Discovery authorization method and device, electronic equipment and storage medium

Abstract

The invention discloses a discovery authorization method and device, electronic equipment and a storage medium, and relates to the technical field of communication. The method comprises the following steps: receiving a first message from a remote terminal; if the currently used target VPLMN is not in the authorized VPLMN list in the first message, sending a discovery authorization request message to an HPLMN DDNMF associated with the remote terminal; receiving a discovery authorization response message sent by the HPLMN DDNMF in response to the fact that the HPLMN DDNMF executes authorization operation of the target VPLMN based on the target VPLMN information and the identity identification information in the discovery authorization request message; wherein the discovery authorization response message comprises a new authorized VPLMN list of the target VPLMN; and sending a second message at least comprising the new authorized VPLMN list to the remote terminal, thereby realizing safer VPLMN DDNMF authorization by using the restricted discovery mode B.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a discovery authorization method, device, electronic device and storage medium. Background Art

[0002] In the 3GPP protocol, the remote UE is generally connected to the network through the UE-to-Network (U2E) relay UE. During its discovery process, only after the Direct Discovery Name Management Function (DDNMF) of the Visited Public Land Mobile Network (VPLMN) authorizes it can send relevant messages in the VPLMN.

[0003] The process of requesting DDNMF authorization of VPLMN generally includes restricted discovery mode A and restricted discovery mode B. In restricted discovery mode A, U2N relay UE performs VPLMN DDNMF authorization as a declarer, while the remote UE, as a monitor, does not need to perform VPLMN DDNMF authorization; in restricted discovery mode B, both U2N relay UE and remote UE need to perform VPLMN DDNMF authorization.

[0004] However, when the VPLMN changes frequently, the U2N relay UE terminal within the coverage of the network after the switch can reapply for VPLMN DDNMF authorization after connecting to the network, while the remote UE that is not within the coverage of the network cannot request authorization from the VPLMN DDNMF. As a result, the more secure restricted discovery mode B cannot be used for VPLMN DDNMF authorization in high-requirement security scenarios (for example, satellite networks), which results in security defects. Summary of the invention

[0005] The present application provides a discovery authorization method, device, electronic device and storage medium, which are used to implement a more secure VPLMN DDNMF authorization using restricted discovery mode B when the network is not covered.

[0006] In a first aspect, the present application provides a discovery authorization method, which is applied to a relay terminal, and the method includes:

[0007] Receiving a first message from a remote terminal; wherein the first message includes an authorized VPLMN list;

[0008] If the currently used target VPLMN is not in the authorized VPLMN list, a discovery authorization request message is sent to the HPLMN DDNMF associated with the remote terminal; wherein the discovery authorization request message includes target VPLMN information and identity information of the remote terminal;

[0009] In response to the HPLMN DDNMF performing the authorization operation of the target VPLMN based on the target VPLMN information and the identity information, receiving a discovery authorization response message sent by the HPLMN DDNMF; wherein the discovery authorization response message includes a new authorized VPLMN list of the target VPLMN;

[0010] A second message including at least the new authorized VPLMN list is sent to the remote terminal.

[0011] In an embodiment of the present application, a first message is received from a remote terminal, the first message including an authorized VPLMN list, and if the target VPLMN currently in use is not in the authorized VPLMN list, a discovery authorization request message including target VPLMN information and identity information of the remote terminal is sent to the HPLMN DDNMF associated with the remote terminal; in response to the HPLMN DDNMF performing an authorization operation of the target VPLMN based on the target VPLMN information and the identity information, a discovery authorization response message sent by the HPLMN DDNMF is received, and a second message including at least a new authorized VPLMN list is sent to the remote terminal, so that even if the remote terminal is out of network coverage, a more secure VPLMN DDNMF authorization can be implemented using restricted discovery mode B.

[0012] In some embodiments, the first message is a message encrypted by the remote terminal using a first discovery security material, and the first discovery security material is obtained from a relay satellite;

[0013] After receiving the first message from the remote terminal, the method further includes:

[0014] The first message is decrypted using the second discovered security material obtained from the relay satellite, and a legality check is performed on the decrypted first message.

