Electronic equipment, wireless communication method and computer readable storage medium

Abstract

The invention relates to electronic equipment, a wireless communication method and a computer readable storage medium. The electronic equipment comprises a processing circuit which is configured to generate updated authentication strategy information used for a network element in an NPN, and the authentication strategy information comprises an authentication strategy used when secondary authentication is carried out on user equipment in the NPN; and sending the updated authentication policy information to a network element in the NPN. According to the electronic equipment, the wireless communication method and the computer readable storage medium disclosed by the invention, the secondary authentication strategy of the NPN network element can be automatically updated, so that the updating process is simplified.

Description

Electronic device, wireless communication method, and computer-readable storage medium Technical Field

[0001] Embodiments of the present disclosure generally relate to the field of wireless communications, and more specifically, to electronic devices, wireless communication methods, and computer-readable storage media. More specifically, the present disclosure relates to an electronic device for managing authentication policies for secondary authentication, an electronic device for a network element in an NPN (Non-Public Network), a wireless communication method performed by the electronic device for managing authentication policies, a wireless communication method performed by a network element in the NPN, and a computer-readable storage medium. Background Art

[0002] In the PNI-NPN (Public Network Integrated NPN, NPN based on the public network) system, the NPN can be connected to the DN (Data Network) through the network slice of the 3GPP network. Here, the DN can be the private network of the enterprise and can include an authentication server DN-AAA (Authentication, Authorization, Accounting). In addition, the UE can be connected to the DN through the network slice of the 3GPP network. In such a wireless communication system, after the 3GPP network performs primary authentication (Primary Authentication) on the UE, the authentication server DN-AAA in the DN is also required to perform secondary authentication (Secondary Authentication) on the UE so that the UE can access the DN through the 3GPP network.

[0003] The secondary authentication policy may not meet current requirements for authentication security or efficiency. In this case, the secondary authentication policy needs to be updated. Existing technologies require manually updating the authentication policy for each NPN element individually. This is a labor-intensive task due to the large number of elements requiring secondary authentication policy updates.

[0004] Therefore, it is necessary to propose a technical solution to automatically update the secondary authentication policy of the network element of the NPN, thereby simplifying the update process.

[0005] Summary of the Invention

[0006] This section provides a general summary of the disclosure, and is not a comprehensive disclosure of its full scope or all of its features.

[0007] The present disclosure aims to provide an electronic device, a wireless communication method, and a computer-readable storage medium to automatically update a secondary authentication policy of a network element of an NPN, thereby simplifying the update process.

[0008] According to one aspect of the present disclosure, an electronic device in an NPN is provided, comprising a processing circuit configured to: generate updated authentication policy information for a network element in the NPN, the authentication policy information comprising an authentication policy used when performing secondary authentication on a user equipment in the NPN; and send the updated authentication policy information to the network element in the NPN.

[0009] According to another aspect of the present disclosure, an electronic device in an NPN is provided, comprising a processing circuit configured to: receive updated authentication policy information for the electronic device generated by an authentication policy management device, the authentication policy information including an authentication policy used when performing secondary authentication on a user device in the NPN; and perform the secondary authentication according to the updated authentication policy information.

[0010] According to another aspect of the present disclosure, a wireless communication method performed by an electronic device in an NPN is provided, including: generating updated authentication policy information for a network element in the NPN, the authentication policy information including an authentication policy used when performing secondary authentication on a user equipment in the NPN; and sending the updated authentication policy information to the network element in the NPN.

[0011] According to another aspect of the present disclosure, a wireless communication method performed by an electronic device in a non-public network (NPN) is provided, comprising: receiving updated authentication policy information for the electronic device generated by an authentication policy management device, the authentication policy information including an authentication policy used when performing secondary authentication on a user device in the NPN; and performing the secondary authentication according to the updated authentication policy information.

[0012] According to another aspect of the present disclosure, a computer-readable storage medium is provided, comprising executable computer instructions, which, when executed by a computer, enable the computer to perform the wireless communication method according to the present disclosure.

[0013] According to another aspect of the present disclosure, a computer program is provided. When the computer program is executed by a computer, the computer is caused to perform the wireless communication method according to the present disclosure.

[0014] Using the electronic device, wireless communication method, and computer-readable storage medium disclosed herein, updated authentication policy information for network elements in an NPN can be generated and sent to the network elements in the NPN. In this way, the network elements in the NPN can use the updated authentication policy information for secondary authentication. Thus, the electronic device disclosed herein can automatically update the secondary authentication policy of network elements in the NPN, thereby simplifying the update process.

[0015] Further areas of applicability will become apparent from the description provided herein.The description and specific examples in this summary are intended for purposes of illustration only and are not intended to limit the scope of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are for illustrative purposes only of selected embodiments and not all possible implementations, and are not intended to limit the scope of the present disclosure. In the drawings:

[0017] FIG1 is a block diagram illustrating an example of a configuration of an electronic device according to an embodiment of the present disclosure;

[0018] 2 is a signaling flow chart illustrating an update process of an authentication policy of an authentication server AAA according to an embodiment of the present disclosure;

[0019] 3 is a signaling flow chart illustrating an update process of an authentication policy of an SMF (Session Management Function) according to an embodiment of the present disclosure;

[0020] 4 is a signaling flow chart illustrating a process of updating an authentication policy of a UE (User Equipment) according to an embodiment of the present disclosure;

[0021] FIG5 is a signaling flow chart illustrating a process of updating an authentication policy of a UE according to another embodiment of the present disclosure;

[0022] 6 is a signaling flow chart illustrating a process of updating an authentication policy of a UE according to another embodiment of the present disclosure;

[0023] 7 is a signaling flow chart illustrating a process of updating an authentication policy of a UE according to another embodiment of the present disclosure;

[0024] 8 is a signaling flow chart illustrating the process of primary authentication and secondary authentication according to an embodiment of the present disclosure;

[0025] 9 is a block diagram illustrating an example of a configuration of an electronic device according to another embodiment of the present disclosure;

[0026] 10 is a flowchart illustrating a wireless communication method performed by an electronic device according to an embodiment of the present disclosure;

[0027] 11 is a flowchart illustrating a wireless communication method performed by an electronic device according to another embodiment of the present disclosure;

[0028] FIG12 is a block diagram illustrating an example of a server that can implement an electronic device according to the present disclosure;

[0029] FIG13 is a block diagram showing an example of a schematic configuration of a smartphone; and

[0030] FIG. 14 is a block diagram showing an example of a schematic configuration of a car navigation device.

[0031] While the present disclosure is susceptible to various modifications and alternative forms, specific embodiments thereof have been shown by way of example in the drawings and are described in detail herein. It should be understood, however, that the description of specific embodiments herein is not intended to limit the disclosure to the particular forms disclosed, but rather, the disclosure is intended to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the disclosure. It should be noted that throughout the several drawings, corresponding reference numerals indicate corresponding parts. DETAILED DESCRIPTION

[0032] Examples of the present disclosure will now be described more fully with reference to the accompanying drawings.The following description is merely exemplary in nature and is not intended to limit the present disclosure, application, or uses.

[0033] Example embodiments are provided so that the present disclosure will be exhaustive and will fully convey its scope to those skilled in the art. Numerous specific details such as examples of specific components, devices, and methods are set forth to provide a detailed understanding of the embodiments of the present disclosure. It will be apparent to those skilled in the art that specific details need not be used and that the example embodiments can be implemented in many different forms, none of which should be construed as limiting the scope of the present disclosure. In some example embodiments, well-known processes, well-known structures, and well-known technologies are not described in detail.

[0034] The description will be in the following order:

[0035] 1. Description of the scene;

[0036] 2. Example configuration of an electronic device for managing authentication policies for secondary authentication;

[0037] 3. Configuration example of electronic equipment used for network elements in NPN;

[0038] 4. Method embodiment;

[0039] 5. Application examples.

[0040] <1. Description of the scene>

[0041] According to the present disclosure, a wireless communication system may include an NPN, which may be hosted by a PLMN (Public Land Mobile Network) or be part of a PLMN. Such an NPN may be referred to as a PNI-NPN. According to the present disclosure, the NPN may be implemented by allocating independent network resources for the NPN on the PLMN through network slicing. For example, the NPN may connect to the DN via a network slice of a 3GPP network. Here, the DN may be an enterprise's private network and may include an authentication server DN-AAA. In other words, the NPN may include the DN and a network slice portion of the 3GPP network. Furthermore, a UE may connect to the DN in the NPN via the network slice portion of the 3GPP network. In such a wireless communication system, after the 3GPP network performs primary authentication on the UE, the authentication server DN-AAA in the DN is required to perform secondary authentication on the UE, enabling the UE to access the DN via the 3GPP network. In the NPN, the UE, the 3GPP network's SMF and UPF (User Plane Function), and the DN-AAA participate in the UE's secondary authentication process. These are all network elements in the NPN, but the UPF is only used to transparently forward messages between the DN and the 3GPP network. The 3GPP network here includes but is not limited to a 5G network or a higher level network that will appear in the future.

