own security capability, the first entity can also select a PSK identity received from the terminal device. Secondly, the first entity can obtain a key according to the selected PSK identity, and derive a premaster secret of DTLS by using the key as an input parameter.

[0086] Optionally, in an embodiment of the present disclosure, the DTLS message can refer to a message sent based on the DTLS protocol.

[0087] In an embodiment of the present disclosure, the PSK identity supported by the terminal device can refer to a PSK identity supported by the terminal device and related to different scenarios. For example, it can include a PSK identity related to AKMA, a PSK identity related to GBA, etc.

[0088] In an embodiment of the present disclosure, the PSK identity comprises a PSK identity hint, an AKMA Key Identifier (A-KID) and a Bootstrapping Transaction Identifier (B-TID). The contents included in the PSK identity for different scenarios can be different. For example, the PSK identity related to AKMA can include a first PSK identity hint and / or A-KID. Or, the PSK identity related to GBA can include a second PSK identity hint and B-TID.

[0089] Optionally, in an embodiment of the present disclosure, the PSK hint can refer to the hint information corresponding to the PSK identity. When the application scenario changes, the corresponding PSK hint can change.

[0090] Optionally, in an embodiment of the present disclosure, the A-KID can be used to find a key associated with AKMA during identity verification.

[0091] Optionally, in an embodiment of the present disclosure, the B-TID can refer to a key used to find a key associated with GBA during identity verification.

[0092] Optionally, in an embodiment of the present disclosure, the first entity can obtain the key from the network based on the selected PSK identity when obtaining the key according to the selected PSK identity.

[0093] In summary, in an embodiment of the present disclosure, the PSK identity is confirmed, the PSK identity is one of the shared key PSK identities supported by the terminal device, and the terminal device is associated with the first entity; the key is obtained according to the selected PSK identity; the premaster secret of the DTLS is generated according to the obtained key; in an embodiment of the present disclosure, by generating the premaster secret corresponding to the selected PSK identity, the DTLS can support the security requirements of the Ua interface for GBA and the Ua* interface for AKMA, and the security during communication can be improved. The present disclosure provides a processing method for the case of "premaster secret generation of data packet transmission layer security protocol DTLS", which can enable the Ua interface for GBA and the Ua* interface for AKMA to authenticate the terminal device and the first entity using the DTLS message including the premaster secret, and can protect the messages carried through the Ua* interface and the Ua interface, and can improve the security during communication.

[0094] Figure 1 A flowchart of a data packet transmission layer security protocol DTLS premaster secret generation method provided by an embodiment of the present disclosure is shown in the figure. The method is applied to a first entity, as shown in the figure, and can include the following steps: Figure 1

[0095] Step 101, receiving a DTLS message sent by a terminal device, wherein the DTLS message includes shared key PSK identity (PSK identity) supported by the terminal device;

[0096] Step 102, selecting one PSK identity from the shared key PSK identity supported by the terminal device;

[0097] Step 103, obtaining a key according to the selected PSK identity;

[0098] Step 104, generating a premaster secret of the DTLS according to the obtained key.

[0099] ​It should be noted that in an embodiment of the present disclosure, the terminal device can refer to a device that provides voice and / or data connectivity for a user. The terminal device can communicate with one or more core networks via a RAN (Radio Access Network), and can be an IoT terminal such as a sensor device, a mobile phone (also known as a "cellular" phone), and a computer with an IoT terminal, for example, which can be a fixed, portable, pocket, handheld, computer-embedded, or vehicle-mounted device. For example, a subscriber station (STA), a subscriber unit, a subscriber station, a mobile station, a mobile, a remote station, an access point, a remote terminal, an access terminal, a user terminal, or a user agent. Alternatively, the terminal device can also be a device of an unmanned aerial vehicle. Alternatively, the terminal device can also be a vehicle-mounted device, which can be a vehicle-mounted computer with wireless communication function or a wireless terminal of an external vehicle-mounted computer. Alternatively, the terminal device can also be a roadside device, which can be a street lamp, a signal lamp, or other roadside devices with wireless communication function, etc.

[0100] In an embodiment of the present disclosure, the first entity can be an AF entity or a NAF entity. At this time, the first entity can receive the DTLS message sent by the terminal device. Based on its own security capability, the first entity can also select the PSK identity received from the terminal device. Secondly, the first entity can obtain the key according to the selected PSK identity, and derive the pre-master key of DTLS by using the key as an input parameter.

[0101] Optionally, in an embodiment of the present disclosure, the DTLS message can refer to a message sent based on the DTLS protocol.

[0102] In an embodiment of the present disclosure, the PSK identity supported by the terminal device can refer to the PSK identity supported by the terminal device in relation to different scenarios. For example, it can include AKMA-related PSK identity, GBA-related PSK identity, etc.

[0103] In an embodiment of the present disclosure, the PSK identity includes a PSK identity hint, an AKMA Key Identifier (A-KID), and a Bootstrapping Transaction Identifier (B-TID). The PSK identity for different scenarios can include different contents. For example, the PSK identity related to AKMA can include a first PSK identity hint and / or A-KID. Alternatively, the PSK identity related to GBA can include a second PSK identity hint and B-TID.

[0104] Optionally, in an embodiment of the present disclosure, the PSK identity hint can refer to the corresponding prompt information of the PSK identity. When the application scenario changes, the corresponding PSK identity hint can also change.

[0105] Optionally, in an embodiment of the present disclosure, the A-KID can be used to find the key associated with AKMA during identity verification.

[0106] Optionally, in an embodiment of the present disclosure, the B-TID can refer to a key used to find the key associated with GBA during identity verification.

[0107] In an embodiment of the present disclosure, when the key is obtained according to the selected PSK identity, the first entity can obtain the key from the network based on the selected PSK identity.

[0108] It should be noted that the above embodiments are not exhaustive, and only some embodiments are shown, and the above embodiments can be implemented alone or in combination with multiple embodiments. The above embodiments are only used as an example and do not specifically limit the protection scope of the embodiments of the present disclosure.

[0109] In the embodiments of the present disclosure, a DTLS message sent by a terminal device is received, wherein the DTLS message includes a shared key PSK identifier supported by the terminal device; one PSK identifier is selected from the shared key PSK identifiers supported by the terminal device; a key is obtained according to the selected PSK identifier; and a pre-master key of DTLS is generated according to the obtained key. In the embodiments of the present disclosure, by generating a pre-master key corresponding to the selected PSK identifier, the DTLS can support the security requirements of the Ua interface for GBA and the Ua* interface for AKMA, and the security during communication can be improved. The present disclosure provides a processing method for the case of "pre-master key generation of data packet transmission layer security protocol DTLS", which can enable the Ua interface for GBA and the Ua* interface for AKMA to authenticate the terminal device and the first entity by using the DTLS message including the pre-master key, can protect the messages carried through the Ua* interface and the Ua interface, and can improve the security during communication.

[0110] Figure 2 A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS provided by the embodiments of the present disclosure is shown in the figure. The method is applied to a first entity, such as Figure 2 As shown in the figure, the method can include the following steps:

[0111] Step 201, receiving a DTLS message sent by a terminal device, wherein the DTLS message includes a shared key PSK identifier supported by the terminal device;

[0112] Step 202, selecting one PSK identifier from the shared key PSK identifiers supported by the terminal device, wherein the PSK identifier includes a first PSK prompt and / or an AKMA key identifier A-KID in an application authentication and key management AKMA scenario;

[0113] Step 203, in response to the selected PSK identifier being an AKMA-related PSK identifier, using the A-KID to obtain an AKMA application key KAF of the first entity from an AKMA anchor function AAnF;

[0114] Step 204, generating a pre-master key of DTLS according to the AKMA application key KAF of the first entity.

[0115] In one embodiment of the present disclosure, the first PSK prompt includes 3GPP-AKMA.

[0116] In one embodiment of the present disclosure, the first entity can be an AF entity or an NAF entity.

[0117] In the embodiments of the present disclosure, a DTLS message sent by a terminal device is received, wherein the DTLS message includes a shared key PSK identifier supported by the terminal device; one PSK identifier is selected from the shared key PSK identifiers supported by the terminal device, the PSK identifier includes a first PSK prompt and / or an AKMA key identifier A-KID in an application authentication and key management AKMA scenario; in response to the selected PSK identifier being an AKMA-related PSK identifier, an A-KID is used to obtain an AKMA application key KAF of a first entity from an AKMA anchor function AAnF; and a pre-master key of DTLS is generated according to the AKMA application key KAF of the first entity. In the embodiments of the present disclosure, by generating a pre-master key corresponding to an AKMA-related PSK identifier, the DTLS can support the security requirements of the Ua* interface for AKMA, and the security during communication can be improved. The present disclosure provides a processing method for the case of "pre-master key generation of data packet transmission layer security protocol DTLS", which can enable the Ua* interface for AKMA to authenticate the terminal device and the first entity by using the DTLS message including the pre-master key, can protect the messages carried through the Ua interface, and can improve the security during communication.

