Redirection method, device, medium and electronic equipment of amf network element

Abstract

The application relates to the field of mobile communication, and discloses a redirection method and device of an AMF network element, a computer readable medium and an electronic device. The method is executed by an initial AMF network element, and comprises the following steps: receiving a registration request from a target user equipment; generating an initial K AMF key in the initial AMF network element and the target user equipment respectively; obtaining target AMF network element information; performing a horizontal derivation operation on the initial K AMF key to obtain a first K AMF key, and instructing the target user equipment to perform a horizontal derivation operation on the initial K AMF key; constructing a second non-access layer security context according to the first K AMF key, and sending the second non-access layer security context containing the first K AMF key to the target AMF network element, so that the target AMF network element performs a horizontal derivation operation on the first K AMF key, and instructs the target user equipment to perform a horizontal derivation operation on the first K AMF key, so that the second K AMF key is obtained in the target AMF network element and the target user equipment. The method avoids the risk of key leakage and guarantees the security isolation between network slices.

Description

Technical Field

[0001] This application relates to the field of mobile communication technology, and in particular to a redirection method, apparatus, computer-readable medium, and electronic device for an AMF network element. Background Technology

[0002] During the registration process of user equipment to the 5G network, if the base station does not support network slice selection, the base station will first select a default initial AMF network element for access. After the primary authentication of the user equipment is completed, the slice subscription information is returned. If the initial AMF network element cannot serve the slice, AMF rerouting will occur.

[0003] However, existing methods have security issues during AMF rerouting and cannot securely achieve inter-slice isolation during AMF rerouting. Summary of the Invention

[0004] In the field of mobile communication technology, in order to solve the above-mentioned technical problems, the purpose of this application is to provide a redirection method, apparatus, computer-readable medium and electronic device for AMF network elements.

[0005] According to one aspect of the embodiments of this application, a redirection method for an AMF network element is provided, the method being executed by an initial AMF network element, the method comprising:

[0006] Receive a registration request from a target user device, the registration request including slice information;

[0007] The initial AMF network element interacts with the target user equipment to generate a first non-access stratum security context on both the initial AMF network element and the target user equipment. The first non-access stratum security context includes an initial K. AMF Key;

[0008] If the initial AMF network element determines that it cannot provide services for the network slice indicated by the slice information in the registration request, then it obtains the target AMF network element information that can provide services for the network slice;

[0009] For the initial K AMF Perform a lateral derivation operation on the key to obtain the first K. AMF The key, and instructs the target user equipment to pass the initial K. AMF The first K is obtained by performing a lateral derivation operation on the key. AMF Key;

[0010] According to the first K AMF Key construction includes the first K AMF The second non-access stratum security context of the key, and the key containing the first K AMFThe second non-access stratum security context of the key and the registration request are sent to the target AMF network element indicated by the target AMF network element information, so that the target AMF network element can, through the first K AMF The second K is obtained by performing a lateral derivation operation on the key. AMF After obtaining the key, the target user equipment is instructed to access the first K. AMF The second K is obtained by performing a lateral derivation operation on the key. AMF A key, so as to communicate with the target user equipment based on the second K AMF The key is used to derive non-access stratum keys and access stratum keys, and then secure communication is used to respond to the registration request.

[0011] According to one aspect of the embodiments of this application, a redirection device for an AMF network element is provided, the device being located in an initial AMF network element, the device comprising:

[0012] The receiving module is configured to receive a registration request from a target user device, the registration request including slice information;

[0013] An interaction module is used to interact between the initial AMF network element and the target user equipment to generate a first non-access stratum security context on both the initial AMF network element and the target user equipment. The first non-access stratum security context includes an initial K. AMF Key;

[0014] The acquisition module is used to acquire target AMF network element information that can provide services to the network slice if the initial AMF network element determines that it cannot provide services to the network slice indicated by the slice information in the registration request;

[0015] Derivation and indication modules are used for the initial K AMF Perform a lateral derivation operation on the key to obtain the first K. AMF The key, and instructs the target user equipment to pass the initial K. AMF The first K is obtained by performing a lateral derivation operation on the key. AMF Key;

[0016] The build and send module is used to build and send according to the first K AMF Key construction includes the first K AMF The second non-access stratum security context of the key, and the key containing the first K AMF The second non-access stratum security context of the key and the registration request are sent to the target AMF network element indicated by the target AMF network element information, so that the target AMF network element can, through the first K AMF The second K is obtained by performing a lateral derivation operation on the key. AMFAfter obtaining the key, the target user equipment is instructed to access the first K. AMF The second K is obtained by performing a lateral derivation operation on the key. AMF A key, so as to communicate with the target user equipment based on the second K AMF The key is used to derive non-access stratum keys and access stratum keys, and then secure communication is used to respond to the registration request.

[0017] According to one aspect of the embodiments of this application, a computer-readable medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method described in the above embodiments.

