Communication method and communication device

Abstract

A communication method and a communication device, the method comprising: acquiring a first parameter and a first key, the first key corresponding to a plurality of terminal devices in a group to which the terminal devices belong, the combination of the first parameter and the first key uniquely corresponding to the terminal devices; generating a message authentication code MAC according to the first parameter and the first key; and sending the MAC to the network equipment, wherein the MAC is used for the network equipment to authenticate the terminal equipment. The first key for the terminal device to generate the MAC corresponds to the plurality of terminal devices, that is, the plurality of terminal devices can share the same key, so that the cost of managing the keys of the terminal devices by the network device is reduced.

Description

Technical Field

[0001] The present application relates to the technical field of security management, and more specifically, to a communication method and a communication device. Background Art

[0002] Radio frequency identification (RFID) is an automatic identification technology that can perform non-contact two-way data communication through radio frequency, read or write recording media (such as electronic tags or radio frequency cards), thereby achieving the purpose of identifying targets and exchanging data.

[0003] RFID systems can include tags, readers, and radio frequency communication channels between tags and readers. Tags can have low complexity and small dimensions, which makes RFID systems have a wide range of applications, long service life, and great advantages in power consumption. However, RFID has a limited reading range, which makes the operation time-consuming. Therefore, it is difficult for RFID to achieve large-scale networks with seamless coverage by densely deploying tags.

[0004] It can be seen that the RFID system is currently unable to meet the needs of the future IoT's wide-area coverage of hundreds of billions of devices. Therefore, new IoT technologies are urgently needed to support a device connection number and / or device density that is an order of magnitude higher than the existing IoT, and to realize new use cases and scenarios in the future IoT. As the number of devices grows toward the hundreds of billions, new IoT technologies are bound to face the problem of rapidly increasing management costs for device information. Summary of the invention

[0005] The embodiment of the present application provides a communication method, which can reduce the cost of a network device managing a key of a terminal device.

[0006] In a first aspect, a communication method is provided. The method may be executed by a terminal device, or may be executed by a component of the terminal device (eg, a chip or a circuit), without limitation.

[0007] The method includes: obtaining a first parameter and a first key, the first key corresponding to multiple terminal devices in the group to which the terminal device belongs, and the combination of the first parameter and the first key uniquely corresponds to the terminal device; generating a message authentication code MAC according to the first parameter and the first key; sending the MAC to a network device, and the MAC is used by the network device to authenticate the terminal device.

[0008] According to the communication method provided by the present application, the first key used by the terminal device to generate MAC is in the form of a group key, that is, one or more terminal devices can be pre-configured with the same key, or the first key can correspond to a number segment to which the terminal device's identifier belongs, and the number segment includes one or more terminal devices, thereby avoiding one key for each terminal device and reducing the cost of network devices managing the keys of terminal devices.

[0009] In combination with the first aspect, in some possible implementations, the combination of the first parameter and the first key uniquely corresponds to the terminal device, including: the second key generated based on the first parameter and the first key uniquely corresponds to the terminal device; the message authentication code MAC is generated based on the first parameter and the first key, including: the MAC is generated based on the second key and the first parameter.

[0010] Based on the above technical solution, when the terminal device generates MAC according to the first key and the first parameter, it can generate the second key according to the first key and the first parameter, and then generate the MAC according to the second key and the first parameter. Among them, the key used by the terminal device to generate MAC is a new key determined by the terminal device according to the key corresponding to the multiple terminal devices pre-configured by the network device and the first parameter, and the MAC is not directly generated according to the first key, thereby preventing the attacker from easily obtaining the key used for authentication by the terminal device, thereby ensuring communication security.

[0011] In combination with the first aspect, in some possible implementations, the message authentication code MAC is generated according to the first parameter and the first key, including: generating the MAC according to the first parameter, the first key and a second parameter, the second parameter comes from the access network device, or the second parameter comes from the network device.

[0012] In combination with the first aspect, in some possible implementations, the combination of the first parameter and the first key uniquely corresponds to the terminal device, including: the second key generated based on the first parameter and the first key uniquely corresponds to the terminal device; the MAC is generated based on the first parameter, the first key and the second parameter, including: the MAC is generated based on the second key and the second parameter.