[0118] Figure 3 A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS provided by the embodiments of the present disclosure is shown in the figure. The method is applied to a first entity, and can include the following steps: Figure 3

[0119] Step 301, receiving a DTLS message sent by a terminal device, wherein the DTLS message includes a shared key PSK identifier supported by the terminal device;

[0120] Step 302, selecting one PSK identifier from the shared key PSK identifiers supported by the terminal device, the PSK identifier including a second PSK prompt and / or a bootstrapping transaction identifier B-TID in a general bootstrapping architecture GBA scenario;

[0121] Step 303, in response to the selected PSK identifier being a GBA-related PSK identifier, using the B-TID and / or the second PSK prompt to obtain a GBA-related key from a bootstrapping server functionality BSF;

[0122] Step 304, generating a pre-master key of DTLS according to the GBA-related key.

[0123] ​In an embodiment of the present disclosure, the second PSK hint comprises one of 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest or 3GPP-gba-digest.

[0124] In an embodiment of the present disclosure, when the first entity is an AF entity, in response to the AF selecting a PSK identity related to GBA, the AF can use the B-TID and / or the second PSK hint to obtain a key related to GBA from the BSF.

[0125] In an embodiment of the present disclosure, when the first entity is an NAF entity, in response to the NAF selecting a PSK identity related to GBA, the NAF can use the B-TID and / or the second PSK hint to obtain a key related to GBA from the BSF.

[0126] In an embodiment of the present disclosure, when the BSF obtains a key related to GBA, the obtained key can be one of Ks_ext_NAF, Ks_int_NAF or Ks_NAF.

[0127] In summary, in an embodiment of the present disclosure, a DTLS message sent by a terminal device is received, wherein the DTLS message comprises a shared key PSK identity supported by the terminal device; one PSK identity is selected from the shared key PSK identity supported by the terminal device, the PSK identity comprises a second PSK hint and / or a bootstrapping transaction identifier B-TID in a general bootstrapping architecture GBA scenario; in response to the selected PSK identity being a PSK identity related to GBA, a key related to GBA is obtained from a bootstrapping server function BSF using the B-TID and / or the second PSK hint; and a pre-master key of DTLS is generated according to the key related to GBA. In an embodiment of the present disclosure, by generating a pre-master key corresponding to a PSK identity related to GBA, the DTLS can support the security requirements of a Ua interface for GBA, and the security during communication can be improved. The present disclosure provides a processing method for the case of "pre-master key generation of a data packet transmission layer security protocol DTLS", which can enable the Ua interface for GBA to authenticate a terminal device and a first entity using a DTLS message comprising a pre-master key, can protect messages carried through the Ua interface, and can improve the security during communication.

[0128] Figure 4 A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS provided in an embodiment of the present disclosure, which is applied to a first entity, such asFigure 4 As shown, the method can include the following steps:

[0129] Step 401, receiving a DTLS message sent by a terminal device, wherein the DTLS message includes a shared key PSK identifier supported by the terminal device;

[0130] Step 402, selecting a PSK identifier from the shared key PSK identifiers supported by the terminal device;

[0131] Step 403, obtaining a key according to the selected PSK identifier;

[0132] Step 404, generating a pre-master key of DTLS according to the obtained key;

[0133] Step 405, sending information related to the selected PSK identifier to the terminal device through the DTLS message.

[0134] In an embodiment of the present disclosure, the steps 401 to 404 can refer to the above-mentioned embodiment description, and the embodiments of the present disclosure are not limited herein. The optional examples in the embodiments of the present disclosure can be combined arbitrarily, and the embodiments of the present disclosure can be combined with the steps of other embodiments, the optional examples in other embodiments, without contradiction.

[0135] In an embodiment of the present disclosure, when the first entity is an AF entity, the AF can send the information related to the selected PSK identifier to the terminal device.

[0136] In an embodiment of the present disclosure, when the first entity is an NAF entity, the NAF can send the information related to the selected PSK identifier to the terminal device. In an embodiment of the present disclosure, the information related to the selected PSK identifier can be, for example, an indicator of the selected PSK identifier.

[0137] In the embodiments of the present disclosure, a DTLS message sent by a terminal device is received, wherein the DTLS message includes a shared key PSK identifier supported by the terminal device; one PSK identifier is selected from the shared key PSK identifiers supported by the terminal device; a key is obtained according to the selected PSK identifier; a pre-master key of DTLS is generated according to the obtained key; and related information of the selected PSK identifier is sent to the terminal device through the DTLS message. In the embodiments of the present disclosure, the pre-master key corresponding to the selected PSK identifier is generated, so that the DTLS can support the security requirements of the Ua interface for GBA and the Ua* interface for AKMA, and the security during communication can be improved. The present disclosure provides a processing method for the case of "pre-master key generation of DTLS", which can enable the Ua interface for GBA and the Ua* interface for AKMA to authenticate the terminal device and the first entity by using the DTLS message including the pre-master key, can protect the messages carried through the Ua* interface and the Ua interface, and can improve the security during communication.

[0138] Figure 5 A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS provided by the embodiments of the present disclosure is shown in the figure. The method is applied to a first entity, such as Figure 5 As shown in the figure, the method can include the following steps:

[0139] Step 501, receiving a DTLS message sent by a terminal device, wherein the DTLS message includes a PSK-based cipher suite supported by the terminal device;

[0140] Step 502, in response to the first entity supporting the PSK-based cipher suite, sending a PSK prompt to the terminal device through the DTLS message;

[0141] Step 503, receiving a PSK identifier sent by the terminal device;

[0142] Step 504, obtaining a key according to the received PSK identifier;

[0143] Step 505, generating a pre-master key of DTLS according to the obtained key.

[0144] In one embodiment of the present disclosure, the first entity can be an AF entity. In this case, the AF can receive a DTLS message sent by the terminal device, the DTLS message including all PSK-based cipher suites supported by the terminal device, and return a PSK hint supported by the AF to the terminal device. Then, the AF can receive a PSK identifier corresponding to the PSK hint sent by the terminal device, and obtain a key according to the received PSK identifier. Finally, the AF can derive a pre-master key of the DTLS with the obtained key as an input parameter.

[0145] In one embodiment of the present disclosure, the first entity can be an NAF entity. In this case, the NAF can receive a DTLS message sent by the terminal device, the DTLS message including all PSK-based cipher suites supported by the terminal device, and return a PSK hint supported by the NAF to the terminal device. Then, the NAF can receive a PSK identifier corresponding to the PSK hint sent by the terminal device, and obtain a key according to the received PSK identifier. Finally, the NAF can derive a pre-master key of the DTLS with the obtained key as an input parameter.

[0146] In one embodiment of the present disclosure, the PSK identifier sent by the terminal device can be a combination of the PSK hint and the A-KID or a combination of the PSK hint and the B-TID. The PSK hint can be one of 3GPP-AKMA, 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest, or 3GPP-gba-digest.

[0147] In one embodiment of the present disclosure, the PSK hint includes at least one of 3GPP-AKMA, 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest, or 3GPP-gba-digest.

[0148] In one embodiment of the present disclosure, when obtaining the key according to the selected PSK identifier, the first entity can obtain the key from the network based on the selected PSK identifier.

[0149] In the embodiments of the present disclosure, a DTLS message sent by a terminal device is received, wherein the DTLS message includes a PSK-based cipher suite supported by the terminal device; a PSK prompt is sent to the terminal device through the DTLS message in response to the first entity supporting the PSK-based cipher suite; a PSK identifier sent by the terminal device is received; a key is obtained according to the received PSK identifier; and a pre-master key of DTLS is generated according to the obtained key. In the embodiments of the present disclosure, by generating a pre-master key corresponding to the supported cipher suite, the DTLS can support the security requirements of the Ua interface for GBA and the Ua* interface for AKMA, and the security during communication can be improved. The present disclosure provides a processing method for the case of "pre-master key generation of data packet transmission layer security protocol DTLS", which can enable the Ua interface for GBA and the Ua* interface for AKMA to authenticate the terminal device and the first entity by using the DTLS message including the pre-master key, and can protect the messages carried through the Ua* interface and the Ua interface, thereby improving the security during communication.

[0150] Figure 6 A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS provided by the embodiments of the present disclosure is shown in the figure. The method is applied to a first entity, and can include the following steps: Figure 6

[0151] Step 601: receiving a DTLS message sent by a terminal device, wherein the DTLS message includes a PSK-based cipher suite supported by the terminal device;

[0152] Step 602: sending a PSK prompt to the terminal device through the DTLS message in response to the first entity supporting the PSK-based cipher suite;

[0153] Step 603: receiving a PSK identifier sent by the terminal device, wherein the PSK identifier includes a first PSK prompt and / or an AKMA key identifier A-KID in an application authentication and key management AKMA scenario;

[0154] Step 604: obtaining an AKMA application key KAF of the first entity from an AKMA anchor function AAnF using the A-KID in response to the received PSK identifier being an AKMA-related PSK identifier;

[0155] Step 605: generating a pre-master key of DTLS according to the AKMA application key KAF of the first entity.

[0156] ​Among them, in one embodiment of the present disclosure, the first entity can be an AF entity or a NAF entity.

[0157] And, in one embodiment of the present disclosure, the first PSK prompt includes 3GPP-AKMA.

