Communication method and apparatus

Abstract

The application provides a communication method and device, which can solve the problem that a terminal device cannot update a global public key, and can be applied to a wireless communication system. The method comprises the following steps: a network device receives first indication information from a key generation center, wherein the first indication information is used for indicating a global public key update; the network device sends a first message to the key generation center according to the first indication information, wherein the first message is used for requesting to obtain an updated private key, the updated private key is determined according to an updated global private key; the network device receives update information of the global public key and the updated private key from the key generation center, wherein the updated private key is used for signing a system message by the network device; and the network device sends the system message and a first signature to a terminal device, wherein the system message comprises the update information of the global public key, and the first signature is a signature of the system message by the network device.

Description

Technical Field

[0001] This application relates to the field of communications, and more particularly to a communication method and apparatus. Background Technology

[0002] Before a terminal device can access a mobile network, it needs to obtain system messages broadcast by the network device, such as the master information block (MIB) and the system information block (SIB), in order to initiate a wireless connection to access the network device. The system messages require security protection during the broadcast process to prevent them from being forged, stolen, or tampered with.

[0003] Identity-based signature (IBS) is an identity-based asymmetric key technology used to sign and protect system messages broadcast by network devices. Specifically, after a private key generator (PKG) generates a global public key (GPK) and a global secret key (GSK), the PKG generates a private key based on the GPK, GSK, and the identity information provided by the network device, and then sends the private key and GPK to the network device. The network device can then use this private key and GPK to sign and protect system messages. Terminal devices can use a pre-configured GPK to verify the signature of received system messages. Upon successful verification, the terminal device initiates a wireless connection to access the mobile network. However, long-term use of the GPK and GSK can lead to attacks and cracking, requiring the PKG to periodically update them. However, when the PKG updates the GPK, the terminal device is unaware of the update and continues to use the outdated GPK for signature verification, resulting in verification failure and preventing access to the mobile network. Summary of the Invention

[0004] This application provides a communication method and apparatus that can solve the problem that terminal devices cannot update the global public key.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] Firstly, a communication method is provided. This method can be executed by a network device, or by a component of the network device, such as a processor, chip, or chip system, or by a logic module or software capable of implementing all or part of the functions of the network device. The following description uses the execution of this method by a network device as an example. The method includes: the network device receiving first indication information from a key generation center, wherein the first indication information is used to indicate a global public key update. The network device sending a first message to the key generation center according to the first indication information, wherein the first message is used to request an updated private key, and the updated private key is determined based on the updated global private key. The network device receiving update information of the global public key and the updated private key from the key generation center, wherein the updated private key is used by the network device to sign a system message. The network device sending a system message and a first signature to a terminal device, wherein the system message includes the update information of the global public key, and the first signature is the network device's signature of the system message.

[0007] Based on the communication method described in the first aspect, the network device can sign the system message based on the update information of the global public key generated by the key generation center, and send the update information of the global public key to the terminal device through the system message. If the terminal device does not know the updated global public key, it can perform signature verification on the system message and the update information of the global public key based on the global public key before the update, and obtain the updated global public key, thereby realizing the update of the global public key of the terminal device, making the global public keys of the key generation center, the network device and the terminal device consistent, and thus improving the reliability of system message signature verification.

[0008] In one possible design, the update information for the global public key can include the updated global public key and its activation time. The first signature is determined based on the previous private key and the previous global public key. Thus, an effective time can be set for the updated global public key. In this case, the network device can use the previous global public key and private key to sign and protect system messages. This allows the terminal device to obtain the updated global public key information in the system message based on the previous global public key, and to synchronize and update the global public key with the network device based on the activation time of the updated global public key, thereby improving the accuracy and reliability of signature verification.

[0009] In another possible design, the update information for the global public key can include the updated global public key, its generation time, and a second signature. The second signature is a signature made by the key generation center based on the previous global private key, along with the updated global public key and its generation time. The first signature is determined based on the updated private key and the updated global public key. In this way, the updated global public key can be protected by signing based on the previous global private key. In this case, the updated global public key takes effect immediately upon generation. Network devices can sign system messages based on the updated private key and the updated global public key, and send system messages protected by the updated global public key signature, along with the updated global public key signature protected by the previous global private key, to terminal devices. This allows terminal devices to determine the authenticity of the updated global public key based on the previously stored previous global public key, and to verify the signature of system messages using the determined updated global public key. Furthermore, it can also verify the authenticity of the acquired updated global public key, thus completing the update of the global public key.

[0010] In one possible design, before the network device sends the system message and the first signature to the terminal device, the communication method provided in this application embodiment further includes: the network device sending first indication information to the terminal device. In this way, the terminal device can promptly obtain information about the global public key update based on the first indication information, and thus update the global public key in a timely manner without constantly receiving system messages for judgment, thereby reducing the signaling and resource overhead of the terminal device.

[0011] Furthermore, the first indication information can be carried in the downlink control information. Sending the first indication information carried in the downlink control information reduces the need for downlink resource information.

[0012] Secondly, a communication method is provided. This method can be executed by a terminal device, or by a component of the terminal device, such as its processor, chip, or chip system, or by a logic module or software capable of implementing all or part of the terminal device's functions. The following description uses the execution of this method by a terminal device as an example. The method includes: the terminal device receiving a system message and a first signature from a network device, wherein the system message includes update information of the global public key, the first signature is the network device's signature of the system message, and the terminal device determines a third signature based on the system message. If the third signature matches the first signature, the terminal device obtains the update information of the global public key from the system message.

[0013] In one possible design, the update information for the global public key may include the updated global public key and the activation time of the updated global public key. The first signature is determined based on the private key and the global public key before the update.

[0014] Furthermore, the terminal device determines the third signature based on the system message, including: the terminal device determines the third signature based on the global public key before the update and the system message.

[0015] In another possible design, the update information for the global public key includes the updated global public key, the generation time of the updated global public key, and a second signature. The second signature is a signature made by the key generation center based on the global private key before the update, along with the updated global public key and its generation time. The first signature is determined based on the updated private key and the updated global public key.

[0016] Furthermore, the terminal device determines the third signature based on the system message, including: the terminal device determines the fourth signature based on the global public key before the update, the updated global public key, and the generation time of the updated global public key. If the fourth signature matches the second signature, the terminal device determines the third signature based on the updated global public key and the system message.

[0017] In one possible design, before the terminal device receives the system message and the first signature from the network device, the communication method provided in this application embodiment further includes: the terminal device receiving first indication information from the network device, the first indication information being used to indicate a global public key update.

[0018] Furthermore, the first indication information can be carried in the downlink control information.

[0019] The technical effects of the method described in the second aspect can be referred to the technical effects of the method described in the first aspect, and will not be repeated here.

[0020] Thirdly, a communication method is provided. This method can be executed by a key generation center, or by a component of the key generation center, such as its processor, chip, or chip system, or by a logic module or software capable of implementing all or part of the key generation center's functions. The following description uses the execution of this method by the key generation center as an example. The method includes: the key generation center sending first indication information to a network device, wherein the first indication information is used to indicate a global public key update. The key generation center receiving a first message from the network device, wherein the first message is used to request an updated private key, the updated private key being determined based on the updated global private key. The key generation center sending the updated global public key information and the updated private key to the network device, wherein the updated private key is used by the network device to sign system messages.

[0021] In one possible design, the update information for the global public key may include the updated global public key and the activation time of the updated global public key.

[0022] In another possible design, the update information of the global public key may include the updated global public key, the generation time of the updated global public key, and a second signature. The second signature is a signature made by the key generation center based on the global private key before the update of the updated global public key and the generation time of the updated global public key.

[0023] The technical effects of the method described in the third aspect can be referred to the technical effects of the method described in the first aspect, and will not be repeated here.