[0042] For such a scenario, the present disclosure proposes an electronic device in a wireless communication system, a wireless communication method performed by the electronic device in the wireless communication system, and a computer-readable storage medium to automatically update the secondary authentication policy of the network element of the NPN, thereby simplifying the update process.

[0043] According to an embodiment of the present disclosure, secondary authentication can be based on the EAP (Extensible Authentication Protocol) framework. In secondary authentication based on the EAP framework, the UE acts as the EAP client, the SMF acts as the EAP authenticator, and the DN-AAA acts as the authentication server.

[0044] This disclosure adds a network element (NE) to the NPN to manage secondary authentication policies. This NE, located in the DN, manages the authentication policies of the NEs in the NPN, including updating them. Furthermore, this NE can be separate from the DN's AAA authentication server or integrated into the DN's AAA authentication server. Furthermore, this NE can be implemented as a server.

[0045] Furthermore, in the present disclosure, the network elements in the NPN whose authentication policy is managed may include UE, SMF and DN-AAA, wherein SMF and DN-AAA may also be implemented as servers.

[0046] The server according to the present disclosure may be a tower server, a rack server, or a blade server, and may also be a control module installed on the server.

[0047] The user equipment according to the present disclosure may be a mobile terminal (such as a smartphone, a tablet personal computer (PC), a notebook PC, a portable game terminal, a portable / dongle-type mobile router, and a digital camera) or an in-vehicle terminal (such as a car navigation device). The user equipment may also be implemented as a terminal that performs machine-to-machine (M2M) communication (also known as a machine-type communication (MTC) terminal). In addition, the user equipment may be a wireless communication module (such as an integrated circuit module including a single chip) installed on each of the above-mentioned terminals.

[0048] <2. Configuration Example of Electronic Device for Managing Authentication Policy for Secondary Authentication>

[0049] 1 is a block diagram showing an example of a configuration of an electronic device 100 according to an embodiment of the present disclosure. Here, the electronic device 100 may be a server for managing authentication policies, which may be set separately from the authentication server AAA in the DN or integrated into the authentication server AAA in the DN. In the case where the electronic device 100 is set separately from the authentication server AAA in the DN, the electronic device 100 may be represented as a DN-PCF (Policy Control function), i.e., a PCF in the DN, whose function is similar to that of the PCF in the 3GPP network.

[0050] As shown in FIG. 1 , the electronic device 100 may include a generating unit 110 and a communicating unit 120 .

[0051] Here, each unit of the electronic device 100 may be included in a processing circuit. It should be noted that the electronic device 100 may include either one processing circuit or multiple processing circuits. Furthermore, the processing circuit may include various discrete functional units to perform various functions and / or operations. It should be noted that these functional units may be physical entities or logical entities, and units with different names may be implemented by the same physical entity.

[0052] According to an embodiment of the present disclosure, the generation unit 110 may generate updated authentication policy information for a network element in the NPN. Herein, the authentication policy information may include an authentication policy used when performing secondary authentication on a user equipment in the NPN.

[0053] According to an embodiment of the present disclosure, the electronic device 100 may send the updated authentication policy information generated by the generation unit 110 to the network element in the NPN through the communication unit 120 .

[0054] Thus, according to an embodiment of the present disclosure, the electronic device 100 can generate updated authentication policy information for network elements in the NPN and send the updated authentication policy information to the network elements in the NPN. In this way, the network elements in the NPN can use the updated authentication policy information to perform secondary authentication. Thus, according to the present disclosure, the electronic device 100 can automatically update the secondary authentication policy of the network elements in the NPN, thereby simplifying the update process.

[0055] In the present disclosure, the authentication policy information may include one or more of the following: an authentication protocol, a key generation method, and an authentication parameter.

[0056] Among them, the authentication protocol used for secondary authentication according to the present disclosure may include an EAP-based authentication protocol, including but not limited to EAP-TLS (EAP-Transport Layer Security, based on EAP transport layer security) authentication protocol, EAP-TTLS (EAP-Tunneled Transport Layer Security, based on EAP tunnel transport layer security) authentication protocol, EAP-FAST (EAP-Flexible Authentication via Secure Tunneling, based on EAP flexible authentication through secure tunneling) authentication protocol, EAP-MD5 (EAP-Message Digest 5, based on EAP MD5 message digest algorithm) authentication protocol, EAP-LEAP (EAP-Lightweight Extensible Authentication Protocol, based on EAP lightweight extensible authentication protocol) and EAP-GPSK (EAP-Generalized Pre-Shared Key, based on EAP generalized pre-shared key) authentication protocol. Multiple EAP-based authentication protocols can be pre-configured in the electronic device 100 and the network elements in the NPN, so that the authentication policy information can include identification information of a selected authentication protocol. In this way, after receiving the authentication policy information, the network element in the NPN can determine the corresponding authentication protocol according to the identification information of the authentication protocol.

[0057] Among them, the key generation methods used for secondary authentication according to the present disclosure include, but are not limited to, Argon2, Scrypt, and PBKDF2. Multiple key generation methods can be pre-configured in both the electronic device 100 and the network elements in the NPN, so that the authentication policy information can include identification information of a selected key generation method. Thus, after receiving the authentication policy information, the network element in the NPN can determine the corresponding key generation method based on the identification information of the key generation method.

[0058] The authentication parameters used for secondary authentication according to the present disclosure may include configuration parameters related to the secondary authentication process, including but not limited to the user equipment identifier in the NPN, the certificate used in the EAP protocol, the identifier of the authentication algorithm used, and extended parameters used in the authentication protocol. Authentication policy information may include these authentication parameters. Thus, after receiving the authentication policy information, the network element in the NPN can obtain these authentication parameters.

[0059] According to an embodiment of the present disclosure, the electronic device 100 may also receive an update notification indicating success or failure of authentication policy update from a network element in the NPN through the communication unit 120 .

[0060] According to an embodiment of the present disclosure, the electronic device 100 can send updated authentication policy information using an EAP message. The EAP message includes identification information of the destination device of the EAP message, so that the network element in the NPN can determine whether the EAP message is sent to itself based on the identification information of the destination device of the EAP message.

[0061] According to an embodiment of the present disclosure, the electronic device 100 may also utilize a key derived from a key generated during the secondary authentication process to perform confidentiality protection and / or integrity protection on the updated authentication policy information.

[0062] According to an embodiment of the present disclosure, in the case where the electronic device 100 is set separately from the authentication server AAA in the DN, the electronic device 100 is referred to herein as DN-PCF, that is, the policy control function network element in the DN, which is similar to the PCF network element in the core network. At this time, the network element in the NPN can be the SMF in the core network, the user equipment, or the authentication server AAA of the DN. That is, the electronic device 100 can configure and update the authentication policy in the SMF, the user equipment, or the authentication server AAA of the DN. In the case where the electronic device 100 is integrated in the authentication server AAA in the DN, the network element in the NPN can be the SMF in the core network or the user equipment. That is, the electronic device 100 can configure and update the authentication policy of the SMF or the user equipment.

[0063] According to embodiments of the present disclosure, electronic device 100 may be responsible for managing authentication policies for secondary authentication of network elements in an NPN, including configuring and updating authentication policies. For example, a network administrator of the NPN may configure authentication policies for network elements in the NPN through electronic device 100, thereby automatically configuring and updating authentication policies for network elements in the NPN according to embodiments of the present disclosure. In other words, if electronic device 100 determines that the network administrator has updated the authentication policy configured on electronic device 100, it may generate updated authentication policy information.

[0064] According to an embodiment of the present disclosure, the electronic device 100 can automatically update the authentication policy of each network element one by one. For example, the electronic device 100 first updates the authentication policy of the authentication server AAA of the DN, then updates the authentication policy of the SMF, and finally updates the authentication policy of each user device one by one. In addition, according to an embodiment of the present disclosure, when at least one of the authentication protocol, key generation method and authentication parameters is updated, the electronic device 100 can update the authentication policy of each network element. Here, the electronic device 100 can include only the updated part in the updated authentication policy information, or can include the complete authentication protocol, key generation method and authentication parameters in the updated authentication policy information. Further, the electronic device 100 can carry the updated authentication policy information through the authentication policy container.

[0065] The following describes the authentication policy update process for the authentication server AAA, SMF, and UE in conjunction with Figures 2-7. In Figures 2-7, the DN-PCF can be implemented by the electronic device 100. In Figure 2, the DN-PCF is configured independently of the DN-AAA. In Figures 3-7, the DN-PCF can be configured independently of the DN-AAA or integrated into the DN-AAA.