[0158] In summary, in an embodiment of the present disclosure, a DTLS message sent by a terminal device is received, wherein the DTLS message includes a PSK-based cipher suite supported by the terminal device; in response to the first entity supporting the PSK-based cipher suite, a PSK prompt is sent to the terminal device through the DTLS message; a PSK identifier sent by the terminal device is received, the PSK identifier including a first PSK prompt and / or an AKMA key identifier A-KID in an application authentication and key management AKMA scenario; in response to the received PSK identifier being an AKMA-related PSK identifier, an AKMA application key KAF of the first entity is obtained from an AKMA anchor function AAnF using the A-KID; and a pre-master key of DTLS is generated according to the AKMA application key KAF of the first entity. In an embodiment of the present disclosure, by generating a pre-master key corresponding to a PSK-based cipher suite supporting AKMA, the DTLS can support the security requirements of the Ua* interface for AKMA, and the security during communication can be improved. The present disclosure provides a processing method for the case of "pre-master key generation of data packet transmission layer security protocol DTLS", which can enable the Ua* interface for AKMA to authenticate the terminal device and the first entity using the DTLS message including the pre-master key, can protect the messages carried through the Ua interface, and can improve the security during communication.

[0159] Figure 7 A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS provided by an embodiment of the present disclosure is shown in the figure. The method is applied to a first entity, as shown in the figure, and can include the following steps: Figure 7

[0160] Step 701, receiving a DTLS message sent by a terminal device, wherein the DTLS message includes a PSK-based cipher suite supported by the terminal device;

[0161] Step 702, in response to the first entity supporting the PSK-based cipher suite, sending a PSK prompt to the terminal device through the DTLS message;

[0162] Step 703, receiving a PSK identifier sent by the terminal device, the PSK identifier including a second PSK prompt and / or a boot transaction identifier B-TID in a general boot architecture GBA scenario;​

[0163] In step 704, in response to the received PSK identity being a PSK identity related to GBA, a key related to GBA is acquired from the BSF using the B-TID and / or the second PSK hint.

[0164] In step 705, a pre-master key of DTLS is generated according to the key related to GBA.

[0165] In an embodiment of the present disclosure, the first entity can be an AF entity or a NAF entity.

[0166] In an embodiment of the present disclosure, the second PSK hint includes one of 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest or 3GPP-gba-digest.

[0167] In an embodiment of the present disclosure, when the key related to GBA is acquired from the BSF, the retrieved key can be one of Ks_ext_NAF, Ks_int_NAF or Ks_NAF.

[0168] In summary, in an embodiment of the present disclosure, a DTLS message sent by a terminal device is received, wherein the DTLS message includes a PSK-based cipher suite supported by the terminal device; in response to the first entity supporting the PSK-based cipher suite, a PSK hint is sent to the terminal device through the DTLS message; a PSK identity sent by the terminal device is received, wherein the PSK identity includes a second PSK hint and / or a bootstrapping transaction identifier B-TID in a generic bootstrapping architecture GBA scenario; in response to the received PSK identity being a PSK identity related to GBA, a key related to GBA is acquired from the BSF using the B-TID and / or the second PSK hint; and a pre-master key of DTLS is generated according to the key related to GBA. In an embodiment of the present disclosure, by generating a pre-master key corresponding to a PSK-based cipher suite corresponding to GBA support, the DTLS can support the security requirements of a Ua interface for GBA, and the security during communication can be improved. The present disclosure provides a processing method for a pre-master key generation of a data packet transport layer security protocol DTLS, which can enable the Ua interface for GBA to authenticate a terminal device and a first entity using a DTLS message including a pre-master key, can protect messages carried through the Ua interface, and can improve the security during communication.

[0169] Figure 8This is a flowchart illustrating a pre-master key generation method for the Data Transport Layer Security (DTLS) protocol provided in this disclosure. The method is applied to a terminal device, such as... Figure 8 As shown, the method may include the following steps:

[0170] Step 801: Send a DTLS message to the first entity, wherein the DTLS message includes the identifier of the shared key PSK supported by the terminal device.

[0171] In one embodiment of this disclosure, the description of step 801 can be found in the above-described embodiments, and this disclosure does not limit the scope of the embodiments. The optional examples in this disclosure can be arbitrarily combined, and without contradiction, this disclosure can be combined with steps from other embodiments and optional examples from other embodiments.

[0172] In one embodiment of this disclosure, the PSK identifier includes the PSK prompt, A-KID, and B-TID.

[0173] Furthermore, in one embodiment of this disclosure, the PSK identifier may include a first PSK hint and / or an AKMA key identifier (A-KID) in an application authentication and key management (AKMA) scenario. The first PSK hint includes 3GPP-AKMA.

[0174] Furthermore, in one embodiment of this disclosure, the PSK identifier may also include a second PSK hint and / or a boot transaction identifier (B-TID) in a General Boot Architecture (GBA) scenario. The second PSK hint includes one of 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest, or 3GPP-gba-digest.

[0175] In summary, in the embodiments of the present disclosure, a DTLS message is sent to the first entity, wherein the DTLS message includes a shared key PSK identifier supported by the terminal device. In the embodiments of the present disclosure, the first entity can generate a pre-master key corresponding to the selected PSK identifier according to the DTLS message sent by the terminal device, so that the DTLS can support the security requirements of the Ua interface for GBA and the Ua* interface for AKMA, and the security during communication can be improved. The present disclosure provides a processing method for the case of "pre-master key generation of data packet transmission layer security protocol DTLS", which can enable the Ua interface for GBA and the Ua* interface for AKMA to authenticate the terminal device and the first entity using the DTLS message including the pre-master key, can protect the messages carried through the Ua* interface and the Ua interface, and can improve the security during communication.

[0176] Figure 9 A flowchart of a data packet transmission layer security protocol DTLS pre-master key generation method provided by the embodiments of the present disclosure is shown in the figure. The method is applied to a terminal device, as shown in the figure, and can include the following steps: Figure 9

[0177] Step 901, a DTLS message is sent to the first entity, wherein the DTLS message includes a shared key PSK identifier supported by the terminal device.

[0178] Step 902, accept the information related to the selected PSK identifier sent by the first entity.

[0179] Step 903, derive the pre-master key of the DTLS according to the information related to the selected PSK identifier.

[0180] In one embodiment of the present disclosure, based on the pre-master key of the DTLS, the terminal device can securely send a CoAP message to the first entity.

[0181] In one embodiment of the present disclosure, when the terminal device generates the pre-master key of the DTLS according to the information related to the selected PSK identifier, the terminal device can generate the pre-master key of the DTLS in the same way as the first entity generates the pre-master key based on the PSK identifier selected by the first entity. That is, the terminal device can derive the DTLS pre-master key through the key associated with the PSK identifier sent to the first entity.

[0182] ​In one embodiment of this disclosure, the terminal device can deduce the AKMA application key KAF using the A-KID based on the AKMA-related PSK identifier sent by the first entity, and then generate a DTLS pre-master key based on the terminal device's AKMA application key KAF. Alternatively, the terminal device can deduce the GBA-related key using the B-TID and / or a second PSK hint based on the GBA-related PSK identifier sent by the first entity, and then generate a DTLS pre-master key based on the GBA-related key.

[0183] Furthermore, in one embodiment of this disclosure, the GBA-related key derived by the terminal can be one of Ks_ext_NAF, Ks_int_NAF, and Ks_NAF.

[0184] In summary, in the embodiments of this disclosure, a DTLS message is sent to a first entity, wherein the DTLS message includes a shared key (PSK) identifier supported by the terminal device; information related to the selected PSK identifier sent by the first entity is received; and a pre-master key for DTLS is derived based on the information related to the selected PSK identifier. In the embodiments of this disclosure, the terminal device can generate a pre-master key corresponding to the selected PSK identifier, enabling DTLS to support the security requirements of the Ua interface for GBA and the Ua* interface for AKMA, thereby improving communication security. This disclosure provides a processing method for the scenario of "pre-master key generation for the Data Packet Transport Layer Security (DTLS) protocol," which allows the Ua interface for GBA and the Ua* interface for AKMA to use DTLS messages including a pre-master key to authenticate the terminal device and the first entity, protecting messages carried through the Ua* and Ua interfaces and improving communication security.

[0185] Figure 10 This is a flowchart illustrating a pre-master key generation method for the Data Transport Layer Security (DTLS) protocol provided in this disclosure. The method is applied to a terminal device, such as... Figure 10 As shown, the method may include the following steps:

[0186] Step 1001: Send a DTLS message to the first entity, wherein the DTLS message includes PSK-based cipher suites supported by the terminal device.

[0187] Step 1002: In response to the first entity supporting the shared key-based cryptographic suite, receive the PSK hint sent by the first entity;

[0188] Step 1003: Send the PSK identifier corresponding to the PSK prompt to the first entity.

[0189] In an embodiment of the disclosure, the PSK identifier can be a combination of the PSK hint and the A-KID or a combination of the PSK hint and the B-TID. For example, the PSK identifier can include a first PSK hint and / or an AKMA key identifier A-KID in an application authentication and key management AKMA scenario. The PSK identifier can also include a second PSK hint and / or a bootstrapping transaction identifier B-TID in a generic bootstrapping architecture GBA scenario.