[0015] The above method is used to ensure the authenticity and integrity of the message.

[0016] In some embodiments, the first message further includes HPLMN information of the remote terminal, discovery authorization indication information of the relay satellite, and a first relay service code; and the identity information is a subscription hidden identifier of the remote terminal.

[0017] Through the above method, the subsequent relay terminal can identify whether the remote terminal's home network and other information are authorized for relay communication, thereby ensuring that only authorized remote terminals can access the relay satellite, thereby improving the security and reliability of communication.

[0018] In some embodiments, the second message further includes a second RSC to enable the remote terminal to connect to the target VPLMN, and the second message is a message encrypted using the second discovery security material.

[0019] Through the above method, the relay terminal will use the second discovered security material to encrypt the second message containing the second RSC and the new authorized VPLMN list, and then send the encrypted second message to the remote terminal. The purpose is to prevent unauthorized third parties from intercepting and tampering with the message content, and it is also convenient for the remote terminal to perform subsequent network connection operations based on the content in the second message.

[0020] In a second aspect, the present application provides a discovery authorization method, which is applied to the HPLMN DDNMF of a remote terminal, and the method includes:

[0021] Receiving a discovery authorization request message from a relay terminal; wherein the discovery authorization request message includes target VPLMN information of the relay terminal and identity information of the remote terminal;

[0022] Performing an authorization operation on the target VPLMN based on the target VPLMN information and the identity information;

[0023] After the authorization operation is performed, a discovery authorization response message is sent to the relay terminal; wherein the discovery authorization response message includes a new authorized VPLMN list of the target VPLMN.

[0024] In some embodiments, performing the authorization operation of the target VPLMN based on the target VPLMN information and the identity information includes:

[0025] If the remote terminal is verified to be legitimate based on the identity information, an authorization indication request is sent to the target VPLMN DDNMF based on the target VPLMN information, so that the target VPLMN DDNMF authorizes the remote terminal.

[0026] In a third aspect, the present application provides a relay terminal, including:

[0027] A first receiving module, configured to receive a first message from a remote terminal; wherein the first message includes an authorized VPLMN list;

[0028] A first sending module, configured to send a discovery authorization request message to the HPLMN DDNMF associated with the remote terminal if the currently used target VPLMN is not in the authorized VPLMN list; wherein the discovery authorization request message includes target VPLMN information and identity information of the remote terminal;

[0029] a second receiving module, configured to receive a discovery authorization response message sent by the HPLMN DDNMF in response to the HPLMN DDNMF performing an authorization operation of the target VPLMN based on the target VPLMN information and the identity information; wherein the discovery authorization response message includes a new authorized VPLMN list of the target VPLMN;

[0030] The second sending module is used to send a second message at least including the new authorized VPLMN list to the remote terminal.

[0031] In a fourth aspect, the present application provides a HPLMN DDNMF of a remote terminal, including:

[0032] A receiving module, configured to receive a discovery authorization request message from a relay terminal; wherein the discovery authorization request message includes target VPLMN information of the relay terminal and identity information of the remote terminal;

[0033] A processing module, configured to perform an authorization operation of the target VPLMN based on the target VPLMN information and the identity information;

[0034] The sending module is used to send a discovery authorization response message to the relay terminal after executing the authorization operation; wherein the discovery authorization response message includes a new authorized VPLMN list of the target VPLMN.

[0035] In a fifth aspect, the present application provides an electronic device, including:

[0036] Memory, used to store computer programs;

[0037] The processor is used to implement the discovery authorization method of the first aspect or the discovery authorization method of the second aspect when executing the computer program stored in the memory.

[0038] In a sixth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the discovery authorization method of the first aspect or the discovery authorization method of the second aspect is implemented.

