Key update method and device, storage medium and electronic device

Abstract

This disclosure belongs to the field of network technology and security technology, and relates to a key update method and apparatus, storage medium, and electronic device. The method includes: when the current K... AF When the key expires, the AF network element requests the next key from the AAnF network element. AF Key; AAnF network element determines the current K AF The key has expired, and it is currently in the Kth generation. AF No K was performed during the key's lifetime. AKMA Key update triggers AUSF network elements based on the current key. AKMA The key is derived from the next K key for the AAnF network element and the user equipment respectively. AKMA Key; AAnF network elements and user equipment respectively utilize the next K key. AKMA Key generation for the next K AF The key is used to enable the AF network element to obtain the next K returned by the AAnF network element. AF Key, and based on the next K AF The key communicates with the user equipment. The AAnF network element in this disclosure performs relevant judgments to trigger the next K-line. AKMA The key update ensures K AF The different lifecycles of the keys improve communication security and can be achieved without triggering master authentication, thus improving the efficiency of key acquisition and preventing unknown impacts from master authentication.

Description

Technical Field

[0001] This disclosure relates to the fields of network technology and security technology, and in particular to a key update method and key update device, computer-readable storage medium and electronic device. Background Technology

[0002] 3GPP (3rd Generation Partnership Project) TS 33.535 specifies that K AKMA Both the key and A-KID (AKMA (Authentication and Key Management for Applications) key identifier) ​​are based on K AUSF The key is derived, so it will only be available after the new primary identity authentication is successfully performed (refreshing the key). AUSF Only with the key can K be refreshed. AKMA Key. The key used for communication between the UE (User Equipment) and the AF (Application Function) network element. AF When the (AKMA application key) expires, the AAnF (AKMA anchor Function, application layer authentication and session key management anchor function) network element will, based on the current K... AKMA Perform a new K AF Derivatives of.

[0003] If K AF K within the life cycle AKMA If it has not been updated and is outdated, then the newly derived K AF Unchanged. Using the same K for a long time. AF The key will affect the security of communication between the UE and AF, therefore, the 3GPP Release 18 stage proposed that when the key... AF Upon expiration, K is implemented by triggering master authentication. AKMA Refresh the key to refresh K AF However, this method is inefficient, and performing master authentication will update the entire key system, which may cause other problems.

[0004] Therefore, there is an urgent need in this field to develop a new key update method and apparatus.

[0005] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] The purpose of this disclosure is to provide a key update method, a key update device, a computer-readable storage medium, and an electronic device, thereby overcoming, to at least a certain extent, the technical problems of low key update efficiency and impact on the key system caused by the limitations of related technologies.

[0007] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part by practice of this disclosure.

[0008] According to a first aspect of the present invention, a key update method is provided, the method comprising:

[0009] When the current K AF When the key expires, the AF network element requests the next key from the AAnF network element. AF Key;

[0010] The AAnF network element determines the current K AF The key has expired, and in the current K AF No K was performed during the key's lifetime. AKMA Key update triggers AUSF network elements based on the current key. AKMA The key is derived from the next K key for the AAnF network element and the user equipment, respectively. AKMA Key;

[0011] The AAnF network element and the user equipment respectively utilize the next K AKMA The key generates the next K AF The key is used to enable the AF network element to obtain the next K returned by the AAnF network element. AF The key, and based on the next K AF The key is used to communicate with the user equipment.

[0012] In an exemplary embodiment of the present invention, the triggering AUSF network element is based on the current K AKMA The key is derived from the next K key for the AAnF network element and the user equipment, respectively. AKMA Keys, including:

[0013] The AUSF network element is based on K AUSF Derivation of the next K key and key update parameters AKMA Key and the next K AKMA The key identifier corresponding to the key is returned to the AAnF network element;

[0014] The AUSF network element utilizes K AUSF The key is used to encrypt the key update parameters to obtain encrypted parameters, and the encrypted parameters are transmitted to the user equipment so that the user equipment can derive the next K. AKMA Key.

[0015] In one exemplary embodiment of the present invention, the user equipment derives the next K. AKMA Keys, including:

[0016] The user equipment utilizes the K AUSF The key is used to decrypt the encrypted parameters to obtain the key update parameters;

[0017] The user equipment utilizes the K AUSF The key and the key update parameters derive the next K AKMA The key and the key identifier.

[0018] In an exemplary embodiment of the present invention, the AAnF network element and the user equipment respectively utilize the next K AKMA The key generates the next K AF Keys, including:

[0019] The user equipment is based on the next K AKMA The next K key derivation AF Key;

[0020] When the user equipment sends a session creation message to the AF network element carrying the key identifier, the AF network element requests the next key from the AAnF network element carrying the key identifier. AF Key;

[0021] The AAnF network element utilizes the next K corresponding to the key identifier. AKMA The key generates the next K AF Key.