[0190] In an embodiment of the disclosure, the PSK hint includes one of 3GPP-AKMA, 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest, or 3GPP-gba-digest.

[0191] In an embodiment of the disclosure, the first PSK hint includes 3GPP-AKMA.

[0192] In an embodiment of the disclosure, the second PSK hint includes one of 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest, or 3GPP-gba-digest.

[0193] In summary, in an embodiment of the disclosure, a DTLS message is sent to a first entity, wherein the DTLS message includes a PSK-based cipher suite supported by a terminal device; in response to the first entity supporting the PSK-based cipher suite, a PSK hint sent by the first entity is received; and a PSK identifier corresponding to the PSK hint is sent to the first entity. In an embodiment of the disclosure, by sending the PSK identifier corresponding to the PSK hint to the first entity, the first entity can generate a pre-master key corresponding to the supported cipher suite, so that the DTLS can support the security requirements of the Ua interface for GBA and the Ua* interface for AKMA, and the security during communication can be improved. The disclosure provides a processing method for the case of "pre-master key generation of DTLS", which can enable the Ua interface for GBA and the Ua* interface for AKMA to authenticate the terminal device and the first entity using the DTLS message including the pre-master key, and can protect the messages carried through the Ua* interface and the Ua interface, and can improve the security during communication.

[0194] Figure 11 A flowchart of a pre-master key generation method of a data packet transmission layer security protocol DTLS provided by an embodiment of the present disclosure is shown in FIG. 11. The method is applied to a terminal device, and the method can include the following steps. Figure 11 As shown in FIG. 11, the method can include the following steps:

[0195] Step 1101, sending a DTLS message to a first entity, wherein the DTLS message includes a PSK-based cipher suite supported by the terminal device, the PSK-based cipher suite being a shared key-based cipher suite;

[0196] Step 1102, in response to the first entity supporting the shared key-based cipher suite, receiving a PSK prompt sent by the first entity;

[0197] Step 1103, sending a PSK identifier corresponding to the PSK prompt to the first entity;

[0198] Step 1104, obtaining a key according to the PSK identifier;

[0199] Step 1105, generating a pre-master key of the DTLS according to the key.

[0200] In one embodiment of the present disclosure, in response to the PSK identifier being a PSK identifier related to AKMA, an AKMA application key KAF is derived using an A-KID. Then, the pre-master key of the DTLS is derived according to the AKMA application key KAF.

[0201] In one embodiment of the present disclosure, in response to the PSK identifier being a PSK identifier related to GBA, a GBA-related key is derived using a B-TID and / or a second PSK prompt. Then, the pre-master key of the DTLS is derived according to the GBA-related key.

[0202] In one embodiment of the present disclosure, the GBA-related key derived by the terminal device can be one of Ks_ext_NAF, Ks_int_NAF, and Ks_NAF.

[0203] In the embodiments of the present disclosure, a DTLS message is sent to a first entity, wherein the DTLS message includes a PSK-based cipher suite supported by a terminal device; in response to the first entity supporting the PSK-based cipher suite, a PSK prompt sent by the first entity is received; a PSK identifier corresponding to the PSK prompt is sent to the first entity; a key is obtained according to the PSK identifier; and a premaster secret of DTLS is generated according to the key. In the embodiments of the present disclosure, by generating a key corresponding to the PSK identifier, the DTLS can support the security requirements of a Ua interface for GBA and a Ua* interface for AKMA, and the security during communication can be improved. The present disclosure provides a processing method for the case of "premaster secret generation of DTLS", which can enable the Ua interface for GBA and the Ua* interface for AKMA to authenticate the terminal device and the first entity by using the DTLS message including the premaster secret, and can protect the messages carried through the Ua* interface and the Ua interface, thereby improving the security during communication.

[0204] The present disclosure provides a premaster secret generation device of DTLS, which can be arranged on the side of the first entity. The device can include:

[0205] The processing module is configured to confirm a PSK identifier, the PSK identifier being one of PSK identifiers supported by the terminal device, the terminal device being associated with the first entity.

[0206] The processing module is further configured to obtain a key according to the selected PSK identifier.

[0207] The processing module is further configured to generate a premaster secret of DTLS according to the obtained key.

[0208] In summary, in the pre-master key generation apparatus of the data packet transmission layer security protocol DTLS in the embodiment of the present disclosure, the PSK identifier is confirmed by the processing module, the PSK identifier is one of the shared key PSK identifiers supported by the terminal device, the terminal device is associated with the first entity, the key is obtained according to the selected PSK identifier, and the pre-master key of the DTLS is generated according to the obtained key. In the embodiment of the present disclosure, the pre-master key corresponding to the selected PSK identifier is generated, so that the DTLS can support the security requirements of the Ua interface for GBA and the Ua* interface for AKMA, and the security during communication can be improved. The present disclosure provides a processing method for the case of "pre-master key generation of data packet transmission layer security protocol DTLS", which can enable the Ua interface for GBA and the Ua* interface for AKMA to authenticate the terminal device and the first entity by using the DTLS message including the pre-master key, can protect the messages carried through the Ua* interface and the Ua interface, and can improve the security during communication.

[0209] Optionally, in an embodiment of the present disclosure, the apparatus further comprises:

[0210] The transceiver is configured to receive a DTLS message sent by the terminal device, wherein the DTLS message comprises a shared key PSK identifier supported by the terminal device.

[0211] Optionally, in an embodiment of the present disclosure, the PSK identifier comprises a first PSK hint and / or an AKMA key identifier A-KID in an application authentication and key management AKMA scenario.

[0212] Optionally, in an embodiment of the present disclosure, the first PSK hint comprises 3GPP-AKMA.

[0213] Optionally, in an embodiment of the present disclosure, the PSK identifier comprises a second PSK hint and / or a bootstrapping transaction identifier B-TID in a general bootstrapping architecture GBA scenario.

[0214] Optionally, in an embodiment of the present disclosure, the second PSK hint comprises one of 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest or 3GPP-gba-digest.

[0215] Optionally, in an embodiment of the present disclosure, the processing module is configured to, when obtaining the key according to the selected PSK identifier, specifically configured to:

[0216] In response to the selected PSK identifier being an AKMA-related PSK identifier, the AKMA application key KAF of the first entity is acquired from an AKMA anchor function AAnF using an A-KID.

[0217] Optionally, in an embodiment of the present disclosure, the processing module is configured to acquire the key according to the selected PSK identifier, specifically configured to:

[0218] In response to the selected PSK identifier being a GBA-related PSK identifier, the GBA-related key is acquired from a bootstrapping server function BSF using a B-TID and / or a second PSK hint.

[0219] Optionally, in an embodiment of the present disclosure, the processing module is configured to generate the pre-master key of the DTLS according to the acquired key, specifically configured to:

[0220] The pre-master key of the DTLS is generated according to the AKMA application key KAF of the first entity or the GBA-related key.

[0221] Optionally, in an embodiment of the present disclosure, the transceiver module is further configured to:

[0222] Send the related information of the selected PSK identifier to the terminal device through the DTLS message.

[0223] Optionally, in an embodiment of the present disclosure, the PSK identifier includes a PSK hint, an A-KID, and a B-TID.

[0224] Figure 12 A structural diagram of a pre-master key generation device of a data packet transmission layer security protocol DTLS provided by an embodiment of the present disclosure is shown in FIG. 12. Figure 12 As shown in FIG. 12, the device 1200 can be arranged on the side of the first entity, and the device 1200 can include:

[0225] The transceiver module 1201 is configured to receive a DTLS message sent by a terminal device, wherein the DTLS message includes a shared key PSK identifier supported by the terminal device.

[0226] The processing module 1202 is configured to select one PSK identifier from the shared key PSK identifier supported by the terminal device.

[0227] The processing module 1202 is further configured to acquire a key according to the selected PSK identifier.

[0228] The processing module 1202 is further configured to generate a pre-master key of the DTLS according to the acquired key.

[0229] In summary, in the pre-master key generation apparatus of the data packet transmission layer security protocol DTLS in the embodiment of the present disclosure, the transceiver module receives the DTLS message sent by the terminal device, wherein the DTLS message includes a shared key PSK identifier supported by the terminal device; the processing module selects a PSK identifier from the shared key PSK identifier supported by the terminal device; the key is obtained according to the selected PSK identifier; and the pre-master key of the DTLS is generated according to the obtained key. In the embodiment of the present disclosure, by generating the pre-master key corresponding to the selected PSK identifier, the DTLS can support the security requirements of the Ua interface for GBA and the Ua* interface for AKMA, and the security during communication can be improved. The present disclosure provides a processing method for the case of "pre-master key generation of data packet transmission layer security protocol DTLS", which can enable the Ua interface for GBA and the Ua* interface for AKMA to authenticate the terminal device and the first entity by using the DTLS message including the pre-master key, can protect the messages carried through the Ua* interface and the Ua interface, and can improve the security during communication.

[0230] Optionally, in an embodiment of the present disclosure, the PSK identifier includes a first PSK prompt and / or an AKMA key identifier A-KID in an application authentication and key management AKMA scenario.

