AKMA key information transmission method and device, computer equipment and storage medium

Abstract

The invention relates to an AKMA key information transmission method and device, computer equipment and a storage medium, and relates to the technical field of mobile communication. The method comprises the following steps: sending a first request message to a UDM network element; wherein the first request comprises position information of the terminal equipment; receiving a first response message sent by the UDM network element; wherein the first response message comprises information of the target AAnF network element; the target AAnF network element is determined by the UDM network element according to the position information and the service area information of the plurality of AAnF network elements; according to the information of the target AAnF network element, AKMA key information is sent to the target AAnF network element, and the AKMA key information is used for the target AAnF network element to authenticate the operation that the terminal device accesses an application function AF network element. In the main authentication stage of the terminal equipment, the AKMA key information is sent to the target AAnF network element, so that the signaling interaction process in the authentication process is reduced, the signaling resource is saved, and the access efficiency of the terminal equipment is improved at the same time.

Description

Technical Field

[0001] The present application relates to the field of mobile communication technology, and in particular to an AKMA key information transmission method, device, computer equipment and storage medium. Background Art

[0002] With the advancement of 5G (5th Generation Mobile Communication Technology), all industries are moving towards informatization and intelligence, and vertical industry applications of various forms are increasingly demanding edge platforms. Although the needs of vertical industries vary, the authentication requirements for services are consistent. Any user must be authenticated before accessing the service platform.

[0003] In the prior art, each time a terminal device accesses an AF (Application Function) network element, the AF network element needs to obtain the AKMA key information of the terminal device from the AAnF (akma anchor Function) network element. If the AAnF network element does not store the AKMA key information of the terminal device locally, the AAnF network element needs to first request the AUSF (AUthentication Server Function) network element to obtain the AKMA key information of the terminal device, and then send the processed AKMA key information to the AF network element. Due to the large amount of signaling interaction in this process, there is a large delay in the terminal device accessing the AF network element.

[0004] Based on this, how to improve the efficiency of terminal equipment accessing application functions has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] Based on this, it is necessary to provide an AKMA key information transmission method, device, computer equipment and storage medium that can improve the efficiency of terminal equipment accessing the application network in order to solve the above technical problems.

[0006] In a first aspect, the present application provides an AKMA key information transmission method, which is applied to an AUSF network element. The method comprises:

[0007] Sending a first request message to a UDM (Unified Data Management) network element; wherein the first request includes location information of the terminal device;

[0008] Receive a first response message sent by the UDM network element; wherein the first response message includes information of a target AKMA (Authentication and Key Management for Application) anchor function AAnF network element; the target AAnF network element is determined by the UDM network element according to the location information and service area information of multiple AAnF network elements;

[0009] According to the information of the target AAnF network element, AKMA key information is sent to the target AAnF network element, and the AKMA key information is used by the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0010] In one embodiment, the AKMA key information includes:

[0011] AKMA anchor key;

[0012] an identifier of the AKMA anchor key; and

[0013] The SUPI (SUbs cription Permanent Identifier) ​​of the terminal device.

[0014] In one embodiment, the method further comprises:

[0015] Receive the location information of the terminal device sent by the AMF network element.

[0016] In one of the embodiments, the first response message also includes application authentication and key management AKMA indication information, and the AKMA indication information is used to indicate that the terminal device has the authority to use the AKMA service.

[0017] In one embodiment, the method further comprises:

[0018] An AKMA anchor key and an identifier of the AKMA anchor key are generated according to the AKMA indication information.

[0019] In one of the embodiments, before sending the first request message to the unified data management function UDM network element, the method further includes:

[0020] A second request message is sent to the UDM network element, where the second request message is used to obtain the contract information of the terminal device.

[0021] In one embodiment, the method further comprises:

[0022] A second response message sent by the UDM network element in response to the second request message is received, where the second response message includes AKMA indication information.

[0023] In one embodiment, the method further comprises:

[0024] An AKMA anchor key and an identifier of the AKMA anchor key are generated according to the AKMA indication information.

[0025] In one embodiment, the method further comprises:

[0026] Receive a third response message sent by the target AAnF network element, where the third response message is sent by the target AAnF network element after receiving AKMA key information sent by the AUSF network element.

[0027] In a second aspect, the present application provides another AKMA key information transmission method, which is applied to a UDM network element. The method includes:

[0028] Receiving a first request message sent by an AUSF network element; wherein the first request includes location information of the terminal device;

[0029] determining a target AAnF network element from the plurality of AAnF network elements according to the location information and service area information of the plurality of AAnF network elements;

[0030] Send a first response message to the AUSF network element; wherein the first response message includes information of the target AAnF network element, and the information of the target AAnF network element is used for the AUSF network element to send AKMA key information to the target AAnF network element, and the AKMA key information is used for the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0031] In one embodiment, the AKMA key information includes:

[0032] AKMA anchor key;

[0033] an identifier of the AKMA anchor key; and

[0034] The SUPI of the terminal device.

[0035] In one of the embodiments, the first response message further includes AKMA indication information, where the AKMA indication information is used to indicate that the terminal device has the authority to use the AKMA service.

[0036] In one embodiment, the method further comprises:

[0037] The AKMA indication information is also used by the AUSF network element to generate an AKMA anchor key and an identifier of the AKMA key.

[0038] In one embodiment, the method further comprises:

[0039] Receive a second request message sent by the AUSF network element, where the second request message is used to obtain the contract information of the terminal device.

[0040] In one embodiment, the method further comprises:

[0041] In response to the second request message, a second response message is sent to the AUSF network element, wherein the second response message includes AKMA indication information.

[0042] In a third aspect, the present application also provides an AKMA key information transmission device. The device comprises:

[0043] A first request sending module, configured to send a first request message to the UDM network element; wherein the first request includes location information of the terminal device;

[0044] A first response receiving module is configured to receive a first response message sent by the UDM network element; wherein the first response message includes information of a target AAnF network element; the target AAnF network element is determined by the UDM network element according to the location information and service area information of multiple AAnF network elements;

[0045] The key information sending module is used to send AKMA key information to the target AAnF network element according to the information of the target AAnF network element, and the AKMA key information is used by the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0046] In a fourth aspect, the present application also provides another AKMA key information transmission device. The device comprises:

[0047] A first request receiving module is configured to receive a first request message sent by an AUSF network element; wherein the first request includes location information of a terminal device;

[0048] a target network element determination module, configured to determine a target AAnF network element from a plurality of AAnF network elements according to the location information and service area information of the plurality of AAnF network elements;