[0022] In an exemplary embodiment of the present invention, transmitting the encryption parameters to the user equipment includes:

[0023] The AUSF network element obtains the network element identifier of the AMF network element of the user equipment from the UDM network element, and sends the encryption parameters to the user equipment using the AMF network element corresponding to the network element identifier.

[0024] In one exemplary embodiment of the present invention, the key update parameter includes: a random number.

[0025] In an exemplary embodiment of the present invention, the AF network element obtains the next K returned by the AAnF network element. AF The key, and based on the next K AF The key communicates with the user equipment, including:

[0026] The AAnF network element will then... AFThe key is returned to the AF network element so that the user equipment and the AF network element can use the next key to... AF Communication is conducted using a key.

[0027] According to a second aspect of the present invention, a key update apparatus is provided, comprising:

[0028] The expiration application module is configured to apply when the current K... AF When the key expires, the AF network element requests the next key from the AAnF network element. AF Key;

[0029] The key derivation module is configured to determine the current K in the AAnF network element. AF The key has expired, and in the current K AF No K was performed during the key's lifetime. AKMA Key update triggers AUSF network elements based on the current key. AKMA The key is derived from the next K key for the AAnF network element and the user equipment, respectively. AKMA Key;

[0030] The secure communication module is configured so that the ANF network element and the user equipment respectively utilize the next K AKMA The key generates the next K AF The key is used to enable the AF network element to obtain the next K returned by the AAnF network element. AF The key, and based on the next K AF The key is used to communicate with the user equipment.

[0031] According to a third aspect of the present invention, an electronic device is provided, comprising: a processor and a memory; wherein the memory stores computer-readable instructions, which, when executed by the processor, implement the key update method in any of the above exemplary embodiments.

[0032] According to a fourth aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the key update method in any of the above exemplary embodiments.

[0033] As can be seen from the above technical solutions, the key update method, key update device, computer storage medium, and electronic device in the exemplary embodiments of this disclosure have at least the following advantages and positive effects:

[0034] In the methods and apparatus provided in the exemplary embodiments of this disclosure, when the current K AF When the key expires, the AAnF network element will check the current K. AF The key is used for relevant checks to trigger the next K. AKMAThe key update ensures K AF The key remains different at different stages of its lifecycle, improving the security of communication between user equipment and AF network elements. During this process, the AUSF network element changes the key for the next KEY. AKMA Key updates can be performed without triggering master authentication, which improves the efficiency of key acquisition and prevents the unknown impact of master authentication on the entire key update process.

[0035] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0036] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0037] Figure 1 A schematic diagram illustrating a method for requesting a new key in related technologies is shown;

[0038] Figure 2 The illustration schematically shows a flowchart of a key update method according to an exemplary embodiment of the present disclosure;

[0039] Figure 3 This schematically illustrates an AUSF network element performing K-axis operation in an exemplary embodiment of this disclosure. AKMA A flowchart illustrating the key update method;

[0040] Figure 4 This schematically illustrates how a user equipment derives the next K in an exemplary embodiment of this disclosure. AKMA A flowchart illustrating the key-based method;

[0041] Figure 5 This schematically illustrates the use of the next K in an exemplary embodiment of the present disclosure. AKMA Key Derivation Next K AF A flowchart illustrating the key-based method;

[0042] Figure 6 This diagram illustrates a key update method in an application scenario of an exemplary embodiment of this disclosure.

[0043] Figure 7 This schematic diagram illustrates the modules of a key update system in an application scenario of an exemplary embodiment of this disclosure.

[0044] Figure 8This schematic diagram illustrates a flowchart of a key update method in an application scenario of an exemplary embodiment of this disclosure.

[0045] Figure 9 This schematic diagram illustrates the structure of a key update apparatus according to an exemplary embodiment of the present disclosure;

[0046] Figure 10 This illustration demonstrates an electronic device for implementing a key update method according to an exemplary embodiment of the present disclosure;

[0047] Figure 11 This illustration intentionally depicts a computer-readable storage medium for implementing a key update method according to an exemplary embodiment of the present disclosure. Detailed Implementation

[0048] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this disclosure more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more of these specific details omitted, or other methods, components, apparatus, steps, etc., can be employed. In other instances, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0049] The terms “a,” “an,” “the,” and “the” are used in this specification to indicate the presence of one or more elements / components / etc.; the terms “including” and “having” are used to indicate an open-ended inclusion and to mean that there may be other elements / components / etc. in addition to the listed elements / components / etc.; the terms “first” and “second” are used only as markings and are not a limitation on the number of objects.

[0050] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities.

