Strategy negotiation method and device, electronic equipment, storage medium and program product

Abstract

Disclosed are a policy negotiation method and apparatus, an electronic device, a storage medium and a program product, which relate to the technical field of communications, the method being executed by a mobile equipment ME, the method specifically comprising: determining a first protection policy with the highest priority supported by a user equipment UE based on user hidden identifier SUCI calculation information stored in a universal subscriber identity module USIM; based on the first protection strategy, calculating a target SUCI corresponding to a USIM identifier stored in the USIM; and sending the target SUCI to a network side device. According to the embodiment of the invention, the problem that the flexibility of an existing SUCI protection strategy negotiation mechanism is poor can be solved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a policy negotiation method, device, electronic device, storage medium and program product. Background Art

[0002] At present, the fifth generation (5G) communication system usually adopts the Elliptic Curve Integrated Encryption Scheme (ECIES) to realize the security protection of the Subscription Concealed Identifier (SUCI). Among them, the algorithm and home network (HN) public key used by ECIES are obtained from the SUCI calculation information stored in the Universal Subscriber Identity Module (USIM). However, the SUCI calculation information of the network side device is written when the USIM is issued, and it cannot be updated later. When calculating SUCI through the USIM, only the cryptographic algorithm supported by the USIM can be used to calculate SUCI. It can be seen that the flexibility of the existing SUCI protection strategy negotiation mechanism is poor. Summary of the invention

[0003] The embodiments of the present application provide a policy negotiation method, device, electronic device, storage medium and program product to solve the problem of poor flexibility of the existing SUCI protection policy negotiation mechanism.

[0004] In a first aspect, an embodiment of the present application provides a policy negotiation method, which is performed by a mobile device ME, and the method includes:

[0005] Determine a first protection strategy with the highest priority supported by the user equipment UE based on calculation information of the user hidden identity SUCI stored in the universal user identity module USIM;

[0006] Calculate, based on the first protection strategy, a target SUCI corresponding to the USIM identifier stored in the USIM;

[0007] Send the target SUCI to the network side device.

[0008] Optionally, before determining the first protection strategy with the highest priority supported by the UE based on the SUCI calculation information stored in the USIM, at least one of the following items is further included:

[0009] Upon receiving the first indication sent by the USIM, acquiring the SUCI calculation information and the USIM identifier from the USIM;

[0010] In a case where the error indication information sent by the USIM is received, the SUCI calculation information and the USIM identifier are acquired from the USIM.

[0011] Optionally, the calculating, based on the first protection strategy, a target SUCI corresponding to the USIM identifier stored in the USIM includes at least one of the following:

[0012] When the first protection policy is not a null algorithm, use the first protection policy to calculate the encrypted SUPI corresponding to the USIM identity, set the protection output field of the target SUCI to the encrypted SUPI, and set the encryption algorithm ID field and the home network HN public key ID field of the target SUCI according to the policy information corresponding to the first protection policy;

[0013] When the first protection strategy is a null algorithm, use the null algorithm to calculate the unencrypted SUPI corresponding to the USIM identity, set the protection output field of the target SUCI to the unencrypted SUPI, and set the encryption algorithm ID field and the HN public key ID field of the target SUCI according to the null algorithm;

[0014] In a case where the ME does not support the first protection strategy, the SUPI is calculated using a null algorithm, and a protection output field of the target SUCI is set to the unencrypted SUPI, and a protection strategy ID field and an HN public key ID field of the target SUCI are set according to the null algorithm.

[0015] In a second aspect, an embodiment of the present application further provides a policy negotiation method, which is performed by a USIM, and the method includes:

[0016] Determining, based on the SUCI calculation information stored in the USIM, a second protection strategy with the highest priority supported by the UE;

[0017] Calculate, based on the second protection strategy, a target SUCI corresponding to the USIM identifier stored in the USIM;

[0018] The target SUCI is sent to the ME.

[0019] Optionally, the method further comprises at least one of the following:

[0020] If the UE does not support the second protection strategy, return error indication information to the ME;

[0021] If it is determined that the second protection policy is not compliant, returning error indication information to the ME;

[0022] If the USIM does not support the second protection strategy, returning error indication information to the ME;

[0023] The error indication information is used to instruct the ME to perform the steps of obtaining the SUCI calculation information and the USIM identifier from the USIM, determining a first protection strategy based on the SUCI calculation information, and calculating a target SUCI corresponding to the USIM identifier based on the first protection strategy.

[0024] Optionally, the determining, based on the SUCI calculation information stored in the USIM, a second protection strategy with a highest priority supported by the UE includes:

[0025] Acquiring the SUCI calculation information, wherein the SUCI calculation information includes at least one protection strategy and corresponding strategy information;

[0026] Based on the at least one protection policy and the corresponding policy information, a protection policy with the highest priority is selected from the at least one protection policy as the second protection policy.

[0027] Optionally, the calculating, based on the second protection strategy, a target SUCI corresponding to the USIM identifier stored in the USIM includes:

[0028] When the second protection policy is not a null algorithm, use the second protection policy to calculate the encrypted user identity SUPI corresponding to the USIM identity, set the protection output field of the target SUCI to the encrypted SUPI, and set the encryption algorithm ID field and the home network HN public key ID field of the target SUCI according to the policy information corresponding to the second protection policy;

[0029] When the second protection strategy is a null algorithm, an unencrypted SUPI corresponding to the USIM identifier is calculated using the null algorithm, and a protection output field of the target SUCI is set to the unencrypted SUPI, and an encryption algorithm ID field and an HN public key ID field of the target SUCI are set according to the null algorithm.

[0030] Optionally, the method further comprises:

[0031] sending a first indication to the ME, where the first indication is used to instruct the ME to calculate the target SUCI;

[0032] and returning the SUCI calculation information and the USIM identifier to the ME.

[0033] Optionally, the method further comprises:

[0034] Receive encryption algorithm update information sent by the network side device;

[0035] Based on the encryption algorithm update information, the SUCI calculation information stored in the USIM is updated.

[0036] In a third aspect, an embodiment of the present application further provides a policy negotiation method, which is performed by a network side device, and the method includes:

[0037] receiving a target SUCI sent by the UE, wherein the target SUCI is calculated by the USIM using the method described in any one of the first aspect or the method described in any one of the second aspect;

[0038] Determine a corresponding target protection policy according to the target SUCI, and use the target protection policy to calculate the decrypted SUPI corresponding to the USIM identity of the UE, where the target protection policy is the first protection policy or the second protection policy;

[0039] and performing authentication with the UE according to the decrypted SUPI to establish a communication connection with the UE.

[0040] Optionally, the method further comprises:

[0041] When it is determined that the target protection policy is not compliant, protection policy update information is sent to the UE according to version information of the target protection policy.

[0042] Optionally, the sending protection policy update information to the UE according to the version information of the target protection policy includes:

[0043] If the version of the target protection policy is not the latest version, modify the policy information corresponding to the target protection policy to obtain an updated SUCI protection policy, and send the updated SUCI protection policy to the USIM in the UE;

[0044] When the version of the target protection policy is the latest version, sending upgrade indication information to the UE, or sending SUCI calculation information supported by the UE to the UE, wherein the upgrade indication information is used to instruct the UE to upgrade the USIM card or upgrade the ME version.

[0045] In a fourth aspect, an embodiment of the present application provides a policy negotiation device, which is applied to a ME, and the device includes:

[0046] A first determination module, configured to determine a first protection strategy with the highest priority supported by the user equipment UE based on calculation information of a hidden user identity SUCI stored in a universal user identity module USIM;

[0047] A first calculation module, configured to calculate a target SUCI corresponding to the USIM identifier stored in the USIM based on the first protection strategy;

[0048] The first sending module is configured to send the target SUCI to a network side device.