[0018] According to one aspect of the embodiments of this application, an electronic device is provided, comprising:

[0019] One or more processors;

[0020] A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to perform the method described in the above embodiments.

[0021] The technical solutions provided by the embodiments of this application may include the following beneficial effects:

[0022] The AMF network element redirection method provided in this application embodiment is executed by an initial AMF network element and includes the following steps: receiving a registration request from a target user equipment, the registration request including slice information; the initial AMF network element interacting with the target user equipment to generate a first non-access stratum security context in both the initial AMF network element and the target user equipment, the first non-access stratum security context including an initial K AMF Key; if the initial AMF network element determines that it cannot provide services for the network slice indicated by the slice information in the registration request, then obtain the target AMF network element information that can provide services for the network slice; for the initial K AMF Perform a lateral derivation operation on the key to obtain the first K. AMF The key, and instructs the target user equipment to pass the initial K. AMF The first K is obtained by performing a lateral derivation operation on the key. AMF Key; based on the first K AMF Key construction includes the first K AMF The second non-access stratum security context of the key, and the key containing the first K AMF The second non-access stratum security context of the key and the registration request are sent to the target AMF network element indicated by the target AMF network element information, so that the target AMF network element can, through the first K AMFThe second K is obtained by performing a lateral derivation operation on the key. AMF After obtaining the key, the target user equipment is instructed to access the first K. AMF The second K is obtained by performing a lateral derivation operation on the key. AMF A key, so as to communicate with the target user equipment based on the second K AMF The key is used to derive non-access stratum keys and access stratum keys, and then secure communication is used to respond to the registration request.

[0023] In this method, when the target user equipment issues a registration request and the initial AMF network element cannot provide the network slice required by the target user equipment, the target AMF network element is first identified, and then the initial K... AMF The first K is derived laterally from the key. AMF The key, and also instructs the target user equipment to use the initial K. AMF The first K is obtained by performing a lateral derivation operation on the key. AMF The key will also contain the first K AMF The second non-access stratum security context of the key is sent to the target AMF network element; the target AMF network element will further process the first key... AMF The second K is obtained by performing a lateral derivation operation on the key. AMF The key, and instruct the target user equipment to also use the first K. AMF The second K is obtained by performing a lateral derivation operation on the key. AMF The key. Therefore, in the scheme of this application embodiment, only the first K is actually transmitted. AMF The key, and the first K AMF The key is a temporary key, avoiding the risk of key leakage; at the same time, since the initial AMF network element and the target AMF network element use different keys... AMF The key provides services to the corresponding slice, ensuring secure isolation between network slices.

[0024] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this application. Attached Figure Description

[0025] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0026] Figure 1 This is a schematic diagram of the system process in the relevant technology;

[0027] Figure 2 This is a flowchart illustrating an AMF network element redirection method according to an exemplary embodiment of this application;

[0028] Figure 3This is a schematic diagram of a system flow according to an exemplary embodiment of this application;

[0029] Figure 4 This is illustrated according to an exemplary embodiment of this application. Figure 2 A flowchart detailing step 220 is provided.

[0030] Figure 5 This is a schematic diagram of the system flow according to another exemplary embodiment of this application;

[0031] Figure 6 This is an overall interaction flowchart illustrating the registration of a user equipment with an AMF network element according to an exemplary embodiment of this application;

[0032] Figure 7 This is a block diagram illustrating a redirection device for an AMF network element according to an exemplary embodiment;

[0033] Figure 8 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown. Detailed Implementation

[0034] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0035] Furthermore, the accompanying drawings are merely illustrative of this application and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities.

[0036] As mentioned in the background section of this application, AMF rerouting occurs when the initial AMF network element cannot specify the slice service for the user equipment's subscription information. Currently, the 3GPP (3rd Generation Partnership Project) standard proposes the following two rerouting methods:

[0037] Method 1: The initial AMF directly sends the NAS security context to the target AMF. This method can lead to the leakage of the keys in the NAS security context provided by the initial AMF to the target AMF, thus creating a network slicing isolation problem.

[0038] Method 2: The initial AMF routes the registration request to the target AMF via the base station. In this method, since the target AMF lacks a NAS security context, sending a message to the UE will be rejected, leading to registration failure.

[0039] Figure 1 This is a system flowchart from a related technology. Please refer to [link / reference]. Figure 1 As shown, the system process is the registration process of UE (User Equipment) with the 5G network. It is based on the communication and interaction between multiple network entities in the 5G network. These network entities include: RAN (Radio Access Network), initial AMF (Access and Mobility Management Function) network element, target AMF network element, UDM (Unified Data Management) network element, and NSSF (The Network Slice Selection Function) network element. Figure 1 The process flow of the solution adopted by the related technology shown is as follows:

[0040] 1. The UE sends a Registration Request to the RAN, which includes a Requested-NSSAI to identify slice A. NSSAI (Network Slice Selection Assistance Information) is network slice selection assistance information used to identify the corresponding network slice.