[0051] 3GPP TS 33.535 specifies that after primary authentication, the AUSF (Authentication Server Function) network element will derive a K... AUSFKey. If the UE has subscribed to the AKMA service, it will be based on the key. AUSF Key Derivation K AUSF Key and A-KID, and K AUSF The key and A-KID are sent to the AAnF network element.

[0052] AAnF network element will be based on K AUSF Key Derivation Application Key K AF And send it to the AF network element so that the AF network element and the UE can communicate based on K AF Secure communication is achieved using keys.

[0053] Figure 1 A schematic diagram of a method for applying for a new key in related technologies is shown, such as... Figure 1 As shown, when K is in the AF network element AF The key has expired and a new key needs to be requested. AF Key.

[0054] When K AF When the key expires, the AF network element requests a new key from the AAnF network element. AF The key, AAnF network element will be based on AF-ID (Identity document) and the current key. AUSF Key generation K AF Key, and K AF The key is returned to the AF network element.

[0055] If K AF K throughout the key's lifetime AKMA If the key has not been updated, then K AF The key remains unchanged. That is, the same key may be used at different lifecycles. AF Key.

[0056] Therefore, K is proposed in the R18 stage. AF When the key expires, network master authentication is triggered to update the key. AUSF Key and K AKMA The key. AAnF network elements will then be based on the new K. AKMA Key generation of new K AF Key.

[0057] However, this method is inefficient, and re-authenticating the master key will update the entire key system, such as K. AF The NAS (NonAccess Stratum) and AS (Access Stratum) layer keys may have other effects.

[0058] In view of the problems existing in the related technologies, this disclosure proposes a key update method. Figure 2A flowchart of the key update method is shown, such as Figure 2 As shown, the key update method includes at least the following steps:

[0059] Step S210. When the current K AF When the key expires, the AF network element requests the next key from the AAnF network element. AF Key.

[0060] Step S220. AAnF network element determines the current K AF The key has expired, and it is currently in the Kth generation. AF No K was performed during the key's lifetime. AKMA Key update triggers AUSF network elements based on the current key. AKMA The key is derived from the next K key for the AAnF network element and the user equipment respectively. AKMA Key.

[0061] Step S230. The AAnF network element and user equipment respectively utilize the next K AKMA Key generation for the next K AF The key is used to enable the AF network element to obtain the next K returned by the AAnF network element. AF Key, and based on the next K AF The key communicates with the user equipment.

[0062] In an exemplary embodiment of this disclosure, when the current K AF When the key expires, the AAnF network element will check the current K. AF The key is used for relevant checks to trigger the next K. AKMA The key update ensures K AF The key remains different at different stages of its lifecycle, improving the security of communication between user equipment and AF network elements. During this process, the AUSF network element changes the key for the next KEY. AKMA Key updates can be performed without triggering master authentication, which improves the efficiency of key acquisition and prevents the unknown impact of master authentication on the entire key update process.

[0063] The following section provides a detailed explanation of each step in the key update method.

[0064] In step S210, when the current K AF When the key expires, the AF network element requests the next key from the AAnF network element. AF Key.

[0065] In an exemplary embodiment of this disclosure, the user equipment performs primary authentication with the 5GC (5G Core Network) to generate a K AUSF Keys, etc.

[0066] When a user device subscribes to the AKMA service, 5GC is based on KAUSF Derivation of AKMA-related keys from keys, such as K AKMA Key and K AF Keys, etc., to enable user equipment and AF network elements to be based on K AF Secure communication is achieved using keys.

[0067] When the current K AF When the key's lifespan expires, the AF network element can carry the AF-ID, A-KID, and K. AF The key requests a new next-generation key from the AAnF network element. AF Key.

[0068] In step S220, the AAnF network element determines the current K AF The key has expired, and it is currently in the Kth generation. AF No K was performed during the key's lifetime. AKMA Key update triggers AUSF network elements based on the current key. AKMA The key is derived from the next K key for the AAnF network element and the user equipment respectively. AKMA Key.

[0069] In an exemplary embodiment of this disclosure, when the AAnF network element receives the next K signal sent by the AF network element... AF After obtaining the key, it can be used according to K. AKMA Key update strategy determines the current K AF Check if the key has expired, and determine if it is currently in the K domain. AF Has the key been used for K-factor authentication during its lifetime? AKMA Key update.

[0070] Specifically, the AAnF network element can determine the current K based on A-KID and AF-ID. AF Whether the key has expired, and whether the AAnF network element stores K. AKMA Determine the current K key using methods such as key update time. AF Has the key been used for K-factor authentication during its lifetime? AKMA Key update.

[0071] When judging the current K AF The key has expired, and it is currently in the Kth generation. AF No K was performed during the key's lifetime. AKMA During key updates, the AAnF network element sends a K to the AUSF network element carrying the SUPI. AKMA A key update request is sent to trigger the AUSF network element to perform a key update. AKMA Key update.