[0024] Fourthly, a communication device is provided. The device includes a processing module and a transceiver module. The transceiver module is configured to receive first indication information from a key generation center, the first indication information indicating a global public key update. The processing module is configured to send a first message to the key generation center according to the first indication information, the first message requesting an updated private key, the updated private key being determined based on an updated global private key. The transceiver module is further configured to receive update information of the global public key and the updated private key from the key generation center, the updated private key being used by the communication device of the fourth aspect to sign system messages. The transceiver module is further configured to send a system message and a first signature to a terminal device, the system message including update information of the global public key, and the first signature being a signature of the system message by the device of the fourth aspect.

[0025] In one possible design, the update information for the global public key may include the updated global public key and the activation time of the updated global public key; the first signature is determined based on the private key before the update and the global public key before the update.

[0026] In another possible design, the update information of the global public key may include the updated global public key, the generation time of the updated global public key, and a second signature. The second signature is a signature made by the key generation center based on the global private key before the update, on the updated global public key and the generation time of the updated global public key. The first signature is determined based on the updated private key and the updated global public key.

[0027] In one possible design, the transceiver module is also used to send first instruction information to the terminal device.

[0028] Furthermore, the first indication information can be carried in the downlink control information.

[0029] Optionally, the transceiver module may include a receiving module and a sending module. The sending module implements the sending function of the communication device described in the fourth aspect, and the receiving module implements the receiving function of the communication device described in the fourth aspect.

[0030] Optionally, the communication device described in the fourth aspect may further include a storage module storing programs or instructions. When the processing module executes the program or instructions, the communication device described in the fourth aspect can perform the method described in the first aspect.

[0031] It should be noted that the communication device described in the fourth aspect may be a network device, or a chip (system) or other component or assembly that can be disposed in a network device, or a device that includes a network device. This application does not limit this.

[0032] The technical effects of the communication device described in the fourth aspect can be referred to the technical effects of the method described in the first aspect, and will not be repeated here.

[0033] Fifthly, a communication device is provided. The device includes a processing module and a transceiver module. The transceiver module is configured to receive a system message and a first signature from a network device. The system message includes update information of a global public key, and the first signature is a signature of the system message by the network device. The processing module is configured to determine a third signature based on the system message. The processing module is further configured to, if the third signature matches the first signature, obtain the update information of the global public key from the system message.

[0034] In one possible design, the update information for the global public key may include the updated global public key and the activation time of the updated global public key; the first signature is determined based on the private key before the update and the global public key before the update.

[0035] Furthermore, the processing module, used to determine the third signature based on the system message, includes: the processing module, used to determine the third signature based on the global public key before the update and the system message.

[0036] In another possible design, the update information of the global public key may include the updated global public key, the generation time of the updated global public key, and a second signature. The second signature is a signature made by the key generation center based on the global private key before the update, on the updated global public key and the generation time of the updated global public key. The first signature is determined based on the updated private key and the updated global public key.

[0037] Further, the processing module is used to determine the third signature based on the system message, including: the processing module is used to determine the fourth signature based on the global public key before the update, the global public key after the update, and the generation time of the global public key after the update; if the fourth signature matches the second signature, the third signature is determined based on the updated global public key and the system message.

[0038] In one possible design, the transceiver module is also used to receive first indication information from the network device, which is used to indicate a global public key update.

[0039] Furthermore, the first indication information can be carried in the downlink control information.

[0040] Optionally, the transceiver module may include a receiving module and a sending module. The sending module implements the sending function of the communication device described in the fifth aspect, and the receiving module implements the receiving function of the communication device described in the fifth aspect.

[0041] Optionally, the communication device described in the fifth aspect may further include a storage module storing programs or instructions. When the processing module executes the program or instructions, the communication device described in the fifth aspect can perform the method described in the second aspect.

[0042] It should be noted that the communication device described in the fifth aspect may be a terminal device, or a chip (system) or other component or assembly that can be disposed in the terminal device, or a device that includes the terminal device. This application does not limit it in this respect.

[0043] The technical effects of the communication device described in the fifth aspect can be referred to the technical effects of the method described in the first aspect, and will not be repeated here.

[0044] Sixthly, a communication device is provided. The device includes a sending module and a receiving module. The sending module is configured to send first indication information to a network device, the first indication information being used to indicate a global public key update. The receiving module is configured to receive a first message from the network device, the first message being used to request an updated private key, the updated private key being determined based on the updated global private key. The sending module is further configured to send update information of the global public key and the updated private key to the network device, the updated private key being used by the network device to sign system messages.

[0045] In one possible design, the update information for the global public key includes the updated global public key and the activation time of the updated global public key.

[0046] In another possible design, the update information of the global public key includes the updated global public key, the generation time of the updated global public key, and a second signature. The second signature is the signature of the communication device described in the sixth aspect on the updated global public key and the generation time of the updated global public key based on the global private key before the update.

[0047] Optionally, the transmitting module and the receiving module can also be integrated into a single module, such as a transceiver module. The transceiver module is used to implement the transmitting and receiving functions of the communication device described in the sixth aspect.

[0048] Optionally, the communication device described in the sixth aspect may further include a processing module. The processing module is used to implement the processing functions of the communication device described in the sixth aspect.

[0049] Optionally, the communication device described in the sixth aspect may further include a storage module storing programs or instructions. When the processing module executes the program or instructions, the communication device can perform the method described in the third aspect.

[0050] It should be noted that the communication device described in the sixth aspect can be a network device, such as a key generation center, or a chip (system) or other component or assembly that can be set in a network device, or a device that includes a network device. This application does not limit this.

[0051] The technical effects of the communication device described in the sixth aspect can be referred to the technical effects of the method described in the first aspect, and will not be repeated here.

[0052] A seventh aspect provides a communication device. The communication device includes a processor coupled to a memory, the processor being configured to execute a computer program stored in the memory, such that the communication device of the seventh aspect can perform the method described in any one of the possible implementations of the first to third aspects.

[0053] In one possible design, the communication device described in the seventh aspect may further include a transceiver. This transceiver may be a transceiver circuit or an interface circuit. The transceiver can be used for communication between the communication device described in the seventh aspect and other communication devices.

[0054] In this application, the communication device described in the seventh aspect may be the network device in the first aspect, the terminal device in the second aspect, or the key generation center in the third aspect, or may be a chip (system) or other component or assembly disposed in the terminal device, network device, or key generation center, or may include the terminal device or network device.

[0055] The technical effects of the communication device described in the seventh aspect can be referred to the technical effects of the method described in the first aspect, and will not be repeated here.

[0056] Eighthly, a communication system is provided. The communication system includes a key generation center, a network device, and a terminal device. The key generation center is used to execute the communication method described in the third aspect above, the network device is used to execute the communication method described in the first aspect above, and the terminal device is used to execute the communication method described in the second aspect above.

[0057] A ninth aspect provides a computer-readable storage medium. The computer-readable storage medium stores a computer program or instructions that, when executed on a computer, cause the computer to perform the method described in any one of the possible implementations of the first to third aspects.

[0058] A tenth aspect provides a computer program product. The computer program product includes a computer program or instructions that, when executed on a computer, cause the computer to perform the method described in any one of the possible implementations of the first to third aspects. Attached Figure Description

[0059] Figure 1 This is a schematic diagram of a process for obtaining a public key based on PWS;

[0060] Figure 2 This is a schematic diagram of a system message signature protection process based on IBS;

[0061] Figure 3 This application provides a schematic diagram of the architecture of a communication system.