[0049] A first response sending module is used to send a first response message to the AUSF network element; wherein the first response message includes information of a target AAnF network element, and the information of the target AAnF network element is used for the AUSF network element to send AKMA key information to the target AAnF network element, and the AKMA key information is used for the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0050] In a fifth aspect, the present application further provides a computer device. The computer device includes a memory, a transceiver, and a processor, the memory stores a computer program, the transceiver is used to perform operations of receiving data or sending data under the control of the processor, and the processor implements the following steps when executing the computer program:

[0051] Sending a first request message to a unified data management function UDM network element; wherein the first request includes location information of the terminal device;

[0052] Receive a first response message sent by the UDM network element; wherein the first response message includes information of a target application authentication and key management AKMA anchor function AAnF network element; the target AAnF network element is determined by the UDM network element according to the location information and service area information of multiple AAnF network elements;

[0053] According to the information of the target AAnF network element, AKMA key information is sent to the target AAnF network element, and the AKMA key information is used by the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0054] Alternatively, when the processor executes the computer program, the following steps are implemented:

[0055] Receiving a first request message sent by an AUSF network element; wherein the first request includes location information of the terminal device;

[0056] determining a target AAnF network element from the plurality of AAnF network elements according to the location information and service area information of the plurality of AAnF network elements;

[0057] Send a first response message to the AUSF network element; wherein the first response message includes information of the target AAnF network element, and the information of the target AAnF network element is used for the AUSF network element to send AKMA key information to the target AAnF network element, and the AKMA key information is used for the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0058] In a sixth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the processing logic in the computer program is executed by a processor, the following steps are implemented:

[0059] Sending a first request message to a unified data management function UDM network element; wherein the first request includes location information of the terminal device;

[0060] Receive a first response message sent by the UDM network element; wherein the first response message includes information of a target application authentication and key management AKMA anchor function AAnF network element; the target AAnF network element is determined by the UDM network element according to the location information and service area information of multiple AAnF network elements;

[0061] According to the information of the target AAnF network element, AKMA key information is sent to the target AAnF network element, and the AKMA key information is used by the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0062] Alternatively, when the processing logic in the computer program is executed by a processor, the following steps are implemented:

[0063] Receiving a first request message sent by an AUSF network element; wherein the first request includes location information of the terminal device;

[0064] determining a target AAnF network element from the plurality of AAnF network elements according to the location information and service area information of the plurality of AAnF network elements;

[0065] Send a first response message to the AUSF network element; wherein the first response message includes information of the target AAnF network element, and the information of the target AAnF network element is used for the AUSF network element to send AKMA key information to the target AAnF network element, and the AKMA key information is used for the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0066] In a seventh aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0067] Sending a first request message to a unified data management function UDM network element; wherein the first request includes location information of the terminal device;

[0068] Receive a first response message sent by the UDM network element; wherein the first response message includes information of a target application authentication and key management AKMA anchor function AAnF network element; the target AAnF network element is determined by the UDM network element according to the location information and service area information of multiple AAnF network elements;

[0069] According to the information of the target AAnF network element, AKMA key information is sent to the target AAnF network element, and the AKMA key information is used by the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0070] Alternatively, when the processing logic in the computer program is executed by a processor, the following steps are implemented:

[0071] Receiving a first request message sent by an AUSF network element; wherein the first request includes location information of the terminal device;

[0072] determining a target AAnF network element from the plurality of AAnF network elements according to the location information and service area information of the plurality of AAnF network elements;

[0073] Send a first response message to the AUSF network element; wherein the first response message includes information of the target AAnF network element, and the information of the target AAnF network element is used for the AUSF network element to send AKMA key information to the target AAnF network element, and the AKMA key information is used for the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0074] According to the above-mentioned AKMA key information transmission method, apparatus, computer equipment and storage medium, the AUSF network element sends a first request message carrying the location information of the terminal device to the UDM network element; the UDM network element determines the target AAnF network element based on the location information of the terminal device and the service area information of multiple AAnF network elements, and sends a first response message carrying the information of the target AAnF network element to the AUSF network element; the AUSF network element sends AKMA key information to the target AAnF network element based on the information of the target AAnF network element, and the AKMA key information is used for the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element. Compared with the prior art, in the present application, during the main authentication phase of the terminal device, the AUSF network element sends the AKMA key information to the target AAnF network element based on the information of the target AAnF network element; the target AAnF network element locally stores the AKMA key information, and when the AF network element requests to obtain the AKMA key information, the target AAnF network element no longer needs to initiate the process of obtaining the AKMA key information from the AUSF network element, and can directly send the locally stored AKMA key information to the AF network element, thereby simplifying the signaling interaction process to save signaling resources and improving the efficiency of terminal equipment accessing the AF network element. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] Figure 1 An application environment diagram of an AKMA key information transmission method in an embodiment;

[0076] Figure 2 A schematic diagram of a flow chart of an AKMA key information transmission method in one embodiment;

[0077] Figure 3 A schematic diagram of a flow chart of an AKMA key information transmission method in another embodiment;

[0078] Figure 4 A schematic diagram of a flow chart of an AKMA key information transmission method in another embodiment;

[0079] Figure 5 A schematic diagram of a flow chart of an AKMA key information transmission method in another embodiment;

[0080] Figure 6 is a structural block diagram of an AKMA key information transmission device in one embodiment;

[0081] Figure 7 is a structural block diagram of an AKMA key information transmission device in one embodiment;

[0082] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0083] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0084] As mentioned in the previous background technology, the current 3GPP SA3 TS 33.535 has defined the specification of the AKMA (Authentication and Key Management for Applications) service process. The AAnF (AKMA Anchor Function) network element is used to store the AKMA anchor key K. AKMA and SUPI of AKMA service. After the terminal device UE successfully completes the 5G main authentication, the AAnF network element needs to obtain K from the AUSF network element. AKMA The AAnF network element also needs to generate a key Key used between the UE and the application function AF network element, and the key Key is used for subsequent transmission of the AKMA context. The AAnF network element sends the UE's SUPI to the AF network element or NEF network element located in the operator's network.

[0085] The problems existing in the prior art are as follows:

[0086] 1. In actual network deployment, AAnF network elements, as network elements similar to AUSF network elements within 3GPP, are likely to be deployed in a centralized manner and the number will not be too large.

[0087] 2. Every time the UE accesses the AF network element, the AF network element needs to obtain the AKMA of the UE access application from the AAnF network element, which results in a large amount of signaling interaction and a long interaction time. There are many reasons for the long interaction time, for example, 1) the AMKA of each UE or each application service is different, that is, each time the UE accesses the AF network element, the AF network element needs to obtain the relevant key from the AAnF network element, which results in a large amount of interaction; 2) If the UE is in a roaming situation, the AF network element also needs to query the AAnF network element where the UE is located through the BSF (Binding Support Function) network element, and then obtain the AKMA from the AAnF network element where the UE is located, which results in a greater delay; 3) If the AF network element is deployed in the operator's non-trusted domain, the AF network element also needs to use the NEF network element to complete the access to the AAnF network element, which results in a greater delay.