[0231] Optionally, in an embodiment of the present disclosure, the first PSK prompt includes 3GPP-AKMA.

[0232] Optionally, in an embodiment of the present disclosure, the PSK identifier includes a second PSK prompt and / or a bootstrapping transaction identifier B-TID in a general bootstrapping architecture GBA scenario.

[0233] Optionally, in an embodiment of the present disclosure, the second PSK prompt includes one of 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest or 3GPP-gba-digest.

[0234] Optionally, in an embodiment of the present disclosure, when the processing module 1202 is used to obtain the key according to the selected PSK identifier, it is specifically used to:

[0235] In response to the selected PSK identifier being an AKMA-related PSK identifier, the AKMA application key KAF of the first entity is obtained from the AKMA anchor function AAnF using the A-KID.

[0236] Optionally, in an embodiment of the present disclosure, the processing module 1202 is configured to, when acquiring the key according to the selected PSK identifier, specifically configured to:

[0237] acquiring the GBA-related key from the bootstrapping server function BSF using the B-TID and / or the second PSK hint in response to the selected PSK identifier being a GBA-related PSK identifier.

[0238] Optionally, in an embodiment of the present disclosure, the processing module 1202 is configured to, when generating the pre-master key of the DTLS according to the acquired key, specifically configured to:

[0239] generating the pre-master key of the DTLS according to the AKMA application key KAF of the first entity or the GBA-related key.

[0240] Optionally, in an embodiment of the present disclosure, the transceiver module 1201 is further configured to:

[0241] sending, to the terminal device, information related to the selected PSK identifier through the DTLS message.

[0242] Optionally, in an embodiment of the present disclosure, the PSK identifier includes a PSK hint, an A-KID, and a B-TID.

[0243] Figure 13 A structural schematic diagram of a pre-master key generation apparatus of a data packet transmission layer security protocol DTLS provided by an embodiment of the present disclosure is shown in FIG. 13, which apparatus 1300 can be arranged at the first entity side, and the apparatus 1300 can include: Figure 13

[0244] a transceiver module 1301 configured to receive a DTLS message sent by a terminal device, wherein the DTLS message includes a PSK-based cipher suite supported by the terminal device;

[0245] the transceiver module 1301 is further configured to, in response to the first entity supporting the PSK-based cipher suite, send a PSK hint to the terminal device through the DTLS message;

[0246] the transceiver module 1301 is further configured to receive a PSK identifier sent by the terminal device;

[0247] a processing module 1302 configured to acquire a key according to the received PSK identifier;

[0248] the processing module 1302 is further configured to generate a pre-master key of the DTLS according to the acquired key.

[0249] ​In summary, in the pre-master key generation apparatus of the data packet transmission layer security protocol DTLS in the embodiment of the present disclosure, the DTLS message sent by the terminal device is received through the transceiving module, wherein the DTLS message includes the PSK-based cipher suites supported by the terminal device; in response to the first entity supporting the PSK-based cipher suites, the PSK prompt is sent to the terminal device through the DTLS message; the PSK identifier sent by the terminal device is received; the key is obtained by the processing module according to the received PSK identifier; and the pre-master key of the DTLS is generated according to the obtained key. In the embodiment of the present disclosure, the pre-master key corresponding to the supported cipher suites is generated, so that the DTLS can support the security requirements of the Ua interface for GBA and the Ua* interface for AKMA, and the security during communication can be improved. The present disclosure provides a processing method for the case of "pre-master key generation of the data packet transmission layer security protocol DTLS", which can enable the Ua interface for GBA and the Ua* interface for AKMA to authenticate the terminal device and the first entity by using the DTLS message including the pre-master key, can protect the messages carried through the Ua* interface and the Ua interface, and can improve the security during communication.

[0250] Optionally, in an embodiment of the present disclosure, the PSK prompt includes at least one of the following: 3GPP-AKMA, 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest, or 3GPP-gba-digest.

[0251] Optionally, in an embodiment of the present disclosure, the PSK identifier includes a first PSK prompt and / or an AKMA key identifier A-KID in an application authentication and key management AKMA scenario.

[0252] Optionally, in an embodiment of the present disclosure, the first PSK prompt includes 3GPP-AKMA.

[0253] Optionally, in an embodiment of the present disclosure, the PSK identifier includes a second PSK prompt and / or a bootstrapping transaction identifier B-TID in a general bootstrapping architecture GBA scenario.

[0254] Optionally, in an embodiment of the present disclosure, the second PSK hint comprises one of 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest or 3GPP-gba-digest.

[0255] Optionally, in an embodiment of the present disclosure, the processing module 1302 is configured to acquire the key according to the received PSK identifier, specifically configured to:

[0256] in response to the received PSK identifier being a PSK identifier related to AKMA, acquire an AKMA application key KAF of the first entity from an AKMA anchor function AAnF using an A-KID.

[0257] Optionally, in an embodiment of the present disclosure, the processing module 1302 is configured to acquire the key according to the received PSK identifier, specifically configured to:

[0258] in response to the received PSK identifier being a PSK identifier related to GBA, acquire a GBA-related key from a BSF using a B-TID and / or a second PSK hint.

[0259] Optionally, in an embodiment of the present disclosure, the processing module 1302 is configured to generate a pre-master key of DTLS according to the acquired key, specifically configured to:

[0260] generate a pre-master key of DTLS according to the AKMA application key KAF of the first entity or the GBA-related key.

[0261] Optionally, in an embodiment of the present disclosure, the PSK identifier comprises a PSK hint, an A-KID and a B-TID.

[0262] Figure 14 A structural schematic diagram of a pre-master key generation apparatus of a data packet transmission layer security protocol DTLS provided by an embodiment of the present disclosure is shown in Figure 14 The apparatus 1400 can be arranged at a terminal device side, and the apparatus 1400 can comprise:

[0263] a transceiver module 1401 configured to send a DTLS message to a first entity, wherein the DTLS message comprises a shared key PSK identifier supported by the terminal device.

[0264] In the pre-master key generation apparatus of the data packet transmission layer security protocol DTLS in the embodiment of the present disclosure, the transceiver module is configured to send a DTLS message to the first entity, wherein the DTLS message comprises a shared key PSK identifier supported by the terminal device. In the embodiment of the present disclosure, the first entity can generate a pre-master key corresponding to the selected PSK identifier according to the DTLS message sent by the terminal device, so that the DTLS can support the security requirements of the Ua interface for GBA and the Ua* interface for AKMA, and the security during communication can be improved. The present disclosure provides a processing method for the case of "pre-master key generation of the data packet transmission layer security protocol DTLS", which can enable the Ua interface for GBA and the Ua* interface for AKMA to authenticate the terminal device and the first entity by using the DTLS message comprising the pre-master key, and can protect the messages carried through the Ua* interface and the Ua interface, thereby improving the security during communication.

[0265] Optionally, in an embodiment of the present disclosure, the PSK identifier comprises a PSK hint, an A-KID, and a B-TID.

[0266] Optionally, in an embodiment of the present disclosure, the PSK identifier comprises a first PSK hint and / or an AKMA key identifier A-KID in an application authentication and key management AKMA scenario.

[0267] Optionally, in an embodiment of the present disclosure, the first PSK hint comprises 3GPP-AKMA.

[0268] Optionally, in an embodiment of the present disclosure, the PSK identifier comprises a second PSK hint and / or a bootstrapping transaction identifier B-TID in a general bootstrapping architecture GBA scenario.

[0269] Optionally, in an embodiment of the present disclosure, the second PSK hint comprises one of 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest, or 3GPP-gba-digest.

[0270] Optionally, in an embodiment of the present disclosure, the transceiver module 1401 is further configured to accept information related to the selected PSK identifier sent by the first entity.

[0271] The transceiver module 1401 is further configured to accept information related to the selected PSK identifier sent by the first entity.

[0272] The processing module 1402 is configured to derive the pre-master key of the DTLS according to the information related to the selected PSK identifier.

[0273] Figure 15 A structure diagram of a pre-master key generation apparatus of a data packet transmission layer security protocol DTLS provided by an embodiment of the present disclosure is shown in FIG. 15. As shown in the figure, the apparatus 1500 can be arranged at a terminal device side. The apparatus 1500 can include: Figure 15

[0274] A transceiver module 1501 is configured to send a DTLS message to a first entity, wherein the DTLS message includes PSK-based cipher suites supported by the terminal device.

[0275] The transceiver module 1501 is further configured to, in response to the first entity supporting the PSK-based cipher suites, receive a PSK hint sent by the first entity.

[0276] The transceiver module 1501 is further configured to send a PSK identifier to the first entity.

[0277] In summary, in the pre-master key generation apparatus of the data packet transmission layer security protocol DTLS, the transceiver module sends a DTLS message to a first entity, wherein the DTLS message includes PSK-based cipher suites supported by the terminal device. In response to the first entity supporting the PSK-based cipher suites, the transceiver module receives a PSK hint sent by the first entity. The transceiver module sends a PSK identifier to the first entity. In the embodiment of the present disclosure, by sending the PSK identifier corresponding to the PSK hint to the first entity, the first entity can generate a pre-master key corresponding to the supported cipher suites, so that the DTLS can support the security requirements of the Ua interface for GBA and the Ua* interface for AKMA, and the security during communication can be improved. The present disclosure provides a processing method for the case of "pre-master key generation of a data packet transmission layer security protocol DTLS", which can enable the Ua interface for GBA and the Ua* interface for AKMA to authenticate the terminal device and the first entity using the DTLS message including the pre-master key, and can protect the messages carried through the Ua* interface and the Ua interface, and can improve the security during communication.