[0072] In an optional embodiment, Figure 3 This shows the AUSF network element performing K AKMAA flowchart illustrating the key update method, as shown below. Figure 3 As shown, the method may include at least the following steps: In step S310, the AUSF network element determines the network element based on K... AUSF Derivation of the next K key and key update parameters AKMA Key and the next K AKMA The key identifier corresponding to the key is returned to the AAnF network element.

[0073] AUSF network elements are based on K AUSF The key and key update parameters derive the new next K AKMA Key K AKMA ′ and key identifier A-KID′.

[0074] In an optional embodiment, the key update parameters include: a random number.

[0075] When the AUSF network element is based on K AUSF The key and key update parameter RAND (random number) are used to create the new next K. AKMA Key K AKMA When deriving the key identifier A-KID, one can use... In addition to this, different derivation methods can be adopted based on different key update parameters, and this exemplary embodiment does not impose any special limitations on this.

[0076] Furthermore, the derived next key can be sent by sending an AKMA key update response. AKMA Key K AKMA The AKMA key update response returns the SUPI (Subscription Permanent Identifier) ​​and the key identifier A-KID to the AAnF network element. AKMA ′ and A-KID′.

[0077] In step S320, the AUSF network element utilizes K AUSF The key is used to encrypt the key update parameters to obtain encrypted parameters, which are then transmitted to the user equipment so that the user equipment can derive the next key. AKMA Key.

[0078] AUSF network elements can also utilize K AUSF The key is used to encrypt the key update parameters to obtain the encrypted parameters.

[0079] Furthermore, the AUSF network element transmits the encrypted parameters to the user equipment.

[0080] In an optional embodiment, the AUSF network element obtains the network element identifier of the AMF network element of the user equipment from the UDM network element, and sends the encryption parameters to the user equipment using the AMF network element corresponding to the network element identifier.

[0081] The AUSF network element obtains the network element identifier, such as ID information, of the AMF network element currently connected to the user equipment.

[0082] The AUSF network element sends an AKMA key update notification to the AMF network element corresponding to the network element identifier. The AMF network element then forwards this AKMA key update notification to the user equipment through the NAS channel, thereby triggering the user equipment to update the AKMA-related keys.

[0083] The AKMA key update notification includes SUPI, AKMA update instruction, and encryption parameters.

[0084] In an optional embodiment, Figure 4 This demonstrates how user equipment derives the next K AKMA A flowchart illustrating the key-based method, as follows: Figure 4 As shown, the method may include at least the following steps: In step S410, the user equipment utilizes K AUSF The key is used to decrypt the encrypted parameters to obtain the key update parameters.

[0085] User equipment uses K AUSF The key is used to decrypt the encrypted parameters to obtain the key update parameters.

[0086] In step S420, the user equipment utilizes K AUSF Derivation of the next K key and key update parameters AKMA Key and key identifier.

[0087] Furthermore, user equipment is based on K AUSF Key and key update parameters are used for K AKMA Derivation of ' and A-KID', to serve as the next K AKMA Key and key identifier. In addition, the user equipment can derive K... AF This exemplary embodiment does not impose any special limitations on this.

[0088] Furthermore, the user equipment sends an AKMA update confirmation message to the AMF network element through the NAS channel, so that the AMF network element sends an AKMA update confirmation message to the AUSF network element.

[0089] In this exemplary embodiment, the AAnF network element triggers the AUSF network element to perform K... AKMA Key updates can be implemented without triggering master authentication. AKMAKey updates improve key acquisition efficiency and prevent unknown impacts from key updates caused by master authentication.

[0090] In step S230, the AAnF network element and the user equipment respectively utilize the next K AKMA Key generation for the next K AF The key is used to enable the AF network element to obtain the next K returned by the AAnF network element. AF Key, and based on the next K AF The key communicates with the user equipment.

[0091] In an exemplary embodiment of this disclosure, the next K is derived. AKMA After the key, the next K can be used. AKMA Key Derivation Next K AF Key.

[0092] In an optional embodiment, Figure 5 It shows the use of the next K AKMA Key Derivation Next K AF A flowchart illustrating the key-based method, as follows: Figure 5 As shown, the method may include at least the following steps: In step S510, the user equipment determines the next K... AKMA Key Derivation Next K AF Key.

[0093] The next K is derived from the user equipment. AKMA After the key, the next K can be used. AKMA Key derivation yields the next K AF Key K AF ′.

[0094] In step S520, when the user equipment sends a session creation message to the AF network element carrying the key identifier, the AF network element requests the next key from the AAnF network element carrying the key identifier. AF Key.

