Communication authentication method and device, terminal, network equipment, medium and program product

Abstract

The invention provides a communication authentication method and device, a terminal, network equipment, a medium and a program product, and relates to the technical field of communication, the communication authentication method is applied to the terminal, the method comprises the following steps: sending a registration request to the network equipment, the registration request carrying a first security enhancement support bit SES, the first SES being used for indicating the security capability supported by the terminal; first authentication information sent by the network equipment is received, the first authentication information carries a second SES, and the second SES is used for indicating the security capability supported by the first authentication information; and according to the second SES, security enhancement is carried out on the first key information to obtain second key information, the first key information is obtained according to the core key K and a random number RAND in the first authentication information, and the second key information is used for key derivation. According to the invention, security capability negotiation and indication between the terminal and the network equipment are realized, security enhancement is carried out on the key information, and the key information can be prevented from being cracked by quantum computing.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a communication authentication method, device, terminal, network equipment, medium and program product. Background Art

[0002] With the rapid development of Internet technology, the network security risks of information systems continue to increase, and the threat challenges are becoming increasingly severe. Cryptographic security is an important foundation for information security and can be used to ensure the data security of network information systems. Cryptographic technology is the core technology and important means to ensure network information systems.

[0003] At present, the network authentication and key agreement (AKA) of the communication network is implemented based on the MILENAGE algorithm, which is used to complete the authentication and key agreement between the universal subscriber identity module (USIM) and the unified data management (UDM). The underlying algorithm of the MILENAGE algorithm is AES-128, and the key K shared between the USIM and UDM is 128 bits.

[0004] However, with the development of quantum computing technology, traditional cryptographic algorithms face serious security threats. Quantum computers have powerful computing power, which can greatly reduce the difficulty of cracking symmetric cryptographic algorithms, making the risk of AES-128 algorithm being cracked greatly increased. Attackers can obtain the plaintext of AES-128 algorithm and calculate the 128-bit key. Summary of the invention

[0005] The purpose of the present invention is to provide a communication authentication method, device, terminal, network equipment, medium and program product to solve the problem that the existing authentication and key negotiation algorithms are easily cracked by quantum computing.

[0006] To solve the above technical problems, the embodiments of the present invention provide the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides a communication authentication method, which is applied to a terminal, and the method includes:

[0008] Sending a registration request to a network device, where the registration request carries a first security enhancement support bit SES, where the first SES is used to indicate security capabilities supported by the terminal;

[0009] receiving first authentication information sent by the network device, where the first authentication information carries a second SES, and the second SES is used to indicate a security capability supported by the first authentication information;

[0010] According to the second SES, the first key information is security enhanced to obtain second key information, the first key information is obtained according to the core key K and the random number RAND in the first authentication information, and the second key information is used for key derivation.

[0011] Optionally, the method further comprises:

[0012] In a case where a universal subscriber identity module USIM on the terminal only supports a first cryptographic algorithm, the first SES is generated.

[0013] Optionally, the registration request carries a hidden user identity SUCI, and the SUCI includes the first SES;

[0014] or,

[0015] The registration request carries the first SES through a first interface field.

[0016] Optionally, the authentication management field AMF of the first authentication information carries the second SES.

[0017] Optionally, the first key information includes a first encryption key CK and a first integrity protection key IK;

[0018] The second key information includes a second CK and a second IK;

[0019] According to the second SES, the first key information is security enhanced to obtain the second key information, including:

[0020] According to the second SES, security enhancement is performed on the first CK to obtain the second CK;

[0021] According to the second SES, security enhancement is performed on the first IK to obtain the second IK.

[0022] Optionally, the security enhancement includes at least one of the following:

[0023] Performing security enhancement according to a first symmetric key, wherein the first symmetric key is obtained when the USIM on the terminal only supports a first cryptographic algorithm, the first symmetric key is generated in a process of encrypting a user permanent identity SUPI of the USIM using a first encryption mechanism to obtain a SUCI, and the first encryption mechanism is an encryption mechanism based on key encapsulation;

[0024] The key derivation function KDF is used for security enhancement.

[0025] Optionally, the key length supported by the second CK is at least 256 bits;

[0026] The key length supported by the second IK is at least 256 bits.

[0027] In a second aspect, an embodiment of the present invention further provides a communication authentication method, which is applied to a network device, and the method includes:

[0028] receiving a registration request sent by a terminal, where the registration request carries a SUCI and a first SES, where the first SES is used to indicate security capabilities supported by the terminal;

[0029] Generate first authentication information and third key information according to the core key K and AMF, where the first authentication information carries a second SES, and the second SES is used to indicate security capabilities supported by the first authentication information;

[0030] According to the core key K and the first SES, the third key information is security enhanced to obtain fourth key information, where the fourth key information is used for key derivation;

[0031] The first authentication information is sent to the terminal.

[0032] Optionally, the method further comprises:

[0033] Obtaining the first SES by parsing the SUCI;

[0034] or,

[0035] The first SES is obtained by parsing the first interface field of the registration request.

[0036] Optionally, the AMF of the first authentication information carries the second SES.

[0037] Optionally, generating first authentication information and third key information according to the core key K and AMF includes:

[0038] Determine a second cryptographic algorithm of corresponding length according to the length of the core key K;

[0039] Utilizing the second cryptographic algorithm, according to the core key K and the AMF, the first authentication information and the third key information are obtained.

[0040] Optionally, the third key information includes a third CK and a third IK;

[0041] The fourth key information includes a fourth CK and a fourth IK;

[0042] According to the core key K and the first SES, the third key information is security enhanced to obtain fourth key information, including:

[0043] According to the length of the first SES and the core key, security enhancement is performed on the third CK to obtain the fourth CK;

[0044] The third IK is security-enhanced according to the length of the first SES and the core key to obtain the fourth IK.

[0045] Optionally, the security enhancement includes at least one of the following:

[0046] Performing security enhancement according to a second symmetric key, where the second symmetric key is obtained by decrypting the SUCI in the registration request according to the first SES using a first decryption mechanism, where the first decryption mechanism is a decryption mechanism based on key encapsulation;

[0047] Use KDF for security enhancement.

[0048] Optionally, the key length supported by the fourth CK is at least 256 bits;

[0049] The key length supported by the fourth IK is at least 256 bits.

[0050] In a third aspect, an embodiment of the present invention further provides a communication authentication device, the device comprising:

[0051] A first sending module, configured to send a registration request to a network device, wherein the registration request carries a first security enhancement support bit SES, and the first SES is used to indicate a security capability supported by the terminal;

[0052] A first receiving module, configured to receive first authentication information sent by the network device, wherein the first authentication information carries a second SES, and the second SES is used to indicate a security capability supported by the first authentication information;

[0053] The first processing module is used to perform security enhancement on the first key information according to the second SES to obtain the second key information, wherein the first key information is obtained according to the core key K and the random number RAND in the first authentication information, and the second key information is used for key derivation.

[0054] In a fourth aspect, an embodiment of the present invention further provides a communication authentication device, the device comprising:

[0055] A second receiving module is configured to receive a registration request sent by a terminal, where the registration request carries a SUCI and a first SRS, and the first SES is used to indicate a security capability supported by the terminal;

[0056] A second processing module is used to generate first authentication information and third key information according to the core key K and the AMF, wherein the first authentication information carries a second SES, and the second SES is used to indicate a security capability supported by the first authentication information;

[0057] A third processing module, configured to perform security enhancement on the third key information according to the core key K and the first SES to obtain fourth key information, wherein the fourth key information is used for key derivation;

[0058] The second sending module is used to send the first authentication information to the terminal.

[0059] In the fifth aspect, an embodiment of the present invention further provides a terminal, comprising: a transceiver, a processor, a memory, and a program or instruction stored in the memory and executable on the processor; when the processor executes the program or instruction, the steps in the communication authentication method described in any one of the first aspects are implemented.

[0060] In the sixth aspect, an embodiment of the present invention further provides a network device, comprising: a transceiver, a processor, a memory, and a program or instruction stored in the memory and executable on the processor; when the processor executes the program or instruction, it implements the steps in the communication authentication method described in any one of the second aspects.

[0061] In the seventh aspect, an embodiment of the present invention further provides a readable storage medium having a program or instruction stored thereon, which, when executed by a processor, implements the steps of the communication authentication method as described in any one of the first aspects, or implements the steps of the communication authentication method as described in any one of the second aspects.