[0278] Optionally, in an embodiment of the present disclosure, the apparatus further includes a processing module 1502 configured to:

[0279] obtain a key according to the PSK identifier;

[0280] generate a pre-master key of the DTLS according to the key.

[0281] Optionally, in an embodiment of the present disclosure, the PSK identifier includes a first PSK hint and / or an AKMA key identifier A-KID in an application authentication and key management AKMA scenario.​

[0282] Optionally, in an embodiment of the present disclosure, the first PSK hint comprises 3GPP-AKMA.

[0283] Optionally, in an embodiment of the present disclosure, the PSK identifier comprises a second PSK hint and / or a bootstrapping transaction identifier B-TID in a generic bootstrapping architecture GBA scenario.

[0284] Optionally, in an embodiment of the present disclosure, the second PSK hint comprises one of 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest or 3GPP-gba-digest.

[0285] Optionally, in an embodiment of the present disclosure, the processing module 1502 is configured to, when obtaining the key according to the PSK identifier, specifically configured to:

[0286] in response to the PSK identifier being a PSK identifier related to AKMA, using the A-KID to derive an AKMA application key KAF.

[0287] Optionally, in an embodiment of the present disclosure, the processing module 1502 is configured to, when obtaining the key according to the PSK identifier, specifically configured to:

[0288] in response to the PSK identifier being a PSK identifier related to GBA, using the B-TID and / or the second PSK hint to derive a key related to GBA.

[0289] Optionally, in an embodiment of the present disclosure, the processing module 1502 is configured to, when generating the pre-master key of the DTLS according to the key, specifically configured to:

[0290] generating the pre-master key of the DTLS according to the AKMA application key KAF or the key related to GBA of the first entity.

[0291] Optionally, in an embodiment of the present disclosure, the PSK identifier comprises a PSK hint, an A-KID and a B-TID.

[0292] Figure 16 A structural schematic diagram of a pre-master key generation system of a data packet transmission layer security protocol DTLS provided by an embodiment of the present disclosure is shown in Figure 16 The system 1600 can include:

[0293] a first entity 1601 configured to perform the method shown in any of Figures 1 to 7 ​

[0294] The terminal device 1602 is configured to perform any of the methods shown above. Figures 8 to 11 The terminal device 1602 is configured to perform any of the methods shown above.

[0295] In summary, in the pre-master key generation system of the data packet transmission layer security protocol DTLS in the embodiments of the present disclosure, by generating the pre-master key corresponding to the selected PSK identifier, the DTLS can support the security requirements of the Ua interface for GBA and the Ua* interface for AKMA, and the security during communication can be improved. The present disclosure provides a processing method for the case of "pre-master key generation of data packet transmission layer security protocol DTLS", which can enable the Ua interface for GBA and the Ua* interface for AKMA to authenticate the terminal device and the first entity using the DTLS message including the pre-master key, protect the messages carried through the Ua* interface and the Ua interface, and improve the security during communication.

[0296] Figure 17 is a block diagram of a terminal device UE 1700 according to an embodiment of the present disclosure. For example, the UE 1700 can be a mobile phone, a computer, a digital broadcast terminal device, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, and the like.

[0297] Referring to Figure 17 , the UE 1700 can include at least one of the following components: a processing component 1702, a memory 1704, a power supply component 1706, a multimedia component 1708, an audio component 1710, an input / output (I / O) interface 1712, a sensor component 1714, and a communication component 1716.

[0298] The processing component 1702 usually controls the overall operation of the UE 1700, such as operations associated with displaying, making phone calls, data communications, camera operations, and recording operations. The processing component 1702 can include at least one processor 1720 to execute instructions to complete all or part of the steps of the methods described above. In addition, the processing component 1702 can include at least one module to facilitate interaction between the processing component 1702 and other components. For example, the processing component 1702 can include a multimedia module to facilitate the interaction between the multimedia component 1708 and the processing component 1702.

[0299] The memory 1704 is configured to store various types of data to support the operation of the UE 1700. Examples of such data include instructions for any application or method operating on the UE 1700, contact data, phonebook data, messages, pictures, videos, and so on. The memory 1704 can be implemented by any type of volatile or nonvolatile storage devices or a combination thereof such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable programmable read only memory (EPROM), programmable read only memory (PROM), read only memory (ROM), magnetic memory, flash memory, magnetic disc or optical disc.

[0300] The power supply component 1706 supplies electrical power for the various components of the UE 1700. The power supply component 1706 can include a power supply management system, at least one power supply, and other components associated with generating, managing and distributing electrical power for the UE 1700.

[0301] The multimedia component 1708 includes a screen providing an output interface between the UE 1700 and a user. In some embodiments, the screen can include a liquid crystal display (LCD) and a touch panel (TP). In response to the screen including a touch panel, the screen can be implemented as a touch screen to receive input signals from a user. The touch panel includes at least one touch sensor to sense touch, swiping and gestures on the touch panel. The touch sensor can not only sense a boundary of a touching or swiping action, but also detect a pressure strength of the touching or swiping action. In some embodiments, the multimedia component 1708 includes a front camera and / or a rear camera. The front and / or rear camera can receive external multimedia data when the UE 1700 is in an operation mode such as a shooting mode or a video mode. Each of the front and rear camera can be a fixed optical lens system or have a focal length and optical zoom capability.

[0302] The audio component 1710 is configured to output and / or input audio signals. For example, the audio component 1710 includes a microphone (MIC) configured to receive external audio signals when the UE 1700 is in an operation mode such as a calling mode, a recording mode and a voice recognition mode. The received audio signals can be further stored in the memory 1704 or transmitted via the communication component 1716. In some embodiments, the audio component 1710 also includes a speaker for outputting audio signals.

[0303] The I / O interface 1712 provides an interface between the processing component 1702 and peripheral interface modules, which can be a keyboard, a click wheel, a button, and so on. The buttons can include, but are not limited to, a home button, a volume button, a start button and a lock button.

[0304] Sensor assembly 1714 includes at least one sensor for providing status assessment of various aspects of UE 1700. For example, sensor assembly 1714 can detect the on / off state of device 1700, the relative positioning of components, such as the display and keypad of UE 1700, changes in position of UE 1700 or one of its components, the presence or absence of user contact with UE 1700, orientation or acceleration / deceleration of UE 1700, and temperature changes of UE 1700. Sensor assembly 1714 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 1714 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, sensor assembly 1714 may also include an accelerometer, gyroscope, magnetometer, pressure sensor, or temperature sensor.

[0305] Communication component 1716 is configured to facilitate wired or wireless communication between UE 1700 and other devices. UE 1700 can access wireless networks based on communication standards, such as WiFi, 2G, or 3G, or combinations thereof. In one exemplary embodiment, communication component 1716 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 1716 also includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0306] In an exemplary embodiment, the UE1700 may be implemented by at least one application-specific integrated circuit (ASIC), digital signal processor (DSP), digital signal processing device (DSPD), programmable logic device (PLD), field-programmable gate array (FPGA), controller, microcontroller, microprocessor or other electronic component to perform the above method.

[0307] Figure 18 This is a block diagram of a network-side device 1800 provided in an embodiment of this disclosure. For example, the network-side device 1800 can be provided as a network-side device. (Refer to...) Figure 18The network-side device 1800 includes a processing component 1822, which further includes at least one processor, and memory resources represented by memory 1832 for storing instructions executable by the processing component 1822, such as application programs. The application programs stored in memory 1832 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 1822 is configured to execute instructions to perform any of the methods described above applied to the network-side device, for example, such as... Figure 1 The method is shown. The network-side device 1800 can be, for example, the first entity.

[0308] The network-side device 1800 may also include a power supply component 1826 configured to perform power management of the network-side device 1800, a wired or wireless network interface 1850 configured to connect the network-side device 1800 to a network, and an input / output (I / O) interface 1858. The network-side device 1800 can operate on an operating system stored in memory 1832, such as Windows Server™, Mac OS X™, Unix™, Linux™, Free BSD™, or similar.

[0309] In the embodiments provided above, the methods provided by the present disclosure have been described from the perspectives of the network-side device and the UE, respectively. To implement the functions of the methods provided in the embodiments of the present disclosure, the network-side device and the UE may include hardware structures and software modules, implementing the above functions in the form of hardware structures, software modules, or a combination of hardware structures and software modules. One of the above functions can be executed in the form of hardware structures, software modules, or a combination of hardware structures and software modules.

[0310] In the embodiments provided above, the methods provided by the present disclosure have been described from the perspectives of the network-side device and the UE, respectively. To implement the functions of the methods provided in the embodiments of the present disclosure, the network-side device and the UE may include hardware structures and software modules, implementing the above functions in the form of hardware structures, software modules, or a combination of hardware structures and software modules. One of the above functions can be executed in the form of hardware structures, software modules, or a combination of hardware structures and software modules.