[0049] In a fifth aspect, an embodiment of the present application further provides a policy negotiation device, applied to a USIM, the device comprising:

[0050] A first acquisition module, configured to determine a second protection strategy with the highest priority supported by the UE based on the SUCI calculation information stored in the USIM;

[0051] A second determination module, configured to calculate a target SUCI corresponding to the USIM identifier stored in the USIM based on the second protection strategy;

[0052] The second calculation module is configured to send the target SUCI to the ME.

[0053] In a sixth aspect, an embodiment of the present application further provides a policy negotiation device, which is applied to a network side device, and the device includes:

[0054] A first receiving module, configured to receive a target SUCI sent by the UE, wherein the target SUCI is calculated by the USIM using the method of any one of claims 1 to 3, or using the method of any one of claims 4 to 9;

[0055] a third determining module, configured to determine a corresponding target protection policy according to the target SUCI, and use the target protection policy to calculate a decrypted SUPI corresponding to the USIM identifier of the UE, wherein the target protection policy is a first protection policy or a second protection policy;

[0056] An authentication module is used to perform authentication with the UE according to the decrypted SUPI to establish a communication connection with the UE.

[0057] In the seventh aspect, the example of the present application provides an electronic device, comprising: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps in the policy negotiation method described in any one of the first aspect, the second aspect, or the third aspect are implemented.

[0058] In the eighth aspect, an embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps in the policy negotiation method as described in any one of the first aspect, the second aspect, or the third aspect are implemented.

[0059] In the ninth aspect, an embodiment of the present application further provides a computer program product, which is stored in a storage medium and is executed by at least one processor to implement the steps in the policy negotiation method as described in any one of the first aspect, the second aspect, or the third aspect.

[0060] In the embodiment of the present application, the stored SUCI calculation information is obtained from the USIM, and then the first protection strategy with the highest priority is determined according to the SUCI calculation information. Subsequently, if the UE supports the first protection strategy, the target SUCI corresponding to the USIM identifier stored in the USIM is calculated based on the first protection strategy, and the target SUCI is sent to the network side device. As a result, the USIM and ME in the UE can select the highest priority protection scheme strategy target SUCI that can be supported on the UE based on the SUCI calculation information stored in the USIM, so as to make full use of the cryptographic calculation capability of the UE, flexibly determine the protection strategy to realize the encryption processing of the USIM identifier, and improve the flexibility of the SUCI protection strategy negotiation mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0062] Figure 1 is a flow chart of a policy negotiation method applied to ME provided in an embodiment of the present application;

[0063] Figure 2 This is one of the flow charts of a policy negotiation method provided in an embodiment of the present application;

[0064] Figure 3 This is the second flowchart of a policy negotiation method provided in an embodiment of the present application;

[0065] Figure 4 is a flow chart of a policy negotiation method applied to a USIM provided in an embodiment of the present application;

[0066] Figure 5 This is the third flowchart of a policy negotiation method provided in an embodiment of the present application;

[0067] Figure 6 This is the fourth flowchart of a policy negotiation method provided in an embodiment of the present application;

[0068] Figure 7This is the fifth flow chart of a policy negotiation method provided in an embodiment of the present application;

[0069] Figure 8 This is a flow chart of a policy negotiation method applied to a network side device provided in an embodiment of the present application;

[0070] Fig. 9 This is one of the schematic diagrams of a policy negotiation device provided in an embodiment of the present application;

[0071] Fig.10 This is a second schematic diagram of a policy negotiation device provided in an embodiment of the present application;

[0072] Fig.11 This is a third schematic diagram of a policy negotiation device provided in an embodiment of the present application;

[0073] Fig.12 is a structural diagram of an electronic device provided in an embodiment of the present application;

[0074] Fig.13 is a structural diagram of another electronic device provided in an embodiment of the present application;

[0075] Fig.14 It is a structural diagram of a network side device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0076] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0077] In conjunction with the accompanying drawings, a policy negotiation method, apparatus, device and program product provided by the embodiments of the present application are described in detail below through specific embodiments and their application scenarios.

[0078] In an embodiment of the present application, a policy negotiation method is performed by a Universal Subscriber Identity Module (USIM), wherein a User Equipment (UE) includes a Mobile Equipment (ME) and a USIM. Figure 1 As shown, the policy negotiation method performed by the ME specifically includes the following steps:

[0079] Step 11: Determine a first protection strategy with the highest priority supported by the user equipment UE based on the calculation information of the user hidden identity SUCI stored in the universal user identity module USIM;

[0080] It should be noted that the USIM includes the Subscription Permanent Identifier (SUCI) protection policy information (SUCI Protection Info, SPI) and the USIM card identifier. The SUCI protection policy information can be stored in the card file of the USIM (e.g., EF SUCI_Calc_Info The SUCI protection policy information may also be read locally by the USIM. The USIM card identifier may be a Subscription Permanent Identifier (SUPI) or an International Mobile Equipment Identity (IMSI).

[0081] The SUCI protection policy information may include information such as SUPI, SUPI type, network access identifier (NAI) of the home location, routing indication, home network public key, home network (Home Network Public Key ID) of the home network (HN) and protection policy identifier list.

[0082] It is worth mentioning that before the network side device (such as HN device) requires the UE to send an identity for network authentication, the ME in the UE can read the SUPI generation policy (i.e., the first protection policy in the embodiment of the present application) from the USIM card, and calculate the SUPI in the USIM according to the SUPI generation policy to obtain the SUCI. Subsequently, the UE can send the SUCI to the network side device, and the network side device performs network authentication.

[0083] In a specific embodiment of the present application, before network authentication is performed, the protection policy or encryption algorithm used in the process of converting SUPI into SUCI may be determined by SUCI calculation information obtained from the USIM. Specifically, the SUCI calculation information may include at least one protection policy identifier and protection policy information corresponding to the protection policy identifier. The SUCI calculation information may also include multiple protection policy identifiers and protection policy information corresponding thereto. Each protection policy may be used as an encryption scheme or encryption algorithm to encrypt the USIM identifier.

[0084] That is, the embodiment of the present application may encrypt the USIM card identifier according to the specific protection strategy or encryption algorithm determined by the SUCI calculation information. For example, if the SUPI in the USIM card identifier needs to be encrypted, and the SUCI calculation information includes an identifier of the first protection strategy (which may be a KEM_ENC algorithm), it may be determined that the encryption algorithm for encrypting the SUPI may be the KEM_ENC algorithm.

[0085] In some embodiments of the present application, the USIM may instruct the ME to calculate the SUCI, and the ME, as the execution subject, determines the first protection strategy, which is the highest priority solution that the UE can support, selected by the ME according to the SUCI calculation information. In some other embodiments of the present application, the USIM may also instruct the USIM to calculate the SUCI, and the USIM, as the execution subject, determines the second protection strategy, which is the highest priority solution that the UE can support, selected by the USIM according to the SUCI calculation information. In this way, the embodiment of the present application can determine the highest priority protection strategy that can be supported on the UE by the ME or the USIM to calculate the target SUCI, thereby making full use of the cryptographic computing capability of the UE, flexibly determining the target protection strategy to implement encryption processing of the USIM identifier, and improving the flexibility of the SUCI protection strategy negotiation mechanism.

[0086] Step 12: Calculate a target SUCI corresponding to the USIM identifier stored in the USIM based on the first protection strategy.