[0088] Every time the terminal device accesses the AF network element, the AF network element needs to authenticate the terminal. If the AKMA key stored locally in the AF network element (obtained from the AAnF network element last time) has not expired, the AF network element uses the key to authenticate the terminal; if the AKMA key stored locally in the AF network element has expired (whether it has expired depends on the timer setting), then the AF network element needs to obtain the AKMA key information of the terminal device, i.e., the AKMA key, from the AAnF network element again. The AKMA key information (AKMA key) stored in the AAnF network element comes from the AUSF network element. That is, each time the terminal device user authenticates, the AUSF network element will generate an AKMA key and send it to the corresponding AAnF network element in a timely manner. Because the AKMA key is generated during the primary authentication of the terminal device, the AUSF network element sends it to the AAnF network element after it is generated. Since there are many AAnF network elements, terminal devices are frequently online and interact frequently with AF network elements, there will be a large number of interactions between AAnF network elements and AF network elements. If the AF network element cannot interact with the AAnF network element based on location, there will be insecurity and a large amount of signaling interaction, resulting in a large delay in the terminal device accessing the AF network element.

[0089] Based on this, the present application proposes an AKMA key information transmission method, device, computer equipment and storage medium. In the main authentication stage of the terminal device, the target AAnF network element serving the terminal device is determined according to the location information of the terminal device, and the AKMA key information used for the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element is directly sent to the target AAnF network element. The target AAnF network element stores the AKMA key information so that when the AF network element requests to obtain relevant information, the target AAnF network element directly sends the relevant information in the AKMA key information to the AF network element, thereby reducing the signaling interaction process, saving signaling resources, and improving the efficiency of terminal equipment accessing the AF network element.

[0090] When the AF network element requests to obtain AKMA key information, this application directly obtains it from the matching target AAnF network element, avoiding problems such as long path delay, insecurity, etc., simplifying the signaling interaction process to save signaling resources, improving the efficiency of terminal equipment accessing the AF network element, and shortening the access delay.

[0091] Compared with the existing solution of AUSF network elements sending AKMA keys to AAnF network elements, this application is more targeted and more in line with the future development direction. Because with the development of vertical industries, AAnF network elements must provide regional services. Therefore, this application is more efficient, secure and practical, and in line with the future development direction; it greatly shortens user access latency, improves user experience, and reduces the difficulty of application development and adaptation, thereby improving user stickiness of the edge platform, and more applications will be willing to be deployed on the edge platform.

[0092] Figure 1 A schematic diagram showing an exemplary system architecture of an AKMA key information transmission method or an AKMA key information transmission device that can be applied to an embodiment of the present application.

[0093] The following is an introduction to some relevant functional network elements included in the communication system.

[0094] The user terminal (UE) accesses the data network (DN) and the like by accessing the operator network, and can use the services provided by the operator or a third party on the DN. For the convenience of explanation, the user terminal, user equipment, terminal equipment or terminal in the embodiments of the present application may be collectively referred to as UE. That is, unless otherwise specified, the UE described in the embodiments of the present application can be replaced by a user terminal, user equipment, terminal equipment or terminal, and of course they can also be interchanged.

[0095] (R)AN: (Radio) access network ((R)AN) mainly controls UE's wireless access to the mobile communication network.

[0096] Access and Mobility Management Function (AMF) is a control plane function in 3GPP network, which is mainly responsible for access control and mobility management of UE accessing operator network. Among them, Security Anchor Function (SEAF) can be deployed in AMF, or SEAF may also be deployed in another device different from AMF, taking SEAF being deployed in AMF as an example. When SEAF is deployed in AMF, SEAF and AMF can be collectively referred to as AMF.

[0097] The SMF (Session Management Function, SMF) network element is a control plane function in the 3GPP network. The SMF is mainly responsible for managing the UE's packet data unit (PDU) session. A PDU session is a channel for transmitting PDUs. UEs can send PDUs to and from DNs through PDU sessions. SMF is responsible for the establishment, maintenance, and deletion of PDU sessions.

[0098] The data network (DN), also known as the packet data network (PDN), is a network located outside the 3GPP network. The 3GPP network can access multiple DNs, and a variety of services provided by operators or third parties can be deployed on the DN. For example, a DN is a private network of a smart factory. The sensors installed in the workshop of the smart factory play the role of UE, and the control server of the sensor is deployed in the DN. The UE communicates with the control server. After obtaining the instructions of the control server, the UE can pass the collected data to the control server according to the instructions. For another example, the DN is an internal office network of a company, and the terminals used by the company's employees can play the role of UE, and this UE can access the company's internal information and other resources.

[0099] Among them, the Unified Data Management (UDM) is also a control plane function in the 3GPP network. UDM is mainly responsible for storing the subscription data, credentials and permanent identity (SUPI) of the subscriber (UE) in the 3GPP network. These data can be used for authentication and authorization of UE access to the operator's 3GPP network.

[0100] Among them, the Network Exposure Function (NEF) is also a control plane function in the 3GPP network. NEF is mainly responsible for opening the external interface of the 3GPP network to third parties in a secure manner. Among them, when functional network elements such as SMF need to communicate with third-party network elements, NEF can be used as a communication relay. Among them, during relaying, NEF can translate internal and external identifiers. For example, when the UE's SUPI is sent from the 3GPP network to a third party, NEF can translate the SUPI into its corresponding external identity (ID). Conversely, NEF can translate the external identity ID into the corresponding SUPI when sending it to the 3GPP network.

[0101] The Authentication Server Function (AUSF) is used for authentication services, key generation, and two-way authentication of user equipment, supporting a unified authentication framework. In the embodiment of the present application, it is mainly used for mutual authentication between the UE and the network, and generates security keys for use in subsequent processes.

[0102] AKMA Anchor Function (AAnF) is a new network function NF. AAnF can be a single deployed NF or co-located with other NFs. AAnF is used to support AKMA anchor key (K AKMA ), and generate the application key (K AF ).

[0103] Among them, the network storage function (NRF, Network Repository Function) is also a control plane function in the 3GPP network. It is mainly responsible for storing the configuration and service information (profile) of the accessible network function (NF) and providing network function discovery services for other functional network elements.

[0104] The user plane function UPF is the gateway for communication between the 3GPP network and the DN.

[0105] The Policy Control Function (PCF) is a control plane function in the 3GPP network, which is used to provide the SMF with the PDU session policy. The policy may include billing, Quality of Service (QoS), authorization-related policies, etc.