[0041] 2. The RAN selects an AMF network element as the initial AMF network element, or directly uses the configured default AMF network element as the initial AMF network element. After determining the initial AMF network element, the RAN will send the registration request to the initial AMF network element.

[0042] 3. After successful primary authentication of the UE on the 5G network, the initial AMF network element will generate a NAS (Non-Access Stratum) security context and a K... AMF In addition to key information, the initial AMF network element will also obtain user subscription information from the UDM network element. The user subscription information includes the user-subscribed network slices (Subscrided-NSSAIs).

[0043] 4. If the initial AMF network element determines that the NSSAI requested by the user is an Allowed-NSSAI based on the network slice subscribed by the user, and if it determines that the initial AMF network element cannot serve the user who requested the NSSAI, then it obtains the service slice information from the NSSF network element. The service slice information is the target AMF network element information that can serve the slice identified by the NSSAI.

[0044] 5. The initial AMF network element routes the message to the target AMF network element. The message contains the requested NSSAI and a K... AMF The NAS security context allows the target AMF network element to provide services for Slice A, which is identified by the requested NSSAI.

[0045] 6. The target AMF network element will use K AMF The key enables secure communication with the UE and returns registration acceptance information to the UE.

[0046] As you can see, Figure 1 The proposed solution cannot guarantee secure isolation of network slices and has security flaws.

[0047] To address this, this application first provides a redirection method for AMF network elements. This method can overcome the above defects, not only ensuring isolation between network slices, but also eliminating the risk of key leakage, thus offering high security and a simple implementation.

[0048] The implementation terminal of this application embodiment can be an AMF network element in the core network of a mobile communication network.

[0049] The solutions in this application can be applied to 5G networks or higher versions of mobile communication networks. This application does not limit these solutions in any way, and the scope of protection of this application should not be limited as a result.

[0050] Figure 2 This is a flowchart illustrating an AMF network element redirection method according to an exemplary embodiment of this application. This method can be executed by an initial AMF network element in a mobile communication network (such as a 5G core network), and the AMF network element can be any AMF network element in the mobile communication network. Figure 2 As shown, the method may include the following steps:

[0051] Step 210: Receive a registration request from the target user device. The registration request includes slice information.

[0052] The target user equipment (UE) can be any device capable of accessing a mobile communication network, such as a smartphone, tablet, or IoT device. The target UE may include a USIM (Universal Subscriber Identity Module) card or a SIM (Subscriber Identity Module) card. The registration request issued by the target UE can be forwarded to the initial AMF (Active Mobile Frame) element via a base station or radio access network. The UE needs to send a registration request when accessing the mobile communication network.

[0053] The slice information in the registration request indicates the slice that the target user equipment is requesting to access.

[0054] Below, in conjunction with Figure 3 The following will further introduce the solutions of the embodiments of this application. Figure 3 This is a schematic diagram of a system flow according to an exemplary embodiment of this application. Please refer to... Figure 3 The registration request is sent by the UE to the initial AMF. Figure 3 The illustrated embodiments and Figure 1 The main differences between the embodiments shown are steps 5, 6, 7, and 8, which will be described in detail later.

[0055] Step 220: The initial AMF network element interacts with the target user equipment to generate a first non-access stratum security context in both the initial AMF network element and the target user equipment. The first non-access stratum security context includes the initial K... AMF Key.

[0056] The first non-access stratum security context is the first NAS security context, initial K AMF The key is K AMF The key, the first NAS security context, is used to ensure secure communication between the initial AMF network element and the target user equipment.

[0057] Figure 4 This is illustrated according to an exemplary embodiment of this application. Figure 2 A flowchart detailing step 220 is provided. Please refer to [link / reference]. Figure 4 As shown, step 220 may specifically include the following steps:

[0058] Step 221: Initiate the primary authentication process for the target user equipment through the initial AMF network element.

[0059] The main authentication process requires interaction between the UE, the initial AMF network element, the UDM (Unified Data Management) network element, and the AUSF (Authentication Server Function) network element. The specific interaction method can adopt the method provided by the 5G communication standard.

[0060] Step 222: After successfully completing the master authentication process, derive the initial K from the initial AMF network element and the target user equipment respectively. AMF Keys, and generate initial K respectively. AMF The first non-access layer security context of the key.

[0061] When primary authentication is successful, K will be derived in both the initial AMF network element and the target user equipment. AMF Key; the initial AMF network element and the target user equipment will also respectively send the K key. AMF The key and other information are packaged together to obtain the first NAS security context. In this way, the initial AMF network element and the target user equipment can conduct secure communication based on the first NAS security context. Figure 3 In step 3, "After successful master authentication, generate the NAS security context and K..." AMF The process of "key" is equivalent to the scheme in this embodiment.

[0062] In one embodiment of this application, the redirection method for the AMF network element further includes:

[0063] The first non-access stratum security mode command procedure is executed between the initial AMF network element and the target user equipment to activate the initial K. AMF Non-access stratum keys derived from keys.