[0039] The technical effects that can be achieved in each of the above-mentioned second to sixth aspects and each of the above-mentioned aspects refer to the technical effects that can be achieved in the above-mentioned first aspect or various possible schemes in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A schematic diagram of a scenario applicable to an embodiment of the present application;

[0041] Figure 2 A flowchart of a discovery authorization method provided in an embodiment of the present application;

[0042] Figure 3 A flowchart of another discovery authorization method provided in an embodiment of the present application;

[0043] Figure 4 A signaling interaction diagram of a discovery authorization method provided in an embodiment of the present application;

[0044] Figure 5 A schematic diagram of the structure of a relay terminal provided in an embodiment of the present application;

[0045] Figure 6 A schematic diagram of the structure of a HPLMN DDNMF of a remote terminal provided in an embodiment of the present application;

[0046] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0048] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0049] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0050] In order to facilitate understanding by those skilled in the art, the technical terms involved in the embodiments of the present application are first explained.

[0051] (1) HPLMN refers to the home network of the terminal, that is, the network to which the user subscribes to mobile services.

[0052] (2) VPLMN refers to the external network accessed by the terminal when roaming. When a user leaves the service area of ​​his HPLMN and enters the service area of ​​another network, the network becomes a VPLMN.

[0053] (3) DDNMF refers to a functional entity in the network that is responsible for handling tasks related to device discovery and mobility management.

[0054] The following is a brief introduction to the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In specific implementation, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0055] Figure 1Schematic diagram of an application scenario applicable to the embodiment of the present application. The scenario mainly includes a remote terminal 100, a relay terminal 101, and a relay satellite 102; wherein the remote terminal 100, the relay terminal 101, and the relay satellite 102 can exchange information through a communication network. It should be noted that the number of the above devices can be more. Figure 1 It is described with only one remote terminal, one relay terminal and one relay satellite.

[0056] The remote terminal 100 may refer to a communication device or system located at a remote end, and it may refer to a communication device at the user end, such as a handheld terminal or a vehicle-mounted terminal, etc., which is used to access a mobile satellite communication network for mobile communication. The remote terminal 100 includes, but is not limited to: mobile phones, tablet computers, laptop computers, PDAs, mobile Internet devices (MID), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminal devices in industrial control, wireless terminal devices in unmanned driving, wireless terminal devices in transportation safety, etc.

[0057] The relay terminal 101 can assist the remote terminal 100 in performing mobile communications in the mobile satellite communication network.

[0058] The relay satellite 102 includes but is not limited to a low-orbit satellite, a medium-orbit satellite, a high-orbit satellite, etc., and can provide network services to the remote terminal 100 and the relay terminal 101 respectively.

[0059] In an embodiment of the present application, when the remote terminal 100 is within the network coverage of the relay satellite 102, the remote terminal 100 can, as a discoverer, request to obtain the sending service authorization of the relay satellite 102, thereby obtaining relevant discovery security materials (such as the first discovery security material below), authorized VPLMN list, etc. for storage, and the relay terminal 101 can, as a discoverer, request to obtain the sending service authorization of the relay satellite 102, thereby obtaining relevant discovery security materials (such as the second discovery security material below), authorized VPLMN list, etc. for storage, so that the remote terminal 100 and the relay terminal 101 use restricted discovery mode B to perform discovery authorization authentication.

[0060] It should be noted that the first discovery security material and the second discovery security material should be used in pairs, that is, there is a certain predefined relationship between them, so that the party with the correct discovery security material can successfully decrypt the message sent by the other party.

[0061] When the remote terminal 100 is not within the network coverage of the relay satellite 102, a first message containing a list of authorized VPLMNs may be broadcast to the surroundings; after receiving the first message, the relay terminal 101 may perform operations such as decryption and verification on it, and determine whether the currently used target VPLMN is in the authorized VPLMN list; if so, a second message is sent to the remote terminal 100, so that the remote terminal 100 obtains the corresponding VPLMN DDNMF authorization based on the second message, thereby connecting to the target VPLMN; if not, a discovery authorization request message is sent to the HPLMN DDNMF associated with the remote terminal 100. After the HPLMN DDNMF performs the authorization operation of the target VPLMN, the relay terminal 101 sends a second message containing information related to the target VPLMN to the remote terminal 100, thereby also realizing the use of restricted discovery mode B to obtain VPLMN DDNMF authorization.