[0106] The Network Slice Selection Function (NSSF) is responsible for selecting network slices for the UE.

[0107] Application Function (AF) is responsible for user application management.

[0108] 3GPP network refers to a network that complies with 3GPP standards. Figure 1 The parts other than UE and DN can be regarded as 3GPP networks. 3GPP networks are not limited to 5G networks defined by 3GPP, but can also include 2G, 3G, and 4G networks. Usually 3GPP networks are operated by operators. Figure 1 N1, N2, N3, N4, N6, etc. in the illustrated architecture represent reference points between related network elements / network functions.

[0109] The present exemplary implementation is described in detail below with reference to the accompanying drawings and embodiments.

[0110] In one embodiment, Figure 2 As shown, a method for transmitting AKMA key information is provided, and the method is applied to Figure 1 The AUSF in the example is used to illustrate, including the following steps:

[0111] S202: Send a first request message to a unified data management function (UDM) network element.

[0112] The first request includes the location information of the terminal device. The location information of the terminal device is information indicating the location of the terminal device, for example, the location information may be the location coordinates of the terminal device.

[0113] Optionally, the first message request may be issued by the AUSF network element during the main authentication phase of the terminal device. For example, after the AUSF network element receives the main authentication request sent by the terminal device, the AUSF network element sends a first request message to the UDM network element. The main authentication request is used to instruct the AUSF network element to initiate an AKMA service authentication process for the terminal device, that is, a process for identity authentication and key negotiation between the mobile device and the network.

[0114] In one embodiment, the method further includes: receiving the location information of the terminal device sent by the AMF network element. Optionally, before sending the first request message to the UDM network element, the AUSF network element may first receive the location information of the terminal device sent by the AMF network element, and then send the first request message carrying the location information of the terminal device to the UDM network element.

[0115] S204: Receive a first response message sent by the UDM network element.

[0116] The first response message includes information of a target application authentication and key management AKMA anchor function AAnF network element; the target AAnF network element is determined by the UDM network element according to location information and service area information of multiple AAnF network elements.

[0117] Optionally, the UDM network element may pre-configure or store service area information of multiple AAnF network elements. The service area information of multiple AAnF network elements may be a correspondence table including multiple AAnF network elements and the service areas corresponding to each AAnF network element. For example, the correspondence table includes: the first service area Area1 corresponding to the first AAnF network element AAnF1, the second service area Area2 corresponding to the second AAnF network element AAnF2, the Nth service area AreaN corresponding to the Nth AAnF network element AAnFn, and so on. The service area may be an area range.

[0118] Optionally, after the UDM network element receives the first request message sent by the AUSF network element, the UDM network element determines the target AAnF network element that serves the terminal device from multiple AAnF network elements based on the terminal device location information in the first request and the service area information of multiple AAnF network elements stored locally, and sends a first response message carrying the information of the target AAnF network element to the AUSF network element.

[0119] Optionally, the information of the target AAnF network element is information used to indicate the identity of the target AAnF network element. For example, the information of the target AAnF network element may be a device identifier or a network identifier of the target AAnF network element.

[0120] S206, sending AKMA key information to the target AAnF network element according to the information of the target AAnF network element, where the AKMA key information is used by the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0121] In one embodiment, the AKMA key information includes: an AKMA anchor key, an identifier of the AKMA anchor key, and a subscription permanent identifier SUPI of the terminal device.

[0122] Optionally, the AUSF network element may apply an AKMA service operation to send the AKMA key information to the target AAnF network element, for example, the AUSF network element uses the Naanf_AKMA_KeyRegistration Request service operation to send the AKMA anchor key, the identifier of the AKMA anchor key and the SUPI of the terminal device to the target AAnF network element. The target AAnF network element stores the AKMA key information most recently sent by the AUSF network element.

[0123] In this embodiment, during the main authentication phase of the terminal device, the UDM network element determines the target AAnF network element based on the location information of the terminal device in the first request message sent by the AUSF network element and the service area information of multiple AAnF network elements stored locally, and sends a first response message carrying the information of the target AAnF network element to the AUSF network element; the AUSF network element sends the AKMA key information to the target AAnF network element based on the information of the target AAnF network element; the target AAnF network element locally stores the AKMA key information, and when the AF network element requests to obtain the AKMA key information, the target AAnF network element no longer needs to initiate the process of obtaining the AKMA key information from the AUSF network element, and can directly send the locally stored AKMA key information to the AF network element, thereby simplifying the signaling interaction process to save signaling resources and improving the efficiency of terminal equipment accessing the AF network element.

[0124] In one embodiment, the first message request can be used as a request message for uploading the location information of the terminal device alone, or as a message for requesting authentication and certification of the terminal device. When the first request message is used as a message for requesting authentication and certification of the terminal device, the first request message can also carry the SUPI or SUCI (SUbs criptionConcealed Identifier) ​​of the terminal device, so that the UDM network element can determine the contract information of the terminal device based on the SUPI / SUCI of the terminal device.

[0125] In one of the embodiments, the first response message also includes application authentication and key management AKMA indication information, and the AKMA indication information is used to indicate that the terminal device has the authority to use the AKMA service. The UDM network element determines the contract information of the terminal device based on the SUPI or SUCI of the terminal device. The contract information includes the terminal device's permission to use the AKMA service and the authentication method for the terminal device, such as EAP-AKA (Extensible Authentication Protocol-Authentication and Key Agreement, 3G to WLAN interconnection authentication and key distribution protocol) or 5G-AKA (5GAuthentication and Key Agreement, fifth-generation authentication and key agreement). In the process of the AUSF network element sending an authentication request for the terminal device to the UDM network element, in addition to uploading the device identification of the terminal device to the UDM network element, the present application also uploads the location information of the terminal device to the UDM network element, so that the UDM network element can determine the target AAnF network element serving the terminal device based on the location information of the terminal device, and save signaling resources by reducing the signaling interaction process, thereby improving the authentication efficiency of the terminal device.

[0126] Optionally, the method further comprises: generating an AKMA anchor key and an identifier of the AKMA anchor key according to the AKMA indication information. The first response message may also include an authentication server function key K AUSF , AUSF network elements can be based on K AUSF Generate AKMA anchor key K AKMA and the identifier of the AKMA anchor key A-KID (AKMA-Key IDentification, the identifier of the AKMA anchor key); or, the AUSF network element directly uses the K stored locally AUSF Generate AKMA anchor key K AKMA and the identifier A-KID of the AKMA anchor key.