[0087] In the specific implementation of the present application, the UE can determine the target protection policy identifier (i.e., the protection of the first protection policy or the protection of the second protection policy) according to at least one protection policy identifier and the corresponding protection policy information, and select the target protection policy corresponding to the target protection policy identifier, i.e., the first protection policy or the second protection policy. For example, the UE can select a protection policy with the highest priority from a protection policy list composed of at least one protection policy identifier, determine the protection policy identifier of the target protection policy with the highest priority, and correspond to the target protection policy and its corresponding protection policy information according to the target protection policy identifier. Alternatively, the UE can select an empty algorithm identifier from a protection policy list composed of at least one protection policy identifier as the target protection policy identifier, that is, the target protection policy is an empty algorithm. As a result, both the USIM and ME in the UE can select the highest priority protection scheme supported on the UE to calculate the SUCI based on the SUCI calculation information stored in the USIM, so as to make full use of the cryptographic calculation capability of the UE to support the cryptographic policy of the network-side device and enhance the flexibility of the policy negotiation mechanism.

[0088] It is worth mentioning that at least one protection policy identifier is stored in the above-mentioned USIM, and each protection policy identifier corresponds to a protection policy. For example, when the protection policy identifier 0x1 is stored in the USIM, it can correspond to the protection policy with the identifier 0x1 in the protection policy list. The protection policy list information can be pre-written in the USIM when the card production is completed, including at least one protection policy identifier and its corresponding protection policy information, so that when the corresponding protection policy needs to be adopted later, the corresponding protection policy (i.e., encryption algorithm) can be directly adopted according to the protection policy identifier for encryption processing. Specifically, the protection policy list can be expressed as:

[0089] plan Identifier Protection policy information Priority Compliance Protection strategy 1 0x1 Description of protection strategy 1 1 yes Protection Strategy 2 0x2 Description of protection strategy 2 2 yes Protection Strategy 3 0x3 Description of protection strategy 3 3 yes Protection Strategy 4 0x4 Description of protection strategy 4 4 no Protection Strategy 5 0x5 Description of protection strategy 5 5 no

[0090] The protection policies in the above protection policy list are not limited to the preset types and quantities, and corresponding protection policies can be added in the USIM as needed.

[0091] Step 13: Send the target SUCI to the network side device.

[0092] It is worth mentioning that the target SUCI in the embodiment of the present application may include the following information, see Table 1 below for details:

[0093] Table 1

[0094]

[0095] The protection output field may be obtained after encrypting the USIM identifier using the target protection policy. SPI ver may be the version number corresponding to the currently used target protection policy, and the SPI ver may be stored in the protection policy information.

[0096] It should be noted that the ME in the UE can send the determined target SUCI to the network side device (e.g., HN), and the network side device receives the target SUCI, and decrypts the target SUCI according to the protection policy identifier in the target SUCI, the public key identifier of the home network, etc., to obtain the USIM identifier (which can be SUPI). In this way, the network side device can generate an authentication vector according to the decrypted SUPI, complete AKA two-way authentication, and establish a data connection between the UE and the network side device. In addition, the embodiment of the present application can also be applied to the EAP-AKA protocol, and can complete the authentication under the EAP-AKA protocol and establish a data connection between the UE and the network side device.

[0097] In a specific embodiment of the present application, after determining the target protection strategy (the first protection strategy or the second protection strategy), the USIM identifier can be encrypted and calculated according to the encryption algorithm corresponding to the target protection strategy (for example, the KEM_ENC algorithm) and the protection strategy information corresponding to the target protection strategy (including NAI, routing indication, HN Public Key ID, etc.). When the USIM identifier is SUPI, the target SUCI can be obtained (specifically, it can be expressed as SUPI_C = KEM_ENC (HN ID, SUPI)). In addition, the target protection strategy can also be a space-time algorithm (null-scheme). At this time, the null algorithm is used to calculate the target SUCI corresponding to the USIM identifier. When the USIM identifier is SUPI, the target SUCI can be output as an unencrypted SUPI. It can be seen that the UE can calculate the target SUCI corresponding to the USIM identifier according to the target protection strategy, so as to make full use of the cryptographic calculation capability of the UE to support the cryptographic policy of the network-side device and enhance the flexibility of the policy negotiation mechanism.

[0098] Optionally, before determining the first protection strategy with the highest priority supported by the UE based on the SUCI calculation information stored in the USIM, at least one of the following items is further included:

[0099] Upon receiving the first indication sent by the USIM, acquiring the SUCI calculation information and the USIM identifier from the USIM;

[0100] In a case where the error indication information sent by the USIM is received, the SUCI calculation information and the USIM identifier are acquired from the USIM.

[0101] In another specific embodiment of the present application, the compliance of the first protection strategy can be judged, and when the first protection strategy selected by the ME is not compliant or the compliance is negative, the USIM can return error indication information or send a first indication to the ME. At this time, after receiving the first indication or error indication information, the ME can select the first protection strategy again, and then calculate the USIM identifier as SUCI according to the first protection strategy.

[0102] In addition, when the USIM determines the second protection strategy as the execution subject, when the UE does not support each protection strategy or the second protection strategy, or when the compliance of each protection strategy is no, the ME determines the first protection strategy to calculate the target SUCI. For details, please refer to the relevant description of the above embodiment, which will not be repeated here.

[0103] Specifically, when the USIM cannot support all protection strategies defined by the HN (for example, the algorithm corresponding to the second protection strategy does not support USIM identity calculation, etc.), an error message may be sent to the ME. At this time, the ME may also select a target protection strategy, and the ME calculates the USIM identity as SUCI according to the target protection strategy.

[0104] It is worth mentioning that in the above two embodiments, the ME can reselect the target protection strategy based on the target protection strategy determined by the USIM. Therefore, the USIM can permanently or temporarily open the authority for the ME to obtain the SUCI calculation information and the USIM identifier, so that the ME can obtain the SUCI calculation information and the USIM identifier from the USIM in a timely manner.

[0105] Optionally, the calculating, based on the first protection strategy, a target SUCI corresponding to the USIM identifier stored in the USIM includes at least one of the following:

[0106] When the first protection policy is not a null algorithm, use the first protection policy to calculate the encrypted SUPI corresponding to the USIM identity, set the protection output field of the target SUCI to the encrypted SUPI, and set the encryption algorithm ID field and the home network HN public key ID field of the target SUCI according to the policy information corresponding to the first protection policy;

[0107] When the first protection strategy is a null algorithm, use the null algorithm to calculate the unencrypted SUPI corresponding to the USIM identity, set the protection output field of the target SUCI to the unencrypted SUPI, and set the encryption algorithm ID field and the HN public key ID field of the target SUCI according to the null algorithm;

[0108] In a case where the ME does not support the first protection strategy, the SUPI is calculated using a null algorithm, and a protection output field of the target SUCI is set to the unencrypted SUPI, and a protection strategy ID field and an HN public key ID field of the target SUCI are set according to the null algorithm.

[0109] In some embodiments, when the first protection strategy or the second protection strategy is not a null algorithm, the first protection strategy or the second protection strategy may be directly used to calculate the encrypted SUPI corresponding to the USIM identity, and the protection output field in the target SUCI is set to the encrypted SUPI. In this way, the network side device may decrypt the protection output field according to the protection strategy ID field and the home network HN public key ID field of the target SUCI to obtain the USIM identity.

[0110] For different situations of whether the first protection policy or the second protection policy is a null algorithm, if there is no protection policy in the protection policy list that can support the ME or USIM to encrypt the USIM identity, the first protection policy or the second protection policy can be selected as the null algorithm. At this time, when the USIM identity is SUPI, the null algorithm is directly used to calculate the unencrypted SUPI corresponding to the USIM identity. The protection policy ID field and the HN public key ID field of the target SUCI can also be set according to the null algorithm, so that the network side device can determine that the first protection policy or the second protection policy is a null algorithm according to the protection policy ID field, and process the unencrypted SUPI according to the HN public key ID field or directly not process it, and directly use the received target SUCI as the SUPI.

[0111] In addition, for the case where the ME or USIM itself does not support the first protection strategy or the second protection strategy, the SUPI may be calculated using the empty algorithm with reference to the embodiment in which the first protection strategy or the second protection strategy is an empty algorithm. For details, reference may be made to the relevant description of the aforementioned embodiment, which will not be repeated here to avoid repetition.