[0062] In an eighth aspect, an embodiment of the present invention further provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the steps of the communication authentication method as described in any one of the first aspects, or implement the steps of the communication authentication method as described in any one of the second aspects.

[0063] The beneficial effects of the above technical solution of the present invention are as follows:

[0064] The communication authentication method provided by the scheme of the present invention receives a registration request sent by a network device through a terminal, the registration request carries a first SES indicating security capabilities supported by the terminal, so that the network device obtains the security capabilities supported by the terminal according to the first SES, and receives first authentication information sent by the network device through the terminal, the first authentication information carries a second SES, and obtains the security capabilities supported by the first authentication information issued by the network device according to the second SES, thereby realizing the negotiation and indication of security capabilities between the terminal and the network device, and the terminal performs security enhancement on the first key information according to the second SES to obtain the second key information. Since the key information is security enhanced, it can be avoided from being cracked by quantum computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 A flow chart of a communication authentication method applied to a terminal provided by an embodiment of the present invention;

[0066] Figure 2 A schematic diagram of the format of SUCI provided in an embodiment of the present invention;

[0067] Figure 3 A flow chart of a communication authentication method applied to a network device provided by an embodiment of the present invention;

[0068] Figure 4 A flowchart of identity submission between a terminal and a network device provided in an embodiment of the present invention;

[0069] Figure 5 A master authentication flow chart provided for an embodiment of the present invention;

[0070] Figure 6 One of the structural schematic diagrams of the communication authentication device provided by the embodiment of the present invention;

[0071] Figure 7 A second structural diagram of a communication authentication device provided by an embodiment of the present invention;

[0072] Figure 8 A schematic diagram of the structure of a terminal provided by an embodiment of the present invention;

[0073] Fig. 9 A schematic diagram of the structure of a network device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0074] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0075] In order to solve the problem that existing authentication and key negotiation algorithms are easily cracked by quantum computing, the embodiments of the present invention provide a security capability negotiation method, apparatus, device, storage medium and program product.

[0076] like Figure 1 As shown, an embodiment of the present invention provides a security capability negotiation method, which is applied to a terminal, and the method includes:

[0077] Step 101: Send a registration request to a network device, wherein the registration request carries a first security enhancement support bit (Security Enhancement Support, SES), and the first SES is used to indicate the security capabilities supported by the terminal.

[0078] It should be noted that the terminal (i.e., user equipment, User Equipment, UE) provided in the embodiment of the present invention is a general term for mobile equipment (Mobile Equipment, ME) and USIM. USIM stores the user's core key K and identifier and other data. ME and USIM cooperate to complete network authentication.

[0079] It can be understood that the security capability negotiation method applied to a terminal provided in the embodiment of the present invention is executed by the ME.

[0080] In this embodiment, the terminal is a terminal supporting security energy enhancement, wherein security energy enhancement means that in order to cope with quantum attacks, the ME on the terminal side will be replaced by an ME supporting the AES-128 algorithm (supporting the Advanced Encryption Standard (AES) algorithm with a key length of 128 bits) to an ME supporting the AES-256 algorithm (supporting the AES algorithm with a key length of 256 bits). That is, the security capability supported by the terminal can be understood as whether the terminal supports security capability enhancement, that is, whether it supports the AES algorithm (or encryption mechanism) with a key length of 256 bits.

[0081] In this step, the ME that supports enhanced security capabilities writes the first SES into a registration request. The first SES is used to indicate whether the ME supports enhanced security capabilities. The registration request is an initial registration request (Initial RegistrationRequest). Through the registration request, the first SES is synchronized to the network device. The network device learns whether the ME supports enhanced security capabilities based on the first SES.

[0082] The registration request also carries a Subscription Concealed Identifier (SUCI).

[0083] In this embodiment, the network device is a home network (Home Network, HN) or a UDM network element in the HN.

[0084] Step 102: Receive first authentication information sent by the network device, where the first authentication information carries a second SES, and the second SES is used to indicate security capabilities supported by the first authentication information.

[0085] The first authentication information includes the following authentication parameters: Authentication Token (AUTN) and Random Challenge (RAND).

[0086] The security capability supported by the first authentication information can be understood as whether the first authentication information or the authentication parameters in the first authentication information support security capability enhancement, that is, whether the key length of the authentication information or the key parameters in the authentication information is 256 bits.

[0087] In this step, after receiving the registration request, if there is a first SES of 1 in the registration request, the UDM generates a second SES, saves the second SES in the first authentication information, and sets it to 1. That is, the first authentication information sent by the network device is received, and the first authentication information carries the second SES, and the second SES is used to indicate whether the first authentication information supports security capability enhancement.

[0088] Specifically, according to the registration request, UDM decrypts the SUCI in the registration request to obtain the user permanent identification (SUPI), creates the first authentication vector (AV), namely 5G HE AV, which includes AUTN, RAND, expected response (XRES), security key K AUSF .

[0089] It can be understood that AUTN and RAND in the first authentication vector are respectively AUTN and RAND in the first authentication information.

[0090] It should also be noted that if there is no first SES of 1 in the registration request, the network device does not perform additional processing.

[0091] After that, UDM will contain AUTN, RAND, expected response XRES*, K AUSF The first authentication vector 5G HE AV is sent to the Authentication Server Function (AUSF).

[0092] Specifically, UDM returns the requested 5G HE AV to AUSF in the Nudm_UEAuthentication_Get Response message and indicates that 5G HE AV is used for 5G AKA. If SUCI is included in the Nudm_UEAuthentication_Get Request, UDM will include SUPI in the Nudm_UEAuthentication_Get Response.

[0093] AUSF shall temporarily save XRES* and the received SUCI or SUPI. AUSF may save K AUSF .

[0094] AUSF shall generate a 5G AV based on the 5G HE AV received from UDM / ARPF. HXRES* (hash of expected response) is calculated from RAND and XRES*, and K AUSF Derive the anchor key K SEAF Then use HXRES* and K SEAF Replace XRES* and K in 5GHE AV respectively AUSF .

[0095] AUSF should then remove K SEAF , the authentication vector 5G SE AV (RAND, AUTN, HXRES*) is sent to the Secure Anchor Function (SEAF) through the Nausf_UEAuthentication_Authenticate response.

[0096] SEAF shall send RAND and AUTN to UE via Non Access Stratum (NAS) message (Auth-Req). It is understandable that the NAS message includes the first authentication information (RAND and AUTN). The message shall also include the Authentication Management Field (AMF) used by UE and Authentication Management Field (K) to identify AMF and ngKSI for some native security contexts, the message should also include anti-bidding down between architectures (ABBA) parameters.

[0097] The ME shall forward the RAND and AUTN in the NAS message (Auth-Req) to the USIM.

[0098] After the USIM receives RAND and AUTN, the USIM shall check whether the AUTN is accepted to verify whether the authentication vector is the latest. If the verification is successful (it is the latest), the USIM shall calculate the response (RES) and return RES, Cipher Key (CK), and Integrity Key (IK) to the ME.

[0099] Among them, SEAF (Security Anchor Function): The access network implements the authentication of the UE. AUSF (Authentication Server Function): The home network implements the authentication of the UE.

[0100] Through the above steps, the negotiation and indication of security capabilities between the terminal and the network device are achieved.

[0101] After this step, the terminal obtains the second SES from the first authentication information.

[0102] Step 103: According to the second SES, the first key information is security enhanced to obtain second key information, where the first key information is obtained based on the core key K and the random number RAND in the first authentication information, and the second key information is used for key derivation.

[0103] The first key information includes a first CK and a first IK, wherein the first CK is the CK returned by the USIM to the ME, and the first IK is the IK returned by the USIM to the ME.

[0104] In this step, when the terminal receives the second SES with a value of 1, security enhancement (or security enhancement processing or security enhancement) is performed on the first CK and the first IK respectively to obtain the second key information, and the second key information includes the second CK (CK*) and the second IK (IK*). The key length supported by CK* and IK* is at least 256 bits, which can avoid being cracked by quantum computing. The second key information is used for key derivation at subsequent levels.

[0105] It should be noted that in the identity submission process between the terminal and the network device, when the network device (or the network side) requires the UE to send SUCI for network authentication, specifically, the UE sends an initialization registration request (ie, a registration request) to the network side, and the ME reads the Subscription Permanent Identifier (SUPI) of the USIM, and uses a key-encapsulation mechanism encryption (KEM_ENC) to encrypt the SUPI to obtain the SUCI, and sends the initialization registration request carrying the SUCI to the UDM in the home network through the relevant network element.