[0095] User equipment can send a session creation request message to the AF network element carrying a key identifier A-KID′. The AF network element does not have a usable KID. AF Therefore, it will carry the key identifier A-KID′ and AF-ID to apply for the next K key from the AAnF network element. AF Key.

[0096] In step S530, the AAnF network element utilizes the next K corresponding to the key identifier. AKMA Key generation for the next K AF Key.

[0097] The AAnF network element determines the corresponding next key based on the key identifier. AKMA The key, and based on the current new next KAKMA Key generation for the next K AF Key.

[0098] In an optional embodiment, the AAnF network element will next K AF The key is returned to the AF network element so that the user equipment and the AF network element can use the next K key to communicate. AF Communication is conducted using a key.

[0099] Furthermore, the AAnF network element returns an application key acquisition response to the AF network element. This application key acquisition response carries the new next key. AF Key and lifecycle.

[0100] Furthermore, the user equipment and AF network elements communicate based on the next kilobyte. AF Secure communication is achieved using keys.

[0101] The key update method in this embodiment of the present disclosure will be described in detail below with reference to an application scenario.

[0102] Figure 6 A schematic diagram of a key update method in an application scenario is shown, such as... Figure 6 As shown, when K AF After the key expires, the AF network element requests a new next key from the AAnF network element. AF Key.

[0103] AAnF network element according to K AKMA Key update strategy determines the current K AF Has the key expired? If expired, check the current key. AF K was not updated during the key's lifetime. AKMA The key is then sent to the AUSF network element. AKMA The update triggers a request.

[0104] AUSF network elements are based on K AUSF Key and AKMA key update parameters for the next K AKMA Key K AKMA Update the AKMA key and send the encrypted update parameters to the UE to trigger the UE to perform K... AKMA 'Key update'.

[0105] AAnF network elements and UEs are based on the new K... AKMA ′Derivative K AF ′.

[0106] The UE sends a session access request to the AF network element, carrying A-KID′. The AF network element obtains the new next K based on A-KID′ from AAnF. AF Key K AF This enables secure interaction between the AF network element and the UE.

[0107] This process avoids both triggering master authentication and using the same key across different lifecycles. AF Key.

[0108] Figure 7 The diagram illustrates the modules of a key update system in an application scenario, such as... Figure 7 As shown, this key update system includes K AKMA Key update strategy module, K AKMA Key update module, AKMA update parameter encryption and sending module, AKMA related key update module.

[0109] Among them, in K AKMA In the key update policy module, the AAnF network element determines the key based on the A-KID. AF Whether it has expired, and in the current K AF Has the key been updated during its lifetime? AKMA Key.

[0110] If the current K AF If the key has not expired, return the current key; if the current key is not expired... AF The key expired and K was updated during that period. AKMA The key is based on the current K. AKMA Key Derivation for the Next K AF Key returned; if K AF Key expired and K AF K was not updated during the key's lifetime. AKMA The key triggers the AUSF network element to perform K... AKMA Key update.

[0111] In K AKMA In the key update module, the AUSF network element is based on K AUSF Key and AKMA key update parameters, such as RAND for new K AKMA Derived from ' and A-KID', and returned to the AAnF network element.

[0112] Among them, the derivation method can be

[0113] In the AKMA update parameter encryption and transmission module, the AUSF network element uses K... AUSF The key encrypts the AKMA key update parameters and obtains the UE's AMF ID information from the UDM. The encrypted AKMA key update parameters are then sent to the UE via the AMF, triggering the user equipment to perform AKMA-related key updates.

[0114] In the AKMA-related key update module, the UE is based on K... AUSFThe key is decrypted to obtain the AKMA key update parameters, and based on K AUSF Key and AKMA key update parameters are used for K AKMA Derived from ' and A-KID', and based on K AKMA Generate the next K AF Key K AF ′.

[0115] Figure 8 The flowchart illustrating the key update method in an application scenario is shown, as follows: Figure 8 As shown, in step S801, the main authentication is performed.

[0116] The user equipment performs master authentication with 5GC and generates a K. AUSF Keys, etc.

[0117] In step S802, based on K AUSF Generate K AKMA A-KID, based on K AKMA Generate K AF Used for secure communication between UE and AF.

[0118] When a user device subscribes to the AKMA service, 5GC is based on K AUSF Derivation of AKMA-related keys from keys, such as K AKMA Key and K AF Keys, etc., to enable user equipment and AF network elements to be based on K AF Secure communication is achieved using keys.

[0119] In step S803, K AF maturity.

[0120] When the current K AF When the key's lifespan expires, subsequent steps can be performed.

[0121] In step S804, an AKMA key update request (A-KID, AF-ID, refresh key indication) is made.

[0122] AF network elements can carry AF-ID, A-KID, and K AF The key requests a new next-generation key from the AAnF network element. AF Key.