[0112] In this way, the embodiment of the present application selects the first protection strategy or the second protection strategy according to different situations, specific needs and security levels. The first protection strategy or the second protection strategy can be an algorithm with high security or a null algorithm, so as to effectively improve the security and flexibility of user identity management.

[0113] See also Figure 2 , a policy negotiation method in an embodiment of the present application includes:

[0114] Step 21: The USIM sends a first indication to the ME, where the first indication is used to instruct the ME to calculate the target SUCI;

[0115] Step 22: The ME obtains the SUCI protection policy information and the USIM identifier from the USIM.

[0116] Step 23: The ME selects a first protection policy corresponding to a target protection policy identifier supported by the UE according to the at least one protection policy identifier and the corresponding protection policy information;

[0117] Step 24: The ME calculates a target SUCI corresponding to the USIM identifier based on the first protection strategy.

[0118] Step 25: The ME sends the target SUCI to the network side.

[0119] Step 26: Receive a target SUCI sent by the UE; determine a corresponding first protection strategy according to the target SUCI, and use the first protection strategy to calculate a decrypted SUPI corresponding to the USIM identity of the UE;

[0120] Step 27: The network side performs authentication with the UE according to the decrypted SUPI to establish a communication connection with the UE.

[0121] like Figure 3 As shown, a policy negotiation method in an embodiment of the present application specifically includes the following steps:

[0122] Step 31: The ME sends a first request to the USIM, where the first request is used to request the USIM to obtain a target SUCI;

[0123] Step 32: The USIM obtains the SUCI protection policy information and the USIM identifier;

[0124] Step 33: The USIM selects a second protection policy corresponding to the protection policy identifier supported by the UE according to at least one protection policy identifier and corresponding protection policy information;

[0125] Step 34: The USIM calculates a target SUCI corresponding to the USIM identifier based on the second protection strategy;

[0126] Step 35: USIM sends the target SUCI to ME;

[0127] Step 36: The ME sends the target SUCI to the network side.

[0128] Step 37: Receive a target SUCI sent by the UE; determine a corresponding second protection strategy according to the target SUCI, and use the second protection strategy to calculate a decrypted SUPI corresponding to the USIM identity of the UE;

[0129] Step 38: The network side performs authentication with the UE according to the decrypted SUPI to establish a communication connection with the UE.

[0130] In another specific embodiment of the present application, as described above Figure 2 and Figure 3In the illustrated embodiment, for the case where the target SUCI generated by the USIM identifier is implemented by the USIM instructing the ME, if the ME does not support the target protection policy, for example, the target protection policy has low security performance, high risk of information leakage, lack of standardization support, etc., then the ME can use the null algorithm to calculate the SUPI, and can set the protection output field of the target SUCI to an unencrypted SUPI. In addition, the protection policy ID field and the HN public key ID field of the target SUCI can also be set according to the null algorithm, so that the network side device can easily restore the USIM identifier when receiving the target SUCI.

[0131] It can be seen that the above embodiments of the present application can be applicable to the situation where the ME does not support various protection strategies, flexibly adjust the target protection strategy, support the USIM identifier to be calculated as the target SUCI in various situations, and improve the flexibility of the policy negotiation mechanism.

[0132] Please refer to Figure 4 A policy negotiation method in an embodiment of the present application is executed by a USIM and specifically includes the following steps:

[0133] Step 41: Determine a second protection strategy with the highest priority supported by the UE based on the SUCI calculation information stored in the USIM;

[0134] Step 42: Calculate the target SUCI corresponding to the USIM identifier stored in the USIM based on the second protection strategy;

[0135] Step 43: Send the target SUCI to the ME.

[0136] The above optional implementations can be found in Figure 1 To avoid repeated description, the relevant descriptions in the embodiment shown in FIG. 1 are not repeated in this embodiment.

[0137] Optionally, the method further comprises at least one of the following:

[0138] If the UE does not support the second protection strategy, return error indication information to the ME;

[0139] If it is determined that the second protection policy is not compliant, returning error indication information to the ME;

[0140] If the USIM does not support the second protection strategy, returning error indication information to the ME;

[0141] The error indication information is used to instruct the ME to perform the steps of obtaining the SUCI calculation information and the USIM identifier from the USIM, determining a first protection strategy based on the SUCI calculation information, and calculating a target SUCI corresponding to the USIM identifier based on the first protection strategy.

[0142] It can be understood that the second protection strategy selected in the embodiment of the present application may be a protection strategy supported by the UE and having the highest priority, and may be implemented corresponding to the determination method of the first protection strategy in the aforementioned embodiment. In the case where the second protection strategy is not supported by the UE, is not compliant, is not used by the USIM, etc., the USIM may return error indication information to the ME, instructing the ME to determine the first protection strategy, and calculate the target SUCI according to the first protection strategy, so as to improve the protection level and security performance of the target SUCI.

[0143] Optionally, the method further comprises:

[0144] sending a first indication to the ME, where the first indication is used to instruct the ME to calculate the target SUCI;

[0145] and returning the SUCI calculation information and the USIM identifier to the ME.

[0146] In some other embodiments, Figure 5 As shown, the following steps are included:

[0147] Step 51: The ME sends a first request to the USIM, where the first request is used to request the USIM to obtain a target SUCI;

[0148] Step 52: The USIM obtains the SUCI protection policy information and the USIM identifier;

[0149] Step 53: The USIM selects a target protection policy corresponding to a target protection policy identifier supported by the UE according to at least one protection policy identifier and corresponding protection policy information;

[0150] Step 54: When it is determined that the target protection policy is not compliant, the USIM returns error indication information to the ME;

[0151] Step 55: The ME obtains the SUCI protection policy information and the USIM identifier from the USIM.

[0152] Step 56: The ME selects a target protection policy corresponding to a target protection policy identifier supported by the UE according to at least one protection policy identifier and corresponding protection policy information;

[0153] Step 57: The ME calculates the target SUCI corresponding to the USIM identifier based on the target protection policy.

[0154] Step 58: The ME sends the target SUCI to the network side.

[0155] Step 59: Receive a target SUCI sent by the UE; determine a corresponding target protection policy according to the target SUCI, and use the target protection policy to calculate a decrypted SUPI corresponding to the USIM identity of the UE;

[0156] Step 60: The network side performs authentication with the UE according to the decrypted SUPI to establish a communication connection with the UE.

[0157] It should be noted that the USIM identification generates the target SUCI, which can be achieved by the ME requesting the USIM to obtain the target SUCI. If the second protection policy determined by the USIM is not compliant, the USIM returns error indication information to the ME, instructing the ME to determine the target protection policy again, thereby generating the target SUCI according to the target protection policy.

[0158] At this time, the ME needs to determine the target protection policy. Therefore, after receiving the error indication information, the ME can request the USIM to obtain the SUCI calculation information and USIM identifier stored therein. After receiving the request from the ME, the USIM sends the SUCI calculation information and the USIM identifier to the ME. Subsequently, the ME can select a target protection policy that the UE can support based on at least one protection policy identifier and the corresponding protection policy information. Finally, the ME can directly calculate the target SUCI corresponding to the USIM identifier based on the target protection policy, and send the target SUCI to the network side device.

[0159] In this way, under the instruction of USIM, ME can quickly and flexibly complete the selection of target protection policy, the generation of target SUCI and the sending of target SUCI, making full use of the cryptographic calculation capability of ME in UE and improving the flexibility of policy negotiation mechanism.

[0160] In some other embodiments of the present application, Figure 6 As shown, the following steps are included:

[0161] Step 61: The ME sends a first request to the USIM, where the first request is used to request the USIM to obtain a target SUCI.