[0106] In KEM_ENC: input the public key PK and the message M, use the key-encapsulation mechanism (KEM) technology to generate a temporary symmetric key sk, and then protect M to output the ciphertext C. The KEM technology here can use traditional public key cryptography algorithms such as elliptic curve cryptography (ECC), asymmetric encryption algorithms (Ron Rivest, Adi Shamir, Leonard Adleman, RSA) and post-quantum cryptography (Post-Quantum Cryptography, PQC), etc. Elliptic Curve Integrated Encryption Scheme (ECIES) encryption is an implementation of KEM_ENC.

[0107] KEM (Key Encapsulation Mechanism) mainly includes the following algorithms:

[0108] KeyGen(pp)->(SK, PK): Generates a public-private key pair. The input pp is the public parameter used to generate the key pair. The output is the generated public-private key pair.

[0109] Encap(PK)->(sk, csk): Generates a temporary symmetric key based on the public key. The input is the public key, and the output is the temporary symmetric key sk and the encrypted sk, i.e. csk.

[0110] Decap(SK, csk)->(sk): Decrypts a temporary symmetric key based on a private key. The input is the private key and csk, and the output is a temporary symmetric key sk.

[0111] Since the USIM card only stores the user's identity, it will not be actively replaced with a new card that supports 256 bits for a long time. Therefore, there must be a large number of old USIM cards in the network that have not been upgraded to support AES-256, that is, USIMs with a core key K of 128 bits.

[0112] In the identity submission process between the terminal and the network device, the ME uses ECIES to encrypt SUPI to obtain SUCI, where:

[0113] If SUCI encryption uses the null scheme, it is executed according to the original protocol without additional processing;

[0114] If SUCI encryption uses a non-null scheme, the following process is performed:

[0115] In the case where the universal user identity module USIM on the terminal only supports the first cryptographic algorithm, the first SES is generated. The first cryptographic algorithm is the MILENAGE-128 algorithm. And, in the case where the USIM on the terminal only supports the first cryptographic algorithm, a first symmetric key is obtained and saved, wherein the first symmetric key is generated in the process of encrypting the SUPI of the USIM using the first encryption mechanism to obtain the SUCI, and the first symmetric key is used for key enhancement extension in the subsequent authentication process. The first encryption mechanism is KEM_ENC.

[0116] If the USIM supports the MILENAGE-256 algorithm, no additional processing is performed.

[0117] Specifically, the ME checks whether the USIM is a legacy card that only supports MILENAGE-128:

[0118] If it is an old card that only supports MILENAGE-128:

[0119] Then ME secretly stores the temporary symmetric key sk generated during the encryption process of KEM_ENC (first encryption mechanism) as K_KEM (i.e., the first symmetric key);

[0120] And, set the security enhancement support bit SES (ie, the first SES), such as setting it to 1.

[0121] If it is an old card that only supports MILENAGE-256:

[0122] No additional processing is performed.

[0123] It should be noted that the first symmetric key K_KEM can also be derived from sk: such as K_KEM=KDF(sk, "KEM"). It is recommended that the length of the first symmetric key K_KEM be at least 128 bits, preferably 256 bits.

[0124] Since SUPI protection adopts the ECIES scheme. ECIES currently uses the public key cryptography algorithm ECC based on elliptic curves, and the post-quantum cryptography algorithm (PQC) can also be used to replace the ECC algorithm in ECIES. Therefore, the KEM_ENC in the above description can support ECIES_KEM or PQC_KEM algorithms at the same time. In order to deal with quantum attacks, the KEM algorithm based on PQC (ie PQC_KEM) is preferred.

[0125] It should be noted that PQC_KEM (Post Quantum Cryptography): a KEM scheme based on the post-quantum public key cryptography algorithm, that is, the public key cryptography algorithm in KEM adopts the post-quantum public key cryptography algorithm.

[0126] ECIES:

[0127] 5G AKA uses ECIES to encrypt SUPI to generate SUCI, which mainly includes two algorithms:

[0128] ECIES_ENC (encryption): input public key PK and plaintext M, output C;

[0129] Encap_ECIES(PK): Use KeyGen(pp) to generate a temporary public-private key pair (eSK, ePK), generate a temporary symmetric key sk based on PK and eSK, and output (sk, ePK);

[0130] SEnc_ECIES(sk, M): Use the temporary key sk to encrypt and integrity protect M to obtain C1 and C2, and output C = (ePK, C1, C2).

[0131] Optionally, the first SES can be placed in SUCI, that is, the registration request carries SUCI, and SUCI includes the first SES; the first SES can also be carried by a new field in the interface of ME->Secure Anchor Function (SEAF)->Authentication Server Function (AUSF)->UDM, that is, the registration request carries the first SES through the first interface field, and the registration request is sent by ME to SEAF, by SEAF to AUSF, and then by AUSF to UDM.

[0132] Among them, SEAF: the access network realizes the authentication of UE. AUSF: the home network realizes the authentication of UE.

[0133] Among them, placing the first SES in SUCI is the preferred solution. If the first SES is placed in SUCI, then a new SES field is added to SUCI, and the format of SUCI is modified as follows: Figure 2 shown.

[0134] During the main authentication process between the terminal and the network device, the ME receives the challenge:

[0135] In an optional embodiment, the authentication management field (Authentication Management Field, AMF) of the first authentication information carries the second SES. Specifically, the AMF of AUTN in the first authentication information carries the second SES.

[0136] Specifically, when the network device receives a registration request, the registration request is parsed to obtain a first SES. If the first SES is 1, the second SES is saved in a reserved bit of the AMF of the AV.

[0137] It should be noted that bits 1-7 and 8-15 of AMF are reserved bits, the default value is 0, and a fixed position can be selected to save the second SES.

[0138] If there is no first SES that is 1, the network device does not perform additional processing.

[0139] According to the second SES, the first key information is security enhanced. Before obtaining the first information, the method further includes:

[0140] The ME obtains the second SES from the AMF in the first authentication information. That is, the ME obtains the SES (i.e., the second SES) from the AMF field of the AV, and the second SES is 1.

[0141] It should be noted that in the original 3GPP protocol, CK and IK are concatenated (ie, CK||IK) as 256-bit input to derive keys at all levels, such as K_ausf, K_seaf, K_amf, K_gNB, etc. However, since the core key K is not 256-bit with sufficient entropy, CK and IK are not 256-bit with sufficient entropy, so the series of keys derived from the combination of CK||IK are not 256-bit with sufficient entropy. Therefore, since K is not 256-bit with sufficient entropy, that is, its randomness is not enough for 256 bits, it cannot provide 256-bit security capabilities, resulting in a series of keys derived between the ME and the network side. There is a security risk in the scenario of quantum attack.

[0142] Further, according to the second SES, the first key information is security enhanced to obtain the second key information, including:

[0143] According to the second SES, the first encryption key CK is security enhanced to obtain the second CK, and, according to the second SES, the first integrity protection key CK is security enhanced to obtain the second IK, that is, when there is a second SES of 1, the ME performs security enhancement on CK and IK respectively.

[0144] The security enhancement includes at least one of the following:

[0145] (1) Security enhancement is performed according to the first symmetric key K_KEM, as follows:

[0146] CK*=HASH(CK||K_KEM), IK*=HASH(IK||K_KEM)

[0147] Wherein, CK is the first CK, CK* is the second CK, IK is the first IK, IK* is the second IK, and K is the core key;

[0148] (2) Using the key derivation function KDF for security enhancement:

[0149] CK*=KDF(K_KEM,CK), IK*=KDF(K_KEM,IK)

[0150] Among them, CK is the first CK, CK* is the second CK, IK is the first IK, IK* is the second IK, and K_KEM is the first symmetric key.

[0151] It should be noted that the output of KDF and HASH is at least 256 bits, that is, the key length supported by the second CK (CK*) is at least 256 bits, and the key length supported by the second IK (IK*) is at least 256 bits. CK and K_KEM can be combined in other ways such as series connection and xor, and other shared parameter information can also be added. In this embodiment, the length of the first CK and the first IK is 128 bits, the length of the first symmetric key K_KEM is at least 128 bits, and 256-bit CK* and IK* are obtained after KDF mixed calculation.

[0152] Afterwards, ME derives other layers of keys and parameters based on the 256-bit secure CK* and IK*, that is, the second response (expressed as the second RES or RES*) is obtained according to the second CK, the second IK, the first response (expressed as the first RES or RES), and the random number RAND, and the first security key K is obtained according to the second CK and the second IK. AUSF , the first security key K AUSF The second response (second RES or RES*) is used for communication authentication.