[0062] Figure 4 A flowchart illustrating a communication method provided in an embodiment of this application;

[0063] Figure 5 A flowchart illustrating another communication method provided in an embodiment of this application;

[0064] Figure 6 A flowchart illustrating yet another communication method provided in an embodiment of this application;

[0065] Figure 7 This is a schematic diagram of the structure of a communication device provided in an embodiment of this application;

[0066] Figure 8 This is a schematic diagram of another communication device provided in an embodiment of this application;

[0067] Figure 9 This is a schematic diagram of another communication device provided in an embodiment of this application. Detailed Implementation

[0068] For ease of understanding, the relevant technologies involved in the embodiments of this application will be described below.

[0069] Before accessing a mobile network, a terminal device needs to obtain system messages broadcast by the network device, such as MIBs and SIBs, to initiate a wireless connection. These system messages require security protection during broadcast to prevent impersonation, theft, or tampering. Currently, network devices typically use their private keys to sign system messages, and the terminal device uses the corresponding public key to verify the signature, determining the accuracy of the system message and ensuring secure network access.

[0070] In this system, the public key can be signed into a certificate by a certification authority (CA) system, while the private key (secret key, SK) is generated by the user. Network devices and terminal devices can use the public key generated by the CA system to sign and protect system messages. However, the long-term use of the public key may lead to attacks and cracking, so it needs to be updated regularly. However, the public key generated by the CA system in the terminal device is pre-set, such as at the factory. When the CA system updates the public key, the terminal device cannot obtain the updated public key.

[0071] Currently, when a public key update occurs in the CA system, network devices can broadcast messages through public warning systems (PWS) to notify terminal devices, enabling the terminal devices to obtain the updated public key. For example, Figure 1 This diagram illustrates the process by which a terminal device obtains a public key based on PWS. For example... Figure 1 As shown, the public key acquisition process includes:

[0072] S101, CA sends the updated public key to the cell broadcast entity (CBE).

[0073] S102 and CBE encapsulate the updated public key into the PWS alarm message and provide application-layer security protection for the PWS alarm message.

[0074] S103 and CBE send PWS alarm messages to network devices.

[0075] Among them, PWS alarm messages can be carried in cell broadcast center (CBC) messages and sent.

[0076] S104. The network device broadcasts system messages to the terminal device.

[0077] The system message contains the updated public key. The terminal device can read the received system message to obtain the updated public key.

[0078] Therefore, based on Figure 1 The process shown for a terminal device to obtain the updated public key of the CA relies on the PWS function deployed by the operator and requires the PWS application layer to enable security protection; otherwise, the terminal device cannot determine the authenticity of the updated public key of the CA.

[0079] Therefore, the public key can be generated by the PKG, and the network device can use the public key generated by the PKG to sign and protect system messages broadcast by the network device based on IBS technology. In this case, the private key in the network device is generated by the PKG based on IBS technology, and is not generated by the network device itself. For example, Figure 2 A schematic diagram of a system message signature protection process based on IBS is shown. Figure 2 As shown, the signature protection process for this system message includes the following steps:

[0080] S201. The network device sends a private key request to the PKG. Correspondingly, the PKG receives the private key request from the network device.

[0081] The private key request is used by the network device to request a private key for signing system messages. The private key request carries the identity information of the network device, which may be the identifier of the network device.

[0082] S202 and PKG generate private keys based on the identity information of GSK and network devices.

[0083] The GSK is generated by the PKG, which in turn generates a corresponding GPK. The GPK and GSK form a global key pair. Based on the network device's identity information, the PKG can use the GSK to generate a private key for that network device, which is then used by the network device to sign and protect system messages.

[0084] Understandably, PKG generates different private keys based on different network devices, and the identity-based private key generated for each network device is unique.

[0085] S203: The PKG sends a private key and GPK to the network device. Correspondingly, the network device receives the private key and GPK from the PKG.

[0086] S204. The network device performs signature calculation on the system message based on the GPK and private key to obtain the signature of the system message.

[0087] For example, the network device takes the private key, GPK, and the system message to be sent as input, performs a signature calculation, and obtains the signature of the system message. The implementation process of the signature calculation can be found in existing implementations, and will not be described in detail here.

[0088] S205. The network device sends a system message and its signature to the terminal device. Correspondingly, the terminal device receives the system message and its signature from the network device.

[0089] This system message carries the network device's identity information and may include cell access and cell selection information, or radio resource configuration information, for use by terminal devices to establish wireless connections. The network device sends the system message and its signature via broadcast.

[0090] S206. The terminal device performs signature verification on the system message signature according to the preset GPK.

[0091] The pre-configured GPK is the same as the GPK generated by the PKG. The pre-configured GPK is deployed during initialization, for example, it can be pre-configured when the terminal device leaves the factory, or it can be pre-configured before the terminal device first enters the network.

[0092] After receiving the system message and its signature, the terminal device takes the network device's identity information, the pre-set GPK, and the system message itself as input to perform signature calculation, obtaining a system message signature. It then compares the calculated system message signature with the received system message signature. If they match, the system message verification is successful, and the terminal device initiates a wireless connection to the network device based on the system message to correctly access the mobile network. If they differ, the system message verification fails, and the terminal device does not initiate a wireless connection based on the system message.

[0093] However, GPK and GSK can be compromised even with prolonged use, and PKG needs to update GPK and GSK periodically. However, when PKG updates GPK, the terminal device is unaware of the update and continues to use the outdated GPK for signature verification, leading to verification failure and inability to access the mobile network. Therefore, this application provides a communication method to solve the problem of terminal devices being unable to update their global public keys.

[0094] The technical solutions in this application will now be described with reference to the accompanying drawings.

[0095] The technical solutions of this application embodiment can be applied to various communication systems, such as wireless fidelity (WiFi) systems, vehicle-to-everything (V2X) communication systems, device-to-device (D2D) communication systems, vehicle-to-everything (V2X) communication systems, 4th generation (4G) mobile communication systems, such as long term evolution (LTE) systems, worldwide interoperability for microwave access (WiMAX) communication systems, 5th generation (5G) mobile communication systems, such as new radio (NR) systems, and future communication systems, such as 6th generation (6G) mobile communication systems, etc.

[0096] This application will present various aspects, embodiments, or features relating to systems that may include multiple devices, components, modules, etc. It should be understood and appreciated that individual systems may include additional devices, components, modules, etc., and / or may not include all the devices, components, modules, etc. discussed in conjunction with the accompanying drawings. Furthermore, combinations of these approaches are also possible.

[0097] Furthermore, in the embodiments of this application, words such as "exemplarily" and "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as an "example" in this application should not be construed as being better or more advantageous than other embodiments or designs. Rather, the use of the word "example" is intended to present the concept in a specific manner.

[0098] In the embodiments of this application, the terms "information," "signal," "message," "channel," and "singaling" may sometimes be used interchangeably. It should be noted that, without emphasizing their distinction, they all convey the same meaning. Similarly, the terms "of," "corresponding (relevant)," and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing their distinction, they all convey the same meaning.

[0099] The network architecture and business scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0100] For example, Figure 3 This is a schematic diagram of the architecture of a communication system provided in an embodiment of this application. Figure 3 As shown, the communication system includes: a key generation center, network equipment, and terminal equipment.

[0101] The key generation center can communicate with network devices, and the network devices can communicate with terminal devices. Figure 3 An example is shown with one network device and one terminal device. The embodiments of this application do not limit the number of network devices and terminal devices.