[0066] Figure 2 is a signaling flow chart illustrating the update process of the authentication policy of the authentication server AAA according to an embodiment of the present disclosure. As shown in Figure 2, in step S201, the DN-PCF determines that its configured authentication policy has been updated, and therefore determines that the authentication policy of the DN-AAA needs to be updated. In step S202, the DN-PCF sends a policy update request (AAA_Policy_Update_Request) to the DN-AAA, which includes the updated authentication policy information of the DN-AAA. Here, after the DN-AAA receives the updated authentication policy information, it can update its stored authentication policy. For example, the new authentication policy can be stored locally together with the previous authentication policy. In other words, various versions of authentication policies can be stored in the DN-AAA. In step S203, after the DN-AAA updates its stored authentication policy, it sends a DN-AAA policy update notification (AAA_Policy_Update_Notify) to the DN-PCF to indicate that the update is successful. In FIG. 2 , in steps S202 and S203 , the message to be sent may be carried by the EAP message, and the key derived from the key generated in the secondary authentication process may be used to perform confidentiality protection and / or integrity protection on the message to be sent.

[0067] Figure 3 is a signaling flow chart illustrating the update process of the authentication policy of the SMF according to an embodiment of the present disclosure. As shown in Figure 3, in step S301, the DN-PCF determines that its configured authentication policy has been updated and the authentication policy of the DN-AAA has been updated, and therefore determines that the authentication policy of the SMF needs to be updated. In step S302, the DN-PCF sends a policy update request (SMF_Policy_Update_Request) to the SMF through the UPF, which includes the updated authentication policy information of the SMF. Here, after the SMF receives the updated authentication policy information, it can update its stored authentication policy. For example, the new authentication policy can be stored locally together with the previous authentication policy. In other words, various versions of authentication policies can be stored in the SMF. In step S303, after the SMF updates its stored authentication policy, it sends an SMF policy update notification (SMF_Policy_Update_Notify) to the DN-PCF through the UPF to indicate that the update is successful. In FIG. 3 , in steps S302 and S303 , the message to be sent may be carried by the EAP message, and the key derived from the key generated in the secondary authentication process may be used to perform confidentiality protection and / or integrity protection on the message to be sent.

[0068] 4-7 are signaling flow charts illustrating a process of updating a UE's authentication policy according to an embodiment of the present disclosure. Here, the DN-PCF may update the authentication policy of each UE in the NPN one by one through the processes shown in FIG4-7.

[0069] As shown in Figure 4, in step S401, the DN-PCF determines that its configured authentication policy has been updated and that the authentication policies of the DN-AAA and SMF have been updated. Therefore, it determines that the UE's authentication policy needs to be updated. In step S402, the DN-PCF sends a UE Policy Update Request (UE_Policy_Update_Request) to the SMF via the UPF, which includes the UE's updated authentication policy information. In step S403, the SMF determines whether the UE's new policy is supported. Specifically, it determines whether the authentication policies stored in the SMF include the UE's new policy. Assuming that the SMF supports the UE's new policy, in step S404, the SMF performs a network-triggered service request, attempting to connect to the UE via a base station in the RAN (Radio Access Network). If the UE is registered with the SMF and the SMF is able to connect to the UE via the base station, in step S405, the SMF forwards the UE Policy Update Request to the UE. After receiving the updated authentication policy information, the UE can update its stored authentication policy. For example, the new authentication policy can replace the old one. That is, only the latest version of the authentication policy is stored in the UE, including the latest version of the authentication protocol, the latest version of the key generation method, and the latest version of the authentication parameters. In step S406, after the UE updates its stored authentication policy, it sends a UE policy update notification (UE_Policy_Update_Notify) to the SMF through the base station device to indicate that the update is successful. In step S407, the SMF forwards the UE policy update notification to the DN-PCF through the UPF. As described above, Figure 4 shows an example of the UE successfully updating the authentication policy. In Figure 4, in steps S402, S405, S406, and S407, the message to be sent can be carried by the EAP message, and the key derived from the key generated during the secondary authentication process can be used to perform confidentiality protection and / or integrity protection on the message to be sent.

[0070] As shown in Figure 5, in step S501, the DN-PCF determines that its configured authentication policy has been updated and that the authentication policies of the DN-AAA and SMF have been updated. Therefore, it determines that the UE's authentication policy needs to be updated. In step S502, the DN-PCF sends a UE Policy Update Request to the SMF via the UPF, which includes the UE's updated authentication policy information. In step S503, the SMF determines whether the UE's new policy is supported, specifically, whether the authentication policy stored in the SMF includes the UE's new policy. Assuming that the SMF does not support the UE's new policy, in step S504, the SMF sends a UE Policy Update Notification to the DN-PCF via the UPF, indicating that the UE policy update failed because the SMF does not support the UE's new policy. As described above, Figure 5 illustrates an example in which the update fails due to the SMF's failure to support the UE's new policy. In steps S502 and S504, the messages to be transmitted can be carried in EAP messages, and confidentiality and / or integrity protection can be provided for the messages using keys derived from the key generated during the secondary authentication process.

[0071] As shown in Figure 6, in step S601, the DN-PCF determines that its configured authentication policy has been updated and that the authentication policies of the DN-AAA and SMF have been updated. Therefore, it determines that the UE's authentication policy needs to be updated. In step S602, the DN-PCF sends a UE Policy Update Request to the SMF via the UPF, which includes the UE's updated authentication policy information. In step S603, the SMF determines whether the UE's new policy is supported, that is, whether the authentication policy stored in the SMF includes the UE's new policy. Assuming that the SMF supports the UE's new policy, in step S604, the SMF performs a network-triggered service request, attempting to connect to the UE via a base station in the RAN (Radio Access Network). Assuming that the UE is not registered with the SMF or cannot be connected to the base station, in step S605, the SMF sends a UE Policy Update Notification to the DN-PCF via the UPF, indicating that the UE policy update failed due to the UE being unregistered or unreachable. As described above, Figure 6 illustrates an example of an update failure caused by a UE being unregistered or unreachable. In FIG. 6 , in steps S602 and S605 , the message to be sent may be carried by the EAP message, and the key derived from the key generated in the secondary authentication process may be used to perform confidentiality protection and / or integrity protection on the message to be sent.

[0072] As shown in Figure 7, in step S701, the DN-PCF determines that its configured authentication policy has been updated and that the authentication policies of the DN-AAA and SMF have been updated. Therefore, it determines that the UE's authentication policy needs to be updated. In step S702, the DN-PCF sends a UE policy update request to the SMF via the UPF, including the UE's updated authentication policy information. In step S703, the SMF determines whether the UE's new policy is supported. Specifically, it determines whether the authentication policy stored in the SMF includes the UE's new policy. Assuming that the SMF supports the UE's new policy, in step S704, the SMF performs a network-triggered service request, attempting to connect to the UE via a base station in the RAN. If the UE is registered with the SMF and the SMF is able to connect to the UE via the base station, in step S705, the SMF forwards the UE policy update request to the UE. The SMF may set a timer. If no policy update notification is received from the UE after the timer expires, the SMF may re-forward the UE policy update request to the UE via the base station in step S706. Here, the SMF can reasonably design the number of times the policy update request is retransmitted, and this disclosure does not limit this. Optionally, in step S706, the SMF can also send a UE policy update notification to the DN-PCF through the UPF, indicating that the UE policy update failed because the policy update notification was not received from the UE within the predetermined time. As described above, Figure 7 shows an example of an update failure caused by not receiving a policy update notification from the UE within the predetermined time. In Figure 7, in steps S702, S705, and S706, the message to be sent can be carried by the EAP message, and the key derived from the key generated during the secondary authentication process can be used to protect the confidentiality and / or integrity of the message to be sent.

[0073] As described above, according to an embodiment of the present disclosure, when the electronic device 100 determines that its configured authentication policy has been updated, it can automatically update the authentication policies of the DN-AAA (when the electronic device 100 is integrated in the DN-AAA, there is no need to update the authentication policy of the DN-AAA), SMF, and UE one by one. After the entire NPN has updated the authentication policy, there may be some unregistered or unreachable UEs that have not successfully updated the authentication policy. Therefore, according to an embodiment of the present disclosure, during the process of performing secondary authentication on the UE, the electronic device 100 can again determine whether the UE's authentication policy needs to be updated.

[0074] According to an embodiment of the present disclosure, as shown in FIG1 , the electronic device 100 may further include a determining unit 130 for determining whether the authentication policy of the user equipment needs to be updated according to the authentication policy currently configured for the user equipment during the secondary authentication process.