[0123] In step S805, confirm K AF It has expired, and the lifespan of K is already over. AKMA If it hasn't been updated, then send K. AKMA Refresh request.

[0124] When the AAnF network element receives the next K signal sent by the AF network element... AF After obtaining the key, it can be used according to K.AKMA Key update strategy determines the current K AF Check if the key has expired, and determine if it is currently in the K domain. AF Has the key been used for K-factor authentication during its lifetime? AKMA Key update.

[0125] Specifically, the AAnF network element can determine the current K based on A-KID and AF-ID. AF Whether the key has expired, and whether the AAnF network element stores K. AKMA Determine the current K key using methods such as key update time. AF Has the key been used for K-factor authentication during its lifetime? AKMA Key update.

[0126] In step S806, K AKMA Key Update Request (SUPI).

[0127] When judging the current K AF The key has expired, and it is currently in the Kth generation. AF No K was performed during the key's lifetime. AKMA During key updates, the AAnF network element sends a K to the AUSF network element carrying the SUPI. AKMA A key update request is sent to trigger the AUSF network element to perform a key update. AKMA Key update.

[0128] In step S807, based on K AUSF and RAND derived K AKMA ′ and A-KID′; using K AUSF Encrypted RAND.

[0129] AUSF network element according to K AUSF Derivation of the next K key and key update parameters AKMA Key K AKMA ′ and the next K AKMA The key identifier A-KID′ corresponding to the key is returned to the AAnF network element.

[0130] The key update parameters include: random number.

[0131] When the AUSF network element is based on K AUSF The key and key update parameter RAND (random number) are used to create the new next K. AKMA Key K AKMA When deriving the key identifier A-KID, one can use... In addition to this, different derivation methods can be adopted based on different key update parameters, and this exemplary embodiment does not impose any special limitations on this.

[0132] AUSF network elements can also utilize K AUSF The key is used to encrypt the key update parameters to obtain the encrypted parameters.

[0133] In step S808, K AKMA Key update response (K) AKMA ′, SUPI, A-KID′).

[0134] Furthermore, the derived next key can be sent by sending an AKMA key update response. AKMA Key K AKMA The AKMA key update response returns SUPI and the key identifier A-KID to the AAnF network element. AKMA ′ and A-KID′.

[0135] In step S809, the current UE access AMF network element request (SUPI) and the current UE access AMF network element response (AMF ID) are obtained.

[0136] The AMF network element request carries SUPI, and the AMF network element response carries the AMF network element representation.

[0137] Among them, the AMF network element obtains the network element identifier, such as ID information, of the AMF network element currently accessed by the user equipment.

[0138] In step S810, the AKMA key refresh notification (K AKMA Update instructions (encrypted RAND).

[0139] AUSF network elements send AKMA key update notifications to the AMF network elements corresponding to the network element identifier.

[0140] The AKMA key update notification includes SUPI, AKMA update instruction, and encryption parameters.

[0141] In step S811, DL (Downlink) NAS encrypted transmission (K AKMA Update instructions (encrypted RAND).

[0142] The AMF network element forwards this AKMA key update notification to the user equipment through the NAS channel, thereby triggering the user equipment to update the AKMA-related keys.

[0143] The AKMA key update notification includes SUPI, AKMA update instruction, and encryption parameters.

[0144] In step S812, based on K AUSF and RAND derived K AKMA ′ and A-KID′, and KAF ′.

[0145] User equipment uses K AUSF The key is used to decrypt the encrypted parameters to obtain the key update parameters.

[0146] Furthermore, user equipment is based on K AUSF Key and key update parameters are used for K AKMA Derivation of ' and A-KID', to serve as the next K AKMA Key and key identifier. In addition, the user equipment can derive K... AF This exemplary embodiment does not impose any special limitations on this.

[0147] The next K is derived from the user equipment. AKMA After the key, the next K can be used. AKMA Key derivation yields the next K AF Key K AF ′.

[0148] In step S813, UL (Uplink) NAS encrypted transmission (ACK (Acknowledgement)).

[0149] User equipment sends AKMA update confirmation messages to AMF network elements via the NAS channel.

[0150] In step S814, the AKMA key refresh response (ACK) is generated.

[0151] The AMF network element sends an AKMA update confirmation message to the AUSF network element.

[0152] In step S815, a session creation message (A-KID') is generated.

[0153] User equipment can send a session creation request message to the AF network element carrying the key identifier A-KID′.

[0154] In step S816, a key acquisition request (A-KID′ and AF-ID) is made.

[0155] AF network element has no available K AF Therefore, it will carry the key identifier A-KID′ and AF-ID to apply for the next K key from the AAnF network element. AF Key.

[0156] In step S817, based on K AKMA Generate K AF ′.