[0102] In this scheme, a key generation center sends a first indication message to a network device, which instructs the global public key to be updated. The network device receives the first indication message from the key generation center and sends a first message to the key generation center based on the first indication message. The first message requests an updated private key, which is determined based on the updated global private key. The key generation center receives the first message from the network device and sends the updated global public key and the updated private key to the network device. The updated private key is used by the network device to sign system messages. The network device receives the updated global public key and the updated private key from the key generation center and sends a system message and a first signature to a terminal device. The system message includes the updated global public key, and the first signature is the network device's signature on the system message. Further, the terminal device receives the system message and the first signature from the network device and determines a third signature based on the system message. If the third signature matches the first signature, the terminal device obtains the updated global public key from the system message. The specific implementation process of this scheme can be found in the following method embodiments, which will not be elaborated here.

[0103] The aforementioned key generation center can be an entity or device responsible for key generation and distribution. Located on the network side of the communication system, the key generation center can be deployed as a separate logical functional entity or on a network device. For example, the key generation center can be a server. It is understood that the key generation center can also be called a private key generation center, private key generator, key generator, key generation center device, key generation device, key generation center entity, or key generation entity, etc., and this application embodiment does not limit this. The key generation center can be one of the aforementioned... Figure 2The PKG shown.

[0104] The aforementioned network device is a device located on the network side of the aforementioned communication system and having wireless transceiver functionality, or a chip or chip system that can be installed in the device. This network equipment includes, but is not limited to: access points (APs) in wireless fidelity (WiFi) systems, such as home gateways, routers, servers, switches, and bridges; evolved Node Bs (eNBs), radio network controllers (RNCs), Node Bs (NBs), base station controllers (BSCs), base transceiver stations (BTSs), home base stations (e.g., home evolved Node Bs or home Node Bs, HNBs), baseband units (BBUs), wireless relay nodes, wireless backhaul nodes, and transmission and reception points (TRPs or TPs). It can also be 5G, such as gNBs in new radio (NR) systems, or transmission points (TRPs or TPs), one or a group of antenna panels (including multiple antenna panels) of a base station in a 5G system, or network nodes constituting gNBs or transmission points, such as baseband units (BBUs) or distributed units (DMUs). Units such as DU (Dedicated Unit) and roadside units (RSU) with base station functions.

[0105] The aforementioned terminal equipment is a terminal that connects to the aforementioned communication system and has wireless transceiver capabilities, or a chip or chip system that can be installed in the terminal. This terminal equipment may also be referred to as a user device, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication equipment, user agent, or user equipment. The terminal devices in the embodiments of this application may be mobile phones, cellular phones, smartphones, wireless data cards, personal digital assistant (PDA) computers, wireless modems, handsets, laptop computers, tablet computers, computers with wireless transceiver capabilities, virtual reality (VR) terminal devices, augmented reality (AR) terminal devices, machine type communication (MTC) terminal devices, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical care, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, vehicle terminals, RSUs with terminal functions, etc. The terminal device of this application may also be an on-board module, on-board component, on-board chip, or on-board unit that is built into a vehicle as one or more components or units. The vehicle can implement the communication method provided in this application through the built-in on-board module, on-board component, on-board chip, or on-board unit.

[0106] It should be noted that the communication method provided in the embodiments of this application can be applied to... Figure 3 The specific implementation of the key generation center and network devices, as well as the terminal devices and network devices, can be found in the following method embodiments, which will not be repeated here.

[0107] It should be understood that the above Figure 3 The devices or functional nodes included in the illustrated communication system are merely exemplary descriptions and do not constitute a limitation on the embodiments of this application. In fact, Figure 3 The communication system shown may also include other network elements, devices, or functional nodes that interact with the devices or functional nodes illustrated in the figure; no specific limitations are made here.

[0108] It should be noted that the solutions in the embodiments of this application can also be applied to other communication systems, and the corresponding names can be replaced by the names of the corresponding functions in other communication systems.

[0109] It should be understood that Figure 3 This is a simplified diagram for ease of understanding only. The communication system may also include other network devices and / or other terminal devices. Figure 3 It was not drawn in the middle.

[0110] The following will combine Figures 4-6 The communication method provided in the embodiments of this application will be described in detail.

[0111] For example, Figure 4 This is a flowchart illustrating a communication method provided in an embodiment of this application. The communication method includes the following steps:

[0112] S401. The key generation center sends a first instruction message to the network device. Correspondingly, the network device receives the first instruction message from the key generation center.

[0113] The first indication information is used to indicate a global public key update. For example, when the key generation center updates the global public key, it sends the first indication information to inform the network device that a global public key update has occurred, so that the network device can update its global public and private keys in a timely manner. It is understood that the global public and private keys are a pair of global keys; therefore, when the key generation center updates the global public key, the global private key is also updated simultaneously.

[0114] S402. The network device sends a first message to the key generation center according to the first instruction information. Correspondingly, the key generation center receives the first message from the network device.

[0115] The first message is used to request the updated private key, and this first message can be one of the above. Figure 2 In the private key request, the first message may carry the identifier of the network device, which is used by the key generation center to generate an identity-based key for the network device.

[0116] S403. The key generation center sends the updated global public key and the updated private key to the network device. Correspondingly, the network device receives the updated global public key and the updated private key from the key generation center.

[0117] For example, after receiving the first message, the key generation center can generate an updated private key for the network device based on the network device's identifier and the updated global private key. The updated private key is used by the network device to sign system messages, and the center sends the updated global public key information and the updated private key to the network device.

[0118] In one possible design, the update information for the global public key can include the updated global public key and its activation time. The activation time of the updated global public key, also known as its effective time, can indicate to the network device that the updated global public key is not yet effective. In other words, before the set activation time of the updated global public key is reached, the network device continues to use the previous global public key and private key to sign and protect system messages. See below for details. Figure 5 The method embodiments shown are illustrated.

[0119] In another possible design, the update information for the global public key can include the updated global public key, the generation time of the updated global public key, and a second signature. The generation time of the updated global public key indicates when the key generation center generated the updated global public key, signifying that the updated global public key takes effect immediately upon generation. In other words, the updated global public key becomes effective immediately after generation. The second signature is a signature made by the key generation center using the previous global private key against the updated global public key and its generation time. Specifically, the key generation center uses the previous global private key to perform a signature calculation on the updated global public key and its generation time to obtain the second signature. See below for details. Figure 6 The method embodiments shown are illustrated.

[0120] Then, the network device receives and stores the update information of the global public key and the updated private key.

[0121] S404. The network device sends a first instruction message to the terminal device. Correspondingly, the terminal device receives the first instruction message from the network device.

[0122] The first indication information is used to indicate a global public key update. In this way, the terminal device can promptly learn of the global public key update based on the first indication information, and thus update the global public key in a timely manner without constantly receiving system messages for judgment, thereby reducing the signaling and resource overhead of the terminal device.

[0123] At this time, the first indication information can be sent in the downlink control information (DCI). For example, the first indication information can be represented by 4 bits in the short message indication field of DCI Format 1_0.

[0124] During the update of the global public key, the network device can periodically send the first indication information to the terminal device.

[0125] It should be noted that step S404 in this embodiment is an optional step, and will not be repeated hereafter. For example, if the terminal device continuously or periodically receives system messages, S404 may not be executed, and the terminal device can determine whether the global public key has been updated based on the received system messages.

[0126] S405. The network device sends a system message and a first signature to the terminal device. Correspondingly, the terminal device receives the system message and the first signature from the network device.

[0127] The system message may include update information of the global public key. In other words, the system message carries update information of the global public key, and the first signature is the signature of the system message by the network device.

[0128] For example, the system message includes an SIB1 message and a new SIB message. The new SIB message is an additional SIB message added based on the existing SIB messages. The new SIB message is used to carry the update information of the global public key, and the SIB1 message includes the scheduling information of the new SIB message.