[0013] Based on the above technical solution, the MAC of the terminal device is generated according to the second parameter and the second key, the second key is determined according to the first key and the first parameter, and the second key uniquely corresponds to the terminal device. Among them, the key (second key) used by the terminal device to generate MAC is a new key determined by the terminal device according to the key (first key) corresponding to the multiple terminal devices pre-configured by the network device and the first parameter, and the MAC is not directly generated according to the first key. At the same time, the terminal device uses the second parameter and the second key from the access network device or the network device to generate MAC, so as to prevent the attacker from easily obtaining the key used for authentication by the terminal device, thereby ensuring communication security.

[0014] In combination with the first aspect, in some possible implementations, obtaining the first parameter includes: receiving the first parameter from an access network device.

[0015] It should be understood that the first parameter may be a parameter generated by the access network device itself, and the access network device sends the generated first parameter to the terminal device for the terminal device to generate a MAC.

[0016] In combination with the first aspect, in some possible implementations, before receiving the first parameter from the access network device, the method also includes: sending a message to the access network device for requesting access to the access network device; obtaining the first parameter includes: receiving an access response message from the access network device, the access response message including the first parameter.

[0017] It should be understood that before the terminal device receives the first parameter from the access network device, the terminal device may also send a message to the access network device for requesting access to the access network device, and the message may be used to trigger the access network device to send the first parameter to the terminal device.

[0018] Based on the above technical solution, in the process of a terminal device requesting access to an access network device, the access network device sends a first parameter for generating a MAC to the terminal device. The first parameter may be included in an access response message sent by the access network device to the terminal device, thereby reducing the communication overhead of the terminal device authentication process and saving the authentication cost of the terminal device.

[0019] In combination with the first aspect, in some possible implementations, before sending a message to the access network device for requesting access to the access network device, the method also includes: receiving an excitation signal from the access network device, wherein the excitation signal is used to provide energy for the terminal device.

[0020] It should be understood that when the terminal device is a passive terminal device or a semi-passive terminal device, the access network device may first send an excitation signal to the terminal device to provide energy for the terminal device.

[0021] In combination with the first aspect, in some possible implementations, the request message for requesting access to the access network device is a random access request message, and obtaining the first parameter includes: receiving a random access response message from the access network device, the random access response message including the first parameter.

[0022] Based on the above technical solution, when the terminal device requests to access the access network device for a random access process, the access network device sends a first parameter for generating a MAC to the terminal device, and the first parameter can be included in a random access response message. The access network device can configure the first parameter for the terminal device during the random access process, thereby reducing the communication overhead of the terminal device authentication process and saving the authentication cost of the terminal device.

[0023] In combination with the first aspect, in some possible implementations, the method further includes: sending a first identifier of the terminal device to the network device, the first identifier being used by the network device to determine a first key corresponding to the group to which the terminal device belongs when authenticating the terminal device.

[0024] In a possible implementation manner, the first identifier of the terminal device may be an identity document (ID) of the terminal device.

[0025] Based on the above technical solution, the terminal device sends a first identifier to the network device. After receiving the first identifier of the terminal device, the network device determines the first key corresponding to the terminal device based on the key stored in itself and the first identifier, and further authenticates the terminal device.

[0026] In combination with the first aspect, in some possible implementations, the method further includes: sending the first parameter to the network device; or, sending a second identifier of the terminal device to the access network device, the second identifier being used by the access network device to determine the first parameter.

[0027] It should be understood that if the first parameter obtained by the terminal device comes from the access network device, the terminal device can send the first parameter to the network device for the network device to authenticate the terminal device.

[0028] In a possible implementation, the access network device can record the correspondence between the first parameter and the terminal device according to the second identifier of the terminal device. The terminal device sends the second identifier of the terminal device to the access network device, and the access network device can determine the first parameter according to the second identifier, and send the first parameter to the network device for the network device to authenticate the terminal device.

[0029] It should be understood that the second identifier of the terminal device can be a temporary identifier determined by the access network device to identify the terminal device, such as: a cell radio network temporary identifier (C-RNTI), a temporary cell radio network temporary identifier (TC-RNTI / T-CRNTI).