[0127] In one of the embodiments, before sending a first request message to a unified data management function UDM network element, the method further includes: sending a second request message to the UDM network element, where the second request message is used to obtain the contract information of the terminal device. The first request message serves as a message for separately uploading the location information of the terminal device. Before uploading the location information of the terminal device to the UDM network element, the AUSF network element may first send a second request message to the UDM network element to obtain the contract information of the terminal device from the UDM network element. The second request message may include the SUPI or SUCI of the terminal device. For example, the AUSF network element may use the Nudm_UEAuthentication_Get Request service operation to send the second request message to the UDM network element.

[0128] Optionally, the AUSF network element can determine whether to send a first request message to the UDM network element based on the contract information. For example, when the contract information includes AKMA indication information, the AUSF network element sends a first request message to the UDM network element; when the contract information does not include AKMA indication information, that is, the terminal device does not have the authority to use the AKMA service, the AUSF network element no longer sends the first request message to the UDM network element to save signaling resources.

[0129] In one of the embodiments, the method further includes: receiving a second response message sent by the UDM network element in response to the second request message, the second response message including AKMA indication information.

[0130] In one embodiment, the method further comprises: generating an AKMA anchor key and an identifier of the AKMA anchor key according to the AKMA indication information. For example, the AUSF network element generates an AKMA anchor key and an identifier of the AKMA anchor key according to the authentication server function key K contained in the second response message. AUSF Generate AKMA anchor key K AKMA and the identifier of the AKMA anchor key A-KID; or, the AUSF network element directly uses the locally stored K AUSF Generate AKMA anchor key K AKMA and the identifier A-KID of the AKMA anchor key.

[0131] In one embodiment, the method further includes: receiving a third response message sent by the target AAnF network element, the third response message being sent by the target AAnF network element when receiving the AKMA key information sent by the AUSF network element. The target AAnF network element sends the third response message to the AUSF network element so as to notify the AUSF network element that the target AAnF network element has successfully received the AKMA key information. For example, the target AAnF network element sends the third response message to the AUSF network element using the Naanf_AKMA_AnchorKey_Register response service operation.

[0132] In one embodiment, Figure 3 As shown, a method for transmitting AKMA key information is provided, and the method is applied to Figure 1 The following steps are used as an example to illustrate the UDM in the example:

[0133] S302, receiving a first request message sent by an AUSF network element;

[0134] The first request includes the location information of the terminal device.

[0135] Optionally, the AUSF network element may use the Nudm_UEAuthentication_Get Request service operation to send the first request message to the UDM network element.

[0136] S304: Determine a target AAnF network element from the multiple AAnF network elements according to the location information and the service area information of the multiple AAnF network elements.

[0137] Optionally, the target service area information to which the location information belongs may be determined from a plurality of service area information, and then the AAnF network element corresponding to the target service area information may be determined as the target AAnF network element.

[0138] S306, sending a first response message to the AUSF network element.

[0139] Among them, the first response message includes the information of the target AAnF network element, and the information of the target AAnF network element is used for the AUSF network element to send AKMA key information to the target AAnF network element, and the AKMA key information is used for the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0140] Optionally, the first response message may also include contract information of the terminal device, where the contract information includes information about the terminal device's authority to use AKMA services and an authentication method for the terminal device, such as EAP-AKA or 5G-AKA.

[0141] In one embodiment, the AKMA key information includes: an AKMA anchor key, an identifier of the AKMA anchor key, and a SUPI of the terminal device.

[0142] In this embodiment, during the main authentication phase of the terminal device, the UDM network element determines the target AAnF network element based on the location information of the terminal device in the first request message sent by the AUSF network element and the service area information of multiple AAnF network elements stored locally, and sends a first response message carrying the information of the target AAnF network element to the AUSF network element; the AUSF network element sends the AKMA key information to the target AAnF network element based on the information of the target AAnF network element; the target AAnF network element locally stores the AKMA key information, and when the AF network element requests to obtain the AKMA key information, the target AAnF network element no longer needs to initiate the process of obtaining the AKMA key information from the AUSF network element, and can directly send the locally stored AKMA key information to the AF network element, thereby simplifying the signaling interaction process to save signaling resources and improving the efficiency of terminal equipment accessing the AF network element.

[0143] In one embodiment, the first response message further includes AKMA indication information, where the AKMA indication information is used to indicate that the terminal device has the authority to use the AKMA service.

[0144] In one embodiment, the method further includes: the AKMA indication information is also used for the AUSF network element to generate an AKMA anchor key and an AKMA key identifier. After receiving the AKMA indication information, the AUSF network element can generate an AKMA anchor key and an AKMA key identifier according to K AUSF Generate AKMA anchor key K AKMA and the identifier A-KID of the AKMA anchor key.

[0145] In one of the embodiments, the method further includes: receiving a second request message sent by the AUSF network element, where the second request message is used to obtain the contract information of the terminal device. The first request message is a message for separately uploading the location information of the terminal device. Before uploading the location information of the terminal device to the UDM network element, the AUSF network element may first send a second request message to the UDM network element to obtain the contract information of the terminal device from the UDM network element. The second request message may include the SUPI or SUCI of the terminal device. For example, the AUSF network element may use the Nudm_UEAuthentication_Get Request service operation to send the second request message to the UDM network element.

[0146] In one embodiment, the method further includes: in response to the second request message, sending a second response message to the AUSF network element, the second response message including AKMA indication information. The UDM network element identifies whether the terminal device has the authority to use the AKMA service according to the SUPI or SUCI of the terminal device in the second request message, and if the terminal device has the authority to use the AKMA service, sends the second response message carrying the AKMA indication information to the AUSF network element.

[0147] For example, this embodiment provides an optional implementation process based on the above embodiment, see Figure 4 The flowchart of another user clustering method shown in FIG. 1 specifically includes the following steps:

[0148] S402, the AMF network element sends the location information of the terminal device to the AUSF network element.

[0149] The location information of the terminal device may be the location coordinates of the terminal device.

[0150] S402, the AUSF network element sends a first request message to the UDM network element.

[0151] The first request includes the location information of the terminal device.

[0152] S406, the UDM network element sends a first response message to the AUSF network element.

[0153] The first response message includes information of the target AAnF network element; the target AAnF network element is determined by the UDM network element according to location information and service area information of multiple AAnF network elements.

[0154] S408, the AUSF network element generates an AKMA anchor key and an identifier of the AKMA anchor key.

[0155] The first response message may also include AKMA indication information and K AUSF , the AUSF network element can use the K contained in the first response message AUSF Generate AKMA anchor key K AKMA and the identifier of the AKMA anchor key A-KID; or, the AUSF network element directly uses the locally stored K AUSF Generate AKMA anchor key K AKMA and the identifier A-KID of the AKMA anchor key.

[0156] S410, the AUSF network element sends AKMA key information to the AAnF network element.