[0153] The first RES is obtained according to the first authentication information. The first RSE is the above-mentioned USIM. After receiving RAND and AUTN, the USIM shall check whether AUTN is accepted to verify whether the authentication vector is the latest. If the verification is successful (the latest), the USIM calculates the RES. The first authentication information includes the RAND, and the first information includes the second RES and the first security key K AUSF .

[0154] Further, using RAND, the first RES, CK*, IK* are derived through the KDF one-way function to obtain K AUSFand RES*, and the subsequent layers of keys, that is, obtaining the second RES according to the second CK, the second IK, the first actual verification data RES, and the random number RAND, including:

[0155] The second response is obtained according to the second CK, the second IK, the first response, and the random number RAND. The specific formula is as follows:

[0156] RES*=KDF(CK*xor IK*, RAND, RES)

[0157] Among them, RES* is the second response, RES is the first response, CK* is the second CK, and IK* is the second IK;

[0158] The second response may also be derived using KDF according to the first response, the RAND, the first CK (CK), and the first IK (IK). The specific formula is as follows:

[0159] RES*=KDF(CK||IK,RAND,RES)

[0160] Among them, RES* is the second response, RES is the first response, CK is the first CK, and IK is the first IK;

[0161] Obtain a first security key K according to the second CK and the second IK AUSF ,include:

[0162] According to the second IK (IK*) and the second CK (CK*), the first security key K is derived using KDF AUSF , the specific formula is as follows:

[0163] K AUSF =KDF(CK*xor IK*,SN_name,SQN xor AK).

[0164] Among them, SN_name is the serial number of the terminal device, SQN is the serial number used to uniquely identify the terminal device, AK is the authentication key (Access Key), CK* is the second CK, and IK* is the second IK.

[0165] The first security key K can also be derived using KDF according to the first CK (CK) and the first IK (IK). AUSF , the specific formula is as follows:

[0166] K AUSF =KDF(CK||IK,SN_name,SQN xor AK)

[0167] Among them, SN_name is the serial number of the terminal device, SQN is the serial number used to uniquely identify the terminal device, AK is the authentication key (Access Key), CK is the first CK, and IK is the first IK.

[0168] The key length supported by the second CK is at least 256 bits, and the key length supported by the second IK is at least 256 bits.

[0169] That is, the ME performs security enhancement processing on the first CK and the first IK based on the shared key (first symmetric key) generated or derived in the SUCI encryption, and extends the security of each layer of keys to at least 256 bits.

[0170] like Figure 3 As shown, an embodiment of the present invention provides a security capability negotiation method, which is applied to a network device, and the method includes:

[0171] Step 301: receiving a registration request sent by a terminal, where the registration request carries a SUCI and a first SES, where the first SES is used to indicate a security capability SUCI supported by the terminal.

[0172] In this embodiment, the terminal is a terminal supporting security energy enhancement, wherein security energy enhancement means that in order to cope with quantum attacks, the ME on the terminal side will be replaced by an ME supporting the AES-128 algorithm (supporting the Advanced Encryption Standard (AES) algorithm with a key length of 128 bits) to an ME supporting the AES-256 algorithm (supporting the AES algorithm with a key length of 256 bits). That is, the security capability supported by the terminal can be understood as whether the terminal supports security capability enhancement, that is, whether it supports the AES algorithm (or encryption mechanism) with a key length of 256 bits.

[0173] In this step, the ME that supports enhanced security capabilities writes the first SES into a registration request. The first SES is used to indicate whether the ME supports enhanced security capabilities. The registration request is an initial registration request (Initial RegistrationRequest). Through the registration request, the first SES is synchronized to the network device. The network device learns whether the ME supports enhanced security capabilities based on the first SES.

[0174] In this embodiment, the network device is a home network (Home Network, HN) or a UDM network element in the HN.

[0175] Step 302: Generate first authentication information and third key information according to the core key K and AMF, where the first authentication information carries a second SES, and the second SES is used to indicate a security capability SUCI supported by the first authentication information.

[0176] The first authentication information includes AUTN and RAND.

[0177] In this step, after receiving the registration request, if there is a first SES of 1 in the registration request, the UDM generates a second SES, saves the second SES in the first authentication information, and sets it to 1. That is, the first authentication information sent by the network device is received, and the first authentication information carries the second SES, and the second SES is used to indicate whether the first authentication information supports security capability enhancement.

[0178] It should also be noted that if there is no first SES of 1 in the registration request, the network device does not perform additional processing.

[0179] The third key information includes CK (also called third CK) and IK (also called third IK). The third CK and third IK are calculated by UDM according to the core key K of SUPI and AMF. SUPI is obtained by decrypting SUCI.

[0180] Specifically, according to the core key K of SUPI and AMF, a second authentication vector AV is obtained, AV=(RAND, AUTN, XRES, CK(third CK), IK(third IK)), that is, the second authentication vector AV includes third key information, AUTN, RAND and XRES, and the third key information includes a third CK and a third IK.

[0181] Step 303: According to the core key K and the first SES, the third key information is security enhanced to obtain fourth key information, and the fourth key information is used for key derivation.

[0182] The fourth key information includes the fourth CK (CK*) and the fourth IK (IK*). The key length supported by the fourth CK and the fourth IK is at least 256 bits, which can avoid being cracked by quantum computing. CK* and IK* are used for key derivation at subsequent levels.

[0183] Afterwards, the second security key K is obtained based on CK* and IK* AUSF , and, according to CK*, IK*, XRES and RAND, XRES* is obtained, and K AUSF, XRES* and AUTN, RAND in the second authentication vector (i.e., the first authentication information) generate a third authentication vector 5G HE AV, which includes RAND, AUTN, XRES* and K AUSF .

[0184] Step 304: Send the first authentication information to the terminal.

[0185] Specifically, UDM returns the requested 5G HE AV (third authentication vector) to AUSF in the Nudm_UEAuthentication_Get Response message and indicates that 5G HE AV is used for 5G AKA. If Nudm_UEAuthentication_GetRequest contains SUCI, UDM will include SUPI in Nudm_UEAuthentication_Get Response.

[0186] The AUSF shall temporarily save the XRES* in the third authentication vector and the received SUCI or SUPI. The AUSF may save the K in the third authentication vector AUSF .

[0187] AUSF shall generate a 5G AV based on the 5G HE AV received from UDM / ARPF. HXRES* (hash of expected response) is calculated from RAND and XRES*, and K AUSF Derive the anchor key K SEAF Then use HXRES* and K SEAF Replace XRES* and K in 5GHE AV respectively AUSF .

[0188] AUSF should then remove K SEAF , the authentication vector 5G SE AV (RAND, AUTN, HXRES*) is sent to the Secure Anchor Function (SEAF) through the Nausf_UEAuthentication_Authenticate response.

[0189] SEAF shall send RAND and AUTN (i.e., first authentication information) to UE via Non Access Stratum (NAS) message (Auth-Req). The message shall also contain the Authentication Management Field (AMF) used by UE and Authentication Management Field (K) to identify AMFand ngKSI for some native security contexts, the message should also include anti-bidding down between architectures (ABBA) parameters.

[0190] The ME shall forward the RAND and AUTN in the NAS message (Auth-Req) to the USIM.

[0191] After the USIM receives RAND and AUTN, the USIM shall check whether the AUTN is accepted to verify whether the authentication vector is the latest. If the verification is successful (it is the latest), the USIM shall calculate the actual response (user response, RES) and return RES, encryption key (Cipher Key, CK), and integrity protection key (Integrity Key, IK) to the ME.

[0192] Among them, SEAF (Security Anchor Function): The access network implements the authentication of the UE. AUSF (Authentication Server Function): The home network implements the authentication of the UE.

[0193] Through the above steps, the negotiation and indication of security capabilities between the terminal and the network device are achieved.

[0194] Optionally, the method further comprises:

[0195] The first SES is obtained by parsing the SUCI in the registration request, that is, the first SES can be placed in the SUCI, that is, the registration request carries the SUCI, the SUCI includes the first SES, and the UDM parses the first SES from the SUCI to determine whether there is a first SES of 1;

[0196] or,

[0197] The first SES is obtained by parsing the first interface field of the registration request, that is, the first SES can also be carried by adding a new field in the interface of ME->Secure Anchor Function (SEAF)->Authentication Server Function (AUSF)->UDM, that is, the registration request carries the first SES through the first interface field. The registration request is sent by ME to SEAF, by SEAF to AUSF, and then by AUSF to UDM. UDM parses the first SES from the interface to determine whether there is a first SES of 1.