[0030] In combination with the first aspect, in some possible implementations, the method further includes: sending the second parameter to the network device; or, sending a second identifier of the terminal device to the access network device, the second identifier being used by the access network device to determine the second parameter.

[0031] In combination with the first aspect, in some possible implementations, the first parameter is a random number, or the first parameter is a first identifier of the terminal device.

[0032] It should be understood that the combination of the first parameter and the first key uniquely corresponds to the terminal device, wherein multiple terminal devices can be configured with the first key, but the first parameter has a one-to-one correspondence with the terminal device. The first parameter can be a random number (Rand, or nonce), or the first parameter can be a first identifier of the terminal device.

[0033] It should also be understood that the first parameter may also be C-RNTI, which can be used to generate the MAC of the terminal device, and the access network device may also record the correspondence between the C-RNTI and the identifier of the terminal device.

[0034] In a second aspect, a communication method is provided, which can be executed by a first network element, or can be executed by a chip or circuit configured in the first network element, which is not limited in the present application. For convenience, the following description is made by taking the execution of the first network element as an example.

[0035] The method includes: receiving a first message authentication code MAC from a terminal device, the first MAC is generated according to a first parameter and a first key, the first key corresponds to a plurality of terminal devices in a group to which the terminal device belongs, and a combination of the first parameter and the first key uniquely corresponds to the terminal device; obtaining a third key, the third key being the same as the first key, or the third key being generated according to the first key and the first parameter; generating a second MAC according to the third key; and authenticating the terminal device according to the second MAC and the first MAC.

[0036] It should be understood that the third key can be a key of the corresponding terminal device pre-stored in the network device, that is, the first key is the same as the third key; the third key can also be a key generated according to the first key and the first parameter, that is, the third key is different from the first key.

[0037] According to the technical solution provided by the present application, after the network device receives the first MAC from the terminal device, the network device needs to determine the second MAC to authenticate the terminal device. The first MAC is determined based on the first key and the first parameter, and the first key corresponds to multiple terminal devices, that is, the key type of the terminal device stored at the network device is in the form of a group key, that is, one key can correspond to multiple terminal devices, thereby reducing the cost of the network device managing the keys of the terminal devices.

[0038] In combination with the second aspect, in some possible implementations, obtaining the third key includes: receiving the third key from a storage network element, where the storage network element is used to store the correspondence between the group to which the terminal device belongs and the first key.

[0039] It should be understood that when the network element (eg, the first network element) used to authenticate the terminal device does not have the ability to store network elements, it is necessary to obtain the third key from the storage network element for further authenticating the terminal device.

[0040] In combination with the second aspect, in some possible implementation methods, before receiving the third key from the storage network element, the method also includes: obtaining an identifier of the terminal device; sending the identifier of the terminal device to the storage network element, and the identifier of the terminal device is used by the storage network element to determine the first key corresponding to the group to which the terminal device belongs.

[0041] Based on the above technical solution, when the first network element does not have the ability to store network elements, or the first network element is not pre-configured with the first key corresponding to the terminal device, the first network element needs to obtain the third key from the storage network element and generate a second MAC. The first network element needs to send the identifier of the terminal device to the storage network element, so that the storage network element can accurately determine the first key corresponding to the group to which the terminal device belongs, and further generate the first MAC based on the third key to authenticate the terminal device, thereby improving the accuracy of authentication.

[0042] In combination with the second aspect, in some possible implementation methods, the third key is generated based on the first key and the first parameter. Before receiving the third key from the storage network element, the method also includes: obtaining the first parameter; sending the first parameter to the storage network element, and the first parameter is used by the storage network element to generate the third key based on the first key.

[0043] It should be understood that the first parameter is generated by the access network device, and the first MAC of the terminal device is generated based on the first parameter. That is, when the network device authenticates the terminal device, it needs to obtain the first parameter and send the first parameter to the storage network element to determine the third key.