[0157] The AKMA key information is used by the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element. The AKMA key information includes: an AKMA anchor key, an identifier of the AKMA anchor key, and a subscription permanent identifier SUPI of the terminal device.

[0158] For example, this embodiment provides an optional implementation process based on the above embodiment, see Figure 5 FIG. 1 is a flow chart of another AKMA key information transmission method shown in FIG. 1 , wherein the process specifically includes the following steps:

[0159] S502, the AMF network element sends the location information of the terminal device to the AUSF network element.

[0160] The location information of the terminal device may be the location coordinates of the terminal device.

[0161] S502, the AUSF network element sends a second request message to the UDM network element.

[0162] The second request message may include the SUPI or SUCI of the terminal device.

[0163] S506, the UDM network element sends a second response message to the AUSF network element.

[0164] The second response message may include AKMA indication information and K AUSF .

[0165] S508, the AUSF network element generates an AKMA anchor key and an identifier of the AKMA anchor key.

[0166] The AUSF network element may determine the K contained in the second response message. AUSF Generate AKMA anchor key K AKMA and the identifier of the AKMA anchor key A-KID; or, the AUSF network element directly uses the locally stored K AUSF Generate AKMA anchor key K AKMA and the identifier A-KID of the AKMA anchor key.

[0167] S510, the AUSF network element sends a first request message to the UDM network element.

[0168] The first request includes the location information of the terminal device.

[0169] S512, the UDM network element sends a first response message to the AUSF network element.

[0170] The first response message includes information of the target AAnF network element; the target AAnF network element is determined by the UDM network element according to location information and service area information of multiple AAnF network elements.

[0171] S514, the AUSF network element sends AKMA key information to the AAnF network element.

[0172] The AKMA key information is used by the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element. The AKMA key information includes: an AKMA anchor key, an identifier of the AKMA anchor key, and a subscription permanent identifier SUPI of the terminal device.

[0173] The specific process of the above S402-S410 or S502-S514 can refer to the description of the above method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0174] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0175] Based on the same inventive concept, the embodiment of the present application also provides an AKMA key information transmission device for implementing the above-mentioned AKMA key information transmission method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in one or more AKMA key information transmission device embodiments provided below can refer to the above-mentioned limitations on the AKMA key information transmission method, which will not be repeated here.

[0176] In one embodiment, Figure 6 As shown, an AKMA key information transmission device is provided, which is applied to the AUSF network element side, and the device includes:

[0177] A first request sending module 610 is configured to send a first request message to a UDM network element; wherein the first request includes location information of a terminal device;

[0178] The first response receiving module 620 is used to receive a first response message sent by the UDM network element; wherein the first response message includes information of a target AAnF network element; the target AAnF network element is determined by the UDM network element according to location information and service area information of multiple AAnF network elements;

[0179] The key information sending module 630 is used to send AKMA key information to the target AAnF network element according to the information of the target AAnF network element. The AKMA key information is used by the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0180] In the above-mentioned device, during the main authentication stage of the terminal device, the UDM network element determines the target AAnF network element based on the location information of the terminal device in the first request message sent by the AUSF network element and the service area information of multiple AAnF network elements stored locally, and sends a first response message carrying the information of the target AAnF network element to the AUSF network element; the AUSF network element sends the AKMA key information to the target AAnF network element based on the information of the target AAnF network element; the target AAnF network element locally stores the AKMA key information, and when the AF network element requests to obtain the AKMA key information, the target AAnF network element no longer needs to initiate the process of obtaining the AKMA key information from the AUSF network element, and can directly send the locally stored AKMA key information to the AF network element, thereby simplifying the signaling interaction process to save signaling resources and improve the efficiency of terminal equipment accessing the AF network element.

[0181] In one embodiment, the AKMA key information includes:

[0182] AKMA anchor key;

[0183] an identifier for the AKMA anchor key; and

[0184] Subscription Permanent Identifier (SUPI) of the terminal device.

[0185] In one of the embodiments, the above-mentioned device also includes a location receiving module, which is used to receive the location information of the terminal device sent by the AMF network element.

[0186] In one of the embodiments, the first response message also includes application authentication and key management AKMA indication information, where the AKMA indication information is used to indicate that the terminal device has the authority to use the AKMA service.

[0187] In one of the embodiments, the apparatus further includes a key generation module, wherein the key generation module is configured to generate an AKMA anchor key and an identifier of the AKMA anchor key according to the AKMA indication information.

[0188] In one of the embodiments, the above-mentioned apparatus further includes a second request sending module, and the second request sending module is used to send a second request message to the UDM network element, and the second request message is used to obtain the contract information of the terminal device.

[0189] In one of the embodiments, the apparatus further includes a second response receiving module, where the second response receiving module is configured to receive a second response message sent by the UDM network element in response to the second request message, where the second response message includes AKMA indication information.

[0190] In one of the embodiments, the above-mentioned device also includes a third response receiving module, which is used to receive a third response message sent by the target AAnF network element. The third response message is sent by the target AAnF network element when it receives AKMA key information sent by the AUSF network element.

[0191] In one embodiment, Figure 7 As shown, another AKMA key information transmission device is provided, which is applied to the UDM network element side, and the device includes:

[0192] The first request receiving module 710 is configured to receive a first request message sent by an AUSF network element; wherein the first request includes location information of the terminal device;

[0193] A target network element determination module 720, configured to determine a target AAnF network element from multiple AAnF network elements according to the location information and the service area information of the multiple AAnF network elements;

[0194] The first response sending module 730 is used to send a first response message to the AUSF network element; wherein the first response message includes information of the target AAnF network element, and the information of the target AAnF network element is used for the AUSF network element to send AKMA key information to the target AAnF network element, and the AKMA key information is used for the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0195] In the above-mentioned device, during the main authentication stage of the terminal device, the UDM network element determines the target AAnF network element based on the location information of the terminal device in the first request message sent by the AUSF network element and the service area information of multiple AAnF network elements stored locally, and sends a first response message carrying the information of the target AAnF network element to the AUSF network element; the AUSF network element sends the AKMA key information to the target AAnF network element based on the information of the target AAnF network element; the target AAnF network element locally stores the AKMA key information, and when the AF network element requests to obtain the AKMA key information, the target AAnF network element no longer needs to initiate the process of obtaining the AKMA key information from the AUSF network element, and can directly send the locally stored AKMA key information to the AF network element, thereby simplifying the signaling interaction process to save signaling resources and improve the efficiency of terminal equipment accessing the AF network element.

[0196] In one embodiment, the AKMA key information includes:

[0197] AKMA anchor key;

[0198] an identifier for the AKMA anchor key; and

[0199] The SUPI of the terminal device.