[0064] The First Non-Access Stratum (NAS) Security Mode Command Procedure is a NAS SMC procedure (Security Mode Command Procedure). The NAS SMC procedure executes after the main authentication procedure. During the execution of the First NAS Security Mode Command Procedure, the initial AMF network element and the target user equipment (User Equipment) will interact multiple times. The initial AMF network element and the target User Equipment (User Equipment) will each derive an initial K... AMF After the key is obtained, it will be based on the initial K. AMF The key is further used to derive a NAS (NonAccess Stratum) key. The initial key can be activated by triggering the execution of the first NAS security mode command procedure. AMF Non-access stratum keys derived from the key.

[0065] Step 230: If the initial AMF network element determines that it cannot provide services for the network slice indicated in the slice information in the registration request, then it obtains the target AMF network element information that can provide services for the network slice.

[0066] In one embodiment of this application, before obtaining target AMF network element information that can provide services to the network slice indicated by the slice information in the registration request if the initial AMF network element determines that it cannot provide services to the network slice, the redirection method of the AMF network element further includes: receiving slice subscription information corresponding to the target user equipment from the UDM network element, and determining whether the target user equipment is allowed to access the network slice indicated by the slice information in the registration request based on the slice subscription information; if so, the initial AMF network element determines whether it can provide services to the network slice based on its local configuration information.

[0067] In one embodiment of this application, obtaining target AMF network element information that can provide services for network slicing includes: obtaining target AMF network element information that can provide services for network slicing from NSSF network elements.

[0068] Please continue reading Figure 3 In step 3, the initial AMF network element will also obtain user subscription information from the UDM network element. The user subscription information includes the network slices (Subscrided-NSSAIs) subscribed to by the user.

[0069] In step 4, if the initial AMF network element determines that the NSSAI requested by the user is an Allowed-NSSAI based on the network slice subscribed by the user, and if it determines that the initial AMF network element cannot serve the user who requested the NSSAI, then it obtains the service slice information from the NSSF network element. The service slice information is the target AMF network element information that indicates the target AMF network element that can serve the slice identified by the NSSAI.

[0070] Step 240, for the initial K AMF Perform a lateral derivation operation on the key to obtain the first K. AMF The key, and instructs the target user equipment to pass the initial K. AMF The first K is obtained by performing a lateral derivation operation on the key. AMF Key.

[0071] For the initial K AMF Lateral deriving of a key refers to the process of creating a new key from the initial K. AMF Further calculations are performed based on the key to obtain the first K. AMF The keying process. The methods and functions used for lateral derivation can be specified by the relevant 5G communication protocol and can be configured as needed; they will not be elaborated here.

[0072] The initial AMF network element is obtained by K AMF By performing a lateral derivation operation on the key, we can obtain K. AMF1 The initial AMF network element will also send K to the UE. AMF1 A key derivation instruction message to instruct the same approach to be used on the UE based on K. AMF To obtain K, perform a lateral derivation operation on the key. AMF1 The initial AMF network element sends K to the UE. AMF1 When derivation a key instruction message, K-based methods can be used. AMF Secure communication is achieved by deriving NAS layer keys and AS layer keys from the key.

[0073] Figure 3 Step 5 in the above is equivalent to step 240 in the embodiments of this application.

[0074] Please continue reading Figure 3 In step 5, the initial AMF network element performs K... AMF Key level deduction, generating K AMF1 Key; simultaneously, send K to the UE AMF1 Key deduction instructions.

[0075] Step 250, according to the first K AMF Key construction includes the first K AMF The second non-access stratum security context of the key, and will contain the first K AMF The second non-access stratum security context of the key and the registration request are sent to the target AMF network element indicated by the target AMF network element information, so that the target AMF network element can, through the first K AMF The second K is obtained by performing a lateral derivation operation on the key. AMF After obtaining the key, the target user equipment is instructed to access the first K. AMF The second K is obtained by performing a lateral derivation operation on the key. AMF Key, so as to communicate with the target user device based on the second K AMF The key is used to derive non-access stratum and access stratum keys, and then secure communication is used to respond to registration requests.

[0076] The target AMF element can be any AMF element in the mobile communication network that is different from the initial AMF element. The initial AMF element will contain the first K AMF The second non-access stratum security context of the key and the registration request message are sent to the target AMF network element. After receiving the message, the target AMF network element will, based on the first K in the second non-access stratum security context... AMF Key (K) AMF1 ) Horizontal derivation yields the second K AMF Key (K) AMF2Simultaneously, the target AMF network element will also send K to the UE. AMF2 The key derivation instruction message will be used by the UE according to K. AMF2 Key derivation instruction message pair K AMF1 Perform a horizontal derivation operation to obtain K. AMF2 The target AMF network element sends K to the UE. AMF2 When derivation a key instruction message, K-based methods can be used. AMF1 Other NAS layer and AS layer keys derived from the key are used for secure communication.