[0198] The first authentication information includes AUTN, and the AMF of the AUTN carries the second SES.

[0199] Specifically, when the network device receives a registration request, the registration request is parsed to obtain a first SES. If the first SES is 1, the second SES is saved in a reserved bit of the AMF of the AV.

[0200] It should be noted that bits 1-7 and 8-15 of AMF are reserved bits, the default value is 0, and a fixed position can be selected to save the second SES.

[0201] If there is no first SES that is 1, the network device does not perform additional processing.

[0202] In the identity submission process between the terminal and the network device, the UDM receives a registration request including the SUCI, and uses a first decryption mechanism to decrypt the SUCI to obtain the SUPI. The first decryption mechanism is a key encapsulation-based decryption mechanism (KEM_DEC), such as the ECIES algorithm.

[0203] KEM_DEC (decryption mechanism based on key encapsulation): input the private key SK and ciphertext C, use KEM technology to decrypt to obtain the temporary symmetric key sk, and then decrypt the ciphertext C to output the plaintext M. The KEM technology here can use traditional public key cryptographic algorithms such as ECC, RSA, and PQC, etc. ECIES decryption is an implementation of KEM_DEC.

[0204] Specifically, the UDM decrypts the SUPI from the SUCI using the KEM_DEC algorithm. The UDM parses the first SES from the SUCI or the interface, determines whether there is a first SES of 1, and if so, generates and saves the second SES, and obtains and saves the symmetric key K_KEM generated in the process of decrypting the SUCI using the first decryption mechanism to obtain the SUPI, that is, the second symmetric key.

[0205] It should be noted that the second symmetric key K_KEM can also be derived through sk: such as K_KEM=KDF(sk, "KEM").

[0206] The second symmetric key is used for key enhancement and expansion in the subsequent authentication process.

[0207] Combine the following Figure 4 , specifically describes the identity submission process between the terminal and the network device provided in the embodiment of the present invention:

[0208] ME uses KEM_ENC to encrypt SUPI to obtain SUCI. If the core key K is 128 bits, the K_KEM (first symmetric key) generated by KEM_ENC is secretly saved, and the first SES bit in SUCI is set to 1;

[0209] When the network side requires the UE to send SUCI for network authentication, the UE sends an Initial Registration Request to the network side.

[0210] UDM receives Nudm_Authenticate_Get Request. If SUCI is received, KEM_DEC should be used to decrypt SUCI to obtain SUPI. If the first SES is 1 in SUCI, K_KEM (the second symmetric key) and SES (ie, the second SES) should be kept secret.

[0211] In the main authentication flow:

[0212] In an optional embodiment, generating the first authentication information and the second key information according to the core key of SUPI and AMF includes:

[0213] According to the length of the core key K, a second cryptographic algorithm of corresponding length is determined, that is, the UDM selects a corresponding second cryptographic algorithm according to the length of the core key K of the current SUPI user, and the second cryptographic algorithm is the MILENAGE-256 algorithm:

[0214] If K is 128 bits, the MILENAGE-128 algorithm is selected;

[0215] If K is 256 bits (or > 128 bits), the MILENAGE-256 algorithm is selected.

[0216] Using the second cryptographic algorithm, according to the core key and the AMF, the first authentication information and the second key information are obtained, that is, using the MILENAGE-256 algorithm or the MILENAGE-128 algorithm, according to the core key K and the AMF, etc., the second authentication vector AV=(RAND, AUTN, XRES, (third CK), IK (third IK)) is calculated, wherein RAND and AUTN are the first authentication information, and CK and IK are the second key information.

[0217] In an optional embodiment, the third key information is security enhanced according to the core key K and the first SES to obtain fourth key information, where the fourth key information is used for key derivation, including:

[0218] Specifically, when the first SES is 1 and the core key K is 128 bits, the third key information is security enhanced to obtain the fourth key information.

[0219] According to the AUTN, the RAND, K AUSFand XRES*, to obtain the third authentication vector, and finally the authentication credential repository and processing function (ARPF) in the UDM or network device should create a RAND, AUTN, XRES* and K AUSF The 5G HE AV (third authentication vector) is sent to the AUSF, so that the AUSF sends the AUTN and RAND in the third authentication vector to the terminal.

[0220] Specifically, UDM returns the requested 5G HE AV (third authentication vector) to AUSF in the Nudm_UEAuthentication_Get Response message and indicates that 5G HE AV is used for 5G AKA. If Nudm_UEAuthentication_GetRequest contains SUCI, UDM will include SUPI in Nudm_UEAuthentication_Get Response.

[0221] AUSF shall temporarily save XRES* and the received SUCI or SUPI. AUSF may save K AUSF .

[0222] AUSF shall generate a 5G AV (Authentication Vector) based on the 5G HE AV received from UDM / ARPF. HXRES* (Hash of Expected Response) is calculated from RAND and XRES*, and K AUSF Derive the anchor key K SEAF Then use HXRES* and K SEAF Replace XRES* and K in 5G HE AV respectively AUSF .

[0223] AUSF should then remove K SEAF , the authentication vector 5G SE AV (RAND, AUTN, HXRES*) is sent to the Secure Anchor Function (SEAF) through the Nausf_UEAuthentication_Authenticate response.

[0224] SEAF shall send RAND and AUTN to UE via Non Access Stratum (NAS) message (Auth-Req). The message shall also contain the Authentication Management Field (AMF) used by UE to identify K AMFand ngKSI for some native security contexts, the message should also include anti-bidding downbetween architectures (ABBA) parameters.

[0225] The ME shall forward the RAND and AUTN in the NAS message (Auth-Req) to the USIM.

[0226] After the USIM receives RAND and AUTN, the USIM shall check whether the AUTN is accepted to verify whether the authentication vector is the latest. If the verification is successful (it is the latest), the USIM shall calculate the actual response (user response, RES) and return RES, encryption key (Cipher Key, CK), and integrity protection key (Integrity Key, IK) to the ME.

[0227] Among them, ARPF: stores the user's contract information, authentication data K, etc.

[0228] Further, the third key information includes a third CK and a third IK; the fourth key information includes a fourth CK and a fourth IK;

[0229] According to the core key and the first SES, the third key information is security enhanced to obtain fourth key information, including:

[0230] According to the length of the first SES and the core key K, the third CK is security enhanced to obtain a fourth CK; and, according to the length of the first SES and the core key K, the third IK is security enhanced to obtain a fourth IK;

[0231] The security enhancement (also referred to as security enhancement processing) includes at least one of the following:

[0232] (1) Security enhancement is performed according to the second symmetric key, as follows:

[0233] CK*=HASH(CK||K_KEM), IK*=HASH(IK||K_KEM)

[0234] Among them, CK is the third CK, CK* is the fourth CK, IK is the third IK, IK* is the fourth IK, and K is the core key;

[0235] (2) Using KDF for security enhancement:

[0236] CK*=KDF(K_KEM,CK), IK*=KDF(K_KEM,IK)

[0237] Among them, CK is the third CK, CK* is the fourth CK, IK is the third IK, IK* is the fourth IK, and K_KEM is the second symmetric key.

[0238] It should be noted that the output of KDF and HASH is at least 256 bits, that is, the key length supported by the fourth CK is at least 256 bits, and the key length supported by the fourth IK is at least 256 bits. CK and K_KEM can be combined in other ways such as series connection and xor, and other shared parameter information can also be added. In this embodiment, the length of the third CK and the third IK is 128 bits, the length of the first symmetric key K_KEM is at least 128 bits, and the KDF mixed calculation obtains 256-bit CK* and IK*.

[0239] It should also be noted that if the core key K is 256 bits (or > 128 bits) or there is no first SES that is 1, no additional processing is performed.

[0240] Afterwards, UDM uses RAND, XRES, CK*, and IK* to derive K through the KDF one-way function. AUSF and XRES*, specifically:

[0241] The second expected response (ie, XRES*) is obtained according to the fourth CK, the fourth IK, the first expected response (XRES), and the RAND, and the second security key K is obtained according to the fourth CK and the fourth IK. AUSF , wherein the first expected response (which can be expressed as a first XRES or XRES) is generated according to the core key and the AMF; the second expected response (which can be expressed as a second XRES or XRES*) is used for communication authentication, and the second security key K AUSF Used for key derivation.

[0242] The first expected response is XRES in the above second authentication vector AV=(RAND, AUTN, XRES, CK(third CK), IK(third IK)).