[0200] In one of the embodiments, the first response message further includes AKMA indication information, where the AKMA indication information is used to indicate that the terminal device has the authority to use the AKMA service.

[0201] In one of the embodiments, the AKMA indication information is also used for the AUSF network element to generate an AKMA anchor key and an identifier of the AKMA key.

[0202] In one of the embodiments, the above-mentioned device also includes a second request receiving module, and the second request receiving module is used to receive a second request message sent by the AUSF network element, and the second request message is used to obtain the contract information of the terminal device.

[0203] In one of the embodiments, the above-mentioned device also includes a second response sending module, and the second response sending module is used to send a second response message to the AUSF network element in response to the second request message, and the second response message includes AKMA indication information.

[0204] Each module in the above-mentioned AKMA key information transmission device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0205] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 8 As shown. The computer device includes a processor, a memory, a network interface and a transceiver (not shown in the figure) connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The transceiver of the computer device is used to perform operations of receiving data or sending data under the control of the processor. The database of the computer device is used to store location information, service area information of multiple AAnF network elements, AKMA key information, AKMA anchor key, SUPI and other data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an AKMA key information transmission method is implemented.

[0206] Those skilled in the art will understand that Figure 8The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0207] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the processing logic in the computer program, the following steps are implemented:

[0208] Sending a first request message to a unified data management function UDM network element; wherein the first request includes location information of the terminal device;

[0209] Receive a first response message sent by the UDM network element; wherein the first response message includes information of a target application authentication and key management AKMA anchor function AAnF network element; the target AAnF network element is determined by the UDM network element according to location information and service area information of multiple AAnF network elements;

[0210] According to the information of the target AAnF network element, AKMA key information is sent to the target AAnF network element, and the AKMA key information is used by the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0211] Alternatively, the processor implements the following steps when executing the processing logic in the computer program:

[0212] Receiving a first request message sent by an AUSF network element; wherein the first request includes location information of the terminal device;

[0213] determining a target AAnF network element from the plurality of AAnF network elements according to the location information and the service area information of the plurality of AAnF network elements;

[0214] A first response message is sent to the AUSF network element; wherein the first response message includes information of the target AAnF network element, and the information of the target AAnF network element is used for the AUSF network element to send AKMA key information to the target AAnF network element, and the AKMA key information is used for the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0215] In one embodiment, when the processor executes the processing logic in the computer program, it also implements the following steps: receiving the location information of the terminal device sent by the AMF network element.

[0216] In one embodiment, when the processor executes the processing logic in the computer program, the processor further implements the following steps: generating an AKMA anchor key and an identifier of the AKMA anchor key according to the AKMA indication information.

[0217] In one embodiment, when the processor executes the processing logic in the computer program, the processor further implements the following steps: sending a second request message to the UDM network element, where the second request message is used to obtain the contract information of the terminal device.

[0218] In one embodiment, when the processor executes the processing logic in the computer program, the processor further implements the following steps: receiving a second response message sent by the UDM network element in response to the second request message, the second response message including AKMA indication information.

[0219] In one embodiment, when the processor executes the processing logic in the computer program, it also implements the following steps: receiving a third response message sent by the target AAnF network element, the third response message is sent by the target AAnF network element when it receives the AKMA key information sent by the AUSF network element.

[0220] In one embodiment, when the processor executes the processing logic in the computer program, it also implements the following steps: receiving a second request message sent by the AUSF network element, where the second request message is used to obtain the contract information of the terminal device.

[0221] In one embodiment, when the processor executes the processing logic in the computer program, it also implements the following steps: in response to the second request message, sending a second response message to the AUSF network element, the second response message including AKMA indication information.

[0222] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the processing logic in the computer program is executed by a processor, the following steps are implemented:

[0223] Sending a first request message to a unified data management function UDM network element; wherein the first request includes location information of the terminal device;

[0224] Receive a first response message sent by the UDM network element; wherein the first response message includes information of a target application authentication and key management AKMA anchor function AAnF network element; the target AAnF network element is determined by the UDM network element according to location information and service area information of multiple AAnF network elements;

[0225] According to the information of the target AAnF network element, AKMA key information is sent to the target AAnF network element, and the AKMA key information is used by the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0226] Alternatively, the processing logic in the computer program implements the following steps when executed by the processor:

[0227] Receiving a first request message sent by an AUSF network element; wherein the first request includes location information of the terminal device;

[0228] determining a target AAnF network element from the plurality of AAnF network elements according to the location information and the service area information of the plurality of AAnF network elements;

[0229] A first response message is sent to the AUSF network element; wherein the first response message includes information of the target AAnF network element, and the information of the target AAnF network element is used for the AUSF network element to send AKMA key information to the target AAnF network element, and the AKMA key information is used for the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0230] In one embodiment, when the processing logic in the computer program is executed by the processor, the following steps are also implemented: receiving the location information of the terminal device sent by the AMF network element.

[0231] In one embodiment, when the processing logic in the computer program is executed by the processor, the following steps are also implemented: a second request message is sent to the UDM network element, where the second request message is used to obtain the contract information of the terminal device.

[0232] In one embodiment, when the processing logic in the computer program is executed by the processor, the following steps are further implemented: receiving a second response message sent by the UDM network element in response to the second request message, the second response message including AKMA indication information.

[0233] In one embodiment, when the processing logic in the computer program is executed by the processor, the following steps are further implemented: generating an AKMA anchor key and an identifier of the AKMA anchor key according to the AKMA indication information.

[0234] In one embodiment, when the processing logic in the computer program is executed by the processor, the following steps are also implemented: receiving a third response message sent by the target AAnF network element, where the third response message is sent by the target AAnF network element after receiving the AKMA key information sent by the AUSF network element.

[0235] In one embodiment, when the processing logic in the computer program is executed by the processor, the following steps are also implemented: receiving a second request message sent by the AUSF network element, where the second request message is used to obtain the contract information of the terminal device.

[0236] In one embodiment, when the processing logic in the computer program is executed by the processor, the following steps are also implemented: in response to the second request message, a second response message is sent to the AUSF network element, and the second response message includes AKMA indication information.

[0237] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0238] Sending a first request message to a unified data management function UDM network element; wherein the first request includes location information of the terminal device;

[0239] Receive a first response message sent by the UDM network element; wherein the first response message includes information of a target application authentication and key management AKMA anchor function AAnF network element; the target AAnF network element is determined by the UDM network element according to location information and service area information of multiple AAnF network elements;

[0240] According to the information of the target AAnF network element, AKMA key information is sent to the target AAnF network element, and the AKMA key information is used by the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0241] Alternatively, the processing logic in the computer program implements the following steps when executed by the processor:

[0242] Receiving a first request message sent by an AUSF network element; wherein the first request includes location information of the terminal device;

[0243] determining a target AAnF network element from the plurality of AAnF network elements according to the location information and the service area information of the plurality of AAnF network elements;

[0244] A first response message is sent to the AUSF network element; wherein the first response message includes information of the target AAnF network element, and the information of the target AAnF network element is used for the AUSF network element to send AKMA key information to the target AAnF network element, and the AKMA key information is used for the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

[0245] In one embodiment, when the processing logic in the computer program is executed by the processor, the following steps are also implemented: receiving the location information of the terminal device sent by the AMF network element.