[0044] In combination with the second aspect, in some possible implementation methods, the third key is generated based on the first key and the first parameter. Before obtaining the third key, the method includes: obtaining the identification of the terminal device and the first parameter; sending the identification of the terminal device to a storage network element, and the identification of the terminal device is used by the storage network element to determine the first key corresponding to the group to which the terminal device belongs; receiving the first key from the storage network element; obtaining the third key includes: generating the third key based on the first key and the first parameter.

[0045] It should be understood that the first network element obtains the first key corresponding to the terminal device from the storage network element based on the identification of the terminal device, and the first network element determines the third key based on the first key and the first parameter. There is no need for the storage network element to determine the third key based on the first key and the first parameter. The first network element itself determines the third key based on the first key and the first parameter.

[0046] In combination with the second aspect, in some possible implementations, the first MAC is generated based on the first parameter, the first key and the second parameter, and the method also includes: obtaining the second parameter; generating the second MAC based on the third key includes: generating the second MAC based on the third key and the second parameter.

[0047] In combination with the second aspect, in some possible implementations, obtaining the second parameter includes: receiving the second parameter from the access network device.

[0048] In combination with the second aspect, in some possible implementations, before receiving the first message authentication code MAC from the terminal device, the method further includes: sending the second parameter to the terminal device.

[0049] In combination with the second aspect, in some possible implementations, the first parameter is a random number, or the first parameter is an identifier of the terminal device.

[0050] In combination with the second aspect, in some possible implementation methods, before receiving the first message authentication code MAC from the terminal device, the method also includes: receiving a message from an application function network element for requesting an inventory of the terminal device; sending the message for requesting an inventory of the terminal device to an access network device, which provides services for the terminal device. When the authentication is successful, the method also includes: sending an identifier of the terminal device to the application function network element, and the identifier of the terminal device is used to conduct an inventory of the terminal device.

[0051] In combination with the second aspect, in some possible implementations, the method may further include: the first network element receives first indication information from the access network device, the first indication information being used to indicate that the access network device has successfully allocated a first quantity of first parameters.

[0052] It should be understood that the first indication information is used by the network device to perform counting and review during the key authentication phase.

[0053] In a third aspect, a communication method is provided, which can be executed by an access network device, or can also be executed by a chip or circuit configured in the access network device, and this application does not limit this. For convenience, the following description is taken as an example of execution by an access network device.

[0054] The method includes:

[0055] A first parameter is sent to a terminal device, where a combination of the first parameter and a first key uniquely corresponds to the terminal device, and the first key corresponds to multiple terminal devices in a group to which the terminal device belongs; a message authentication code MAC is received from the terminal device, where the MAC is generated by the terminal device based on the first key and the first parameter; and the MAC is sent to a network device, where the MAC is used by the network device to authenticate the terminal device.

[0056] According to the communication method provided by the present application, the first key used by the terminal device to generate MAC is in the form of a group key, that is, one or more terminal devices can be pre-configured with the same key, or the first key can correspond to a number segment to which the terminal device's identifier belongs, and the number segment includes one or more terminal devices, thereby avoiding one key for each terminal device and reducing the key management cost of the network device for the terminal device.

[0057] In combination with the third aspect, in some possible implementations, before sending the first parameter to the terminal device, the method further includes: generating the first parameter; the method further includes: sending the first parameter to the network device.

[0058] It should be understood that the access network device may send the first parameter to the network device before the access network device sends the MAC to the network device, or send the first parameter to the network device at the same time as the access network device sends the MAC to the network device.

[0059] In combination with the third aspect, in some possible implementations, before sending the first parameter to the network device, the method also includes: receiving an identifier from the terminal device; determining the first parameter based on a correspondence between the identifier of the terminal device and the first parameter; or, receiving the first parameter from the terminal device.

[0060] It should be understood that the access network device receives the first parameter from the terminal device and forwards the first parameter to the network device; or the access network device determines the first parameter based on the received terminal identifier and the correspondence between the terminal device identifier and the first parameter recorded in itself, and sends the first parameter to the network device.

[0061] In combination with the third aspect, in some possible implementations, the method further includes: sending a second parameter to the terminal device, where the second parameter is used to generate the MAC.

[0062] In combination with the third aspect, in some possible implementations, before sending the second parameter to the terminal device, the method further includes: receiving the second parameter from the network device.