[0243] Further, according to the first expected response, the RAND, the fourth CK, and the fourth IK, the second expected response is derived using KDF, and the specific formula is as follows:

[0244] XRES*=KDF(CK*xor IK*,RAND,XRES).

[0245] Among them, XRES* is the second expected response, XRES is the first expected response, CK* is the fourth CK, and IK* is the fourth IK.

[0246] The second XRES may also be derived using KDF according to the first XRES, the RAND, the third CK (CK), and the third IK (IK). The specific formula is as follows:

[0247] XRES*=KDF(CK||IK,RAND,XRES)

[0248] Wherein, XRES* is the second expected response, XRES is the first expected response, CK is the third CK, and IK is the third IK;

[0249] The second security key K is obtained according to the fourth CK and the fourth IK AUSF ,include:

[0250] According to the fourth IK (IK*) and the fourth CK (CK*), the second security key K is derived using KDF AUSF , the specific formula is as follows:

[0251] K AUSF =KDF(CK*xor IK*,SN_name,SQN xor AK).

[0252] Among them, SN_name is the serial number of the terminal device, SQN is the serial number used to uniquely identify the terminal device, AK is the authentication key (Access Key), CK* is the fourth CK, and IK* is the fourth IK.

[0253] The second security key K can also be derived using KDF according to the third CK (CK) and the third IK (IK). AUSF , the specific formula is as follows:

[0254] K AUSF =KDF(CK||IK,SN_name,SQN xor AK)

[0255] Among them, SN_name is the serial number of the terminal device, SQN is the serial number used to uniquely identify the terminal device, AK is the authentication key (Access Key), CK is the third CK, and IK is the third IK.

[0256] The key length supported by the fourth CK is at least 256 bits, and the key length supported by the fourth IK is at least 256 bits.

[0257] That is, the ME performs security enhancement processing on the third CK and the third IK based on the shared key (second symmetric key) generated or derived in the decryption of SUCI, and extends the security of each layer of keys to at least 256 bits.

[0258] Combine the following Figure 5, specifically explain the main authentication process:

[0259] UDM parsing obtains that if there is an SES bit of 1 (first SES), then the AMF in AUTN is set (that is, the AMF in the first authentication information is set, which can also be understood as the AMF of AUTN in the first authentication information carries the second SES); the MILENAGE (128 / 256) algorithm is selected according to the length of the core key K; the second authentication vector AV = (RAND, AUTN, XRES, CK, IK) is calculated; if the first SES is 1, CK and IK are security-enhanced and extended based on the second symmetric key K_KEM, CK* = HASH(CK||K_KEM), IK* = HASH(IK||K_KEM); K is derived by calculation AUSF , XRES*, etc.

[0260] Send 5G HE AV containing RAND, AUTN, XRES* and KAUSF to SEAF;

[0261] UDM returns the requested 5G HEAV to AUSF in the Nudm_UEAuthentication_Get Response message and indicates that 5G HEAV is used for 5G AKA. If SUCI is included in the Nudm_UEAuthentication_Get request, UDM will include SUPI in the Nudm_UEAuthentication_Get response;

[0262] AUSF shall temporarily save XRES* and the received SUCI or SUPI. AUSF may save K AUSF .

[0263] AUSF shall generate a 5G AV based on the 5G HE AV received from UDM / ARPF. HXRES* is calculated from RAND and XRES*, and K AUSF Derived K SEAF Then use HXRES* and K SEAF Replace XRES* and K in 5G HE AV respectively AUSF .

[0264] AUSF should then remove K SEAF , send 5G SEAV (RAND, AUTN, HXRES*) to SEAF through Nausf_UEAuthentication_Authenticate response.

[0265] SEAF shall send RAND and AUTN to UE via NAS message (Authentication Request, Auth-Req). The message shall also contain the K AMF and ngKSI for a partial native security context, the message should also include the ABBA parameter.

[0266] The ME shall forward the RAND and AUTN in the NAS message (Auth-Req) to the USIM.

[0267] After the USIM receives RAND and AUTN, it shall check whether AUTN is accepted to verify whether the authentication vector is the latest. If the verification is successful, the USIM shall calculate the response RES and return RES (first RES), CK (first CK), and IK (first IK) to the ME.

[0268] ME shall calculate RES* (second RES) based on RES. ME shall derive K from CK||IK AUSF (First symmetric key).

[0269] Specifically, ME obtains the SES bit (second SES) from the AMF field of AUTN. If SES (second SES) is 1, CK and IK are extended for security enhancement based on K_KEM (first symmetric key), CK*(second CK)=HASH(CK||K_KEM), IK*(first IK)=HASH(IK||K_KEM), and the first security key K is calculated and derived. AUSF , the second RES (RES*), etc.

[0270] The UE shall return RES* to SEAF in the NAS message Authentication Response.

[0271] SEAF shall calculate HRES* based on RAND and RES*, and compare HRES* with HXRES*. If the two values ​​are consistent, SEAF shall consider the authentication successful from the perspective of the service network. If they are inconsistent, SEAF shall consider the authentication failed and indicate the failure to AUSF.

[0272] The SEAF shall send the corresponding SUCI or SUPI from the UE to the AUSF via the Nausf_UEAuthentication_AuthenticateRequest message.

[0273] When receiving a Nausf_UEAuthentication_Authenticate Request message containing a RES*, the AUSF may verify whether the AV has expired. If the AV has expired, the AUSF may consider the authentication unsuccessful from the perspective of the home network. The AUSF shall compare the received RES* with the stored XRES*. If the RES* and XRES* match, the AUSF shall consider the authentication successful from the perspective of the home network.

[0274] The AUSF shall indicate to the SEAF whether the authentication is successful via the Nausf_UEAuthentication_Authenticate Response. If the authentication is successful, the K SEAF If the AUSF receives SUCI from SEAF when starting authentication and the authentication is successful, the AUSF shall also include the SUPI in the Nausf_UEAuthentication_Authenticate Response.

[0275] If the authentication is successful, SEAF shall receive the key K from the Nausf_UEAuthentication_Authenticate Response message. SEAF As the anchor key. SEAF should then SEAF , ABBA parameters and SUPI to derive K AMF and provide ngKSI and K AMF .

[0276] If SUCI is used for this authentication, SEAF shall provide ngKSI and K to AMF only after receiving Nausf_UEAuthentication_Authenticate Response message containing SUPI. AMF ; No communication service will be provided to the UE until the service network learns the SUPI.

[0277] like Figure 6 As shown, an embodiment of the present invention further provides a communication authentication device, the device comprising:

[0278] A first sending module 601 is configured to send a registration request to a network device, where the registration request carries a first security enhancement support bit SES, where the first SES is used to indicate security capabilities supported by the terminal;

[0279] A first receiving module 602 is configured to receive first authentication information sent by the network device, where the first authentication information carries a second SES, and the second SES is used to indicate a security capability supported by the first authentication information;

[0280] The first processing module 603 is used to enhance the security of the first key information according to the second SES to obtain the second key information, where the first key information is obtained according to the core key K and the random number RAND in the first authentication information, and the second key information is used for key derivation.

[0281] Optionally, the device further comprises:

[0282] The first target processing module is configured to generate the first SES when a universal user identity module USIM on the terminal only supports a first cryptographic algorithm.

[0283] Optionally, the registration request carries a hidden user identity SUCI, and the SUCI includes the first SES;

[0284] or,

[0285] The registration request carries the first SES through a first interface field.

[0286] Optionally, the authentication management field AMF of the first authentication information carries the second SES.

[0287] Optionally, the first key information includes a first encryption key CK and a first integrity protection key IK;

[0288] The second key information includes a second CK and a second IK;

[0289] The first processing module 603 includes:

[0290] A first processing unit, configured to perform security enhancement on the first CK according to the second SES to obtain the second CK;

[0291] The second processing unit is configured to perform security enhancement on the first IK according to the second SES to obtain the second IK.

[0292] Optionally, the security enhancement includes at least one of the following:

[0293] Performing security enhancement according to a first symmetric key, wherein the first symmetric key is obtained when the USIM on the terminal only supports a first cryptographic algorithm, the first symmetric key is generated in a process of encrypting a user permanent identity SUPI of the USIM using a first encryption mechanism to obtain a SUCI, and the first encryption mechanism is an encryption mechanism based on key encapsulation;

[0294] The key derivation function KDF is used for security enhancement.

[0295] Optionally, the key length supported by the second CK is at least 256 bits;

[0296] The key length supported by the second IK is at least 256 bits.