[0162] Step 62: The USIM obtains the SUCI protection policy information and the USIM identifier;

[0163] Step 63: The USIM selects a second protection policy supported by the UE according to at least one protection policy identifier and corresponding protection policy information;

[0164] Step 64: If the USIM does not support the second protection strategy, the USIM returns error indication information to the ME;

[0165] Step 65: The ME obtains the SUCI protection policy information and the USIM identifier from the USIM.

[0166] Step 66: The ME selects a target protection policy corresponding to a target protection policy identifier supported by the UE according to at least one protection policy identifier and corresponding protection policy information;

[0167] Step 67: The ME calculates the target SUCI corresponding to the USIM identifier based on the target protection policy.

[0168] Step 68: The ME sends the target SUCI to the network side.

[0169] Step 69: Receive a target SUCI sent by the UE; determine a corresponding target protection policy according to the target SUCI, and use the target protection policy to calculate a decrypted SUPI corresponding to the USIM identity of the UE;

[0170] Step 70: The network side performs authentication with the UE according to the decrypted SUPI to establish a communication connection with the UE.

[0171] Specifically, in order to realize the data connection between the UE and the network side device, the ME sends a first request to the USIM, requesting the USIM to send it a target SUCI. At this time, the USIM actively calculates the target SUCI. First, the USIM can obtain the SUCI calculation information and the USIM identifier from its own card file, and determine the second protection policy with the highest priority level according to a protection policy identifier in the protection policy list. If the USIM does not support the second protection policy, it can return an error indication information to the ME, and determine the target protection policy that the UE can support through the ME. Finally, the ME directly calculates the target SUCI corresponding to the USIM identifier according to the target protection policy, and sends the target SUCI to the network side device to complete the communication data connection between the UE and the network side device.

[0172] In this way, the USIM itself can also quickly and flexibly complete the selection of the target protection policy and the generation of the target SUCI, thereby improving the flexibility of the policy negotiation mechanism.

[0173] Optionally, the method further comprises:

[0174] Receive encryption algorithm update information sent by the network side device;

[0175] Based on the encryption algorithm update information, the SUCI calculation information stored in the USIM is updated.

[0176] See also Figure 6 In some other embodiments of the present application, the network side device may send protection policy update information to the UE to instruct the UE to start the protection policy update process, which specifically includes the following steps:

[0177] Step 71: The USIM sends a first indication to the ME, where the first indication is used to instruct the ME to calculate the target SUCI.

[0178] Step 72: The ME obtains the SUCI protection policy information and the USIM identifier from the USIM.

[0179] Step 73: The ME selects a second protection policy corresponding to the target protection policy identifier supported by the UE according to the at least one protection policy identifier and the corresponding protection policy information;

[0180] Step 74: The ME calculates a target SUCI corresponding to the USIM identifier based on the second protection strategy.

[0181] Step 75: The ME sends the target SUCI to the network side.

[0182] Step 77: Receive a target SUCI sent by the UE; determine a corresponding second protection strategy according to the target SUCI, and use the target protection strategy to calculate a decrypted SUPI corresponding to the USIM identity of the UE;

[0183] Step 77: The network side performs authentication with the UE according to the decrypted SUPI to establish a communication connection with the UE;

[0184] Step 78: When it is determined that there is a non-compliant protection policy in the SUCI protection policy information, the network side sends protection policy update information to the UE according to the version information of the target protection policy;

[0185] Step 79: Receive protection policy update information; and update the SUCI protection policy information stored in the USIM based on the protection policy update information.

[0186] Specifically, the network side device may send protection policy update information to the UE in the following cases: the protection policy pre-stored in the USIM is no longer safe or compliant; there is one or more public key information corresponding to the protection policy that needs to be modified; the priority of each protection policy pre-stored in the USIM needs to be adjusted, etc. This application does not specifically limit the reason why the network side device sends the protection policy update information, which can be adjusted according to actual application requirements.

[0187] In addition, when the relevant protection policy contained in the protection policy information in the USIM is not compliant, the network side device can send protection policy update information to the UE, instructing the USIM in the UE to update the protection policy information and protection policy identifier in its card file, so that a safe and effective protection policy can be adopted when calculating the target SUCI next time.

[0188] Specifically, the network side device can encrypt and package the latest protection strategy information into a SUCI calculation information update request and send it to the USIM through the Over-the-Air (OTA) channel. After receiving the SUCI calculation information update request, the USIM decrypts the SUCI calculation information and updates the local file (such as EF SUCI_Calc_Info In this way, the embodiment of the present application can flexibly update the SUCI calculation information of the USIM in the UE according to actual operation requirements, adapt to the changing requirements of the UE or network side equipment, and improve the flexibility of SUCI generation.

[0189] In another embodiment of the present application, before the protection policy information in the USIM needs to be updated, the version information (SPI ver) of the target protection policy can also be confirmed. If SPI ver is not the latest version or the required version, it indicates that the SUCI calculation information stored in the USIM has not been updated, and the network side device can initiate the home network SUCI protection policy update process. If the protection policy version corresponding to the current target protection policy is the latest version according to SPI ver, it indicates that the version of the USIM or ME needs to be updated, and the multiple protection policies in the current SUCI calculation information are difficult to support the protection scheme currently defined by the HN, then the HN can perform corresponding update processing according to the target protection policy and the current protection policy settings. For example, the user can be reminded to change the card or upgrade the terminal through channels such as text messages, or the supported SUCI protection policy can be issued to the user. Among them, the target information can be public key information, priority of the protection policy, etc.

[0190] In this way, the protection policy information in the USIM can be updated through the embodiment of the present application, and the UE can timely select the highest priority protection policy calculation target SUCI to make full use of the cryptographic computing capability of the UE and support the protection policy of the network side device. At the same time, the update of the protection policy information in the embodiment of the present application can only be achieved by modifying the USIM, ME and the unified data management function (Unified Data Management, UDM), without modifying other network elements and related interfaces, with low modification costs and high compatibility with the original protocol.

[0191] like Figure 8 As shown, the present application also provides a policy negotiation method, which is performed by a network side device, and the method includes:

[0192] Step 81: Receive the target SUCI sent by the UE, where the target SUCI is the target SUCI used by the USIM. Figure 1 The method described in the embodiment, or using Figure 4 Calculated by the method described in the embodiment;

[0193] Step 82: determining a corresponding target protection policy according to the target SUCI, and using the target protection policy to calculate a decrypted SUPI corresponding to the USIM identity of the UE, where the target protection policy is a first protection policy or a second protection policy;

[0194] Step 83: Perform authentication with the UE according to the decrypted SUPI to establish a communication connection with the UE.

[0195] Optionally, the method further comprises:

[0196] When it is determined that the target protection policy is not compliant, protection policy update information is sent to the UE according to version information of the target protection policy.

[0197] Optionally, the sending protection policy update information to the UE according to the version information of the target protection policy includes:

[0198] If the version of the target protection policy is not the latest version, modify the policy information corresponding to the target protection policy to obtain an updated SUCI protection policy, and send the updated SUCI protection policy to the USIM in the UE;

[0199] When the version of the target protection policy is the latest version, sending upgrade indication information to the UE, or sending SUCI calculation information supported by the UE to the UE, wherein the upgrade indication information is used to instruct the UE to upgrade the USIM card or upgrade the ME version.

[0200] It should be noted that the above optional implementations can be found in Figure 1 or Figure 4 To avoid repeated description, the relevant descriptions in the embodiment shown in FIG. 1 are not repeated in this embodiment.

[0201] like Fig. 9 As shown, the present application provides a policy negotiation device 90, which is applied to ME, and the device includes:

[0202] A first determining module 91 is configured to determine a first protection strategy with the highest priority supported by the user equipment UE based on calculation information of a hidden user identity SUCI stored in a universal user identity module USIM;

[0203] A first calculation module 92, configured to calculate a target SUCI corresponding to the USIM identifier stored in the USIM based on the first protection strategy;

[0204] The first sending module 93 is configured to send the target SUCI to the network side device.