[0077] The initial AMF network element will construct a network containing the first K AMF NAS security context of the key; the target user equipment obtains the first K in the derivation. AMF When obtaining the key, a corresponding NAS security context is also constructed. Similarly, the target AMF network element and the target user equipment derive the second K... AMF When using the key, a corresponding structure containing the second K will also be constructed. AMF The NAS security context of the key allows the target AMF network element to communicate with the target user equipment based on the second K. AMF Other NAS layer keys and AS layer keys derived from the key are used for secure communication.

[0078] The initial AMF network element will construct a network containing the first K AMF The second NAS security context of the key is transmitted to the target AMF network element, which then obtains the first K. AMF The key is then used to perform the second K AMF Key derivation, and simultaneously, the target AMF network element obtains the second NAS security context, enabling secure communication with the target user equipment to send the second K to the target user equipment. AMF Key derivation instruction.

[0079] In one embodiment of this application, the second K AMF The non-access stratum key derived from the key is activated by executing a second non-access stratum security mode command procedure between the target AMF network element and the target user equipment.

[0080] In one embodiment of this application, when the target user equipment obtains the second AMF key by performing a lateral derivation operation, it triggers the update of the NAS key and the AS key.

[0081] NAS (Non-Access Stratum) keys are used for secure data packet transmission between AMF network elements and UEs. This application embodiment ensures the reliability of communication between the target user equipment and the core network AMF network elements by updating the NAS key.

[0082] The Access Stratum (AS) key is used for secure transmission of data packets between the base station and the UE. This application embodiment ensures the reliability of communication between the target user equipment and the base station by updating the AS key.

[0083] The technical means of step 250 are specifically reflected in Figure 3 In steps 6-8 of the embodiment.

[0084] Please continue reading Figure 3 In step 6, the initial AMF element routes the message to the target AMF element.

[0085] Figure 3 Step 6 shown Figure 1 The difference in step 5 shown is that, Figure 3 The NAS security context contained in the message routed in step 6, as shown, contains the key K. AMF1 It's not K AMF .

[0086] In step 7, the target AMF network element performs key level deduction to generate K. AMF2 Simultaneously, the target AMF network element will also send K to the UE. AMF2 The key deduction instruction is sent, and NAS layer and AS layer key update instructions are sent to the UE.

[0087] In step 8, the message sent by the target AMF network element to the UE carries K. AMF2 Key derivation instructions and NAS layer and AS layer key update instructions.

[0088] UE will be based on K AMF2 Key deduction instruction to deduce K AMF2 It updates the NAS layer key according to the NAS layer key update instruction and updates the AS layer key according to the AS layer key update instruction.

[0089] In one embodiment of this application, when including the first K AMF Before sending the second non-access stratum security context of the key and the registration request to the target AMF network element indicated by the target AMF network element information, the method further includes: determining a method for rerouting to the target AMF network element indicated by the target AMF network element information;

[0090] Will include the first K AMF The second non-access stratum security context of the key and the registration request are sent to the target AMF network element indicated by the target AMF network element information, including: rerouting to the target AMF network element in this manner to include the first K AMF The second non-access stratum security context of the key and the registration request are sent to the target AMF network element.

[0091] The rerouting method to the target AMF network element can be either direct access to the target AMF network element or forwarding to the target AMF network element through the base station.

[0092] Specifically, when the rerouting method is direct access to the target AMF network element, the initial AMF network element can directly include the first K AMF The second non-access stratum security context of the key and the registration request are sent to the target AMF network element; when the rerouting method is to forward to the target AMF network element through the base station, the initial AMF network element needs to forward information through the base station.

[0093] The method used to determine the rerouting route to the target AMF network element indicated by the target AMF network element information can be arbitrary. For example, a method can be randomly determined or determined according to a specified rule. The specified rule can be that if the initial AMF network element can address the target AMF network element, the rerouting route to the target AMF network element is determined to be direct access to the target AMF network element; otherwise, the rerouting route to the target AMF network element is determined to be access to the target AMF network element through a base station.

[0094] In one embodiment of this application, the method involves forwarding the data to the target AMF network element via a base station, and then rerouting it to the target AMF network element according to this method, so as to include the first K... AMF The second non-access stratum security context of the key and the registration request are sent to the target AMF network element, including:

[0095] Will include the first K AMF The second non-access stratum security context of the key and the registration request are sent to the base station, and the base station transmits the key containing the first K. AMF The second non-access stratum security context of the key and the registration request are forwarded to the target AMF network element.

[0096] In one embodiment of this application, the target AMF network element and the target user equipment communicate securely based on a redefined encryption algorithm and integrity protection algorithm. The redefined encryption algorithm and integrity protection algorithm are obtained through communication negotiation based on a non-access stratum key, which is based on a second K key. AMF Derived from the key.

[0097] The redefined encryption and integrity protection algorithms are the latest negotiated encryption and integrity protection algorithms. This application also implements updates to the encryption and integrity protection algorithms, thereby further improving the security of mobile network communications.