[0075] According to an embodiment of the present disclosure, during secondary authentication, the electronic device 100 may obtain the currently configured authentication policy of the user device through the communication unit 120. For example, if the electronic device 100 is separate from the DN-AAA, the electronic device 100 may obtain the currently configured authentication policy of the user device from the DN-AAA; if the electronic device 100 is integrated into the DN-AAA, the electronic device 100 may obtain the currently configured authentication policy of the user device from the SMF through the UPF. Furthermore, the determination unit 130 may determine whether the currently configured authentication policy of the user device is the latest version of the authentication policy, i.e., whether it is the authentication policy that the electronic device 100 configured for the user device in the NPN during the most recent update. If the currently configured authentication policy of the user device is not the latest version, the determination unit 130 may determine that the authentication policy of the user device needs to be updated. Furthermore, if the determination unit 130 determines that the authentication policy of the user device needs to be updated, the electronic device 100 may update the authentication policy of the user device in the manner described above.

[0076] Figure 8 is a signaling flow chart illustrating the primary and secondary authentication processes according to an embodiment of the present disclosure. In Figure 8 , the DN-PCF can be implemented by the electronic device 100. The AMF (Authentication Management Function), V-SMF (Virtual-SMF, i.e., the roaming SMF), H-SMF (Home-SMF), and H-UPF (Home-UPF) are all network elements in the core network. As shown in Figure 8 , in step S801, the primary authentication process is performed between the UE and the core network. In step S802, the H-SMF initiates the secondary authentication process. In step S803, the H-SMF sends an EAP request to the UE, requesting the UE's identification information in the NPN and the UE's currently configured authentication policy. In step S804, the UE sends an EAP response to the H-SMF, which includes the UE's currently configured authentication policy and may also include the UE's identification information in the NPN. In step S805, the H-SMF and H-UPF establish a session. In steps S806 and S807, the H-SMF forwards the UE's EAP response to the DN-AAA via the H-UPF. In step S808, the DN-AAA performs secondary authentication on the UE based on the UE's currently configured authentication policy. In steps S809 and S810, the DN-AAA sends a message to the H-SMF via the H-UPF confirming the success of the secondary authentication process. In step S811, the H-SMF determines that the secondary authentication process is complete. In step S812, a session is established between the UE and the H-UPF. After the DN-AAA receives the EAP response from the UE, it can forward the UE's currently configured authentication policy to the DN-PCF at an appropriate time. As shown in Figure 8, in step S821, the DN-AAA forwards the UE's currently configured authentication policy to the DN-PCF. In step S822, the DN-PCF determines whether the UE's currently configured authentication policy is the latest version, thereby determining whether the UE's authentication policy needs to be updated. Assuming that the DN-PCF determines that the UE's authentication policy needs to be updated, the UE's authentication policy may be updated according to the methods described above in this disclosure, for example, with reference to the processes shown in Figures 4 to 7. Here, the process of updating the UE's authentication policy may be performed when the UE is relatively idle, for example, after a session is established between the UE and the H-UPF.

[0077] It is worth noting that Figure 8 shows a signaling flow chart of the primary and secondary authentication processes according to an embodiment of the present disclosure when the DN-PCF and DN-AAA are separately configured. When the DN-PCF is integrated into the DN-AAA, step S821 does not need to be performed, and the DN-AAA can perform step S822 at an appropriate time.

[0078] Thus, according to the embodiments of the present disclosure, when the electronic device 100 determines that its configured authentication policy has been updated, it can automatically update the authentication policy of each network element one by one. Furthermore, after the entire NPN has updated its authentication policy, some unregistered or unreachable UEs may not have successfully updated their authentication policy. Therefore, during the secondary authentication process for the UE, the electronic device 100 can again determine whether the UE's authentication policy needs to be updated. In short, according to the present disclosure, the electronic device 100 can automatically update the secondary authentication policy of the network elements of the NPN, thereby simplifying the update process.

[0079] <3. Configuration Example of Electronic Devices Used as Network Elements in NPN>

[0080] Figure 9 is a block diagram showing the structure of an electronic device 900 in a wireless communication system according to an embodiment of the present disclosure. Here, the electronic device 900 can be a network element in the NPN that needs to update the authentication policy, such as an SMF, a user device, or an authentication server AAA of the DN. Specifically, when the electronic device 100 is set separately from the authentication server AAA in the DN, the electronic device 900 can be an SMF, a user device, or an authentication server AAA of the DN; when the electronic device 100 is integrated into the authentication server AAA in the DN, the electronic device 900 can be an SMF or a user device.

[0081] As shown in FIG. 9 , the electronic device 900 may include a communication unit 910 and an authentication unit 920 .

[0082] Here, each unit of electronic device 900 may be included in a processing circuit. It should be noted that electronic device 900 may include either one processing circuit or multiple processing circuits. Furthermore, the processing circuit may include various discrete functional units to perform various functions and / or operations. It should be noted that these functional units may be physical entities or logical entities, and units with different names may be implemented by the same physical entity.

[0083] According to an embodiment of the present disclosure, electronic device 900 may receive updated authentication policy information generated by an authentication policy management device for electronic device 900 via communication unit 910. The authentication policy information includes an authentication policy used when performing secondary authentication on a user device in an NPN. The authentication policy management device may be electronic device 100 as described above.

[0084] According to an embodiment of the present disclosure, the authentication unit 920 may perform secondary authentication according to the updated authentication policy information.

[0085] As described above, according to an embodiment of the present disclosure, the electronic device 900 can receive updated authentication policy information from the authentication policy management device and use the updated authentication policy information to perform secondary authentication. Thus, according to the present disclosure, the electronic device 900 can automatically update the secondary authentication policy under the control of the authentication policy management device, thereby simplifying the update process.

[0086] According to an embodiment of the present disclosure, the authentication policy information includes one or more of the following: an authentication protocol, a key generation method, and an authentication parameter.

[0087] According to an embodiment of the present disclosure, as shown in Figure 9, the electronic device 900 may include an updating unit 930 for updating the authentication policy stored in the electronic device 900 according to the received updated authentication policy information. Specifically, in the case where the electronic device 900 is a DN-AAA or SMF, the updating unit 930 may store the new authentication policy included in the updated authentication policy information together with the previous authentication policy locally. That is, various versions of authentication policies may be stored in the DN-AAA or SMF. In the case where the electronic device 900 is a UE, the updating unit 930 may replace the old authentication policy with the new authentication policy. That is, only the latest version of the authentication policy is stored in the UE, including the latest version of the authentication protocol, the latest version of the key generation method, and the latest version of the authentication parameters.

[0088] According to an embodiment of the present disclosure, as shown in FIG9 , the electronic device 900 may further include a generation unit 940 for generating an update notification indicating that the update is successful when the authentication policy update is successful, and generating an update notification indicating that the update fails when the authentication policy update fails. In addition, when the electronic device 900 is an SMF, the generation unit 940 may further generate an update notification indicating that the new policy of the UE is not supported, generate an update notification indicating that the UE is not registered or unreachable, and generate an update notification indicating that the update notification from the UE has not been received within a predetermined time. Further, the electronic device 900 may send the update notification to the authentication policy management device via the communication unit 910.

[0089] According to an embodiment of the present disclosure, the electronic device 900 may send an update notification using an EAP message, where the EAP message includes identification information of a destination device.

[0090] According to an embodiment of the present disclosure, the electronic device 900 may utilize a key derived from a key generated during the secondary authentication process to perform confidentiality protection and / or integrity protection on the update notification.

[0091] According to an embodiment of the present disclosure, when the electronic device 900 is an SMF, the electronic device 900 may receive updated authentication policy information for the user device generated by the authentication policy management device through the communication unit 910. Furthermore, as shown in FIG9 , the electronic device 900 may further include a determination unit 950 for determining whether to forward the updated authentication policy information to the user device.

[0092] According to an embodiment of the present disclosure, when the electronic device 900 supports the updated authentication policy of the user device, that is, when the authentication policy configured by the electronic device 900 includes the authentication policy in the updated authentication policy information for the user device, the determination unit 950 can determine to forward the updated authentication policy information to the user device.

[0093] According to an embodiment of the present disclosure, as shown in FIG9 , the electronic device 900 may further include a timing unit 960 configured to start timing after forwarding the updated authentication policy information to the user device. Furthermore, if an update notification indicating a successful authentication policy update is not received from the user device within a predetermined time period, the electronic device 900 may re-forward the updated authentication policy information to the user device. Alternatively, the electronic device 900 may also directly send an update notification indicating a failed authentication policy update to the authentication policy management device.

[0094] As described above, according to the embodiments of the present disclosure, the DN-AAA, SMF, and UE can update the authentication policy under the control of the authentication policy management device.

[0095] According to an embodiment of the present disclosure, when the electronic device 900 is a user device, during the secondary authentication process, in response to the request information from the SMF, the generation unit 940 can generate EAP response information, which includes the authentication policy currently configured for the user device, so that the electronic device 900 can send the EAP response information to the SMF via the communication unit 910. Optionally, the EAP response information can also include identification information of the user device in the NPN.