[0062] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps as shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiment of the present application. The method may be executed or executed in parallel in the actual processing process or when the device is executed in accordance with the method sequence shown in the embodiment or drawings.

[0063] Figure 2 A flowchart of a discovery authorization method provided in an embodiment of the present application, the process can be performed by a relay terminal (such as Figure 1 The relay terminal 101 shown in FIG. 1 is used to implement VPLMN DDNMF authorization using restricted discovery mode B when the network is not covered. Figure 2 As shown, the process includes the following steps:

[0064] 201: Receive a first message from a remote terminal, where the first message includes an authorized VPLMN list.

[0065] In this step, a first message from a remote terminal is received. The specific process may be: the remote terminal (such as Figure 1 The remote terminal 100 shown in the figure sends a first message to the surrounding in the form of broadcast, and the first message includes an authorized VPLMN list, and the authorized VPLMN list may include information of multiple authorized VPLMNs, such as "operator A", "operator B", etc. These operators are networks that are allowed to be accessed, so users do not need additional authorization procedures when accessing these networks.

[0066] In some embodiments, the first message may also include the HPLMN information and identity information of the remote terminal, the relay satellite (such as Figure 1 The relay satellite 102 shown in the figure has discovery authorization indication information, a first relay service code (RelayService Code, RSC), etc., so that subsequent relay terminals can identify whether the remote terminal's home network and other information are authorized for relay communication, thereby ensuring that only authorized remote terminals can access the relay satellite, thereby improving the security and reliability of communications.

[0067] In some embodiments, the identity information may be a subscription concealed identifier (SUCI) of the remote terminal to ensure that the identity of the remote terminal is verified without leaking sensitive user information. SUCI is an encrypted identity generated by the remote terminal and sent to the network side, which then converts it into a permanent identifier (IMEI-SV) ​​or IMSI for internal use to protect the privacy of the user.

[0068] In some other embodiments, the identity information may also include some international mobile equipment identities, international mobile subscriber identities, etc., so that the HPLMN DDNMF can verify the validity of the request and make corresponding processing.

[0069] In some embodiments, the first message may be a message encrypted by the remote terminal using the first discovery security material, the first discovery security material being transmitted from a relay satellite (such as Figure 1 The remote terminal may obtain the first discovered security material by using the relay satellite 103 shown in the figure; for example, when the remote terminal is within the network coverage of the relay satellite, it may establish a communication connection with the relay satellite in advance to obtain the first discovered security material from the relay satellite and store it; subsequently, the remote terminal may use the obtained first discovered security material to encrypt the message to be sent to form an encrypted first message. This process ensures the security of the message during transmission.

[0070] The first discovery security material may refer to a set of pre-negotiated keys or other data required by the encryption algorithm, which are used to protect the integrity and confidentiality of the first message during transmission. Specifically, the remote terminal uses the first discovery security material to encrypt the first message containing the HPLMN information, identity information, discovery authorization indication information, and the first RSC, and then sends the encrypted first message to the relay terminal, in order to prevent an unauthorized third party from intercepting and tampering with the message content.

[0071] In some embodiments, after receiving the first message from the remote terminal, the relay terminal can use the second discovered security material obtained from the relay satellite to decrypt the encrypted first message, and then perform a legal verification on the decrypted first message to ensure the authenticity and integrity of the message.

[0072] In some embodiments, the first message is subjected to a legal verification, which generally includes but is not limited to verifying whether the source of the first message is reliable, whether the content contained in the first message has been tampered with, etc. The legal verification can be completed by a preset verification algorithm, such as using a digital signature or a hash value comparison, etc. Only when the first message passes the legal verification can the first message be considered valid and the subsequent processing flow can be continued.

[0073] 202: If the currently used target VPLMN is not in the authorized VPLMN list, a discovery authorization request message is sent to the HPLMN DDNMF associated with the remote terminal.

[0074] The discovery authorization request message includes target VPLMN information and identity information of the remote terminal.