[0157] The AAnF network element determines the corresponding next key based on the key identifier. AKMAThe key, and based on the current new next K AKMA Key generation for the next K AF Key.

[0158] In step S818, the key acquisition response (K) AF ′、K AF (Lifecycle, SUPI).

[0159] Furthermore, the AAnF network element returns an application key acquisition response to the AF network element. This application key acquisition response carries the new next key. AF Key and lifecycle.

[0160] In step S819, the UE and AF communicate based on K AF Secure communication between ' and A-KID'.

[0161] Furthermore, the user equipment and AF network elements communicate based on the next kilobyte. AF Secure communication is achieved using keys.

[0162] In this application scenario, the key update method, when the current K AF When the key expires, the AAnF network element will check the current K. AF The key is used for relevant checks to trigger the next K. AKMA The key update ensures K AF Maintaining different keys across different lifecycles enhances the security of communication between user equipment and AF network elements. During this process, the AUSF network element... AKMA Key updates can be performed without triggering master authentication, which improves the efficiency of key acquisition and prevents the unknown impact of master authentication on the entire key update process.

[0163] Figure 9 A schematic diagram of the key update device is shown, such as... Figure 9 As shown, the key update device 900 may include: an expiration request module 910, a key derivation module 920, and a secure communication module 930. Wherein:

[0164] The expiration application module 910 is configured to be used when the current K... AF When the key expires, the AF network element requests the next key from the AAnF network element. AF Key;

[0165] The key derivation module 920 is configured to determine the current K by the AAnF network element. AF The key has expired, and in the current K AF No K was performed during the key's lifetime. AKMA Key update triggers AUSF network elements based on the current key. AKMAThe key is derived from the next K key for the AAnF network element and the user equipment, respectively. AKMA Key;

[0166] The secure communication module 930 is configured so that the ANF network element and the user equipment respectively utilize the next K AKMA The key generates the next K AF The key is used to enable the AF network element to obtain the next K returned by the AAnF network element. AF The key, and based on the next K AF The key is used to communicate with the user equipment.

[0167] In an exemplary embodiment of the present invention, the triggering AUSF network element is based on the current K AKMA The key is derived from the next K key for the AAnF network element and the user equipment, respectively. AKMA Keys, including:

[0168] The AUSF network element is based on K AUSF Derivation of the next K key and key update parameters AKMA Key and the next K AKMA The key identifier corresponding to the key is returned to the AAnF network element;

[0169] The AUSF network element utilizes K AUSF The key is used to encrypt the key update parameters to obtain encrypted parameters, and the encrypted parameters are transmitted to the user equipment so that the user equipment can derive the next K. AKMA Key.

[0170] In one exemplary embodiment of the present invention, the user equipment derives the next K. AKMA Keys, including:

[0171] The user equipment utilizes the K AUSF The key is used to decrypt the encrypted parameters to obtain the key update parameters;

[0172] The user equipment utilizes the K AUSF The key and the key update parameters derive the next K AKMA The key and the key identifier.

[0173] In an exemplary embodiment of the present invention, the AAnF network element and the user equipment respectively utilize the next K AKMA The key generates the next K AF Keys, including:

[0174] The user equipment is based on the next K AKMA The next K key derivation AF Key;

[0175] When the user equipment sends a session creation message to the AF network element carrying the key identifier, the AF network element requests the next key from the AAnF network element carrying the key identifier. AF Key;

[0176] The AAnF network element utilizes the next K corresponding to the key identifier. AKMA The key generates the next K AF Key.

[0177] In an exemplary embodiment of the present invention, transmitting the encryption parameters to the user equipment includes:

[0178] The AUSF network element obtains the network element identifier of the AMF network element of the user equipment from the UDM network element, and sends the encryption parameters to the user equipment using the AMF network element corresponding to the network element identifier.

[0179] In one exemplary embodiment of the present invention, the key update parameter includes: a random number.

[0180] In an exemplary embodiment of the present invention, the AF network element obtains the next K returned by the AAnF network element. AF The key, and based on the next K AF The key communicates with the user equipment, including:

[0181] The AAnF network element will then... AF The key is returned to the AF network element so that the user equipment and the AF network element can use the next key to... AF Communication is conducted using a key.

[0182] The specific details of the aforementioned key update device 900 have been described in detail in the corresponding key update method, so they will not be repeated here.

[0183] It should be noted that although several modules or units of the key update device 900 have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0184] Furthermore, in an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0185] The following reference Figure 10To describe an electronic device 1000 according to such an embodiment of the present invention. Figure 10 The electronic device 1000 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0186] like Figure 10 As shown, the electronic device 1000 is manifested in the form of a general-purpose computing device. The components of the electronic device 1000 may include, but are not limited to: at least one processing unit 1010, at least one storage unit 1020, a bus 1030 connecting different system components (including storage unit 1020 and processing unit 1010), and a display unit 1040.