[0096] As described above, during the secondary authentication process, the electronic device 900 can send its currently configured authentication policy to the SMF, so that the authentication policy management device can determine whether to update the authentication policy of the electronic device 900 based on the currently configured authentication policy of the electronic device 900.

[0097] <4. Method Example>

[0098] Next, a wireless communication method performed by the electronic device 100 in the wireless communication system according to an embodiment of the present disclosure will be described in detail.

[0099] FIG10 is a flowchart illustrating a wireless communication method performed by the electronic device 100 in the wireless communication system according to an embodiment of the present disclosure.

[0100] As shown in FIG. 10 , in step S1010 , updated authentication policy information for a network element in the NPN is generated. The authentication policy information includes an authentication policy used when performing secondary authentication on a user equipment in the NPN.

[0101] Next, in step S1020, the updated authentication policy information is sent to the network elements in the NPN.

[0102] Preferably, the authentication policy information includes one or more of the following: authentication protocol, key generation method and authentication parameters.

[0103] Preferably, the wireless communication method further comprises: receiving an update notification indicating success or failure of the authentication policy update from a network element in the NPN.

[0104] Preferably, sending the updated authentication policy information includes: sending the updated authentication policy information using an Extensible Authentication Protocol (EAP) message.

[0105] Preferably, sending the updated authentication policy information includes: using a key derived from a key generated during the secondary authentication process to protect the confidentiality of the updated authentication policy information.

[0106] Preferably, the network elements in the NPN include SMF, user equipment and an authentication server AAA of the external data network DN.

[0107] Preferably, the wireless communication method further comprises: generating updated authentication policy information when it is determined that the authentication policy configured for the electronic device is updated.

[0108] Preferably, the network element in the NPN includes a user equipment, and the wireless communication method further comprises: determining whether the authentication policy of the user equipment needs to be updated according to the authentication policy currently configured for the user equipment.

[0109] Preferably, the wireless communication method further includes: obtaining the authentication policy currently configured for the user equipment during the secondary authentication process; and determining that the authentication policy of the user equipment needs to be updated if the authentication policy currently configured for the user equipment is not the latest version.

[0110] Preferably, the electronic device is located in an authentication server AAA of the external data network DN.

[0111] According to an embodiment of the present disclosure, the subject that executes the above method may be the electronic device 100 according to an embodiment of the present disclosure, and therefore all the embodiments regarding the electronic device 100 in the foregoing text are applicable hereto.

[0112] Next, a wireless communication method performed by the electronic device 900 in the wireless communication system according to an embodiment of the present disclosure will be described in detail.

[0113] FIG11 is a flowchart illustrating a wireless communication method performed by an electronic device 900 in a wireless communication system according to an embodiment of the present disclosure.

[0114] As shown in FIG. 11 , in step S1110 , updated authentication policy information generated by an authentication policy management device and used for the electronic device 900 is received. The authentication policy information includes an authentication policy used when performing secondary authentication on a user device in the NPN.

[0115] Next, in step S1120, secondary authentication is performed according to the updated authentication policy information.

[0116] Preferably, the authentication policy information includes one or more of the following: authentication protocol, key generation method and authentication parameters.

[0117] Preferably, the wireless communication method further comprises: sending an update notification indicating whether the authentication policy update is successful or failed.

[0118] Preferably, sending the update notification includes: sending the update notification using an Extensible Authentication Protocol (EAP) message.

[0119] Preferably, sending the update notification includes: using a key derived from a key generated during the secondary authentication process to protect the confidentiality of the update notification.

[0120] Preferably, the electronic device 900 is an SMF, a user device or an authentication server AAA of an external data network DN.

[0121] Preferably, when the electronic device 900 is an SMF, the wireless communication method further includes: receiving updated authentication policy information for the user equipment generated by the authentication policy management device; and determining whether to forward the updated authentication policy information to the user equipment.

[0122] Preferably, determining whether to forward the updated authentication policy information to the user equipment includes: forwarding the updated authentication policy information to the user equipment when the authentication policy configured on the electronic device 900 includes the authentication policy in the updated authentication policy information for the user equipment.

[0123] Preferably, the wireless communication method further includes: if no update notification indicating successful authentication policy update is received from the user device within a predetermined time, re-forwarding the updated authentication policy information to the user device, or sending an update notification indicating failed authentication policy update to the authentication policy management device.

[0124] Preferably, in the case where the electronic device 900 is a user equipment, the wireless communication method further comprises: sending the authentication policy currently configured for the user equipment to the SMF in response to the request information from the SMF.

[0125] According to an embodiment of the present disclosure, the subject that executes the above method may be the electronic device 900 according to an embodiment of the present disclosure, and therefore all the embodiments regarding the electronic device 900 in the foregoing text are applicable hereto.

[0126] <5. Application Examples>

[0127] The technology of the present disclosure can be applied to various products.

[0128] For example, the electronic device 100, the electronic device 900 as an SMF, and the electronic device 900 as a DN-AAA can be implemented as any type of server, such as a tower server, a rack server, and a blade server. The electronic device 100, the electronic device 900 as an SMF, and the electronic device 900 as a DN-AAA can be a control module installed on the server (such as an integrated circuit module including a single chip, and a card or blade inserted into a slot of a blade server).

[0129] The electronic device 900 as a user device can be implemented as a mobile terminal (such as a smartphone, a tablet personal computer (PC), a notebook PC, a portable game terminal, a portable / dongle-type mobile router, and a digital camera) or an in-vehicle terminal (such as a car navigation device). The user device can also be implemented as a terminal that performs machine-to-machine (M2M) communication (also known as a machine-type communication (MTC) terminal). In addition, the user device can be a wireless communication module (such as an integrated circuit module including a single chip) installed in each of the user devices described above.

[0130] <About server application examples>

[0131] 12 is a block diagram illustrating an example of a server 1200 that can implement the electronic device 100, the electronic device 900 as an SMF, and the electronic device 900 as a DN-AAA according to the present disclosure. The server 1200 includes a processor 1201, a memory 1202, a storage device 1203, a network interface 1204, and a bus 1206.

[0132] The processor 1201 may be, for example, a central processing unit (CPU) or a digital signal processor (DSP), and controls the functions of the server 1200. The memory 1202 includes a random access memory (RAM) and a read-only memory (ROM), and stores data and programs executed by the processor 1201. The storage device 1203 may include a storage medium such as a semiconductor memory and a hard disk.

[0133] The network interface 1204 is a wired communication interface for connecting the server 1200 to the wired communication network 1205. The wired communication network 1205 may be a core network such as an evolved packet core (EPC) or a packet data network (PDN) such as the Internet.

[0134] The bus 1206 connects the processor 1201, the memory 1202, the storage device 1203, and the network interface 1204 to each other. The bus 1206 may include two or more buses each having a different speed (such as a high-speed bus and a low-speed bus).

[0135] In the server 1200 shown in FIG12 , the generation unit 110 and determination unit 130 described in FIG1 , the authentication unit 910, the update unit 930, the generation unit 940, the determination unit 950, and the timing unit 960 described in FIG9 can be implemented by the processor 1201, and the communication unit 120 described in FIG1 and the communication unit 910 described in FIG9 can be implemented by the network interface 1204. For example, the processor 1201 can execute instructions stored in the memory 1202 or the storage device 1203 to perform functions such as generating updated authentication policy information, determining whether to update the authentication policy of the user equipment, performing secondary authentication, updating the authentication policy, generating an update notification, determining whether to forward the updated authentication policy to the user equipment, and performing timing.

[0136] <Application examples for terminal devices>

[0137] (First application example)

[0138] 13 is a block diagram showing an example of a schematic configuration of a smartphone 1300 to which the technology of the present disclosure can be applied. The smartphone 1300 includes a processor 1301, a memory 1302, a storage device 1303, an external connection interface 1304, a camera 1306, a sensor 1307, a microphone 1308, an input device 1309, a display device 1310, a speaker 1311, a wireless communication interface 1312, one or more antenna switches 1315, one or more antennas 1316, a bus 1317, a battery 1318, and an auxiliary controller 1319.

[0139] The processor 1301 may be, for example, a CPU or a system on a chip (SoC), and controls the functions of the application layer and other layers of the smartphone 1300. The memory 1302 includes RAM and ROM, and stores data and programs executed by the processor 1301. The storage device 1303 may include storage media such as semiconductor memories and hard disks. The external connection interface 1304 is an interface for connecting external devices (such as memory cards and universal serial bus (USB) devices) to the smartphone 1300.