[0246] In one embodiment, when the processing logic in the computer program is executed by the processor, the following steps are also implemented: a second request message is sent to the UDM network element, where the second request message is used to obtain the contract information of the terminal device.

[0247] In one embodiment, when the processing logic in the computer program is executed by the processor, the following steps are further implemented: receiving a second response message sent by the UDM network element in response to the second request message, the second response message including AKMA indication information.

[0248] In one embodiment, when the processing logic in the computer program is executed by the processor, the following steps are further implemented: generating an AKMA anchor key and an identifier of the AKMA anchor key according to the AKMA indication information.

[0249] In one embodiment, when the processing logic in the computer program is executed by the processor, the following steps are also implemented: receiving a third response message sent by the target AAnF network element, where the third response message is sent by the target AAnF network element after receiving the AKMA key information sent by the AUSF network element.

[0250] In one embodiment, when the processing logic in the computer program is executed by the processor, the following steps are also implemented: receiving a second request message sent by the AUSF network element, where the second request message is used to obtain the contract information of the terminal device.

[0251] In one embodiment, when the processing logic in the computer program is executed by the processor, the following steps are also implemented: in response to the second request message, a second response message is sent to the AUSF network element, and the second response message includes AKMA indication information.

[0252] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0253] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0254] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An AKMA key information transmission method, characterized in that: Applied to an authentication server function AUSF network element, the method comprises: Sending a first request message to a unified data management function UDM network element; wherein the first request includes location information of the terminal device; Receive a first response message sent by the UDM network element; wherein the first response message includes information of a target application authentication and key management AKMA anchor function AAnF network element; the target AAnF network element is determined by the UDM network element according to the location information and service area information of multiple AAnF network elements; According to the information of the target AAnF network element, AKMA key information is sent to the target AAnF network element, and the AKMA key information is used by the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

2. The method according to claim 1, characterized in that The AKMA key information includes: AKMA anchor key; an identifier of the AKMA anchor key; and The subscription permanent identifier SUPI of the terminal device.

3. The method according to claim 1, characterized in that The method further comprises: Receive the location information of the terminal device sent by the AMF network element.

4. The method according to claim 1, characterized in that: The first response message also includes application authentication and key management AKMA indication information, where the AKMA indication information is used to indicate that the terminal device has the authority to use the AKMA service.

5. The method according to claim 4, characterized in that The method further comprises: An AKMA anchor key and an identifier of the AKMA anchor key are generated according to the AKMA indication information.

6. The method according to claim 1, characterized in that Before sending the first request message to the unified data management function UDM network element, the method further includes: A second request message is sent to the UDM network element, where the second request message is used to obtain the contract information of the terminal device.

7. The method according to claim 6, characterized in that The method further comprises: A second response message sent by the UDM network element in response to the second request message is received, where the second response message includes AKMA indication information.

8. The method according to claim 7, characterized in that The method further comprises: An AKMA anchor key and an identifier of the AKMA anchor key are generated according to the AKMA indication information.

9. The method according to claim 1, characterized in that: The method further comprises: Receive a third response message sent by the target AAnF network element, where the third response message is sent by the target AAnF network element after receiving AKMA key information sent by the AUSF network element.

10. An AKMA key information transmission method, characterized in that: Applied to a UDM network element, the method comprises: Receiving a first request message sent by an AUSF network element; wherein the first request includes location information of the terminal device; determining a target AAnF network element from the plurality of AAnF network elements according to the location information and service area information of the plurality of AAnF network elements; Send a first response message to the AUSF network element; wherein the first response message includes information of the target AAnF network element, and the information of the target AAnF network element is used for the AUSF network element to send AKMA key information to the target AAnF network element, and the AKMA key information is used for the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

11. The method according to claim 10, characterized in that The AKMA key information includes: AKMA anchor key; an identifier of the AKMA anchor key; and The SUPI of the terminal device.

12. The method according to claim 10, characterized in that The first response message also includes AKMA indication information, where the AKMA indication information is used to indicate that the terminal device has the authority to use the AKMA service.

13. The method according to claim 12, characterized in that The method further comprises: The AKMA indication information is also used by the AUSF network element to generate an AKMA anchor key and an identifier of the AKMA key.

14. The method according to claim 10, characterized in that The method further comprises: Receive a second request message sent by the AUSF network element, where the second request message is used to obtain the contract information of the terminal device.

15. The method according to claim 14, characterized in that The method further comprises: In response to the second request message, a second response message is sent to the AUSF network element, wherein the second response message includes AKMA indication information.

16. An AKMA key information transmission device, characterized in that: Applied to the AUSF network element side, the device comprises: A first request sending module, configured to send a first request message to the UDM network element; wherein the first request includes location information of the terminal device; A first response receiving module is configured to receive a first response message sent by the UDM network element; wherein the first response message includes information of a target AAnF network element; the target AAnF network element is determined by the UDM network element according to the location information and service area information of multiple AAnF network elements; The key information sending module is used to send AKMA key information to the target AAnF network element according to the information of the target AAnF network element, and the AKMA key information is used by the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

17. An AKMA key information transmission device, characterized in that: Applied to the UDM network element side, the device includes: A first request receiving module is configured to receive a first request message sent by an AUSF network element; wherein the first request includes location information of a terminal device; a target network element determination module, configured to determine a target AAnF network element from a plurality of AAnF network elements according to the location information and service area information of the plurality of AAnF network elements; A first response sending module is used to send a first response message to the AUSF network element; wherein the first response message includes information of a target AAnF network element, and the information of the target AAnF network element is used for the AUSF network element to send AKMA key information to the target AAnF network element, and the AKMA key information is used for the target AAnF network element to authenticate the operation of the terminal device accessing the application function AF network element.

18. A computer device comprising a memory, a transceiver and a processor, wherein the memory stores a computer program, characterized in that: The processor implements the steps of the method described in any one of claims 1 to 9 when executing the computer program, or implements the steps of the method described in any one of claims 10 to 15 when executing the computer program, and the transceiver is used to perform the operation of receiving data or sending data under the control of the processor.

19. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 15 are implemented.

20. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 15 are implemented.

Images