[0063] It should be understood that the second parameter used by the terminal device to generate MAC may be generated by the network device, that is, the access network device first receives the second parameter from the network device, and forwards the second parameter to the terminal device for the terminal device to generate MAC.

[0064] In combination with the third aspect, in some possible implementations, before sending the second parameter to the terminal device, the method further includes: generating the second parameter; the method further includes: sending the second parameter to the network device.

[0065] It should be understood that the second parameter used by the terminal device to generate the MAC can be generated by the access network device, that is, the access network device sends the second parameter determined by itself to the terminal device for the terminal device to generate the MAC. The access network device also needs to send the second parameter to the network device for the network device to authenticate the terminal device.

[0066] In combination with the third aspect, in some possible implementation methods, before sending the first parameter to the terminal device, the method also includes: receiving a request message from the terminal device for requesting access to the access network device; sending the first parameter to the terminal device includes: sending an access response message to the terminal device, the access response message including the first parameter.

[0067] Based on the above technical solution, in the process of a terminal device requesting access to an access network device, the access network device sends a first parameter for generating a MAC to the terminal device. The first parameter may be included in an access response message sent by the access network device to the terminal device, thereby reducing the communication overhead of the terminal device authentication process and saving the authentication cost of the terminal device.

[0068] In combination with the third aspect, in some possible implementations, before receiving a request message from the terminal device for requesting access to the access network device, the method also includes: sending an excitation signal to the terminal device, wherein the excitation signal is used to provide energy to the terminal device.

[0069] In combination with the third aspect, in some possible implementation methods, the request message for requesting access to the access network device is a random access request message, and sending the first parameter to the terminal device includes: sending a random access response message to the terminal device, and the random access response message includes the first parameter.

[0070] Based on the above technical solution, when the terminal device requests to access the access network device for a random access process, the access network device sends a first parameter for generating a MAC to the terminal device, and the first parameter can be included in a random access response message. The access network device can configure the first parameter for the terminal device during the random access process, thereby reducing the communication overhead of the terminal device authentication process and saving the authentication cost of the terminal device.

[0071] In combination with the third aspect, in some possible implementations, the method may further include: the access network device sends first indication information to the first network element, where the first indication information is used to indicate that the access network device has successfully allocated a first quantity of first parameters.

[0072] It should be understood that the first indication information is used by the network device to perform counting and review during the key authentication phase.

[0073] In a fourth aspect, a communication method is provided, the method comprising: an access network device sends a first parameter to a terminal device, a combination of the first parameter and a first key uniquely corresponds to the terminal device, and the first key corresponds to multiple terminal devices in the group to which the terminal device belongs; the access network device receives a first message authentication code MAC from the terminal device, the first MAC is generated by the terminal device according to the first key and the first parameter, the first key corresponds to multiple terminal devices in the group to which the terminal device belongs, and the combination of the first parameter and the first key uniquely corresponds to the terminal device; the access network device sends the first MAC of the terminal device to a first network element, the first MAC is generated according to the first parameter and the first key; the first network element obtains a second key, the second key is the same as the first key, or the second key is generated according to the first key and the first parameter; the first network element generates a second MAC according to the second key; the first network element authenticates the terminal device according to the second MAC and the first MAC.

[0074] It should be understood that the first network element can execute the processing steps in the method provided in the second aspect above; the access network device can be used to execute the processing steps in the method provided in the third aspect above.

[0075] In a fifth aspect, a communication device is provided, comprising: a processing module, used to obtain a first parameter and a first key, the first key corresponding to multiple terminal devices in the group to which the terminal device belongs, and a combination of the first parameter and the first key uniquely corresponds to the terminal device; the processing module is also used to generate a message authentication code MAC based on the first parameter and the first key; a transceiver module is used to send the MAC to a network device, and the MAC is used by the network device to authenticate the terminal device.

[0076] The transceiver module can perform the reception and transmission processing in the aforementioned first aspect; the processing module can perform other processing except reception and transmission in the aforementioned first aspect.