[0205] Optionally, the first determining module 91 further includes at least one of the following:

[0206] a first acquiring unit, configured to acquire the SUCI calculation information and the USIM identifier from the USIM when receiving a first indication sent by the USIM;

[0207] The second acquiring unit is configured to acquire the SUCI calculation information and the USIM identifier from the USIM when receiving the error indication information sent by the USIM.

[0208] Optionally, the first calculation module 92 includes at least one of the following:

[0209] a first encryption unit, configured to, when the first protection policy is not a null algorithm, calculate the encrypted SUPI corresponding to the USIM identity using the first protection policy, set the protection output field of the target SUCI to the encrypted SUPI, and set the encryption algorithm ID field and the home network HN public key ID field of the target SUCI according to the policy information corresponding to the first protection policy;

[0210] a second encryption unit, configured to, when the first protection strategy is a null algorithm, calculate an unencrypted SUPI corresponding to the USIM identifier using a null algorithm, set a protection output field of the target SUCI to the unencrypted SUPI, and set an encryption algorithm ID field and an HN public key ID field of the target SUCI according to the null algorithm;

[0211] a third encryption unit, configured to, when the ME does not support the first protection policy, calculate the SUPI using a null algorithm, set the protection output field of the target SUCI to the unencrypted SUPI, and set a protection policy ID field and an HN public key ID field of the target SUCI according to the null algorithm.

[0212] It should be noted that the policy negotiation device 90 provided in the embodiment of the present application is capable of executing the above-mentioned Figure 1 If the device of the policy negotiation method shown in , all implementations of the policy negotiation method embodiment applied to ME are applicable to the policy negotiation device, and can achieve the same or similar beneficial effects. To avoid repeated description, this embodiment will not be repeated.

[0213] See also Fig.10 The embodiment of the present application further provides a policy negotiation device 100, which is applied to a USIM, and the device includes:

[0214] A first acquisition module 101 is used to determine a second protection strategy with the highest priority supported by the UE based on the SUCI calculation information stored in the USIM;

[0215] A second calculation module 102, configured to calculate a target SUCI corresponding to the USIM identifier stored in the USIM based on the second protection strategy;

[0216] The second sending module 103 is configured to send the target SUCI to the ME.

[0217] Optionally, the policy negotiation device 100 further includes at least one of the following:

[0218] A first returning module, configured to return error indication information to the ME when the UE does not support the second protection strategy;

[0219] A second returning module, configured to return error indication information to the ME when determining that the second protection policy is not compliant;

[0220] A third returning module, configured to return error indication information to the ME when the USIM does not support the second protection strategy;

[0221] The error indication information is used to instruct the ME to perform the steps of obtaining the SUCI calculation information and the USIM identifier from the USIM, determining a first protection strategy based on the SUCI calculation information, and calculating a target SUCI corresponding to the USIM identifier based on the first protection strategy.

[0222] Optionally, the first acquisition module 101 includes:

[0223] a third acquiring unit, configured to acquire the SUCI calculation information, wherein the SUCI calculation information includes at least one protection strategy and corresponding strategy information;

[0224] A fourth acquisition unit is configured to select, based on the at least one protection strategy and corresponding strategy information, a protection strategy with a highest priority from the at least one protection strategy as the second protection strategy.

[0225] Optionally, the second calculation module 102 includes:

[0226] a fourth encryption unit, configured to, when the second protection policy is not a null algorithm, calculate the encrypted user identity SUPI corresponding to the USIM identity by using the second protection policy, set the protection output field of the target SUCI to the encrypted SUPI, and set the encryption algorithm ID field and the home network HN public key ID field of the target SUCI according to the policy information corresponding to the second protection policy;

[0227] a fifth encryption unit, configured to, when the second protection strategy is a null algorithm, calculate an unencrypted SUPI corresponding to the USIM identifier by using a null algorithm, set a protection output field of the target SUCI to the unencrypted SUPI, and set an encryption algorithm ID field and an HN public key ID field of the target SUCI according to the null algorithm.

[0228] Optionally, the policy negotiation device 100 further includes:

[0229] A third sending module is configured to send a first indication to the ME, where the first indication is used to instruct the ME to calculate the target SUCI;

[0230] The third sending module is configured to return the SUCI calculation information and the USIM identifier to the ME.

[0231] Optionally, the policy negotiation device 100 further includes:

[0232] A second receiving module is used to receive encryption algorithm update information sent by the network side device;

[0233] An information updating module is used to update the SUCI calculation information stored in the USIM based on the encryption algorithm update information.

[0234] It should be noted that the policy negotiation device 100 provided in the embodiment of the present application is capable of executing the above-mentioned Figure 4 In the embodiment of the policy negotiation method shown in FIG, all implementations of the policy negotiation method applied to USIM are applicable to the policy negotiation device 100, and can achieve the same or similar beneficial effects. To avoid repeated description, this embodiment will not be repeated.

[0235] See also Fig.11 The embodiment of the present application further provides a policy negotiation device 200, which is applied to a network side device, and the device includes:

[0236] The first receiving module 201 is configured to receive a target SUCI sent by the UE, wherein the target SUCI is a Figure 1 or by using the method described in Figure 7Calculated by any of the methods described in any one of the above;

[0237] A third determining module 202 is configured to determine a corresponding target protection policy according to the target SUCI, and use the target protection policy to calculate a decrypted SUPI corresponding to the USIM identity of the UE, wherein the target protection policy is a first protection policy or a second protection policy;

[0238] An authentication module is used to perform authentication with the UE according to the decrypted SUPI to establish a communication connection with the UE.

[0239] Optionally, the policy negotiation device 200 further includes:

[0240] The fourth sending module is used to send protection policy update information to the UE according to the version information of the target protection policy when it is determined that the target protection policy is not compliant.

[0241] Optionally, the fourth sending module includes:

[0242] a policy updating unit, configured to, when a version of the target protection policy is not the latest version, modify policy information corresponding to the target protection policy to obtain an updated SUCI protection policy, and send the updated SUCI protection policy to the USIM in the UE;

[0243] A version upgrade unit is used to send upgrade indication information to the UE when the version of the target protection policy is the latest version, or send SUCI calculation information supported by the UE to the UE, wherein the upgrade indication information is used to instruct the UE to upgrade the USIM card or upgrade the ME version.

[0244] It should be noted that the policy negotiation device 200 provided in the embodiment of the present application is capable of executing the above-mentioned Figure 1 or Figure 4 In the embodiment of the policy negotiation method shown in FIG, all implementations of the policy negotiation method applied to USIM or ME are applicable to the policy negotiation device 200, and can achieve the same or similar beneficial effects. To avoid repeated description, this embodiment will not be repeated.

[0245] The present application also provides an electronic device. Figure 8 , Figure 8 Since the principle of solving the problem by the electronic device is similar to the policy negotiation method in the embodiment of the present application, the implementation of the electronic device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0246] like Fig.12As shown, the electronic device includes: a processor 300, which is used to read the program in the memory 320 and execute the following process:

[0247] Determine a first protection strategy with the highest priority supported by the user equipment UE based on calculation information of the user hidden identity SUCI stored in the universal user identity module USIM;

[0248] Calculate, based on the first protection strategy, a target SUCI corresponding to the USIM identifier stored in the USIM;

[0249] Sending the target SUCI to the network side device through the transceiver 310;

[0250] The transceiver 310 is configured to receive and send data under the control of the processor 300 .

[0251] Among them, Fig.12 In the embodiment of the present invention, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 300 and memory represented by memory 320. The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface.

[0252] Optionally, the processor 300 is further configured to read a program in the memory 320 and perform at least one of the following steps:

[0253] Upon receiving the first indication sent by the USIM, acquiring the SUCI calculation information and the USIM identifier from the USIM;

[0254] In a case where the error indication information sent by the USIM is received, the SUCI calculation information and the USIM identifier are acquired from the USIM.