[0297] It should be noted that the embodiments of the present invention provide Figure 6 The communication authentication device shown is a device capable of executing the above-mentioned communication authentication method applied to a terminal, and all embodiments of the above-mentioned communication authentication method applied to a terminal are applicable to the device and can achieve the same or similar technical effects.

[0298] like Figure 7 As shown, the present invention is an embodiment and further provides a communication authentication device, the device comprising:

[0299] The second receiving module 701 is configured to receive a registration request sent by a terminal, where the registration request carries a SUCI and a first SES, where the first SES is used to indicate security capabilities supported by the terminal;

[0300] The second processing module 702 is used to generate first authentication information and third key information according to the core key K and AMF, wherein the first authentication information carries a second SES, and the second SES is used to indicate a security capability supported by the first authentication information;

[0301] A third processing module 703 is used to perform security enhancement on the third key information according to the core key K and the first SES to obtain fourth key information, where the fourth key information is used for key derivation;

[0302] The second sending module 704 is configured to send the first authentication information to the terminal.

[0303] Optionally, the device further includes a second target processing module, wherein the second target processing module is configured to:

[0304] Obtaining the first SES by parsing the SUCI;

[0305] or,

[0306] The first SES is obtained by parsing the first interface field of the registration request.

[0307] Optionally, the AMF of the first authentication information carries the second SES.

[0308] Optionally, the second processing module 702 includes:

[0309] A third processing unit, configured to determine a second cryptographic algorithm of corresponding length according to the length of the core key K;

[0310] The fourth processing unit is used to use the second cryptographic algorithm to obtain the first authentication information and the third key information according to the core key K and the AMF.

[0311] Optionally, the third key information includes a third CK and a third IK;

[0312] The fourth key information includes a fourth CK and a fourth IK;

[0313] The third processing module 703 includes:

[0314] a fifth processing unit, configured to perform security enhancement on the third CK according to the length of the first SES and the core key to obtain the fourth CK;

[0315] The sixth processing unit is configured to perform security enhancement on the third IK according to the length of the first SES and the core key to obtain the fourth IK.

[0316] Optionally, the security enhancement includes at least one of the following:

[0317] Performing security enhancement according to a second symmetric key, where the second symmetric key is obtained by decrypting the SUCI in the registration request according to the first SES using a first decryption mechanism, where the first decryption mechanism is a decryption mechanism based on key encapsulation;

[0318] Use KDF for security enhancement.

[0319] Optionally, the key length supported by the fourth CK is at least 256 bits;

[0320] The key length supported by the fourth IK is at least 256 bits.

[0321] It should be noted that the embodiments of the present invention provide Figure 7 The communication authentication device shown is a device capable of executing the above-mentioned communication authentication method applied to a network device. All embodiments of the above-mentioned communication authentication method applied to a network device are applicable to the device and can achieve the same or similar technical effects.

[0322] like Figure 8As shown, an embodiment of the present invention also provides a terminal, including: a processor 801; and a memory 803 connected to the processor 801 through a bus interface 802, the memory 803 is used to store programs and data used by the processor 801 when performing operations, and the processor 801 calls and executes the programs and data stored in the memory 803.

[0323] The transceiver 804 is connected to the bus interface 802 and is used to receive and send data under the control of the processor 801. Specifically, the processor 801 is used to read the program in the memory 803, and the transceiver 804 performs the following process:

[0324] Sending a registration request to a network device, where the registration request carries a first security enhancement support bit SES, where the first SES is used to indicate security capabilities supported by the terminal;

[0325] receiving first authentication information sent by the network device, where the first authentication information carries a second SES, and the second SES is used to indicate a security capability supported by the first authentication information;

[0326] The processor 801 performs the following processes:

[0327] According to the second SES, the first key information is security enhanced to obtain second key information, the first key information is obtained according to the core key K and the random number RAND in the first authentication information, and the second key information is used for key derivation.

[0328] Optionally, the processor 801 is further configured to:

[0329] In a case where a universal subscriber identity module USIM on the terminal only supports a first cryptographic algorithm, the first SES is generated.

[0330] Optionally, the registration request carries a hidden user identity SUCI, and the SUCI includes the first SES;

[0331] or,

[0332] The registration request carries the first SES through a first interface field.

[0333] Optionally, the authentication management field AMF of the first authentication information carries the second SES.

[0334] Optionally, the first key information includes a first encryption key CK and a first integrity protection key IK;

[0335] The second key information includes a second CK and a second IK;

[0336] The processor 801 is used for:

[0337] According to the second SES, security enhancement is performed on the first CK to obtain the second CK;

[0338] According to the second SES, security enhancement is performed on the first IK to obtain the second IK.

[0339] Optionally, the security enhancement includes at least one of the following:

[0340] Performing security enhancement according to a first symmetric key, wherein the first symmetric key is obtained when the USIM on the terminal only supports a first cryptographic algorithm, the first symmetric key is generated in a process of encrypting a user permanent identity SUPI of the USIM using a first encryption mechanism to obtain a SUCI, and the first encryption mechanism is an encryption mechanism based on key encapsulation;

[0341] The key derivation function KDF is used for security enhancement.

[0342] Optionally, the key length supported by the second CK is at least 256 bits;

[0343] The key length supported by the second IK is at least 256 bits.

[0344] Among them, Figure 8 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 801 and memory represented by memory 803. The bus architecture may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides a user interface 805. The transceiver 804 may be a plurality of components, i.e., including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 801 is responsible for managing the bus architecture and general processing, and the memory 803 may store data used by the processor 801 when performing operations.

[0345] like Fig. 9 As shown, an embodiment of the present invention also provides a network device, including: a processor 901; and a memory 903 connected to the processor 901 through a bus interface 902, the memory 903 is used to store programs and data used by the processor 901 when performing operations, and the processor 901 calls and executes the programs and data stored in the memory 903.

[0346] The transceiver 904 is connected to the bus interface 902 and is used to receive and send data under the control of the processor 901. Specifically, the processor 901 is used to read the program in the memory 903, and the transceiver 904 performs the following process:

[0347] receiving a registration request sent by a terminal, where the registration request carries a SUCI and a first SES, where the first SES is used to indicate security capabilities supported by the terminal;

[0348] The processor 901 performs the following processes:

[0349] Generate first authentication information and third key information according to the core key K and AMF, where the first authentication information carries a second SES, and the second SES is used to indicate security capabilities supported by the first authentication information;

[0350] According to the core key K and the first SES, the third key information is security enhanced to obtain fourth key information, where the fourth key information is used for key derivation;

[0351] The transceiver 904 performs the following process:

[0352] The first authentication information is sent to the terminal.

[0353] Optionally, the processor 901 is configured to:

[0354] Obtaining the first SES by parsing the SUCI;

[0355] or,

[0356] The first SES is obtained by parsing the first interface field of the registration request.

[0357] Optionally, the AMF of the first authentication information carries the second SES.

[0358] Optionally, the processor 901 is configured to:

[0359] Determine a second cryptographic algorithm of corresponding length according to the length of the core key K;

[0360] Utilizing the second cryptographic algorithm, according to the core key K and the AMF, the first authentication information and the third key information are obtained.

[0361] Optionally, the third key information includes a third CK and a third IK;

[0362] The fourth key information includes a fourth CK and a fourth IK;

[0363] The processor 901 is specifically configured to:

[0364] According to the length of the first SES and the core key, security enhancement is performed on the third CK to obtain the fourth CK;

[0365] The third IK is security-enhanced according to the length of the first SES and the core key to obtain the fourth IK.

[0366] Optionally, the security enhancement includes at least one of the following:

[0367] Performing security enhancement according to a second symmetric key, where the second symmetric key is obtained by decrypting the SUCI in the registration request according to the first SES using a first decryption mechanism, where the first decryption mechanism is a decryption mechanism based on key encapsulation;

[0368] Use KDF for security enhancement.

[0369] Optionally, the key length supported by the fourth CK is at least 256 bits;

[0370] The key length supported by the fourth IK is at least 256 bits.

[0371] Among them, Fig. 9 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 901 and memory represented by memory 903. The bus architecture may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 904 may be a plurality of components, i.e., including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 901 is responsible for managing the bus architecture and general processing, and the memory 903 may store data used by the processor 901 when performing operations.