[0075] In this step, after receiving the authorized VPLMN list in the first message, the relay terminal first determines whether the currently used target VPLMN is in the authorized VPLMN list; if so, a second message containing a second RSC and related to the target VPLMN is sent to the remote terminal; if not, a discovery authorization request message is sent to the HPLMN DDNMF associated with the remote terminal. The second RSC may be security context information specific to the target VPLMN, which includes keys and other security parameters required for encryption and decryption of communications, to ensure that only remote terminals with the correct second RSC can successfully access the target VPLMN, thereby enhancing security.

[0076] 203: In response to the HPLMN DDNMF performing the authorization operation of the target VPLMN based on the target VPLMN information and the identity information, receiving a discovery authorization response message sent by the HPLMN DDNMF, where the discovery authorization response message includes a new authorized VPLMN list of the target VPLMN.

[0077] In this step, after the HPLMN DDNMF receives the discovery authorization request message, it will perform authorization operations based on the target VPLMN information and the identity information of the remote terminal to ensure that the subsequent remote terminal has the right to access the target VPLMN. Then it will generate a discovery authorization response message and return it to the relay terminal to facilitate the relay terminal to perform subsequent processing procedures.

[0078] 204: Send a second message at least including a new authorized VPLMN list to the remote terminal.

[0079] In this step, the relay terminal receives the discovery authorization response message sent by the HPLMN DDNMF, extracts the new authorized VPLMN list, and packages it into a new second message and sends it to the remote terminal. The second message contains at least the new authorized VPLMN list, and may also contain information such as the second RSC, so that the remote terminal can perform subsequent network connection operations according to the content of the second message.

[0080] In some embodiments, the second message may be a message encrypted using the second discovery security material, and the second discovery security material may refer to a set of pre-negotiated keys or other data required by an encryption algorithm, which are used to protect the integrity and confidentiality of the second message during transmission. Specifically, the relay terminal uses the second discovery security material to encrypt the second message containing the second RSC and the new authorized VPLMN list, and then sends the encrypted second message to the remote terminal, in order to prevent an unauthorized third party from intercepting and tampering with the message content.

[0081] In some embodiments, after receiving the encrypted second message, the remote terminal can use the first discovery security material corresponding to the second discovery security material to decrypt and verify it, and then obtain the new authorization list and the second RSC to establish a secure connection with the target VPLMN.

[0082] In an embodiment of the present application, a first message is received from a remote terminal, the first message including an authorized VPLMN list, and if the target VPLMN currently in use is not in the authorized VPLMN list, a discovery authorization request message including target VPLMN information and identity information of the remote terminal is sent to the HPLMN DDNMF associated with the remote terminal; in response to the HPLMN DDNMF performing an authorization operation of the target VPLMN based on the target VPLMN information and the identity information, a discovery authorization response message sent by the HPLMN DDNMF is received, and a second message including at least a new authorized VPLMN list is sent to the remote terminal, so that even if the remote terminal is out of network coverage, a more secure VPLMN DDNMF authorization can be implemented using restricted discovery mode B.

[0083] Based on the above Figure 2 , Figure 3 The flowchart of another discovery authorization method provided in the embodiment of the present application is applied to the HPLMN DDNMF of the remote terminal. Figure 3 As shown, the process includes the following steps:

[0084] 301: Receive a discovery authorization request message from a relay terminal, where the discovery authorization request message includes target VPLMN information of the relay terminal and identity information of the remote terminal.

[0085] In this step, the target VPLMN information may include information such as the identity of the target VPLMN. The identity information may refer to the above Figure 2 The relevant description in will not be repeated here.

[0086] The discovery authorization request message is sent by the relay terminal after determining that the currently used target VPLMN is no longer in the VPLMN list sent by the remote terminal.

[0087] 302: Perform an authorization operation of the target VPLMN based on the target VPLMN information and the identity information.

[0088] In some embodiments, if the remote terminal is verified to be legitimate based on the identity information, an authorization indication request is sent to the target VPLMN DDNMF based on the target VPLMN information, so that the target VPLMN DDNMF authorizes the remote terminal, for example, by providing a specific configuration file, certificate or other form of authorization credentials to ensure that the subsequent remote terminal can operate normally in the target VPLMN and access corresponding services.