[0311] This disclosure provides a communication device. The communication device may include a transceiver module and a processing module. The transceiver module may include a sending module and / or a receiving module. The sending module is used to implement the sending function, and the receiving module is used to implement the receiving function. The transceiver module can implement both sending and / or receiving functions.

[0312] The communication apparatus can be a terminal device (such as the terminal device in the foregoing method embodiments), can be an apparatus in a terminal device, and can also be an apparatus that can be used in matching with a terminal device. Alternatively, the communication apparatus can be a network device, can be an apparatus in a network device, and can also be an apparatus that can be used in matching with a network device.

[0313] Another communication apparatus provided by the embodiments of the present disclosure. The communication apparatus can be a network device, can be a terminal device (such as the terminal device in the foregoing method embodiments), can be a chip, a chip system, or a processor supporting the network device to implement the foregoing method, and can also be a chip, a chip system, or a processor supporting the terminal device to implement the foregoing method. The apparatus can be used to implement the method described in the foregoing method embodiments, and specific implementation can be referred to the description in the foregoing method embodiments.

[0314] The communication apparatus can include one or more processors. The processor can be a general-purpose processor or a special-purpose processor. For example, it can be a baseband processor or a central processing unit. The baseband processor can be used to process a communication protocol and communication data, and the central processing unit can be used to control the communication apparatus (such as a network side device, a baseband chip, a terminal device, a terminal device chip, a DU or a CU, etc.), execute a computer program, and process data of the computer program.

[0315] Optionally, the communication apparatus can further include one or more memories, and the memories can store computer programs. The processor executes the computer programs to enable the communication apparatus to perform the method described in the foregoing method embodiments. Optionally, the memories can also store data. The communication apparatus and the memories can be separately arranged or integrated together.

[0316] Optionally, the communication apparatus can further include a transceiver, an antenna. The transceiver can be referred to as a transceiving unit, a transceiver, or a transceiving circuit, etc., and is used to realize the transceiving function. The transceiver can include a receiver and a transmitter. The receiver can be referred to as a receiver or a receiving circuit, etc., and is used to realize the receiving function. The transmitter can be referred to as a transmitter or a transmitting circuit, etc., and is used to realize the transmitting function.

[0317] Optionally, the communication apparatus can further include one or more interface circuits. The interface circuit is used to receive code instructions and transmit them to the processor. The processor runs the code instructions to enable the communication apparatus to perform the method described in the foregoing method embodiments.

[0318] The communication apparatus is a first entity: the processor is configured to perform Figures 1-7 any of the methods.

[0319] The communication apparatus is a terminal device: the processor is configured to perform Figures 8-11 any of the methods.

[0320] In an implementation, the processor can include a transceiver for implementing the receiving and transmitting functions. For example, the transceiver can be a transceiver circuit, or an interface, or an interface circuit. The transceiver circuit, interface or interface circuit for implementing the receiving and transmitting functions can be separate or integrated together. The transceiver circuit, interface or interface circuit described above can be used for reading and writing of code / data, or the transceiver circuit, interface or interface circuit described above can be used for transmission or transfer of signals.

[0321] In an implementation, the processor can store a computer program, which, when running on the processor, can cause the communication apparatus to perform the methods described in the foregoing method embodiments. The computer program can be fixed in the processor, in which case the processor can be implemented by hardware.

[0322] In an implementation, the communication apparatus can include a circuit, which can implement the functions of transmitting or receiving or communicating in the foregoing method embodiments. The processor and the transceiver described in the disclosure can be implemented on an integrated circuit (IC), an analog IC, a radio frequency integrated circuit (RFIC), a mixed-signal IC, an application specific integrated circuit (ASIC), a printed circuit board (PCB), an electronic device, etc. The processor and the transceiver can also be manufactured using various IC technologies, such as complementary metal oxide semiconductor (CMOS), n metal-oxide-semiconductor (NMOS), positive channel metal oxide semiconductor (PMOS), bipolar junction transistor (BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.

[0323] The communication apparatus described in the foregoing embodiments can be a network device or a terminal device (such as the terminal device in the foregoing method embodiments), but the scope of the communication apparatus described in the disclosure is not limited thereto, and the structure of the communication apparatus can not be limited. The communication apparatus can be a standalone device or can be part of a larger device. For example, the communication apparatus can be:

[0324] (1) a standalone integrated circuit (IC), or a chip, or a chip system or subsystem;

[0325] (2) a set of one or more ICs, optionally including storage for data, computer programs, etc.

[0326] (3) an ASIC, such as a Modem;

[0327] (4) a module that can be embedded within other devices;

[0328] (5) a receiver, terminal device, intelligent terminal device, cellular phone, wireless device, handset, mobile unit, vehicular device, network device, cloud device, artificial intelligence device, etc.

[0329] (6) other, etc.

[0330] For the case that the communication apparatus can be a chip or a chip system, the chip includes a processor and an interface. Wherein, the number of the processor can be one or more, and the number of the interface can be multiple.

[0331] Optionally, the chip further includes a memory, and the memory is used to store necessary computer programs and data.

[0332] Those skilled in the art can understand that the various illustrative logical blocks and steps listed in the embodiments of the present disclosure can be implemented by electronic hardware, computer software, or a combination of both. Whether the function is implemented by hardware or software depends on the specific application and design requirements of the whole system. Those skilled in the art can implement the described functions for each specific application by using various methods, but such implementation should not be understood as beyond the scope of protection of the embodiments of the present disclosure.

[0333] The present disclosure also provides a readable storage medium, which stores instructions, and the instructions are executed by a computer to realize the functions of any of the above method embodiments.

[0334] The present disclosure also provides a computer program product, which is executed by a computer to realize the functions of any of the above method embodiments.

[0335] In the above embodiments, all or part can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part can be implemented in the form of a computer program product. The computer program product includes one or more computer programs. When the computer programs are loaded on a computer and executed, all or part of the processes or functions described in the embodiments of the present disclosure are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer programs can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another computer-readable storage medium, for example, the computer programs can be transferred from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media (such as floppy disk, hard disk, magnetic tape), optical media (such as high-density digital video disc (digital video disc, DVD)), or semiconductor media (such as solid state disk (solid state disk, SSD)) and the like.

[0336] Those of ordinary skill in the art can understand that the first, second, and the like various numerical designations involved in the present disclosure are only for the convenience of description and do not limit the scope of the embodiments of the present disclosure, nor represent the order of precedence.

[0337] At least one of the present disclosure can also be described as one or more, and the plurality can be two, three, four or more, and the present disclosure does not limit. In the embodiments of the present disclosure, for a technical feature, the technical features in the technical feature are distinguished by "first", "second", "third", "A", "B", "C" and "D", and there is no order or size order between the technical features described by "first", "second", "third", "A", "B", "C" and "D".

[0338] Other embodiments of the present disclosure will be readily apparent to those skilled in the art upon considering the description set forth herein. The present disclosure is intended to cover any variations, uses or adaptive changes of the present disclosure that follow the general principles of the present disclosure and include common knowledge or conventional technical means in the art that are not disclosed in the present disclosure. The specification and examples are only considered as exemplary, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0339] It should be understood that the present disclosure is not limited to the precise construction that has been described above and shown in the accompanying drawings, and that various modifications and changes can be made by those of ordinary skill in the art without departing from the scope of this disclosure. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for generating a pre-master key for the Data Packet Transport Layer Security (DTLS) protocol, characterized in that, Applied to a first entity, the method includes: Receive a DTLS message sent by a terminal device, wherein the DTLS message includes a shared key (PSK) identifier supported by the terminal device; Select one PSK identifier from the shared key PSK identifiers supported by the terminal device; Obtain the key based on the selected PSK identifier; The pre-master key of the DTLS is generated based on the obtained key; The PSK identifier includes the first PSK hint and the AKMA key identifier A-KID in the AKMA application authentication and key management scenario, or the PSK identifier includes the second PSK hint and the bootstrap transaction identifier B-TID in the GBA general bootstrap architecture scenario.

2. The method as described in claim 1, characterized in that, The first PSK prompt includes 3GPP-AKMA.

3. The method as described in claim 1, characterized in that, The second PSK prompt includes one of 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest, or 3GPP-gba-digest.

4. The method as described in claim 1, characterized in that, The step of obtaining the key based on the selected PSK identifier includes: In response to the selected PSK identifier being a PSK identifier associated with the AKMA, the AKMA application key KAF of the first entity is obtained from the AKMA anchor function AAnF using the A-KID.

5. The method as described in claim 1, characterized in that, The step of obtaining the key based on the selected PSK identifier includes: In response to the selected PSK identifier being a PSK identifier associated with the GBA, the key associated with the GBA is obtained from the Boot Server Function (BSF) using the B-TID and / or the second PSK hint.

6. The method as described in claim 4 or 5, characterized in that, The step of generating the DTLS pre-master key based on the acquired key includes: The pre-master key for the DTLS is generated based on the AKMA application key KAF of the first entity or the key associated with the GBA.