[0140] The camera 1306 includes an image sensor (such as a charge coupled device (CCD) and a complementary metal oxide semiconductor (CMOS)) and generates a captured image. The sensor 1307 may include a group of sensors such as a measurement sensor, a gyroscope sensor, a geomagnetic sensor, and an acceleration sensor. The microphone 1308 converts the sound input to the smartphone 1300 into an audio signal. The input device 1309 includes, for example, a touch sensor configured to detect a touch on the screen of the display device 1310, a keypad, a keyboard, a button, or a switch, and receives an operation or information input from the user. The display device 1310 includes a screen (such as a liquid crystal display (LCD) and an organic light emitting diode (OLED) display) and displays the output image of the smartphone 1300. The speaker 1311 converts the audio signal output from the smartphone 1300 into sound.

[0141] The wireless communication interface 1312 supports any cellular communication scheme (such as LTE and LTE-Advanced) and performs wireless communications. The wireless communication interface 1312 may generally include, for example, a BB processor 1313 and an RF circuit 1314. The BB processor 1313 may perform, for example, encoding / decoding, modulation / demodulation, and multiplexing / demultiplexing, and perform various types of signal processing for wireless communication. Meanwhile, the RF circuit 1314 may include, for example, a mixer, a filter, and an amplifier, and transmit and receive wireless signals via an antenna 1316. The wireless communication interface 1312 may be a chip module on which the BB processor 1313 and the RF circuit 1314 are integrated. As shown in FIG13 , the wireless communication interface 1312 may include multiple BB processors 1313 and multiple RF circuits 1314. Although FIG13 shows an example in which the wireless communication interface 1312 includes multiple BB processors 1313 and multiple RF circuits 1314, the wireless communication interface 1312 may also include a single BB processor 1313 or a single RF circuit 1314.

[0142] In addition, in addition to the cellular communication scheme, the wireless communication interface 1312 can support other types of wireless communication schemes, such as a short-range wireless communication scheme, a near-field communication scheme, and a wireless local area network (LAN) scheme. In this case, the wireless communication interface 1312 may include a BB processor 1313 and an RF circuit 1314 for each wireless communication scheme.

[0143] Each of the antenna switches 1315 switches a connection destination of the antenna 1316 between a plurality of circuits (eg, circuits for different wireless communication schemes) included in the wireless communication interface 1312 .

[0144] Each of the antennas 1316 includes a single or multiple antenna elements (such as multiple antenna elements included in a MIMO antenna) and is used for transmitting and receiving wireless signals via the wireless communication interface 1312. As shown in FIG13 , the smartphone 1300 may include multiple antennas 1316. Although FIG13 shows an example in which the smartphone 1300 includes multiple antennas 1316, the smartphone 1300 may also include a single antenna 1316.

[0145] In addition, the smartphone 1300 may include an antenna 1316 for each wireless communication scheme. In this case, the antenna switch 1315 may be omitted from the configuration of the smartphone 1300.

[0146] The bus 1317 connects the processor 1301, the memory 1302, the storage device 1303, the external connection interface 1304, the camera 1306, the sensor 1307, the microphone 1308, the input device 1309, the display device 1310, the speaker 1311, the wireless communication interface 1312, and the auxiliary controller 1319. The battery 1318 supplies power to the various blocks of the smartphone 1300 shown in FIG13 via feeders, which are partially shown as dashed lines in the figure. The auxiliary controller 1319 operates the minimum necessary functions of the smartphone 1300, for example, in sleep mode.

[0147] In the smartphone 1300 shown in FIG13 , the authentication unit 920, update unit 930, and generation unit 940 described in FIG9 can be implemented by the processor 1301 or the auxiliary controller 1319. At least a portion of the functionality can also be implemented by the processor 1301 or the auxiliary controller 1319. For example, the processor 1301 or the auxiliary controller 1319 can execute instructions stored in the memory 1302 or the storage device 1303 to perform secondary authentication, update authentication policies, and generate update notifications.

[0148] (Second application example)

[0149] 14 is a block diagram showing an example of a schematic configuration of a car navigation device 1420 to which the technology of the present disclosure can be applied. The car navigation device 1420 includes a processor 1421, a memory 1422, a global positioning system (GPS) module 1424, a sensor 1425, a data interface 1426, a content player 1427, a storage medium interface 1428, an input device 1429, a display device 1430, a speaker 1431, a wireless communication interface 1433, one or more antenna switches 1436, one or more antennas 1437, and a battery 1438.

[0150] The processor 1421 may be, for example, a CPU or an SoC, and controls a navigation function and other functions of the car navigation device 1420. The memory 1422 includes a RAM and a ROM, and stores data and programs executed by the processor 1421.

[0151] The GPS module 1424 uses GPS signals received from GPS satellites to measure the position (such as latitude, longitude, and altitude) of the car navigation device 1420. The sensor 1425 may include a group of sensors such as a gyroscope sensor, a geomagnetic sensor, and an air pressure sensor. The data interface 1426 is connected to, for example, the vehicle network 1441 via a terminal not shown, and acquires data generated by the vehicle (such as vehicle speed data).

[0152] The content player 1427 reproduces content stored in a storage medium (such as a CD or DVD) inserted into the storage medium interface 1428. The input device 1429 includes, for example, a touch sensor, button, or switch configured to detect a touch on the screen of the display device 1430, and receives operations or information input from the user. The display device 1430 includes a screen such as an LCD or OLED display and displays images of the navigation function or reproduced content. The speaker 1431 outputs sounds of the navigation function or reproduced content.

[0153] The wireless communication interface 1433 supports any cellular communication scheme (such as LTE and LTE-Advanced) and performs wireless communication. The wireless communication interface 1433 may generally include, for example, a BB processor 1434 and an RF circuit 1435. The BB processor 1434 may perform, for example, encoding / decoding, modulation / demodulation, and multiplexing / demultiplexing, and perform various types of signal processing for wireless communication. Meanwhile, the RF circuit 1435 may include, for example, a mixer, a filter, and an amplifier, and transmit and receive wireless signals via an antenna 1437. The wireless communication interface 1433 may also be a chip module on which the BB processor 1434 and the RF circuit 1435 are integrated. As shown in FIG14 , the wireless communication interface 1433 may include multiple BB processors 1434 and multiple RF circuits 1435. Although FIG14 shows an example in which the wireless communication interface 1433 includes multiple BB processors 1434 and multiple RF circuits 1435, the wireless communication interface 1433 may also include a single BB processor 1434 or a single RF circuit 1435.

[0154] In addition, in addition to the cellular communication scheme, the wireless communication interface 1433 can support other types of wireless communication schemes, such as a short-range wireless communication scheme, a near field communication scheme, and a wireless LAN scheme. In this case, for each wireless communication scheme, the wireless communication interface 1433 can include a BB processor 1434 and an RF circuit 1435.

[0155] Each of the antenna switches 1436 switches a connection destination of the antenna 1437 between a plurality of circuits included in the wireless communication interface 1433 , such as circuits for different wireless communication schemes.

[0156] Each of the antennas 1437 includes a single or multiple antenna elements (such as multiple antenna elements included in a MIMO antenna) and is used for transmitting and receiving wireless signals via the wireless communication interface 1433. As shown in FIG14, the car navigation device 1420 may include multiple antennas 1437. Although FIG14 shows an example in which the car navigation device 1420 includes multiple antennas 1437, the car navigation device 1420 may also include a single antenna 1437.

[0157] In addition, the car navigation device 1420 may include an antenna 1437 for each wireless communication scheme. In this case, the antenna switch 1436 may be omitted from the configuration of the car navigation device 1420.

[0158] The battery 1438 supplies power to the respective blocks of the car navigation device 1420 shown in Fig. 14 via a feeder line, which is partially shown as a dotted line in the figure. The battery 1438 accumulates the power supplied from the vehicle.

[0159] In the car navigation device 1420 shown in FIG14 , the authentication unit 920, update unit 930, and generation unit 940 described in FIG9 can be implemented by a processor 1421. At least a portion of the functions can also be implemented by the processor 1421. For example, the processor 1421 can perform secondary authentication, update authentication policies, and generate update notifications by executing instructions stored in the memory 1422.

[0160] The technology of the present disclosure can also be implemented as an in-vehicle system (or vehicle) 1440 including a car navigation device 1420, an in-vehicle network 1441, and one or more blocks in a vehicle module 1442. The vehicle module 1442 generates vehicle data (such as vehicle speed, engine speed, and fault information) and outputs the generated data to the in-vehicle network 1441.

[0161] The preferred embodiments of the present disclosure are described above with reference to the accompanying drawings, but the present disclosure is of course not limited to the above examples. Those skilled in the art may obtain various changes and modifications within the scope of the appended claims, and it should be understood that these changes and modifications will naturally fall within the technical scope of the present disclosure.

[0162] For example, the units shown in dotted boxes in the functional block diagrams shown in the accompanying drawings all indicate that the functional units are optional in the corresponding device, and the various optional functional units can be combined in an appropriate manner to achieve the required functions.