[0089] In other embodiments, if the identity information is consistent with a plurality of pre-stored identity information, the remote terminal is verified.

[0090] In other embodiments, the service quality and availability of the target VPLMN may also be checked based on the VPLMN information.

[0091] 303: After executing the above authorization operation, a discovery authorization response message is sent to the relay terminal, and the discovery authorization response message includes a new authorized VPLMN list of the target VPLMN.

[0092] In this step, after performing the above authorization operation, the HPLMN DDNMF will generate a discovery authorization response message, which includes a new authorized VPLMN list of the target VPLMN, and return it to the relay terminal, so that the relay terminal can send a second message including at least the new authorized VPLMN list and the second RSC to the remote terminal, so that the remote terminal can subsequently connect to the target VPLMN based on the new authorized VPLMN list and the second RSC.

[0093] Through the above Figure 3The manner shown enables a more secure VPLMN DDNMF authorization to be performed using restricted discovery mode B even when the remote terminal is not within the network coverage range.

[0094] Based on the above Figure 2 , Figure 3 Description, Figure 4 A signaling interaction diagram of a discovery authorization method provided in an embodiment of the present application.

[0095] 401: The remote terminal encrypts a first message including an authorized VPLMN list, a first RSC, HPLMN information, SUCI information, and discovery authorization indication information of a relay satellite using a first discovery security material, and sends the encrypted first message to the relay terminal.

[0096] 402: After receiving the first message, the relay terminal uses the second discovered security material to decrypt the first message and performs a legality check on the decrypted first message.

[0097] 403: If it is verified that the first message is valid, determine whether the currently used target VPLMN is in the authorized VPLMN list; if so, proceed to 409; if not, proceed to 404.

[0098] 404: The relay terminal sends a discovery authorization request message including target VPLMN information and the SUCI of the remote terminal to the HPLMN DDNMF associated with the remote terminal.

[0099] 405: The HPLMN DDNMF of the remote terminal performs a legality check on the remote terminal based on the SUCI. If the remote terminal is found to be legal, an authorization indication request is sent to the target VPLMN DDNMF based on the target VPLMN information.

[0100] 406: After receiving the authorization indication request, the target VPLMN DDNMF completes the authorization for the remote terminal and returns an authorization completion message to the HPLMN DDNMF of the remote terminal.

[0101] 407: After receiving the authorization completion message, the HPLMN DDNMF of the remote terminal sends a discovery authorization response message including a new authorized VPLMN list of the target VPLMN to the relay terminal.

[0102] 408: After receiving the discovery authorization response message, the relay terminal uses the second discovery security material to encrypt a second message including the new authorized VPLMN list and the second RSC, and sends the encrypted second message to the remote terminal.

[0103] 409: Send the HPLMN information of the relay terminal and the second RSC to the remote terminal.

[0104] Based on the same inventive concept, an embodiment of the present application also provides a structural diagram of a relay terminal.

[0105] like Figure 5 , which is a schematic diagram of the structure of a relay terminal provided in an embodiment of the present application, the relay terminal includes a first receiving module 501, a first sending module 502, a second receiving module 503, and a second sending module 504.

[0106] The first receiving module 501 is configured to receive a first message from a remote terminal; wherein the first message includes an authorized VPLMN list;

[0107] The first sending module 502 is configured to send a discovery authorization request message to the HPLMN DDNMF associated with the remote terminal if the currently used target VPLMN is not in the authorized VPLMN list; wherein the discovery authorization request message includes target VPLMN information and identity information of the remote terminal;

[0108] The second receiving module 503 is configured to receive a discovery authorization response message sent by the HPLMN DDNMF in response to the HPLMN DDNMF performing the authorization operation of the target VPLMN based on the target VPLMN information and the identity information; wherein the discovery authorization response message includes a new authorized VPLMN list of the target VPLMN;

[0109] The second sending module 504 is configured to send a second message at least including the new authorized VPLMN list to the remote terminal.