[0129] It is understood that the update information of the global public key can also be carried in existing SIB messages, such as SIB1 or SIB2, and this embodiment of the application does not limit this. In addition, the SIB1 message also carries the identifier of the network device, configuration information for the terminal device to complete mobile network access, resource information, and scheduling information of other existing SIB messages (such as SIB2, SIB3), etc. Further, the network device signs the system message to obtain the first signature.

[0130] In one possible implementation, if the update information of the global public key includes the updated global public key and the activation time of the updated global public key, the network device can sign the system message based on the private key before the update and the global public key before the update to obtain the first signature.

[0131] In one possible implementation, where the update information of the global public key includes the updated global public key, the generation time of the updated global public key, and the second signature, the network device can sign the system message based on the updated private key and the updated global public key to obtain the first signature.

[0132] After obtaining the system message and the first signature, the network device can send the system message and the first signature to the terminal device in the form of broadcast, so that the terminal device can read the information carried in the system message.

[0133] S406. The terminal device determines the third signature based on the system message.

[0134] The third signature is the signature of the system message received by the terminal device. The terminal device verifies the authenticity of the system message and the global public key by performing signature verification on the system message.

[0135] In one possible implementation, if the update information for the global public key includes the updated global public key and its activation time, the terminal device determines the third signature based on the global public key before the update and the system message. For example, the terminal device uses the network device's identifier, the global public key before the update, and the system message as input to perform signature calculation and obtain the third signature.

[0136] In one possible implementation, when the global public key update information includes the updated global public key, its generation time, and a second signature, the terminal device determines a fourth signature based on the original global public key, the updated global public key, and its generation time. This fourth signature can be calculated by the terminal device using the original global public key, the updated global public key, and the updated signature. If the fourth signature matches the second signature (i.e., the second signature verification is successful), it indicates that the global public key update information is correct. The terminal device can then determine a third signature based on the updated global public key and the system message. For example, the terminal device can use the network device identifier, the updated global public key, and the system message as input for signature calculation to obtain the third signature.

[0137] S407. If the third signature matches the first signature, the terminal device obtains the update information of the global public key from the system message.

[0138] The matching of the third signature and the first signature indicates that the system message signature verification is successful, the system message is correct, and the terminal device can access the network based on the correct system message. Thus, the terminal device can store and use the update information of the global public key in the system message.

[0139] When the update information of the global public key includes the updated global public key and the activation time of the updated global public key, the terminal device can determine the effective time of the updated global public key based on the activation time of the updated global public key. Once the activation time of the updated global public key is reached, the updated global public key can be used to sign and verify system messages sent by subsequent network devices.

[0140] It is worth noting that due to potential time synchronization issues between network devices and terminal devices, such as the network device's time being slightly faster than the terminal device's time (meaning the network device determines that the updated global public key's activation time has arrived, but the terminal device has not), the network device may have already signed the system message with the updated global public key. In this case, the terminal device might still perceive the received system message as being signed with the previous global public key, leading to a verification error. Therefore, in this embodiment, after receiving the updated global public key, the terminal device can set transition periods before and after the updated global public key's activation time. During these transition periods, the terminal device can verify the received system message using both the previous and updated global public keys. If either the previous or updated global public key successfully verifies the message, the system message is considered correct.

[0141] based on Figure 4 The communication method shown allows a network device to sign a system message based on the update information of the global public key generated by the key generation center, and send the update information of the global public key to the terminal device via the system message. If the terminal device does not know the updated global public key, it can verify the signature of the system message and the update information of the global public key based on the global public key before the update, and obtain the updated global public key. This achieves the update of the global public key of the terminal device, making the global public keys of the key generation center, the network device, and the terminal device consistent, thereby improving the reliability of system message signature verification.

[0142] The communication method provided in this application embodiment will be described in detail below with reference to specific application scenarios. The communication method provided in this application embodiment can be applied to... Figure 2 In the scenario shown, the key generation center can be Figure 2 The PKG shown.

[0143] For example, Figure 5 A flowchart illustrating another communication method provided in an embodiment of this application is shown. This communication method includes the following steps:

[0144] S501. The key generation center sends a global public key update notification to the network devices. Correspondingly, the network devices receive the global public key update notification from the key generation center.

[0145] The global public key update notification carries the first instruction information. After the key generation center updates the global public key, it sends a global public key update notification to the network device to inform the network device that a global public key update has occurred.

[0146] S502. The network device sends a private key request to the key generation center. Correspondingly, the key generation center receives the private key request from the network device.

[0147] The private key request includes the identifier of the network device. After receiving the global public key update notification, the network device re-requests a private key from the key generation center.

[0148] S503. The key generation center sends a private key request response to the network device. Correspondingly, the network device receives the private key request response from the key generation center.

[0149] For example, upon receiving a private key request, the key generation center can generate an updated private key for the network device based on the network device's identifier and the generated updated global private key in the request, and then send a private key request response to the network device. The private key request response carries the updated global public key information and the updated private key. The updated global public key information includes the updated global public key and its activation time. The activation time of the updated global public key, also known as its effective time, can be used to indicate to the network device that the updated global public key is not yet effective. In other words, until the set activation time of the updated global public key is reached, the network device continues to use the previous global public key and private key.

[0150] Furthermore, after receiving the update information of the global public key and the updated private key, the network device stores them locally and does not use them for the time being. Instead, it determines when to use the updated global public key to sign system messages based on the activation time of the updated global public key in the update information of the global public key.

[0151] S504. The network device sends a DCI to the terminal device. Correspondingly, the terminal device receives the DCI from the network device.

[0152] The DCI carries first indication information, for example, indicated by 4 bits in the Short Message Indication field of DCI Format 1_0. Network devices can periodically send DCIs to terminal devices before the activation time of the updated global public key to notify them to update the global public key. In other words, network devices can stop sending DCIs to terminal devices after determining that the activation time of the updated global public key has arrived.

[0153] S505: The network device sends an SIB1 message, an add SIB message, and a first signature to the terminal device. Correspondingly, the terminal device receives the SIB1 message, the add SIB message, and the first signature from the network device.

[0154] The first signature is obtained by the network device signing the SIB1 message and the new SIB message using the original private key and the original global public key. The SIB1 message includes scheduling information for the new SIB message, which carries the update information of the global public key. A detailed description of S505 can be found in the relevant content of S405 above, and will not be repeated here.

[0155] S506. The terminal device determines the third signature based on the SIB1 message and the newly added SIB message.

[0156] For example, after receiving the SIB1 message and the new SIB message, the terminal device uses the global public key stored locally on the terminal device before the update and the network device identifier in the SIB1 message to perform signature calculation on the SIB1 message and the new SIB message to obtain a third signature.

[0157] S507. If the third signature matches the first signature, the terminal device obtains the update information of the global public key in the newly added SIB message.

[0158] For details on the implementation of S507, please refer to the relevant content in S407 above, which will not be repeated here.

[0159] Furthermore, after obtaining the updated global public key information, the terminal device, upon determining that the activation time of the updated global public key has arrived, uses the updated global public key to perform signature verification on subsequently received system messages.

[0160] It is worth noting that due to potential time synchronization issues between network devices and terminal devices, such as the network device's time being slightly faster than the terminal device's time (meaning the network device determines that the updated global public key's activation time has arrived, but the terminal device has not), the network device may have already signed the system message with the updated global public key. In this case, the terminal device might still perceive the received system message as being signed with the previous global public key, leading to a verification error. Therefore, in this embodiment, after receiving the updated global public key, the terminal device can set transition periods before and after the updated global public key's activation time. During these transition periods, the terminal device can verify the received system message using both the previous and updated global public keys. If either the previous or updated global public key successfully verifies the message, the system message is considered correct.