[0187] The storage unit stores program code that can be executed by the processing unit 1010, causing the processing unit 1010 to perform the steps described in the "Exemplary Methods" section above, according to various exemplary embodiments of the present invention.

[0188] Storage unit 1020 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 1021 and / or a cache memory unit 1022, and may further include a read-only memory unit (ROM) 1023.

[0189] Storage unit 1020 may also include a program / utility 1024 having a set (at least one) program module 1025, such program module 1025 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0190] Bus 1030 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the multiple bus structures.

[0191] Electronic device 1000 can also communicate with one or more external devices 1200 (e.g., keyboard, pointing device, Bluetooth device, etc.), one or more devices that enable a user to interact with electronic device 1000, and / or any device that enables electronic device 1000 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 1050. Furthermore, electronic device 1000 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 1060. As shown, network adapter 1060 communicates with other modules of electronic device 1000 via bus 1030. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 1000, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0192] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0193] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the invention may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of the invention described in the "Exemplary Methods" section above.

[0194] refer to Figure 11 As shown, a program product 1100 for implementing the above-described method according to an embodiment of the present invention is described. It may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, the readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0195] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0196] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0197] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0198] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0199] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

Claims

1. A key update method, characterized in that, The method includes: When the current When the key expires, the AF network element requests the next key from the AAnF network element. Key; The AAnF network element determines the current The key has expired, and in the current... No changes were made during the key's lifetime. Key update triggers AUSF network element based on The key and key update parameters derive the next Key and the next The key identifier corresponding to the key is returned to the AAnF network element, and the AAnF network element is triggered to utilize the key. The key is used to encrypt the key update parameters to obtain encrypted parameters, and the encrypted parameters are transmitted to the user equipment so that the user equipment can derive the next... The key; wherein the key update parameters include random numbers; The AAnF network element and the user equipment respectively utilize the next... The next key generation The key is used to enable the AF network element to obtain the next key returned by the AAnF network element. Key, and based on the next The key communicates with the user equipment; If the AAnF network element determines the current The key has expired, and in the current... Updated during the key's lifecycle The key is based on the current Key Derivation Next Return the key.

2. The key update method according to claim 1, characterized in that, The user equipment is derived to obtain the next Keys, including: The user equipment utilizes the The key is used to decrypt the encrypted parameters to obtain the key update parameters; The user equipment utilizes the The key and the key update parameters derive the next... The key and the key identifier.

3. The key update method according to claim 2, characterized in that, The AAnF network element and the user equipment respectively utilize the next... The next key generation Keys, including: The user equipment according to the next The next key derivation Key; When the user equipment sends a session creation message to the AF network element carrying the key identifier, the AF network element requests the next session creation message from the AAnF network element carrying the key identifier. Key; The AAnF network element utilizes the next step corresponding to the key identifier. The next key generation Key.

4. The key update method according to claim 1, characterized in that, The step of transmitting the encrypted parameters to the user equipment includes: The AUSF network element obtains the network element identifier of the AMF network element of the user equipment from the UDM network element, and sends the encryption parameters to the user equipment using the AMF network element corresponding to the network element identifier.

5. The key update method according to claim 1, characterized in that, The AF network element obtains the next information returned by the AAnF network element. Key, and based on the next The key communicates with the user equipment, including: The AAnF network element will then... The key is returned to the AF network element so that the user equipment and the AF network element can use the next... Communication is conducted using a key.

6. A key update device, characterized in that, include: The expiration application module is configured to be used when the current application expires. When the key expires, the AF network element requests the next key from the AAnF network element. Key; The key derivation module is configured to determine the current key of the AAnF network element. The key has expired, and in the current... No changes were made during the key's lifetime. Key update triggers AUSF network element based on The key and key update parameters derive the next Key and the next The key identifier corresponding to the key is returned to the AAnF network element, and the AAnF network element is triggered to utilize the key. The key is used to encrypt the key update parameters to obtain encrypted parameters, and the encrypted parameters are transmitted to the user equipment so that the user equipment can derive the next... Key; if the AAnF network element determines the current The key has expired, and in the current... Updated during the key's lifecycle The key is based on the current Key Derivation Next The key is then returned; wherein the key update parameter includes a random number. The secure communication module is configured so that the ANF network element and the user equipment respectively utilize the next... The next key generation The key is used to enable the AF network element to obtain the next key returned by the AAnF network element. Key, and based on the next The key is used to communicate with the user equipment.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the key update method according to any one of claims 1-5.

8. An electronic device, characterized in that, include: processor; Memory for storing the executable instructions of the processor; The processor is configured to execute the key update method according to any one of claims 1-5 by executing the executable instructions.

Images