[0077] In the sixth aspect, a communication device is provided, including: a transceiver module, used to receive a first message authentication code MAC from a terminal device, the first MAC is generated based on a first parameter and a first key, the first key corresponds to multiple terminal devices in the group to which the terminal device belongs, and the combination of the first parameter and the first key uniquely corresponds to the terminal device; a processing module, used to obtain a third key, the third key is the same as the first key, or the third key is generated based on the first key and the first parameter; the processing module is also used to generate a second MAC based on the third key; and authenticate the terminal device based on the second MAC and the first MAC.

[0078] The transceiver module can perform the reception and transmission processing in the aforementioned second aspect; the processing module can perform other processing except reception and transmission in the aforementioned second aspect.

[0079] In the seventh aspect, a communication device is provided, including: a transceiver module, used to send a first parameter to a terminal device, the combination of the first parameter and a first key uniquely corresponds to the terminal device, and the first key corresponds to multiple terminal devices in the group to which the terminal device belongs; the transceiver module is also used to receive a message authentication code MAC from the terminal device, and the MAC is generated by the terminal device based on the first key and the first parameter; the transceiver module is also used to send the MAC to a network device, and the MAC is used by the network device to authenticate the terminal device.

[0080] The transceiver module can perform the receiving and sending processing in the aforementioned third aspect.

[0081] In a possible implementation, the communication device may further include a processing module, which may perform other processing in addition to receiving and sending in the aforementioned third aspect.

[0082] In an eighth aspect, a communication system is provided, including an access network device and a first network element. Optionally, the communication system may further include a storage network element. The access network device is used to execute the method shown in the third aspect above, and the first network element and the storage network element are used to execute the method shown in the second aspect above.

[0083] In a ninth aspect, a communication device is provided, which includes: a transceiver module and a processing module, the transceiver module is used to execute the steps of sending and receiving information in the methods provided by the above aspects, and the processing module is used to execute the steps of processing in the methods provided by the above aspects.

[0084] In a tenth aspect, a communication device is provided, which includes: a memory for storing programs; a processor for executing the programs stored in the memory, and when the programs stored in the memory are executed, the processor is used to execute the methods provided in the above aspects.

[0085] In the eleventh aspect, the present application provides a processor for executing the methods provided in the above aspects. In the process of executing these methods, the process of sending the above information and obtaining / receiving the above information in the above methods can be understood as the process of the processor outputting the above information and the process of the processor receiving the input above information. When outputting the above information, the processor outputs the above information to the transceiver so that it can be transmitted by the transceiver. After being output by the processor, the above information may also need to be processed otherwise before reaching the transceiver. Similarly, when the processor receives the input information, the transceiver obtains / receives the above information and inputs it into the processor. Furthermore, after the transceiver receives the above information, the above information may need to be processed otherwise before being input into the processor.

[0086] Based on the above principle, for example, the receiving request message mentioned in the above method can be understood as the processor receiving input information.

[0087] For the operations such as transmission, sending and acquisition / reception involved in the processor, unless otherwise specified, or unless they conflict with their actual functions or internal logic in the relevant descriptions, they can be more generally understood as processor output, reception, input and other operations, rather than transmission, sending and receiving operations performed directly by the RF circuit and antenna.

[0088] In the implementation process, the processor may be a processor specifically used to execute these methods, or a processor that executes computer instructions in a memory to execute these methods, such as a general-purpose processor. The memory may be a non-transitory memory, such as a read-only memory (ROM), which may be integrated with the processor on the same chip or may be separately arranged on different chips. The embodiment of the present application does not limit the type of memory and the arrangement of the memory and the processor.

[0089] In a twelfth aspect, a computer-readable storage medium is provided, which stores a program code for execution by a device, wherein the program code includes a program for executing the methods provided in the above aspects.

[0090] In a thirteenth aspect, a computer program product comprising instructions is provided. When the computer program product is run on a computer, the computer is used to execute the methods provided in the above aspects.

[0091] In a fourteenth aspect, a chip is provided, which includes a processor and a communication interface. The processor reads instructions stored in a memory through the communication interface to execute the methods provided in the above aspects.