[0163] For example, a plurality of functions included in one unit in the above embodiments may be implemented by separate devices. Alternatively, a plurality of functions implemented by a plurality of units in the above embodiments may be implemented by separate devices, respectively. In addition, one of the above functions may be implemented by a plurality of units. Needless to say, such a configuration is included in the technical scope of the present disclosure.

[0164] In this specification, the steps described in the flowchart include not only processing executed in time series in the order described, but also processing executed in parallel or individually rather than necessarily in time series. In addition, even in the steps processed in time series, it goes without saying that the order can be changed as appropriate.

[0165] Furthermore, the present disclosure may have configurations as described below.

[0166] 1. An electronic device in a non-public network (NPN), comprising a processing circuit configured to:

[0167] generating updated authentication policy information for a network element in the NPN, the authentication policy information including an authentication policy used when performing secondary authentication on a user equipment in the NPN; and

[0168] Send the updated authentication policy information to the network element in the NPN.

[0169] 2. The electronic device according to 1, wherein the authentication policy information includes one or more of the following: an authentication protocol, a key generation method, and an authentication parameter.

[0170] 3. The electronic device according to 1, wherein the processing circuit is further configured to:

[0171] An update notification indicating success or failure of authentication policy update is received from a network element in the NPN.

[0172] 4. The electronic device according to 1, wherein the processing circuit is further configured to:

[0173] The updated authentication policy information is sent using an Extensible Authentication Protocol (EAP) message.

[0174] 5. The electronic device according to 1, wherein the processing circuit is further configured to:

[0175] The updated authentication policy information is confidentially protected by using a key derived from a key generated during the secondary authentication process.

[0176] 6. The electronic device according to 1, wherein the network elements in the NPN include a session management function SMF, a user equipment and an authentication server AAA of an external data network DN.

[0177] 7. The electronic device according to 6, wherein the processing circuit is further configured to:

[0178] In the case where it is determined that the authentication policy configured for the electronic device is updated, the updated authentication policy information is generated.

[0179] 8. The electronic device according to item 1, wherein the network element in the NPN includes a user equipment, and

[0180] The processing circuit is further configured to determine whether the authentication policy of the user equipment needs to be updated according to the authentication policy currently configured for the user equipment.

[0181] 9. The electronic device according to 8, wherein the processing circuit is further configured to:

[0182] During the secondary authentication, obtaining the authentication policy currently configured on the user equipment; and

[0183] In a case where the authentication policy currently configured on the user equipment is not the latest version, it is determined that the authentication policy of the user equipment needs to be updated.

[0184] 10. The electronic device according to item 1, wherein the electronic device is located in an authentication server AAA of an external data network DN.

[0185] 11. An electronic device in a non-public network (NPN), comprising a processing circuit configured to:

[0186] receiving updated authentication policy information for the electronic device generated by an authentication policy management device, the authentication policy information including an authentication policy used when performing secondary authentication on a user device in the NPN; and

[0187] The secondary authentication is performed according to the updated authentication policy information.

[0188] 12. The electronic device according to 11, wherein the authentication policy information includes one or more of the following: an authentication protocol, a key generation method, and an authentication parameter.

[0189] 13. The electronic device according to 11, wherein the processing circuit is further configured to:

[0190] Sends an update notification indicating the success or failure of an authentication policy update.

[0191] 14. The electronic device according to 13, wherein the processing circuit is further configured to:

[0192] The update notification is sent using an Extensible Authentication Protocol (EAP) message.

[0193] 15. The electronic device according to 13, wherein the processing circuit is further configured to:

[0194] The update notification is confidentially protected using a key derived from a key generated during the secondary authentication process.

[0195] 16. The electronic device according to 11, wherein the electronic device is a session management function SMF, the user equipment or an authentication server AAA of an external data network DN.

[0196] 17. The electronic device according to 16, wherein, when the electronic device is an SMF, the processing circuit is further configured to:

[0197] receiving updated authentication policy information for the user equipment generated by an authentication policy management device; and

[0198] Determine whether to forward the updated authentication policy information to the user equipment.

[0199] 18. The electronic device according to 17, wherein the processing circuit is further configured to:

[0200] In a case where the authentication policy configured for the electronic device includes the authentication policy in the updated authentication policy information for the user equipment, the updated authentication policy information is forwarded to the user equipment.

[0201] 19. The electronic device according to 18, wherein the processing circuit is further configured to:

[0202] If no update notification indicating that the authentication policy update is successful is received from the user equipment within a predetermined time, the updated authentication policy information is re-forwarded to the user equipment, or an update notification indicating that the authentication policy update fails is sent to the authentication policy management device.

[0203] 20. The electronic device according to 16, wherein, when the electronic device is the user equipment, the processing circuit is further configured to:

[0204] In response to the request information from the SMF, the authentication policy currently configured for the user equipment is sent to the SMF.

[0205] 21. A wireless communication method performed by an electronic device in a non-public network (NPN), comprising:

[0206] generating updated authentication policy information for a network element in the NPN, the authentication policy information including an authentication policy used when performing secondary authentication on a user equipment in the NPN; and

[0207] Send the updated authentication policy information to the network element in the NPN.

[0208] 22. The wireless communication method according to 21, wherein the authentication policy information includes one or more of the following: an authentication protocol, a key generation method, and an authentication parameter.

[0209] 23. The wireless communication method according to 21, wherein the wireless communication method further comprises:

[0210] An update notification indicating success or failure of authentication policy update is received from a network element in the NPN.

[0211] 24. The wireless communication method according to 21, wherein sending the updated authentication policy information comprises:

[0212] The updated authentication policy information is sent using an Extensible Authentication Protocol (EAP) message.

[0213] 25. The wireless communication method according to 21, wherein sending the updated authentication policy information comprises:

[0214] The updated authentication policy information is confidentially protected by using a key derived from a key generated during the secondary authentication process.

[0215] 26. The wireless communication method according to 21, wherein the network elements in the NPN include a session management function SMF, a user equipment and an authentication server AAA of an external data network DN.

[0216] 27. The wireless communication method according to 26, wherein the wireless communication method further comprises:

[0217] In the case where it is determined that the authentication policy configured for the electronic device is updated, the updated authentication policy information is generated.

[0218] 28. The wireless communication method according to 21, wherein the network element in the NPN includes a user equipment, and

[0219] The wireless communication method further includes: determining whether the authentication policy of the user equipment needs to be updated according to the authentication policy currently configured for the user equipment.

[0220] 29. The wireless communication method according to 28, wherein the wireless communication method further comprises:

[0221] During the secondary authentication, obtaining the authentication policy currently configured on the user equipment; and

[0222] In a case where the authentication policy currently configured on the user equipment is not the latest version, it is determined that the authentication policy of the user equipment needs to be updated.

[0223] 30. The wireless communication method according to 21, wherein the electronic device is located in an authentication server AAA of an external data network DN.

[0224] 31. A wireless communication method performed by an electronic device in a non-public network (NPN), comprising:

[0225] receiving updated authentication policy information for the electronic device generated by an authentication policy management device, the authentication policy information including an authentication policy used when performing secondary authentication on a user device in the NPN; and

[0226] The secondary authentication is performed according to the updated authentication policy information.

[0227] 32. The wireless communication method according to 31, wherein the authentication policy information includes one or more of the following: an authentication protocol, a key generation method, and an authentication parameter.

[0228] 33. The wireless communication method according to 31, wherein the wireless communication method further comprises:

[0229] Sends an update notification indicating the success or failure of an authentication policy update.

[0230] 34. The wireless communication method according to 33, wherein sending the update notification comprises:

[0231] The update notification is sent using an Extensible Authentication Protocol (EAP) message.

[0232] 35. The wireless communication method according to 33, wherein sending the update notification comprises:

[0233] The update notification is confidentially protected using a key derived from a key generated during the secondary authentication process.

[0234] 36. The wireless communication method according to 31, wherein the electronic device is a session management function SMF, the user equipment or an authentication server AAA of an external data network DN.

[0235] 37. The wireless communication method according to 36, wherein, when the electronic device is an SMF, the wireless communication method further comprises:

[0236] receiving updated authentication policy information for the user equipment generated by an authentication policy management device; and

[0237] Determine whether to forward the updated authentication policy information to the user equipment.

[0238] 38. The wireless communication method according to 37, wherein determining whether to forward the updated authentication policy information to the user equipment comprises:

[0239] In a case where the authentication policy configured for the electronic device includes the authentication policy in the updated authentication policy information for the user equipment, the updated authentication policy information is forwarded to the user equipment.

[0240] 39. The wireless communication method according to 38, wherein the wireless communication method further comprises:

[0241] If no update notification indicating that the authentication policy update is successful is received from the user equipment within a predetermined time, the updated authentication policy information is re-forwarded to the user equipment, or an update notification indicating that the authentication policy update fails is sent to the authentication policy management device.