[0255] Optionally, the processor 300 is further configured to read a program in the memory 320 and perform at least one of the following steps:

[0256] When the first protection policy is not a null algorithm, use the first protection policy to calculate the encrypted SUPI corresponding to the USIM identity, set the protection output field of the target SUCI to the encrypted SUPI, and set the encryption algorithm ID field and the home network HN public key ID field of the target SUCI according to the policy information corresponding to the first protection policy;

[0257] When the first protection strategy is a null algorithm, use the null algorithm to calculate the unencrypted SUPI corresponding to the USIM identity, set the protection output field of the target SUCI to the unencrypted SUPI, and set the encryption algorithm ID field and the HN public key ID field of the target SUCI according to the null algorithm;

[0258] In a case where the ME does not support the first protection strategy, the SUPI is calculated using a null algorithm, and a protection output field of the target SUCI is set to the unencrypted SUPI, and a protection strategy ID field and an HN public key ID field of the target SUCI are set according to the null algorithm.

[0259] The electronic device provided in the embodiment of the present application can perform the above Figure 1 , Figure 4 or Figure 8 The implementation principle and technical effect of the method embodiment shown are similar, and this embodiment will not be repeated here.

[0260] The embodiment of the present application also provides an electronic device. Since the principle of solving the problem by the electronic device is similar to the policy negotiation method performed by the USIM in the embodiment of the present application, the implementation of the electronic device can refer to the implementation of the method, and the repeated parts will not be repeated. Fig.13 As shown, the electronic device of the embodiment of the present application includes:

[0261] The processor 400 is used to read the program in the memory 420 and execute the following process:

[0262] Determining, based on the SUCI calculation information stored in the USIM, a second protection strategy with the highest priority supported by the UE;

[0263] Calculate, based on the second protection strategy, a target SUCI corresponding to the USIM identifier stored in the USIM;

[0264] Sending the target SUCI to the ME via the transceiver 410;

[0265] The transceiver 410 is configured to receive and send data under the control of the processor 400 .

[0266] Among them, Fig.13In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 400 and memory represented by memory 420. The bus architecture may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 410 may be a plurality of components, namely, a transmitter and a transceiver, providing a unit for communicating with various other devices on a transmission medium. The processor 400 is responsible for managing the bus architecture and general processing, and the memory 420 may store data used by the processor 400 when performing operations.

[0267] Optionally, the processor 400 is further configured to read a program in the memory 420 and perform at least one of the following steps:

[0268] If the UE does not support the second protection strategy, return error indication information to the ME;

[0269] If it is determined that the second protection policy is not compliant, returning error indication information to the ME;

[0270] If the USIM does not support the second protection strategy, returning error indication information to the ME;

[0271] The error indication information is used to instruct the ME to perform the steps of obtaining the SUCI calculation information and the USIM identifier from the USIM, determining a first protection strategy based on the SUCI calculation information, and calculating a target SUCI corresponding to the USIM identifier based on the first protection strategy.

[0272] Optionally, the processor 400 is further configured to read a program in the memory 420 and execute the following steps:

[0273] Acquiring the SUCI calculation information, wherein the SUCI calculation information includes at least one protection strategy and corresponding strategy information;

[0274] Based on the at least one protection policy and the corresponding policy information, a protection policy with the highest priority is selected from the at least one protection policy as the second protection policy.

[0275] Optionally, the processor 400 is further configured to read a program in the memory 420 and execute the following steps:

[0276] When the second protection policy is not a null algorithm, use the second protection policy to calculate the encrypted user identity SUPI corresponding to the USIM identity, set the protection output field of the target SUCI to the encrypted SUPI, and set the encryption algorithm ID field and the home network HN public key ID field of the target SUCI according to the policy information corresponding to the second protection policy;

[0277] When the second protection strategy is a null algorithm, an unencrypted SUPI corresponding to the USIM identifier is calculated using the null algorithm, and a protection output field of the target SUCI is set to the unencrypted SUPI, and an encryption algorithm ID field and an HN public key ID field of the target SUCI are set according to the null algorithm.

[0278] Optionally, the processor 400 is further configured to read a program in the memory 420 and execute the following steps:

[0279] sending a first indication to the ME, where the first indication is used to instruct the ME to calculate the target SUCI;

[0280] and returning the SUCI calculation information and the USIM identifier to the ME.

[0281] Optionally, the processor 400 is further configured to read a program in the memory 420 and execute the following steps:

[0282] Receive encryption algorithm update information sent by the network side device;

[0283] Based on the encryption algorithm update information, the SUCI calculation information stored in the USIM is updated.

[0284] The electronic device provided in the embodiment of the present application can perform the above Figure 1 , Figure 4 or Figure 8 The implementation principle and technical effect of the method embodiment shown are similar, and this embodiment will not be repeated here.

[0285] The embodiment of the present application also provides a network side device. Since the principle of the network side device to solve the problem is similar to the policy negotiation method performed by the network side device in the embodiment of the present application, the implementation of the network side device can refer to the implementation of the method, and the repeated parts will not be repeated. Fig.14 As shown, the network side device of the embodiment of the present application includes:

[0286] The processor 500 is used to read the program in the memory 520 and execute the following process:

[0287] The target SUCI sent by the UE is received by the transceiver 510, wherein the target SUCI is a Figure 1 The method described in the embodiment, or using Figure 4 Calculated by the method described in the embodiment;

[0288] Determine a corresponding target protection policy according to the target SUCI, and use the target protection policy to calculate the decrypted SUPI corresponding to the USIM identity of the UE, where the target protection policy is the first protection policy or the second protection policy;

[0289] performing authentication with the UE according to the decrypted SUPI to establish a communication connection with the UE;

[0290] The transceiver 510 is configured to receive and send data under the control of the processor 500 .

[0291] Among them, Fig.14 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 500 and memory represented by memory 520. The bus architecture may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 510 may be a plurality of components, namely, a transmitter and a transceiver, providing a unit for communicating with various other devices on a transmission medium. The processor 500 is responsible for managing the bus architecture and general processing, and the memory 520 may store data used by the processor 500 when performing operations.

[0292] Optionally, the processor 500 is further configured to read a program in the memory 520 and execute the following steps:

[0293] When it is determined that the target protection policy is not compliant, protection policy update information is sent to the UE according to version information of the target protection policy.

[0294] Optionally, the processor 500 is further configured to read a program in the memory 520 and execute the following steps:

[0295] If the version of the target protection policy is not the latest version, modify the policy information corresponding to the target protection policy to obtain an updated SUCI protection policy, and send the updated SUCI protection policy to the USIM in the UE;

[0296] When the version of the target protection policy is the latest version, sending upgrade indication information to the UE, or sending SUCI calculation information supported by the UE to the UE, wherein the upgrade indication information is used to instruct the UE to upgrade the USIM card or upgrade the ME version.

[0297] The electronic device provided in the embodiment of the present application can perform the above Figure 1 , Figure 4 or Figure 8 The implementation principle and technical effect of the method embodiment shown are similar, and this embodiment will not be repeated here.

[0298] The present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned Figure 1 or Figure 4 or Figure 8 The various processes of the embodiment of the policy negotiation method in the embodiment can achieve the same technical effect, and are not repeated here to avoid repetition. Among them, the computer-readable storage medium, such as read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0299] The present application embodiment further provides a computer program / program product, wherein the computer program / program product is stored in a storage medium, and the computer program / program product is executed by at least one processor to implement the above Figure 1 or Figure 4 or Figure 8 The various processes of the policy negotiation method implementation example can achieve the same technical effect, and will not be described again here to avoid repetition.