[0092] Optionally, as an implementation manner, the chip may further include a memory, in which instructions are stored, and the processor is used to execute the instructions stored in the memory. When the instructions are executed, the processor is used to execute the methods provided by the above aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0093] Figure 1 It is a schematic diagram of the network architecture 100 provided in this application.

[0094] Figure 2 The invention is a schematic flow chart of a method for authentication and key negotiation.

[0095] Figure 3 It is a schematic flow chart of a communication method provided in an embodiment of the present application.

[0096] Figure 4 It is a schematic flow chart of another communication method provided in an embodiment of the present application.

[0097] Figure 5 It is a schematic flow chart of another communication method provided in an embodiment of the present application.

[0098] Figure 6 It is a schematic block diagram of a communication device 10 provided in an embodiment of the present application.

[0099] Figure 7It is a schematic diagram of another communication device 20 provided in an embodiment of the present application.

[0100] Figure 8 It is a schematic diagram of a chip system 30 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0101] The technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0102] The technical solutions of the embodiments of the present application can be applied to various communication systems. For example: the fifth generation (5th generation, 5G) system or new radio (new radio, NR), long term evolution (long term evolution, LTE) system, LTE frequency division duplex (frequency division duplex, FDD) system, LTE time division duplex (time division duplex, TDD), etc. The technical solutions provided by the present application can also be applied to future communication systems, such as the sixth generation mobile communication system.

[0103] In order to facilitate understanding of the communication method provided below, first combine Figure 1 The following describes communication scenarios to which the communication method provided in the embodiments of the present application is applicable.

[0104] Figure 1 1 is a schematic diagram of a system architecture 100 provided by the present application. Figure 1 The various parts involved in the network architecture shown are explained separately:

[0105] 1. User equipment (UE) 210: may include various handheld devices with wireless communication functions, vehicle-mounted devices, wearable devices, computing devices or other processing devices connected to a wireless modem, as well as various forms of terminals, mobile stations (MS), terminals or soft terminals, etc. For example, water meters, electric meters, sensors, etc.

[0106] Exemplarily, the user equipment in the embodiments of the present application may refer to an access terminal, a user unit, a user station, a mobile station, a mobile station, a relay station, a remote station, a remote terminal, a mobile device, a user terminal, a terminal equipment, a wireless communication device, a user agent or a user device. The user equipment may also be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a handheld device with wireless communication function, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, a user equipment in a 5G network or a user equipment in a future evolved public land mobile network (PLMN) or a user equipment in a future Internet of Vehicles, etc., and the embodiments of the present application are not limited to this.

[0107] As an example and not a limitation, in the embodiments of the present application, wearable devices may also be referred to as wearable smart devices, which are a general term for wearable devices that are intelligently designed and developed by applying wearable technology to daily wear, such as glasses, gloves, watches, clothing, and shoes. A wearable device is a portable device that is worn directly on the body or integrated into the user's clothes or accessories. Wearable devices are not only hardware devices, but also achieve powerful functions through software support, data interaction, and cloud interaction. Broadly speaking, wearable smart devices include full-featured, large-sized, and independent of smartphones to achieve complete or partial functions, such as smart watches or smart glasses, as well as devices that only focus on a certain type of application function and need to be used in conjunction with other devices such as smartphones, such as various types of smart bracelets and smart jewelry for vital sign monitoring.

[0108] In addition, in an embodiment of the present application, the user device may also be a user device in an Internet of Things (IoT) system. IoT is an important part of the future development of information technology. Its main technical feature is to connect items to the network through communication technology, thereby realizing an intelligent network of human-machine interconnection and object-to-object interconnection. In an embodiment of the present application, IoT technology can achieve massive connections, deep coverage, and terminal power saving through narrowband (NB) technology, for example. In addition, in an embodiment of the present application, the user device may also include a smart printer, a train detector, a gas station sensor, etc., and its main functions include collecting data (part of the user device), receiving control information and downlink data of the access network device, and sending electromagnetic waves to transmit uplink data to the access network device. In an embodiment of the present application, the user device may also include an environmental IoT device, such as a passive tag device, a semi-passive IoT device, and an active IoT device. Its main functions include being used for inventorying goods and commodities, measuring temperature, etc.