7. The method according to any one of claims 1-5, characterized in that, Also includes: The relevant information of the selected PSK identifier is sent to the terminal device via a DTLS message.

8. The method as described in claim 1, characterized in that, The PSK identifier includes the PSK prompt, the A-KID, and the B-TID.

9. A method for generating a pre-master key for DTLS, characterized in that, Applied to a first entity, the method includes: Receive a DTLS message sent by a terminal device, wherein the DTLS message includes PSK-based cipher suites supported by the terminal device. In response to the first entity supporting the shared-key-based cryptographic suite, a PSK hint is sent to the terminal device via a DTLS message; Receive a PSK identifier sent by the terminal device, wherein the PSK identifier includes a first PSK hint and an AKMA key identifier A-KID in the application authentication and key management (AKMA) scenario, or the PSK identifier includes a second PSK hint and a boot transaction identifier B-TID in the general boot architecture (GBA) scenario; Obtain the key based on the received PSK identifier; The pre-master key of the DTLS is generated based on the obtained key.

10. The method as described in claim 9, characterized in that, The PSK prompt includes at least one of the following: 3GPP-AKMA, 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest, or 3GPP-gba-digest.

11. The method as described in claim 9, characterized in that, The first PSK prompt includes 3GPP-AKMA.

12. The method as described in claim 9, characterized in that, The second PSK prompt includes one of 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest, or 3GPP-gba-digest.

13. The method as described in claim 9, characterized in that, The step of obtaining the key based on the received PSK identifier includes: In response to the received PSK identifier being a PSK identifier associated with the AKMA, the AKMA application key KAF of the first entity is obtained from the AKMA anchor function AAnF using the A-KID.

14. The method as described in claim 9, characterized in that, The step of obtaining the key based on the received PSK identifier includes: In response to the received PSK identifier being a PSK identifier associated with the GBA, the key associated with the GBA is obtained from the BSF using the B-TID and / or the second PSK hint.

15. The method as described in claim 13 or 14, characterized in that, The step of generating the DTLS pre-master key based on the acquired key includes: The pre-master key for the DTLS is generated based on the AKMA application key KAF of the first entity or the key associated with the GBA.

16. The method as described in claim 9, characterized in that, The PSK identifier includes the PSK prompt, the A-KID, and the B-TID.

17. A method for generating a pre-master key for DTLS, characterized in that, Applied to a terminal device, the method includes: Send a DTLS message to the first entity, wherein the DTLS message includes a shared key PSK identifier supported by the terminal device; the PSK identifier includes a first PSK hint and an AKMA key identifier A-KID in the application authentication and key management AKMA scenario, or the PSK identifier includes a second PSK hint and a bootstrap transaction identifier B-TID in the general bootstrap architecture GBA scenario.

18. The method as described in claim 17, characterized in that, The PSK identifier includes the PSK prompt, the A-KID, and the B-TID.

19. The method as described in claim 17, characterized in that, The first PSK prompt includes 3GPP-AKMA.

20. The method as described in claim 17, characterized in that, The second PSK prompt includes one of 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest, or 3GPP-gba-digest.

21. The method as described in claim 17, characterized in that, Also includes: Receive information related to the selected PSK identifier sent by the first entity; The pre-master key for DTLS is derived based on the relevant information of the selected PSK identifier.

22. A method for generating a pre-master key for DTLS, characterized in that, Applied to a terminal device, the method includes: Send a DTLS message to the first entity, wherein the DTLS message includes PSK-based cipher suites supported by the terminal device; In response to the first entity supporting the shared key-based cryptographic suite, receive the PSK hint sent by the first entity; Send a PSK identifier to the first entity; the PSK identifier includes a first PSK hint and an AKMA key identifier A-KID in the application authentication and key management (AKMA) scenario, or the PSK identifier includes a second PSK hint and a bootstrap transaction identifier B-TID in the generic bootstrap architecture (GBA) scenario.

23. The method as described in claim 22, characterized in that, Also includes: Obtain the key based on the PSK identifier; The pre-master key for the DTLS is generated based on the key.

24. The method as described in claim 22, characterized in that, The first PSK prompt includes 3GPP-AKMA.

25. The method as described in claim 22, characterized in that, The second PSK prompt includes one of 3GPP-bootstrapping-uicc, 3GPP-gba-uicc, 3GPP-bootstrapping, 3GPP-gba, 3GPP-bootstrapping-digest, or 3GPP-gba-digest.

26. The method as described in claim 23, characterized in that, The step of obtaining the key based on the PSK identifier includes: In response to the PSK identifier being a PSK identifier associated with the AKMA, the AKMA application key KAF is derived using the A-KID.

27. The method as described in claim 23, characterized in that, The step of obtaining the key based on the PSK identifier includes: In response to the PSK identifier being a PSK identifier associated with the GBA, the key associated with the GBA is derived using the B-TID and / or the second PSK hint.

28. The method as described in claim 26 or 27, characterized in that, The step of generating the DTLS pre-master key based on the key includes: The pre-master key for the DTLS is generated based on the AKMA application key KAF of the first entity or the key associated with the GBA.

29. The method as described in claim 22, characterized in that, The PSK identifier includes the PSK prompt, the A-KID, and the B-TID.

30. A pre-master key generation apparatus for the Data Transport Layer Security (DTLS) protocol, characterized in that, The device is disposed on the first entity side and includes: The transceiver module is used to receive DTLS messages sent by the terminal device, wherein the DTLS message includes a shared key (PSK) identifier supported by the terminal device; The processing module is configured to select a PSK identifier from among the shared key PSK identifiers supported by the terminal device; The processing module is further configured to obtain a key based on the selected PSK identifier; The processing module is further configured to generate the pre-master key of the DTLS based on the acquired key; The PSK identifier includes the first PSK hint and the AKMA key identifier A-KID in the AKMA application authentication and key management scenario, or the PSK identifier includes the second PSK hint and the bootstrap transaction identifier B-TID in the GBA general bootstrap architecture scenario.

31. A pre-master key generation apparatus for the Data Transport Layer Security (DTLS) protocol, characterized in that, The device is disposed on the first entity side and includes: The transceiver module is used to receive DTLS messages sent by the terminal device, wherein the DTLS messages include PSK-based cipher suites supported by the terminal device. The transceiver module is further configured to send a PSK prompt to the terminal device via a DTLS message in response to the first entity supporting the shared key-based cipher suite; The transceiver module is further configured to receive a PSK identifier sent by the terminal device; the PSK identifier includes a first PSK hint and an AKMA key identifier A-KID in the application authentication and key management (AKMA) scenario, or the PSK identifier includes a second PSK hint and a bootstrap transaction identifier B-TID in the general bootstrap architecture (GBA) scenario. The processing module is used to obtain a key based on the received PSK identifier; The processing module is further configured to generate the pre-master key of the DTLS based on the acquired key.

32. A pre-master key generation apparatus for the Data Transport Layer Security (DTLS) protocol, characterized in that, The device is located on the terminal equipment side and includes: The transceiver module is used to send DTLS messages to the first entity, wherein the DTLS message includes a shared key PSK identifier supported by the terminal device; the PSK identifier includes a first PSK hint and an AKMA key identifier A-KID in the application authentication and key management AKMA scenario, or the PSK identifier includes a second PSK hint and a bootstrap transaction identifier B-TID in the general bootstrap architecture GBA scenario.

33. A pre-master key generation apparatus for the Data Transport Layer Security (DTLS) protocol, characterized in that, The device is located on the terminal equipment side and includes: A transceiver module is used to send DTLS messages to a first entity, wherein the DTLS messages include PSK-based cipher suites supported by the terminal device. The transceiver module is further configured to receive a PSK prompt sent by the first entity in response to the first entity supporting the shared key-based cryptographic suite; The transceiver module is further configured to send a PSK identifier to the first entity; the PSK identifier includes a first PSK hint and an AKMA key identifier A-KID in the application authentication and key management (AKMA) scenario, or the PSK identifier includes a second PSK hint and a bootstrap transaction identifier B-TID in the general bootstrap architecture (GBA) scenario.

34. A first entity, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program, and the processor executes the computer program stored in the memory to cause the first entity to perform the method as described in any one of claims 1 to 8 or 9 to 16.

35. A terminal device, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program, and the processor executes the computer program stored in the memory to cause the terminal device to perform the method as described in any one of claims 17 to 21 or 22 to 29.

36. A pre-master key generation system for the Data Transport Layer Security (DTLS) protocol, characterized in that, include: A first entity is configured to perform the method as described in any one of claims 1 to 8 or 9 to 16; A terminal device for performing the method as described in any one of claims 17 to 21 or 22 to 29.

37. A communication device, characterized in that, include: Processor and interface circuitry, among which The interface circuit is used to receive code instructions and transmit them to the processor; The processor is configured to run the code instructions to perform the method as described in any one of claims 1 to 8, 9 to 16, 17 to 21, or 22 to 29.

38. A computer-readable storage medium, characterized in that, The device is configured to store instructions that, when executed, cause the method as described in any one of claims 1 to 8, 9 to 16, 17 to 21, or 22 to 29 to be implemented.

Images