[0372] A readable storage medium according to an embodiment of the present invention stores a program or instruction thereon. When the program or instruction is executed by a processor, the steps in the communication authentication method as described above are implemented and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0373] In the embodiment of the present invention, module can be implemented with software so that it can be executed by various types of processors. For example, an executable code module of an identification can include one or more physical or logical blocks of computer instructions, for example, it can be constructed as an object, process or function. Nevertheless, the executable code of the identified module does not need to be physically located together, but can include different instructions stored in different positions, and when these instructions are logically combined together, it constitutes a module and realizes the specified purpose of the module.

[0374] In fact, executable code module can be a single instruction or many instructions, and can even be distributed on a plurality of different code segments, distributed among different programs, and distributed across a plurality of memory devices. Similarly, operating data can be identified in the module, and can be implemented and organized in the data structure of any appropriate type according to any appropriate form. The operating data can be collected as a single data set, or can be distributed in different locations (including on different storage devices), and can only be present on a system or network as an electronic signal at least in part.

[0375] When a module can be implemented by software, considering the level of existing hardware technology, a person skilled in the art can build a corresponding hardware circuit to implement the corresponding function of the module that can be implemented by software without considering the cost. The hardware circuit includes a conventional very large scale integration (VLSI) circuit or gate array and existing semiconductors such as logic chips, transistors, or other discrete components. The module can also be implemented by a programmable hardware device, such as a field programmable gate array, a programmable array logic, a programmable logic device, etc.

[0376] The above exemplary embodiments are described with reference to the accompanying drawings, and many different forms and embodiments are feasible without departing from the spirit and teachings of the present invention. Therefore, the present invention should not be constructed as a limitation of the exemplary embodiments proposed herein. More specifically, these exemplary embodiments are provided so that the present invention will be perfect and complete, and the scope of the present invention will be conveyed to those who are familiar with the technology. In these figures, the component sizes and relative sizes may be exaggerated for clarity. The terms used here are only based on the purpose of describing specific exemplary embodiments and are not intended to be limiting. As used herein, unless the text clearly indicates otherwise, the singular forms "one", "an" and "the" are intended to include these multiple forms. It will be further understood that the terms "including" and / or "comprising" when used in this specification indicate the presence of the features, integers, steps, operations, components and / or components, but do not exclude the presence or increase of one or more other features, integers, steps, operations, components, components and / or their groups. Unless otherwise indicated, when stated, a range of values ​​includes the upper and lower limits of that range and any subranges therebetween.

[0377] A specific embodiment of the present invention further provides a computer program product, including computer instructions, which, when executed by a processor, implement the above Figure 1 or Figure 3 The various processes of the method embodiment shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0378] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A communication authentication method, characterized in that: Applied to a terminal, the method comprises: Sending a registration request to a network device, where the registration request carries a first security enhancement support bit SES, where the first SES is used to indicate security capabilities supported by the terminal; receiving first authentication information sent by the network device, where the first authentication information carries a second SES, and the second SES is used to indicate a security capability supported by the first authentication information; According to the second SES, the first key information is security enhanced to obtain second key information, the first key information is obtained according to the core key K and the random number RAND in the first authentication information, and the second key information is used for key derivation.

2. The method according to claim 1, characterized in that The method further comprises: In a case where a universal subscriber identity module USIM on the terminal only supports a first cryptographic algorithm, the first SES is generated.

3. The method according to claim 1, characterized in that The registration request carries a hidden user identity SUCI, where the SUCI includes the first SES; or, The registration request carries the first SES through a first interface field.

4. The method according to claim 1, characterized in that: The authentication management field AMF of the first authentication information carries the second SES.

5. The method according to claim 1, characterized in that The first key information includes a first encryption key CK and a first integrity protection key IK; The second key information includes a second CK and a second IK; According to the second SES, security enhancement is performed on the first key information to obtain second key information, including: According to the second SES, security enhancement is performed on the first CK to obtain the second CK; According to the second SES, security enhancement is performed on the first IK to obtain the second IK.

6. The method according to claim 1 or 5, characterized in that: The security enhancement includes at least one of the following: Performing security enhancement according to a first symmetric key, wherein the first symmetric key is obtained when the USIM on the terminal only supports a first cryptographic algorithm, the first symmetric key is generated in a process of encrypting a user permanent identity SUPI of the USIM using a first encryption mechanism to obtain a SUCI, and the first encryption mechanism is an encryption mechanism based on key encapsulation; The key derivation function KDF is used for security enhancement.

7. The method according to claim 5, characterized in that The key length supported by the second CK is at least 256 bits; The key length supported by the second IK is at least 256 bits.

8. A communication authentication method, characterized in that: Applied to a network device, the method comprises: receiving a registration request sent by a terminal, where the registration request carries a SUCI and a first SES, where the first SES is used to indicate security capabilities supported by the terminal; Generate first authentication information and third key information according to the core key K and AMF, where the first authentication information carries a second SES, and the second SES is used to indicate security capabilities supported by the first authentication information; According to the core key K and the first SES, the third key information is security enhanced to obtain fourth key information, where the fourth key information is used for key derivation; The first authentication information is sent to the terminal.

9. The method according to claim 8, characterized in that The method further comprises: Obtaining the first SES by parsing the SUCI; or, The first SES is obtained by parsing the first interface field of the registration request.

10. The method according to claim 8, characterized in that The AMF of the first authentication information carries the second SES.

11. The method according to claim 8, characterized in that Generate first authentication information and third key information according to the core key K and AMF, including: Determine a second cryptographic algorithm of corresponding length according to the length of the core key K; Utilizing the second cryptographic algorithm, according to the core key K and the AMF, the first authentication information and the third key information are obtained.

12. The method according to claim 8, characterized in that The third key information includes a third CK and a third IK; The fourth key information includes a fourth CK and a fourth IK; According to the core key K and the first SES, the third key information is security enhanced to obtain fourth key information, including: According to the length of the first SES and the core key, security enhancement is performed on the third CK to obtain the fourth CK; The third IK is security-enhanced according to the length of the first SES and the core key to obtain the fourth IK.

13. The method according to claim 8 or 12, characterized in that: The security enhancement includes at least one of the following: Performing security enhancement according to a second symmetric key, where the second symmetric key is obtained by decrypting the SUCI in the registration request according to the first SES using a first decryption mechanism, where the first decryption mechanism is a decryption mechanism based on key encapsulation; Use KDF for security enhancement.

14. The method according to claim 12, characterized in that The key length supported by the fourth CK is at least 256 bits; The key length supported by the fourth IK is at least 256 bits.

15. A communication authentication device, characterized in that: The device comprises: A first sending module, configured to send a registration request to a network device, wherein the registration request carries a first security enhancement support bit SES, where the first SES is used to indicate security capabilities supported by the terminal; A first receiving module, configured to receive first authentication information sent by the network device, wherein the first authentication information carries a second SES, and the second SES is used to indicate a security capability supported by the first authentication information; The first processing module is used to perform security enhancement on the first key information according to the second SES to obtain the second key information, wherein the first key information is obtained according to the core key K and the random number RAND in the first authentication information, and the second key information is used for key derivation.

16. A communication authentication device, characterized in that: The device comprises: A second receiving module, configured to receive a registration request sent by a terminal, where the registration request carries a SUCI and a first SES, where the first SES is used to indicate a security capability supported by the terminal; A second processing module is used to generate first authentication information and third key information according to the core key K and the AMF, wherein the first authentication information carries a second SES, and the second SES is used to indicate a security capability supported by the first authentication information; A third processing module, configured to perform security enhancement on the third key information according to the core key K and the first SES to obtain fourth key information, wherein the fourth key information is used for key derivation; The second sending module is used to send the first authentication information to the terminal.

17. A terminal, comprising: A transceiver, a processor, a memory, and a program or instruction stored in the memory and executable on the processor; wherein the processor implements the steps of the communication authentication method as described in any one of claims 1 to 7 when executing the program or instruction.

18. A network device comprising: A transceiver, a processor, a memory, and a program or instruction stored in the memory and executable on the processor; wherein the processor implements the steps of the communication authentication method as described in any one of claims 8 to 14 when executing the program or instruction.

19. A readable storage medium having a program or instruction stored thereon, characterized in that: When the program or instruction is executed by a processor, the steps of the communication authentication method according to any one of claims 1 to 7 are implemented, or the steps of the communication authentication method according to any one of claims 8 to 14 are implemented.

20. A computer program product, characterized in that The method comprises computer instructions, which, when executed by a processor, implement the steps in the communication authentication method according to any one of claims 1 to 7, or implement the steps in the communication authentication method according to any one of claims 8 to 14.

Images