[0098] Figure 5 This is a schematic diagram of a system flow according to another exemplary embodiment of this application. Figure 5This includes multiple entities such as UE, gNB (base station), initial AMF, target AMF, AUSF, NSSF, and UDM. The initial AMF includes a primary authentication module, a rerouting module, and a key derivation module, while the target AMF includes a key derivation module and a trigger SMC module. The initial AMF can serve slice B, and the target AMF can serve slice A. Please refer to [link to relevant documentation]. Figure 5 As shown, the process may include the following:

[0099] 1. The UE sends a NAS message to the initial AMF, which carries a registration request for S-NSSAI.

[0100] 2. Initially, the AMF initiates a main authentication request through the main authentication module, carrying SUCI (Subscription Concealed Identifier) ​​and S-NSSAI, to conduct the main authentication process. The main authentication process requires interaction with entities such as AUSF and UDM.

[0101] 3. Upon successful authentication, the initial AMF generation includes K. AMF The NAS security context; the initial AMF will also obtain the subscription information within the UDM.

[0102] 4. The initial AMF determines whether it can serve slice A based on the contract information. If the initial AMF cannot serve slice A, it will proceed with the next steps.

[0103] 5. The initial AMF obtains target AMF information that can serve slice A from the NSSF network element through the rerouting module, and determines the rerouting method.

[0104] 6. Initial AMF to K AMF Key lateral derivation to generate K AMF1 and ngKSI1, and send K to UE AMF1 Key derivation instruction message, performed by UE. AMF1 Key derivation operations. ngKSI1 is used to identify K. AMF1 and the corresponding security context.

[0105] 7. The initial AMF sends either a Namf_Communication_N1MessageNotify message or a RerouteNAS message to include K. AMF1 The security context and registration request (RR) message are sent to the target AMF. When sent as a Reroute NAS message, it will be forwarded through the gNB.

[0106] 8. The target AMF uses the key derivation module based on K AMF1 Horizontal derivation of K AMF2 and ngKSI2, and send K to UE AMF2 Key derivation instruction message, performed by UE. AMF2 Derivation operations of the key.

[0107] 9. The target AMF triggers the SMC process by triggering the SMC module, activating K. AMF2 This will also trigger the NAS layer key and AS layer key update.

[0108] Below, in conjunction with Figure 6 The embodiments of this application will be further described in general. Figure 6 This is a flowchart illustrating the overall interaction process of a user equipment registering with an AMF network element according to an exemplary embodiment of this application. Figure 6 As shown, the signaling interaction flow may include the following:

[0109] 1. The UE sends a registration request to the initial AMF, which includes SUCI and NSSAI.

[0110] The RAN does not have the ability to select slices, so when the UE initiates registration with the network, the RAN will select the already configured default AMF, i.e., the initial AMF.

[0111] 2. The initial AMF initiates the primary authentication process. After successful primary authentication, the initial AMF will derive K. AMF Key.

[0112] 3. Initially, the AMF and UE perform the SMC process, simultaneously generating a sequence containing K. AMF The NAS security context of the key enables secure communication between the UE and the initial AMF.

[0113] 4. Initially, the AMF selects the UDM and obtains the UE's slice subscription information by sending a Nudm_SDM_GET message to the UDM. Based on the slice subscription information, it determines whether the slice requested by the UE is a slice that the UE is allowed to access. If so, proceed to the next step.

[0114] 5. Initially, the AMF determines whether it can serve the slice requested by the UE. If it cannot serve the slice, it performs AMF rerouting.

[0115] 6. The initial AMF obtains the target AMF information for the slice service that the UE can request access from the NSSF network element.

[0116] 7. Initially, the AMF determines whether to reroute through the RAN based on the locally configured policies and subscription information of the AMF, that is, whether to directly access the target AMF or reroute to the target AMF through the RAN.

[0117] 8. Initial AMF based on K AMF The key is horizontally derived to generate a temporary key K. AMF1 and ngKSI1.

[0118] 9. Initially, the AMF sends K to the UE. AMF1 Key derivation instruction message.

[0119] 10. UE based on K AMF1 Key derivation instruction message, horizontally derive K AMF1 and ngKSI1.

[0120] 11. If the initial AMF directly connects to the target AMF, the initial AMF uses a NAS notification (N1MessageNotify) message to send the registration request and a message containing K. AMF1 The NAS security context is passed to the target AMF.

[0121] If the initial AMF needs to be routed to the target AMF via the RAN, then steps 11a and 11b are performed.

[0122] 11a. Initially, the AMF sends the registration request, containing K, via a NAS routing message. AMF1 The NAS security context is sent to the RAN.

[0123] 11b. RAN sends the registration request and includes K AMF1 The NAS security context is packaged into a NAS routing message and sent to the target AMF.

[0124] 12. Target AMF based on K AMF1 Horizontal derivation to generate K AMF2 and ngKSI2.

[0125] 13. Target AMF based on current K AMF1 The generated NAS layer security context sends K to the UE AMF2 Key derivation instruction message.