[0300] In the several embodiments provided in the present application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0301] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may be physically included separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0302] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform some steps of the sending and receiving methods described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0303] The above is a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles described in the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A policy negotiation method, characterized in that: Executed by a mobile device ME, the method includes: Determine a first protection strategy with the highest priority supported by the user equipment UE based on calculation information of the user hidden identity SUCI stored in the universal user identity module USIM; Calculate, based on the first protection strategy, a target SUCI corresponding to the USIM identifier stored in the USIM; Send the target SUCI to the network side device.

2. The method according to claim 1, characterized in that Before determining the first protection strategy with the highest priority supported by the UE based on the SUCI calculation information stored in the USIM, at least one of the following items is further included: Upon receiving the first indication sent by the USIM, acquiring the SUCI calculation information and the USIM identifier from the USIM; In a case where the error indication information sent by the USIM is received, the SUCI calculation information and the USIM identifier are acquired from the USIM.

3. The method according to claim 1 or 2, characterized in that: The calculating, based on the first protection strategy, a target SUCI corresponding to the USIM identifier stored in the USIM includes at least one of the following: When the first protection policy is not a null algorithm, use the first protection policy to calculate the encrypted SUPI corresponding to the USIM identity, set the protection output field of the target SUCI to the encrypted SUPI, and set the encryption algorithm ID field and the home network HN public key ID field of the target SUCI according to the policy information corresponding to the first protection policy; When the first protection strategy is a null algorithm, use the null algorithm to calculate the unencrypted SUPI corresponding to the USIM identity, set the protection output field of the target SUCI to the unencrypted SUPI, and set the encryption algorithm ID field and the HN public key ID field of the target SUCI according to the null algorithm; In a case where the ME does not support the first protection strategy, the SUPI is calculated using a null algorithm, and a protection output field of the target SUCI is set to the unencrypted SUPI, and a protection strategy ID field and an HN public key ID field of the target SUCI are set according to the null algorithm.

4. A policy negotiation method, characterized in that: Executed by the USIM, the method includes: Determining, based on the SUCI calculation information stored in the USIM, a second protection strategy with the highest priority supported by the UE; Calculate, based on the second protection strategy, a target SUCI corresponding to the USIM identifier stored in the USIM; The target SUCI is sent to the ME.

5. The method according to claim 4, characterized in that The method further comprises at least one of the following: If the UE does not support the second protection strategy, return error indication information to the ME; If it is determined that the second protection policy is not compliant, returning error indication information to the ME; If the USIM does not support the second protection strategy, returning error indication information to the ME; The error indication information is used to instruct the ME to perform the steps of obtaining the SUCI calculation information and the USIM identifier from the USIM, determining a first protection strategy based on the SUCI calculation information, and calculating a target SUCI corresponding to the USIM identifier based on the first protection strategy.

6. The method according to claim 4, characterized in that The determining, based on the SUCI calculation information stored in the USIM, a second protection strategy with the highest priority supported by the UE, includes: Acquiring the SUCI calculation information, wherein the SUCI calculation information includes at least one protection strategy and corresponding strategy information; Based on the at least one protection policy and the corresponding policy information, a protection policy with the highest priority is selected from the at least one protection policy as the second protection policy.

7. The method according to claim 6, characterized in that The calculating, based on the second protection strategy, a target SUCI corresponding to the USIM identifier stored in the USIM includes: When the second protection policy is not a null algorithm, use the second protection policy to calculate the encrypted user identity SUPI corresponding to the USIM identity, set the protection output field of the target SUCI to the encrypted SUPI, and set the encryption algorithm ID field and the home network HN public key ID field of the target SUCI according to the policy information corresponding to the second protection policy; When the second protection strategy is a null algorithm, an unencrypted SUPI corresponding to the USIM identifier is calculated using the null algorithm, and a protection output field of the target SUCI is set to the unencrypted SUPI, and an encryption algorithm ID field and an HN public key ID field of the target SUCI are set according to the null algorithm.

8. The method according to any one of claims 4 to 7, characterized in that The method further comprises: sending a first indication to the ME, where the first indication is used to instruct the ME to calculate the target SUCI; and returning the SUCI calculation information and the USIM identifier to the ME.

9. The method according to claim 4 or 5, characterized in that: The method further comprises: Receive encryption algorithm update information sent by the network side device; Based on the encryption algorithm update information, the SUCI calculation information stored in the USIM is updated.

10. A policy negotiation method, characterized in that: The method is performed by a network side device and includes: receiving a target SUCI sent by the UE, wherein the target SUCI is calculated by the USIM using the method of any one of claims 1 to 3, or using the method of any one of claims 4 to 9; Determine a corresponding target protection policy according to the target SUCI, and use the target protection policy to calculate the decrypted SUPI corresponding to the USIM identity of the UE, where the target protection policy is the first protection policy or the second protection policy; and performing authentication with the UE according to the decrypted SUPI to establish a communication connection with the UE.

11. The method according to claim 10, characterized in that The method further comprises: When it is determined that the target protection policy is not compliant, protection policy update information is sent to the UE according to version information of the target protection policy.

12. The method according to claim 11, characterized in that The sending protection policy update information to the UE according to the version information of the target protection policy includes: If the version of the target protection policy is not the latest version, modify the policy information corresponding to the target protection policy to obtain an updated SUCI protection policy, and send the updated SUCI protection policy to the USIM in the UE; When the version of the target protection policy is the latest version, sending upgrade indication information to the UE, or sending SUCI calculation information supported by the UE to the UE, wherein the upgrade indication information is used to instruct the UE to upgrade the USIM card or upgrade the ME version.

13. A policy negotiation device, characterized in that: Applied to ME, the device comprises: A first determination module, configured to determine a first protection strategy with the highest priority supported by the user equipment UE based on calculation information of a hidden user identity SUCI stored in a universal user identity module USIM; A first calculation module, configured to calculate a target SUCI corresponding to the USIM identifier stored in the USIM based on the first protection strategy; The first sending module is configured to send the target SUCI to a network side device.

14. A policy negotiation device, characterized in that: Applied to USIM, the device comprises: A first acquisition module, configured to determine a second protection strategy with the highest priority supported by the UE based on the SUCI calculation information stored in the USIM; A second determining module, configured to calculate a target SUCI corresponding to the USIM identifier stored in the USIM based on the second protection strategy; The second calculation module is configured to send the target SUCI to the ME.

15. A policy negotiation device, characterized in that: Applied to a network side device, the device comprises: A first receiving module, configured to receive a target SUCI sent by the UE, wherein the target SUCI is calculated by the USIM using the method of any one of claims 1 to 3, or using the method of any one of claims 4 to 9; a third determining module, configured to determine a corresponding target protection policy according to the target SUCI, and use the target protection policy to calculate a decrypted SUPI corresponding to the USIM identifier of the UE, wherein the target protection policy is a first protection policy or a second protection policy; An authentication module is used to perform authentication with the UE according to the decrypted SUPI to establish a communication connection with the UE.

16. An electronic device, characterized in that: include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps in the policy negotiation method as described in any one of claims 1 to 3, or implements the steps in the policy negotiation method as described in any one of claims 4 to 9, or implements the steps in the policy negotiation method as described in any one of claims 10 to 12.

17. A computer-readable storage medium for storing a computer program, characterized in that: When the computer program is executed by the processor, it implements the steps in the policy negotiation method as described in any one of claims 1 to 3, or implements the steps in the policy negotiation method as described in any one of claims 4 to 9, or implements the steps in the policy negotiation method as described in any one of claims 10 to 12.

18. A computer program product, characterized in that It comprises computer instructions which, when executed by a processor, implement the steps in the policy negotiation method as described in any one of claims 1 to 3, or implement the steps in the policy negotiation method as described in any one of claims 4 to 9, or implement the steps in the policy negotiation method as described in any one of claims 10 to 12.

Images