[0161] It should be noted that if the terminal device is not turned on or is in airplane mode before the updated global public key takes effect, causing the terminal device to be unable to obtain the updated global public key information, the terminal device needs to re-execute the initialization of the global public key acquisition process before accessing the mobile network again. That is, the process of the terminal device obtaining the GPK for the first time, such as the GPK process pre-configured before the terminal device leaves the factory, or the GPK acquisition process before the terminal device enters the network. For the specific implementation process, please refer to the existing implementation method. This application embodiment will not be described in detail.

[0162] based on Figure 5 The communication method shown employs a post-update approach for the global public key. Network devices can send update instructions to terminal devices based on the activation time of the updated global public key, and sign system messages using the previous global public key. This allows terminal devices to verify the signature of system messages using the previously stored previous global public key, thereby obtaining the updated global public key. Furthermore, the key generation center, network devices, and terminal devices can simultaneously activate the updated global public key, ensuring consistency of the global public key and improving the security and reliability of system messages.

[0163] By way of example, the communication method provided in the embodiments of this application can also be implemented in another way. The following... Figure 6 A flowchart illustrating another communication method provided in an embodiment of this application is shown. The communication method includes the following steps:

[0164] S601. The key generation center enables timed global public key update notifications.

[0165] For example, after updating the global public key, the key generation center enables the set global public key update notification timer to control the update time of the global public key.

[0166] S602. The key generation center sends a global public key update notification to the network devices. Correspondingly, the network devices receive the global public key update notification from the key generation center.

[0167] S603. The network device sends a private key request to the key generation center. Correspondingly, the key generation center receives the private key request from the network device.

[0168] The specific implementation process of S602-S603 can be found in the relevant descriptions in S401 or S501-S502 above, and will not be repeated here.

[0169] S604. The key generation center sends a private key request response to the network device. Correspondingly, the network device receives the private key request response from the key generation center.

[0170] The private key request response in S604 carries update information for the global public key and the updated private key. Unlike the private key request response in S503, the update information for the global public key carried in the private key request response in S604 includes the updated global public key, the generation time of the updated global public key, and the second signature. The relevant descriptions of the generation time of the updated global public key and the second signature can be found in the relevant content of S403 above, and will not be repeated here.

[0171] S605. The network device sends a DCI to the terminal device. Correspondingly, the terminal device receives the DCI from the network device.

[0172] The specific implementation process of S605 can be found in the relevant description in S504 above, and will not be repeated here.

[0173] S606. The network device sends an SIB1 message, an add SIB message, and a first signature to the terminal device. Correspondingly, the terminal device receives the SIB1 message, the add SIB message, and the first signature from the network device.

[0174] The specific implementation process of S606 can be found in the relevant descriptions in S405 or S505 above, and will not be repeated here. The difference from S505 is that the first signature is obtained by the network device signing the SIB1 message and the newly added SIB message using the updated private key and the updated global public key.

[0175] S607. The terminal device determines the fourth signature based on the global public key before the update, the global public key after the update, and the generation time of the global public key before the update.

[0176] The implementation process in S607 can be found in the relevant description in S406 above, and will not be repeated here.

[0177] S608. If the fourth signature matches the second signature, the terminal device determines the third signature based on the updated global public key, the SIB1 message, and the newly added SIB.

[0178] If the fourth signature matches the second signature, meaning the second signature verification is successful, it indicates that the update information of the global public key is correct. The terminal device can determine the third signature based on the updated global public key, the SIB1 message, and the newly added SIB. For example, the terminal device can use the network device identifier, the updated global public key, the SIB1 message, and the newly added SIB as input to perform signature calculation and obtain the third signature.

[0179] S609. If the third signature matches the first signature, the terminal device obtains the update information of the global public key in the newly added SIB message.

[0180] The implementation process in S609 can be found in the relevant description in S407 above, and will not be repeated here.

[0181] S610, the key generation center sends a stop global public key update notification to the network device. Correspondingly, the network device receives the stop global public key update notification from the key generation center.

[0182] For example, after the global public key update notification is completed on schedule, the key generation center informs the network device to stop or end sending global public key update notifications to the terminal device, such as stopping or ending sending DCI to the terminal device, thereby stopping or ending the global public key update notification process.

[0183] It should be noted that if the terminal device is not turned on or is in airplane mode before the global public key update notification timeout ends, causing the terminal device to be unable to obtain the global public key update information, the terminal device needs to re-execute the initialization of the global public key acquisition process before reconnecting to the mobile network. That is, the process of the terminal device obtaining the GPK for the first time, such as the GPK process pre-configured before the terminal device leaves the factory, or the GPK acquisition process before the terminal device enters the network. For the specific implementation process, please refer to the existing implementation methods, which will not be described in detail in the embodiments of this application.

[0184] based on Figure 6 The communication method shown allows the global public key to take effect immediately upon generation. The updated global public key is then protected by signing the previous global private key. The network device signs system messages based on the updated global public key and sends the system messages, protected by the updated global public key and the updated global public key, to the terminal device. This allows the terminal device to verify the authenticity of the updated global public key using the previously stored previous global public key, and to further verify the authenticity of the acquired updated global public key by signing the system messages with the verified updated global public key, thus completing the update of the global public key.

[0185] It is worth noting that the message names such as "Global Public Key Update Notification" and "Stop Global Public Key Update Notification" can also be replaced with other message names, and this application embodiment does not limit this.

[0186] It is understood that, in the above embodiments, the methods and / or steps implemented by the key generation center can also be implemented by components (e.g., processors, chips, chip systems, circuits, logic modules, or software) that can be used in the key generation center; the methods and / or steps implemented by the network device can also be implemented by components (e.g., processors, chips, chip systems, circuits, logic modules, or software) that can be used in the network device; and the methods and / or steps implemented by the terminal device can also be implemented by components (e.g., processors, chips, chip systems, circuits, logic modules, or software) that can be used in the terminal device.

[0187] The foregoing mainly describes the solutions provided in this application. Accordingly, this application also provides a communication device for implementing various methods in the above method embodiments. This communication device can be a key generation center in the above method embodiments, or an apparatus containing a key generation center, or a component that can be used in a key generation center, such as a chip or chip system. Alternatively, the communication device can be a network device in the above method embodiments, or an apparatus containing a network device, or a component that can be used in a network device, such as a chip or chip system. Alternatively, the communication device can be a terminal device in the above method embodiments, or an apparatus containing a terminal device, or a component that can be used in a terminal device, such as a chip or chip system.

[0188] It is understood that, in order to achieve the aforementioned functions, the communication device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should readily recognize that, based on the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0189] This application embodiment can divide the communication device into functional modules according to the above method embodiment. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0190] Taking the communication device as an example, which is the terminal device or network device in the above method embodiments, Figure 7 This is a schematic diagram of the structure of a communication device provided in an embodiment of this application. Figure 7 As shown, the communication device 700 includes a processing module 701 and a transceiver module 702.

[0191] In this example, the communication device 700 is a network device in the above method embodiment:

[0192] The transceiver module 702 is used to receive first indication information from the key generation center, which indicates that the global public key should be updated. The processing module 701 is used to send a first message to the key generation center according to the first indication information. The first message requests the updated private key, which is determined based on the updated global private key.

[0193] The transceiver module 702 is also used to receive update information of the global public key and the updated private key from the key generation center. The updated private key is used by the communication device 700 to sign system messages.

[0194] The transceiver module 702 is also used to send system messages and a first signature to the terminal device. The system message includes update information of the global public key, and the first signature is the signature of the system message by the communication device 700.

[0195] In one possible design, the update information for the global public key may include the updated global public key and the activation time of the updated global public key; the first signature is determined based on the private key before the update and the global public key before the update.