[0126] 14. UE based on K AMF2 Key derivation instruction message, horizontal derivation to generate K AMF2 and ngKSI2.

[0127] 15. The target AMF triggers the SMC process between the UE and activates K-based... AMF2The target AMF derives NAS and AS layer security keys and negotiates new encryption and integrity protection algorithms. This enables the target AMF and UE to communicate securely based on the security mechanisms provided by the new NAS layer key, encryption algorithm, and integrity protection algorithm, while simultaneously triggering an AS layer key update. Based on this security mechanism, the target AMF can securely and reliably return a Registration Request to the UE.

[0128] In summary, this application proposes a redirection scheme for AMF network elements, whereby the initial AMF network element provides K to the target AMF network element. AMF1 It is a derived temporary key. Even if this key is captured by the base station or other entities during rerouting, it will not cause the initial AMF network element's own K. AMF The key leakage ensures forward security; simultaneously, the key used by the target AMF network element is also derived, and this key cannot be obtained by the initial AMF network element, ensuring backward security; moreover, each slice key accessed by the UE is different, achieving secure isolation between slices, which can meet the needs of various industries with high communication security requirements; during the base station rerouting process, the use of temporary keys also reduces the AMF triggering of a second primary authentication, improving rerouting efficiency; in addition, since the overall solution can make the most of existing network interfaces, the degree of network element modification is small, which is in line with the development trend of network slicing.

[0129] According to a second aspect of this application, this application also provides a redirection device for an AMF network element, which can be located within the initial AMF network element. The following are embodiments of the device from this application.

[0130] Figure 7 This is a block diagram illustrating a redirection device for an AMF network element according to an exemplary embodiment. Figure 7 As shown, the redirection device 700 of the AMF network element includes:

[0131] The receiving module 710 is configured to receive a registration request from a target user device, the registration request including slice information;

[0132] Interaction module 720 is used to interact between the initial AMF network element and the target user equipment to generate a first non-access stratum security context in both the initial AMF network element and the target user equipment. The first non-access stratum security context includes an initial K AMF Key;

[0133] The acquisition module 730 is used to acquire target AMF network element information that can provide services to the network slice if the initial AMF network element determines that it cannot provide services to the network slice indicated by the slice information in the registration request;

[0134] Derivation and indication module 740, for the initial K AMF Perform a lateral derivation operation on the key to obtain the first K. AMF The key, and instructs the target user equipment to pass the initial K. AMF The first K is obtained by performing a lateral derivation operation on the key. AMF Key;

[0135] The build and send module 750 is configured to, based on the first K AMF Key construction includes the first K AMF The second non-access stratum security context of the key, and the key containing the first K AMF The second non-access stratum security context of the key and the registration request are sent to the target AMF network element indicated by the target AMF network element information, so that the target AMF network element can, through the first K AMF The second K is obtained by performing a lateral derivation operation on the key. AMF After obtaining the key, the target user equipment is instructed to access the first K. AMF The second K is obtained by performing a lateral derivation operation on the key. AMF A key, so as to communicate with the target user equipment based on the second K AMF The key is used to derive non-access stratum keys and access stratum keys, and then secure communication is used to respond to the registration request.

[0136] According to another aspect of this application, an electronic device capable of implementing the above-described method is also provided.

[0137] Those skilled in the art will understand that various aspects of this application can be implemented as a system, method, or program product. Therefore, various aspects of this application can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, collectively referred to herein as a "circuit," "module," or "system."

[0138] Figure 8 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown.

[0139] It should be noted that, Figure 8 The computer system 800 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0140] like Figure 8 As shown, the computer system 800 includes a Central Processing Unit (CPU) 801, which can perform various appropriate actions and processes based on programs stored in Read-Only Memory (ROM) 802 or programs loaded from storage portion 808 into Random Access Memory (RAM) 803, such as performing the methods described in the above embodiments. The RAM 803 also stores various programs and data required for system operation. The CPU 801, ROM 802, and RAM 803 are interconnected via a bus 804. An Input / Output (I / O) interface 805 is also connected to the bus 804.

[0141] The following components are connected to I / O interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to I / O interface 805 as needed. A removable medium 811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 810 as needed so that computer programs read from it can be installed into storage section 808 as needed.

[0142] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 809, and / or installed from removable medium 811. When the computer program is executed by central processing unit (CPU) 801, it performs various functions defined in the system of this application.

[0143] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such transmitted data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0144] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0145] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0146] In one aspect, this application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the methods described in the above embodiments.

[0147] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0148] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the method according to the embodiments of this application.