[0110] In some embodiments, the first message is a message encrypted by the remote terminal using a first discovery security material, and the first discovery security material is obtained from a relay satellite; the first receiving module 501 is further used to:

[0111] The first message is decrypted using the second discovered security material obtained from the relay satellite, and a legality check is performed on the decrypted first message.

[0112] Based on the same inventive concept, an embodiment of the present application also provides a structural diagram of a HPLMN DDNMF of a remote terminal.

[0113] like Figure 6, which is a schematic diagram of the structure of a HPLMN DDNMF of a remote terminal provided in an embodiment of the present application. The HPLMN DDNMF includes a receiving module 601, a processing module 602, and a sending module 603.

[0114] The receiving module 601 is used to receive a discovery authorization request message from a relay terminal; wherein the discovery authorization request message includes the target VPLMN information of the relay terminal and the identity information of the remote terminal;

[0115] A processing module 602 is configured to perform an authorization operation of the target VPLMN based on the target VPLMN information and the identity information;

[0116] The sending module 603 is used to send a discovery authorization response message to the relay terminal after executing the authorization operation; wherein the discovery authorization response message includes a new authorized VPLMN list of the target VPLMN.

[0117] In some embodiments, the processing module 602 is specifically configured to:

[0118] If the remote terminal is verified to be legitimate based on the identity information, an authorization indication request is sent to the target VPLMN DDNMF based on the target VPLMN information, so that the target VPLMN DDNMF authorizes the remote terminal.

[0119] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps in the above-mentioned method embodiment and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0120] Based on the same inventive concept, an electronic device is also provided in an embodiment of the present application, and the electronic device can implement the functions of the aforementioned relay terminal or the HPLMN DDNMF of the remote terminal, referring to Figure 7 , the electronic device comprises:

[0121] At least one processor 701, and a memory 702 connected to the at least one processor 701. The specific connection medium between the processor 701 and the memory 702 is not limited in the embodiment of the present application. Figure 7 In the example, the processor 701 and the memory 702 are connected via a bus 700. Figure 7 The connections between other components are shown in bold lines, and are not intended to be limiting. The bus 700 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, Figure 7Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 701 can also be called a controller, and there is no limitation on the name.

[0122] In the embodiment of the present application, the memory 702 stores instructions that can be executed by at least one processor 701. The at least one processor 701 can execute the xxxx method discussed above by executing the instructions stored in the memory 702. The processor 701 can implement Figure 5 or Figure 6 The functions of each module in the device shown.

[0123] Among them, the processor 701 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 702 and calling data stored in the memory 702, the various functions of the device and process data, the device can be monitored as a whole.

[0124] In one possible design, the processor 701 may include one or more processing units, and the processor 701 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 701. In some embodiments, the processor 701 and the memory 702 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0125] Processor 701 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the discovery authorization method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0126] The memory 702 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 702 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 702 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 702 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0127] By programming the processor 701, the code corresponding to the xxxx method described in the above embodiment can be fixed into the chip, so that the chip can execute the xxxx method when it is running. Figure 2 or Figure 3 The steps of the discovery authorization method of the illustrated embodiment. How to design and program the processor 701 is a technique well known to those skilled in the art and will not be described in detail here.

[0128] Based on the same inventive concept, an embodiment of the present disclosure provides a computer storage medium, the computer storage medium includes: a computer program code, when the computer program code is executed on a computer, the computer executes any one of the discovery authorization methods discussed above. Since the principle of solving the problem by the above computer storage medium is similar to that of a discovery authorization method, the implementation of the above computer storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0129] In the specific implementation process, the computer storage medium may include: Universal Serial Bus Flash Drive (USB), mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and other storage media that can store program codes.

[0130] Based on the same inventive concept, the embodiment of the present disclosure also provides a computer program product, which includes: computer program code, when the computer program code is run on a computer, the computer executes any one of the discovery authorization methods discussed above. Since the principle of solving the problem by the above computer program product is similar to that of a discovery authorization method, the implementation of the above computer program product can refer to the implementation of the method, and the repeated parts will not be repeated.

[0131] The computer program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more conductors, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0132] The method in the present application can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instruction is loaded and executed on a computer, the process or function described in the present application is executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device, a core network device, an OAM or other programmable device.