[0242] 40. The wireless communication method according to claim 36, wherein, when the electronic device is the user equipment, the wireless communication method further comprises:

[0243] In response to the request information from the SMF, the authentication policy currently configured for the user equipment is sent to the SMF.

[0244] 41. A computer-readable storage medium comprising executable computer instructions, which, when executed by a computer, cause the computer to perform the wireless communication method according to any one of 21-40.

[0245] Although the embodiments of the present disclosure have been described in detail above with reference to the accompanying drawings, it should be understood that the embodiments described above are merely illustrative of the present disclosure and are not intended to limit the present disclosure. Those skilled in the art will appreciate that various modifications and variations can be made to the above embodiments without departing from the spirit and scope of the present disclosure. Therefore, the scope of the present disclosure is solely defined by the appended claims and their equivalents.

Claims

1. An electronic device in a non-public network (NPN), comprising a processing circuit configured to: generating updated authentication policy information for a network element in the NPN, the authentication policy information including an authentication policy used when performing secondary authentication on a user equipment in the NPN; and Send the updated authentication policy information to the network element in the NPN.

2. The electronic device according to claim 1, wherein The authentication policy information includes one or more of the following: authentication protocol, key generation method, and authentication parameters.

3. The electronic device according to claim 1, wherein The processing circuit is further configured to: An update notification indicating success or failure of authentication policy update is received from a network element in the NPN.

4. The electronic device according to claim 1, wherein The processing circuit is further configured to: The updated authentication policy information is sent using an Extensible Authentication Protocol (EAP) message.

5. The electronic device according to claim 1, wherein The processing circuit is further configured to: The updated authentication policy information is confidentially protected by using a key derived from a key generated during the secondary authentication process. The electronic device according to claim 1 , wherein: The network elements in the NPN include a session management function SMF, user equipment and an authentication server AAA of an external data network DN.

7. The electronic device according to claim 6, wherein: The processing circuit is further configured to: In the case where it is determined that the authentication policy configured for the electronic device is updated, the updated authentication policy information is generated.

8. The electronic device according to claim 1, wherein The network elements in the NPN include user equipment, and The processing circuit is further configured to determine whether the authentication policy of the user equipment needs to be updated according to the authentication policy currently configured for the user equipment.

9. The electronic device according to claim 8, wherein: The processing circuit is further configured to: During the secondary authentication, obtaining the authentication policy currently configured on the user equipment; as well as In a case where the authentication policy currently configured on the user equipment is not the latest version, it is determined that the authentication policy of the user equipment needs to be updated.

10. The electronic device according to claim 1, wherein The electronic device is located in an authentication server AAA of an external data network DN.

11. An electronic device in a non-public network (NPN), comprising a processing circuit configured to: receiving updated authentication policy information for the electronic device generated by an authentication policy management device, the authentication policy information including an authentication policy used when performing secondary authentication on a user device in the NPN; and The secondary authentication is performed according to the updated authentication policy information.

12. The electronic device according to claim 11, wherein The authentication policy information includes one or more of the following: authentication protocol, key generation method, and authentication parameters.

13. The electronic device according to claim 11, wherein The processing circuit is further configured to: Sends an update notification indicating the success or failure of an authentication policy update.

14. The electronic device according to claim 13, wherein: The processing circuit is further configured to: The update notification is sent using an Extensible Authentication Protocol (EAP) message.

15. The electronic device according to claim 13, wherein The processing circuit is further configured to: The update notification is confidentially protected using a key derived from a key generated during the secondary authentication process.

16. The electronic device according to claim 11, wherein The electronic device is a session management function SMF, the user equipment or an authentication server AAA of an external data network DN.

17. The electronic device according to claim 16, wherein: In the case where the electronic device is an SMF, the processing circuit is further configured to: receiving updated authentication policy information for the user equipment generated by an authentication policy management device; as well as Determine whether to forward the updated authentication policy information to the user equipment.

18. The electronic device according to claim 17, wherein: The processing circuit is further configured to: In a case where the authentication policy configured for the electronic device includes the authentication policy in the updated authentication policy information for the user equipment, the updated authentication policy information is forwarded to the user equipment.

19. The electronic device according to claim 18, wherein The processing circuit is further configured to: If no update notification indicating that the authentication policy update is successful is received from the user equipment within a predetermined time, the updated authentication policy information is re-forwarded to the user equipment, or an update notification indicating that the authentication policy update fails is sent to the authentication policy management device.

20. The electronic device according to claim 16, wherein In the case where the electronic device is the user equipment, the processing circuit is further configured to: In response to the request information from the SMF, the authentication policy currently configured for the user equipment is sent to the SMF.

21. A wireless communication method performed by an electronic device in a non-public network (NPN), comprising: generating updated authentication policy information for a network element in the NPN, the authentication policy information including an authentication policy used when performing secondary authentication on a user equipment in the NPN; as well as Send the updated authentication policy information to the network element in the NPN.

22. The wireless communication method according to claim 21, wherein: The authentication policy information includes one or more of the following: authentication protocol, key generation method, and authentication parameters.

23. The wireless communication method according to claim 21, wherein: The wireless communication method further includes: An update notification indicating success or failure of authentication policy update is received from a network element in the NPN.

24. The wireless communication method according to claim 21, wherein: Sending the updated authentication policy information includes: The updated authentication policy information is sent using an Extensible Authentication Protocol (EAP) message.

25. The wireless communication method according to claim 21, wherein: Sending the updated authentication policy information includes: The updated authentication policy information is confidentially protected by using a key derived from a key generated during the secondary authentication process.

26. The wireless communication method according to claim 21, wherein: The network elements in the NPN include a session management function SMF, user equipment and an authentication server AAA of an external data network DN.

27. The wireless communication method according to claim 26, wherein: The wireless communication method further includes: In the case where it is determined that the authentication policy configured for the electronic device is updated, the updated authentication policy information is generated.

28. The wireless communication method according to claim 21, wherein: The network elements in the NPN include user equipment, and The wireless communication method further includes: determining whether the authentication policy of the user equipment needs to be updated according to the authentication policy currently configured for the user equipment.

29. The wireless communication method according to claim 28, wherein: The wireless communication method further includes: During the secondary authentication, obtaining the authentication policy currently configured on the user equipment; and In a case where the authentication policy currently configured on the user equipment is not the latest version, it is determined that the authentication policy of the user equipment needs to be updated.

30. The wireless communication method according to claim 21, wherein: The electronic device is located in an authentication server AAA of an external data network DN.

31. A wireless communication method performed by an electronic device in a non-public network (NPN), comprising: receiving updated authentication policy information for the electronic device generated by an authentication policy management device, the authentication policy information including an authentication policy used when performing secondary authentication on a user device in the NPN; as well as The secondary authentication is performed according to the updated authentication policy information.

32. The wireless communication method according to claim 31, wherein: The authentication policy information includes one or more of the following: authentication protocol, key generation method, and authentication parameters.

33. The wireless communication method according to claim 31, wherein: The wireless communication method further includes: Sends an update notification indicating the success or failure of an authentication policy update.

34. The wireless communication method according to claim 33, wherein: Sending the update notification includes: The update notification is sent using an Extensible Authentication Protocol (EAP) message.

35. The wireless communication method according to claim 33, wherein: Sending the update notification includes: The update notification is confidentially protected using a key derived from a key generated during the secondary authentication process.

36. The wireless communication method according to claim 31, wherein: The electronic device is a session management function SMF, the user equipment or an authentication server AAA of an external data network DN.

37. The wireless communication method according to claim 36, wherein: In the case where the electronic device is an SMF, the wireless communication method further includes: receiving updated authentication policy information for the user equipment generated by an authentication policy management device; and Determine whether to forward the updated authentication policy information to the user equipment.

38. The wireless communication method according to claim 37, wherein: Determining whether to forward the updated authentication policy information to the user equipment includes: In a case where the authentication policy configured for the electronic device includes the authentication policy in the updated authentication policy information for the user equipment, the updated authentication policy information is forwarded to the user equipment.

39. The wireless communication method according to claim 38, wherein: The wireless communication method further includes: If no update notification indicating that the authentication policy update is successful is received from the user equipment within a predetermined time, the updated authentication policy information is re-forwarded to the user equipment, or an update notification indicating that the authentication policy update fails is sent to the authentication policy management device.

40. The wireless communication method according to claim 36, wherein: In a case where the electronic device is the user equipment, the wireless communication method further includes: In response to the request information from the SMF, the authentication policy currently configured for the user equipment is sent to the SMF.

41. A computer-readable storage medium comprising executable computer instructions, which, when executed by a computer, cause the computer to perform the wireless communication method according to any one of claims 21-40.

Images