[0196] In another possible design, the update information of the global public key may include the updated global public key, the generation time of the updated global public key, and a second signature. The second signature is a signature made by the key generation center based on the global private key before the update, on the updated global public key and the generation time of the updated global public key. The first signature is determined based on the updated private key and the updated global public key.

[0197] In one possible design, the transceiver module 702 is also used to send first instruction information to the terminal device.

[0198] Furthermore, the first indication information can be carried in the downlink control information.

[0199] Taking the communication device 700 as an example of the terminal device in the above method embodiment:

[0200] The transceiver module 702 is used to receive a system message and a first signature from the network device. The system message includes update information of the global public key, and the first signature is the network device's signature of the system message. The processing module 701 is used to determine a third signature based on the system message. The processing module 701 is also used to obtain the update information of the global public key from the system message if the third signature and the first signature match.

[0201] In one possible design, the update information for the global public key may include the updated global public key and the activation time of the updated global public key; the first signature is determined based on the private key before the update and the global public key before the update.

[0202] Further, the processing module 701 is used to determine the third signature based on the system message, including: the processing module 701 is used to determine the third signature based on the global public key before the update and the system message.

[0203] In another possible design, the update information of the global public key may include the updated global public key, the generation time of the updated global public key, and a second signature. The second signature is a signature made by the key generation center based on the global private key before the update, on the updated global public key and the generation time of the updated global public key. The first signature is determined based on the updated private key and the updated global public key.

[0204] Further, the processing module 701 is used to determine the third signature based on the system message, including: the processing module 701 is used to determine the fourth signature based on the global public key before the update, the global public key after the update, and the generation time of the global public key after the update; if the fourth signature matches the second signature, the third signature is determined based on the updated global public key and the system message.

[0205] In one possible design, the transceiver module 702 is also used to receive first indication information from the network device, the first indication information being used to indicate a global public key update.

[0206] Furthermore, the first indication information can be carried in the downlink control information.

[0207] All relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0208] Since the communication device 700 provided in this embodiment can execute the above-described communication method, the technical effects it can achieve can be referred to the above-described method embodiments, and will not be repeated here.

[0209] Optionally, in this embodiment of the application, the transceiver module 702 may include a receiving module and a sending module. Figure 7 (Not shown in the image). The transceiver module is used to implement the sending and receiving functions of the communication device 700.

[0210] Optionally, the communication device 700 may also include a storage module. Figure 7 (Not shown in the image), this storage module stores programs or instructions. When the processing module 701 executes the program or instructions, it enables the communication device 700 to perform... Figures 4-6The function of the network device or terminal device in any of the communication methods shown.

[0211] It should be understood that the processing module 701 involved in the communication device 700 can be implemented by a processor or processor-related circuit components, and can be a processor or processing unit; the transceiver module 702 can be implemented by a transceiver or transceiver-related circuit components, for example, the transceiver module can be a transceiver or transceiver unit.

[0212] Taking the communication device as the key generation center in the above method embodiment as an example, Figure 8 This is a schematic diagram of another communication device provided in an embodiment of this application. For example... Figure 8 As shown, the communication device 800 includes a receiving module 801 and a transmitting module 802.

[0213] The sending module 802 is used to send a first indication message to the network device, which indicates that the global public key should be updated. The receiving module 801 is used to receive a first message from the network device, which requests the updated private key, which is determined based on the updated global private key. The sending module 802 is also used to send the updated global public key and the updated private key to the network device, which is used by the network device to sign system messages.

[0214] In one possible design, the update information for the global public key includes the updated global public key and the activation time of the updated global public key.

[0215] In another possible design, the update information of the global public key includes the updated global public key, the generation time of the updated global public key, and a second signature. The second signature is a signature made by the communication device 800 based on the global private key before the update for the updated global public key and the generation time of the updated global public key.

[0216] All relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0217] Since the communication device 800 provided in this embodiment can execute the above-described communication method, the technical effects it can achieve can be referred to the above-described method embodiments, and will not be repeated here.

[0218] Optionally, in this embodiment of the application, the receiving module 801 and the sending module 802 can also be integrated into one module, such as a transceiver module. Figure 8 (Not shown in the image). The transceiver module is used to implement the sending and receiving functions of the communication device 800.

[0219] Optionally, the communication device 800 may further include a processing module 803. Figure 8(Shown in dashed box). The processing module 803 is used to implement the processing functions of the communication device 800.

[0220] Optionally, the communication device 800 may also include a storage module. Figure 8 (Not shown in the image), this storage module stores programs or instructions. When the processing module 803 executes the program or instructions, it enables the communication device 800 to perform... Figures 4-6 The function of the key generation center in any of the communication methods shown.

[0221] It should be understood that the processing module 803 involved in the communication device 800 can be implemented by a processor or processor-related circuit components, and can be a processor or processing unit; the transceiver module can be implemented by a transceiver or transceiver-related circuit components, for example, the transceiver module can be a transceiver or transceiver unit.

[0222] For example, Figure 9 This is a schematic diagram illustrating the structure of another communication device provided in an embodiment of this application. The communication device can be a terminal device, a network device, or a key generation center, or it can be a chip (system) or other component or assembly that can be disposed in the terminal device, network device, or key generation center. Figure 9 As shown, the communication device 900 may include a processor 901. Optionally, the communication device 900 may also include a memory 902 and / or a transceiver 903. The processor 901 is coupled to the memory 902 and the transceiver 903, for example, they can be connected via a communication bus.

[0223] The following is combined Figure 9 A detailed description of each component of the communication device 900 is provided below:

[0224] The processor 901 is the control center of the communication device 900. It can be a single processor or a collective term for multiple processing elements. For example, the processor 901 can be one or more central processing units (CPUs), application-specific integrated circuits (ASICs), or one or more integrated circuits configured to implement the embodiments of this application, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0225] Optionally, the processor 901 can perform various functions of the communication device 900 by running or executing software programs stored in the memory 902 and calling data stored in the memory 902.

[0226] In a specific implementation, as one example, the processor 901 may include one or more CPUs, for example... Figure 9 CPU0 and CPU1 are shown in the diagram.

[0227] In a specific implementation, as one example, the communication device 900 may also include multiple processors, for example... Figure 2 The processors 901 and 904 are shown. Each of these processors can be a single-core processor or a multi-core processor. Here, "processor" can refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0228] The memory 902 is used to store the software program that executes the solution of this application, and is controlled by the processor 901 to execute it. The specific implementation method can be referred to the above method embodiment, and will not be repeated here.

[0229] Optionally, the memory 902 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory 902 may be integrated with the processor 901 or exist independently, and may be connected via the interface circuit of the communication device 900. Figure 9 (Not shown in the image) is coupled to the processor 901, but this embodiment does not specifically limit this.

[0230] Transceiver 903 is used for communication with other communication devices. For example, if communication device 900 is a terminal device, transceiver 903 can be used to communicate with a network device or with another terminal device. As another example, if communication device 900 is a network device, transceiver 903 can be used to communicate with a terminal device or with another network device.

[0231] Optionally, transceiver 903 may include a receiver and a transmitter. Figure 9 (Not shown separately). The receiver is used to implement the receiving function, and the transmitter is used to implement the sending function.

[0232] Optionally, the transceiver 903 can be integrated with the processor 901, or it can exist independently and be connected via the interface circuit of the communication device 900. Figure 9 (Not shown in the image) is coupled to the processor 901, but this embodiment does not specifically limit this.

[0233] It should be noted that, Figure 9 The structure of the communication device 900 shown does not constitute a limitation on the communication device. Actual communication devices may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0234] Since the communication device 900 provided in this embodiment can execute the above-described communication method, the technical effects it can achieve can be referred to the above-described method embodiments, and will not be repeated here.

[0235] This application also provides a communication system. The communication system includes the aforementioned key generation center, network equipment, and terminal equipment.