[0133] The computer program or instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program or instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired or wireless means. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it may also be an optical medium, such as a digital video disk; it may also be a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0134] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program code.

[0135] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that has the functions specified in one or more boxes.

[0136] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0137] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0138] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A discovery authorization method, applied to a relay terminal, characterized in that: The method comprises: Receiving a first message from a remote terminal; wherein the first message includes an authorized VPLMN list; If the currently used target VPLMN is not in the authorized VPLMN list, a discovery authorization request message is sent to the HPLMNDDNMF associated with the remote terminal; wherein the discovery authorization request message includes target VPLMN information and identity information of the remote terminal; In response to the HPLMN DDNMF performing the authorization operation of the target VPLMN based on the target VPLMN information and the identity information, receiving a discovery authorization response message sent by the HPLMN DDNMF; wherein the discovery authorization response message includes a new authorized VPLMN list of the target VPLMN; A second message including at least the new authorized VPLMN list is sent to the remote terminal.

2. The method according to claim 1, characterized in that The first message is a message encrypted by the remote terminal using a first discovery security material, where the first discovery security material is obtained from a relay satellite; After receiving the first message from the remote terminal, the method further includes: The first message is decrypted using the second discovered security material obtained from the relay satellite, and a legality check is performed on the decrypted first message.

3. The method according to claim 2, characterized in that The first message also includes the HPLMN information of the remote terminal, the discovery authorization indication information of the relay satellite, and the first relay service code RSC; The identity information is a subscription hidden identifier SUCI of the remote terminal.

4. The method according to claim 2 or 3, characterized in that The second message further includes a second RSC so that the remote terminal is connected to the target VPLMN, and the second message is a message encrypted using the second discovery security material.

5. A discovery authorization method, applied to the HPLMN DDNMF of a remote terminal, characterized in that: The method comprises: Receiving a discovery authorization request message from a relay terminal; wherein the discovery authorization request message includes target VPLMN information of the relay terminal and identity information of the remote terminal; Performing an authorization operation on the target VPLMN based on the target VPLMN information and the identity information; After the authorization operation is performed, a discovery authorization response message is sent to the relay terminal; wherein the discovery authorization response message includes a new authorized VPLMN list of the target VPLMN.

6. The method according to claim 5, characterized in that The performing the authorization operation of the target VPLMN based on the target VPLMN information and the identity information includes: If the remote terminal is verified to be legitimate based on the identity information, an authorization indication request is sent to the target VPLMN DDNMF based on the target VPLMN information, so that the target VPLMN DDNMF authorizes the remote terminal.

7. A relay terminal, characterized in that: include: A first receiving module, configured to receive a first message from a remote terminal; wherein the first message includes an authorized VPLMN list; A first sending module, configured to send a discovery authorization request message to the HPLMN DDNMF associated with the remote terminal if the currently used target VPLMN is not in the authorized VPLMN list; wherein the discovery authorization request message includes target VPLMN information and identity information of the remote terminal; a second receiving module, configured to receive a discovery authorization response message sent by the HPLMN DDNMF in response to the HPLMN DDNMF performing an authorization operation of the target VPLMN based on the target VPLMN information and the identity information; wherein the discovery authorization response message includes a new authorized VPLMN list of the target VPLMN; The second sending module is used to send a second message at least including the new authorized VPLMN list to the remote terminal.

8. A HPLMN DDNMF of a remote terminal, characterized in that: include: A receiving module, configured to receive a discovery authorization request message from a relay terminal; wherein the discovery authorization request message includes target VPLMN information of the relay terminal and identity information of the remote terminal; A processing module, configured to perform an authorization operation of the target VPLMN based on the target VPLMN information and the identity information; The sending module is used to send a discovery authorization response message to the relay terminal after executing the authorization operation; wherein the discovery authorization response message includes a new authorized VPLMN list of the target VPLMN.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method according to any one of claims 1 to 4, or implement the method according to claim 5 or 6, when executing the computer program stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented, or the method according to claim 5 or 6 is implemented.

Images