[0149] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the embodiments disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

[0150] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A redirection method for an AMF network element, characterized in that, The method is executed by the initial AMF network element, and the method includes: Receive a registration request from a target user device, the registration request including slice information; The initial AMF network element interacts with the target user equipment to generate a first non-access stratum security context on both the initial AMF network element and the target user equipment. The first non-access stratum security context includes an initial K. AMF Key; If the initial AMF network element determines that it cannot provide services for the network slice indicated by the slice information in the registration request, then it obtains the target AMF network element information that can provide services for the network slice; For the initial K AMF Perform a lateral derivation operation on the key to obtain the first K. AMF The key, and instructs the target user equipment to pass the initial K. AMF The first K is obtained by performing a lateral derivation operation on the key. AMF Key; According to the first K AMF Key construction includes the first K AMF The second non-access stratum security context of the key, and the key containing the first K AMF The second non-access stratum security context of the key and the registration request are sent to the target AMF network element indicated by the target AMF network element information, so that the target AMF network element can, through the first K AMF The second K is obtained by performing a lateral derivation operation on the key. AMF After obtaining the key, the target user equipment is instructed to access the first K. AMF The second K is obtained by performing a lateral derivation operation on the key. AMF A key, so as to communicate with the target user equipment based on the second K AMF The key is used to derive non-access stratum keys and access stratum keys, and then secure communication is used to respond to the registration request.

2. The redirection method for AMF network elements according to claim 1, characterized in that, In the context of including the first K AMF Before the second non-access stratum security context of the key and the registration request are sent to the target AMF network element indicated by the target AMF network element information, the method further includes: Determine the method of rerouting to the target AMF network element indicated by the target AMF network element information; The first K is included AMF The second non-access stratum security context of the key and the registration request sent to the target AMF network element indicated by the target AMF network element information include: Rerouting to the target AMF network element in the manner described above, so as to include the first K AMF The second non-access stratum security context of the key and the registration request are sent to the target AMF network element.

3. The redirection method for AMF network elements according to claim 2, characterized in that, The method is to directly access the target AMF network element or to forward the data to the target AMF network element through a base station.

4. The redirection method for AMF network elements according to claim 3, characterized in that, The method involves forwarding the data to the target AMF network element via a base station, and then rerouting it to the target AMF network element according to the aforementioned method, so as to include the first K... AMF The second non-access stratum security context of the key and the registration request are sent to the target AMF network element, including: The first K AMF The second non-access stratum security context of the key and the registration request are sent to the base station, and the base station transmits the key containing the first K. AMF The second non-access stratum security context of the key and the registration request are forwarded to the target AMF network element.

5. The redirection method for an AMF network element according to any one of claims 1-4, characterized in that, The initial AMF network element interacts with the target user equipment to generate a first non-access stratum security context on both the initial AMF network element and the target user equipment, including: The primary authentication process for the target user equipment is initiated through the initial AMF network element; After successfully completing the master authentication process, initial K is derived from the initial AMF network element and the target user equipment, respectively. AMF The key is used to generate the initial K. AMF The first non-access layer security context of the key.

6. The redirection method for AMF network elements according to claim 5, characterized in that, The second K AMF The non-access stratum key derived from the key is activated by executing a second non-access stratum security mode command procedure between the target AMF network element and the target user equipment, and the method further includes: A first non-access stratum security mode command procedure is executed between the initial AMF network element and the target user equipment to activate the initial K. AMF Non-access stratum keys derived from keys.

7. The redirection method for an AMF network element according to any one of claims 1-4, characterized in that, The target AMF network element and the target user equipment communicate securely based on a redefined encryption algorithm and integrity protection algorithm. This redefined encryption algorithm and integrity protection algorithm are negotiated using a non-access stratum key, which is based on the second K key. AMF Derived from the key.

8. A redirection device for an AMF network element, characterized in that, The device is located in the initial AMF network element, and the device includes: The receiving module is configured to receive a registration request from a target user device, the registration request including slice information; An interaction module is used to interact between the initial AMF network element and the target user equipment to generate a first non-access stratum security context on both the initial AMF network element and the target user equipment. The first non-access stratum security context includes an initial K. AMF Key; The acquisition module is used to acquire target AMF network element information that can provide services to the network slice if the initial AMF network element determines that it cannot provide services to the network slice indicated by the slice information in the registration request; Derivation and indication modules are used for the initial K AMF Perform a lateral derivation operation on the key to obtain the first K. AMF The key, and instructs the target user equipment to pass the initial K. AMF The first K is obtained by performing a lateral derivation operation on the key. AMF Key; The build and send module is used to build and send according to the first K AMF Key construction includes the first K AMF The second non-access stratum security context of the key, and the key containing the first K AMF The second non-access stratum security context of the key and the registration request are sent to the target AMF network element indicated by the target AMF network element information, so that the target AMF network element can, through the first K AMF The second K is obtained by performing a lateral derivation operation on the key. AMF After obtaining the key, the target user equipment is instructed to access the first K. AMF The second K is obtained by performing a lateral derivation operation on the key. AMF A key, so as to communicate with the target user equipment based on the second K AMF The key is used to derive non-access stratum keys and access stratum keys, and then secure communication is used to respond to the registration request.

9. A computer-readable medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 7.

10. An electronic device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the method as described in any one of claims 1 to 7.

Images