[0236] In some embodiments, the key generation center, network device, and terminal device described in this application may also be implemented using one or more field programmable gate arrays (FPGAs), programmable logic devices (PLDs), controllers, state machines, gate logic, discrete hardware components, any other suitable circuits, or any combination of circuits capable of performing the various functions described throughout this application.

[0237] In some embodiments, this application also provides a communication device, which includes a processor for implementing the methods in any of the above method embodiments.

[0238] As one possible implementation, the communication device also includes a memory. This memory stores necessary computer programs and data. The computer program may include instructions, which a processor can invoke to instruct the communication device to execute the methods described in any of the above method embodiments. Alternatively, the memory may not be present in the communication device.

[0239] As another possible implementation, the communication device also includes an interface circuit, which is a code / data read / write interface circuit, used to receive computer execution instructions (which are stored in memory and may be read directly from memory or may be transmitted through other devices) and transmit them to the processor.

[0240] As another possible implementation, the communication device also includes a communication interface for communicating with modules outside the communication device.

[0241] It is understood that the communication device can be a chip or a chip system. When the communication device is a chip system, it can be composed of chips or may include chips and other discrete devices. This application does not specifically limit this.

[0242] This application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a computer, implements the functions of any of the above-described method embodiments.

[0243] This application also provides a computer program product that, when executed by a computer, implements the functions of any of the above method embodiments.

[0244] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0245] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0246] In this application, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or multiple items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0247] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0248] It is understood that the systems, apparatuses, and methods described in this application can also be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the couplings or direct couplings or communication connections shown or discussed may be through some interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0249] The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. The components shown as units may or may not be physical units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0250] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0251] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device containing one or more servers, data centers, etc., that can be integrated with the medium. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)). In this embodiment, the computer may include the aforementioned apparatus.

[0252] Although this application has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings, disclosure, and appended claims, will understand and implement other variations of the disclosed embodiments in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce good results.

[0253] Although this application has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made thereto without departing from the spirit and scope of this application. Accordingly, this specification and drawings are merely exemplary illustrations of this application as defined by the appended claims, and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from the spirit and scope of this application. Thus, if such modifications and modifications of this application fall within the scope of the claims of this application and their equivalents, this application is also intended to include such modifications and modifications.

Claims

1. A communication method characterized by comprising: The method comprises: The network device receives first indication information from a key generation center, the first indication information being used for indicating global public key update; The network device sends a first message to the key generation center according to the first indication information, the first message being used for requesting to obtain an updated private key, the updated private key being determined according to an updated global private key; The network device receives update information of the global public key and the updated private key from the key generation center, the updated private key being used for the network device to sign a system message; The network device sends the system message and a first signature to a terminal device, the system message comprising the update information of the global public key, and the first signature being a signature of the network device on the system message.

2. The method of claim 1, wherein, The update information of the global public key comprises an updated global public key and an enabling time of the updated global public key; The first signature is determined according to a pre-update private key and a pre-update global public key.

3. The method of claim 1, wherein, The update information of the global public key comprises an updated global public key, a generation time of the updated global public key and a second signature, the second signature being a signature of the key generation center on the updated global public key and the generation time of the updated global public key according to a pre-update global private key; The first signature is determined according to the updated private key and the updated global public key.

4. The method according to any one of claims 1-3, characterized in that, Before the network device sends the system message and the first signature to the terminal device, the method further comprises: The network device sends the first indication information to the terminal device.

5. The method of claim 4, wherein, The first indication information is carried in downlink control information.

6. A communication method characterized by comprising: The method comprises: A terminal device receives a system message and a first signature from a network device, the system message comprising update information of a global public key, and the first signature being a signature of the network device on the system message; The terminal device determines a third signature according to the system message; In a case where the third signature matches the first signature, the terminal device obtains the update information of the global public key in the system message.

7. The method of claim 6, wherein, The update information of the global public key comprises an updated global public key and an enabling time of the updated global public key; The first signature is determined according to a pre-update private key and a pre-update global public key.

8. The method of claim 7, wherein, The terminal device determines a third signature according to the system message, comprising: The terminal device determines the third signature according to a pre-update global public key and the system message.

9. The method of claim 6, wherein, The update information of the global public key comprises an updated global public key, a generation time of the updated global public key and a second signature, the second signature being a signature of a key generation center on the updated global public key and the generation time of the updated global public key according to a pre-update global private key; The first signature is determined according to an updated private key and the updated global public key.

10. The method of claim 9, wherein, The terminal device determines a third signature according to the system message, comprising: The terminal device determines a fourth signature according to a pre-update global public key, the updated global public key and the generation time of the updated global public key; In a case where the fourth signature matches the second signature, the terminal device determines the third signature according to the updated global public key and the system message.

11. The method according to any one of claims 6-10, characterized in that, Before the terminal device receives the system message and the first signature from the network device, the method further comprises: The terminal device receives first indication information from the network device, the first indication information being used to indicate the global public key update.

12. The method of claim 11, wherein, The first indication information is carried in downlink control information.

13. A method of communication, comprising: The method comprises: A key generation center sends first indication information to a network device, the first indication information being used to indicate a global public key update; The key generation center receives a first message from the network device, the first message being used to request an updated private key, the updated private key being determined according to an updated global private key; The key generation center sends update information of the global public key and the updated private key to the network device, the updated private key being used by the network device to sign a system message.

14. The method of claim 13, wherein, The update information of the global public key comprises the updated global public key and an enabling time of the updated global public key.

15. The method of claim 13, wherein, The update information of the global public key comprises the updated global public key, a generation time of the updated global public key and a second signature, the second signature being a signature of the updated global public key and the generation time of the updated global public key by the key generation center according to a global private key before the update.

16. A communications device, characterized by The apparatus comprises a processing module and a transceiver module; wherein, The processing module is configured to perform the processing functions of the method according to any one of claims 1-5 or claims 6-12; The transceiver module is configured to perform the transceiving functions of the method according to any one of claims 1-5 or claims 6-12.

17. A communications device, characterized by The apparatus comprises a receiving module and a sending module; wherein, The receiving module is configured to perform the receiving functions of the method according to any one of claims 13-15; The sending module is configured to perform the sending functions of the method according to any one of claims 13-15.

18. A communications device, characterized by comprises: a processor coupled with a memory; the memory is configured to store a computer program; the processor is configured to execute the computer program stored in the memory, so that the communication apparatus performs the method according to any one of claims 1-5 or claims 6-12 or claims 13-15.

19. A communication system, characterized by The communication system comprises a key generation center, a network device and a terminal device; wherein, The key generation center is configured to send first indication information to the network device, wherein the first indication information is used to indicate a global public key update; The network device is configured to receive the first indication information from the key generation center, and send a first message to the key generation center according to the first indication information, the first message being used to request an updated private key; The key generation center is configured to receive the first message from the network device, and send updated information of the global public key and the updated private key to the network device, wherein the updated private key is determined according to an updated global private key. The network device is configured to receive the updated information of the global public key and the updated private key from the key generation center, and send a system message and a first signature to the terminal device, wherein the system message comprises the updated information of the global public key, and the first signature is a signature of the network device on the system message. The terminal device is configured to receive the system message and the first signature from the network device, determine a third signature according to the system message, and acquire the updated information of the global public key in the system message when the third signature matches the first signature.

20. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program or instructions, which, when executed on a computer, cause the computer to perform the method of any one of claims 1-5 or claims 6-12 or claims 13-15.

21. A computer program product, characterised in that, The computer program product comprises a computer program or instructions, which, when executed on a computer, cause the computer to perform the method of any one of claims 1-5 or claims 6-12 or claims 13-15.

Images