[0109] 2. (Radio) access network (R)AN) 220: used to provide network access for authorized user devices in a specific area, and can use transmission tunnels of different qualities according to the level of user devices, business requirements, etc.

[0110] (R)AN can manage wireless resources, provide access services for user equipment, and then complete the forwarding of control signals and user equipment data between user equipment and the core network. (R)AN can also be understood as a base station in a traditional network.

[0111] Exemplarily, the access network device in the embodiment of the present application may be any communication device with wireless transceiver function for communicating with user equipment. The access network equipment includes but is not limited to: evolved NodeB (eNB), radio network controller (RNC), Node B (NB), base station controller (BSC), base transceiver station (BTS), home evolved NodeB (HeNB, or homeNode B, HNB), baseband unit (BBU), access point (AP) in wireless fidelity (WIFI) system, wireless relay node, wireless backhaul node, transmission point (TP) or transmission and reception point (TRP), etc., and can also be a next generation node B (gNB) or transmission point (TRP or TP) in 5G, such as NR, system, one or a group of (including multiple antenna panels) antenna panels of a base station in a 5G system, or, it can also be a network node constituting a gNB or a transmission point, such as a baseband unit (BBU), or a distributed unit (DU), etc.

[0112] In some deployments, the gNB may include a centralized unit (CU) and a DU. The gNB may also include an active antenna unit (AAU). The CU implements some functions of the gNB, and the DU implements some functions of the gNB. For example, the CU is responsible for processing non-real-time protocols and services, and implementing the functions of the radio resource control (RRC) and packet data convergence protocol (PDCP) layers. The DU is responsible for processing physical layer protocols and real-time services, and implementing the functions of the radio link control (RLC) layer, the media access control (MAC) layer, and the physical (PHY) layer. The AAU implements some physical layer processing functions, radio frequency processing, and related functions of active antennas. Since the information of the RRC layer will eventually become the information of the PHY layer, or be converted from the information of the PHY layer, under this architecture, high-level signaling, such as RRC layer signaling, can also be considered to be sent by the DU, or by the DU+AAU. It can be understood that the access network device can be a device including one or more of a CU node, a DU node, and an AAU node. In addition, the CU may be divided into an access network device in an access network (radio access network, RAN), or the CU may be divided into an access network device in a core network (core network, CN), and this application does not limit this.

[0113] 3. Mobility management network element 260: Mainly used for mobility management and access management. In the 5G communication system, the access management network element may be the access and mobility management function (AMF), which mainly performs mobility management, access authentication / authorization, etc. In addition, it is also responsible for transmitting user policies between the terminal and the policy control function (PCF) network element.

[0114] 4. Application network element 280: In the 5G communication system, the application network element can be an application function (AF) network element, which represents the application function of a third party or an operator. It is the interface for the 5G network to obtain external application data and is mainly used to convey the requirements of the application side to the network side.

[0115] in, Figure 1It also includes: authentication server function (AUSF) network element 250, unified data management (UDM) network element 290, PCF network element 291, network function repository function (NRF) network element 292, network exposure function (NEF) network element 293, network slice selection function (NSSF) network element 294, network slice selection authentication and authorization function (NSSAAF) network element 295, user plane function (UPF) network element 230, data network (DN) network element 240, session management function (SMF) network element 270, etc. For the specific functions of the above network elements, please refer to the detailed introduction in the 5G communication system.

[0116] The functions of the above network elements or devices can be completed by an independent network element or by several network elements. In actual deployment, the network elements in the core network can be deployed on the same or different physical devices. For example, as a possible deployment, AMF and SMF can be deployed on the same physical device. For another example, the network elements of the 5G core network can be deployed on the same physical device as the network elements of the 4G core network. This embodiment of the present application is not limited to this.

[0117] It should be understood that the above naming is only defined for the convenience of distinguishing different functions and should not constitute any limitation to this application. This application does not exclude the possibility of using other naming in 5G networks and other future networks. For example, in a 6G network, some or all of the above network elements may use the terminology in 5G, or may use other names.

[0118] Currently, the Internet of Things (IoT) has received widespread attention in the field of wireless communications. It is expected that more IoTs will be interconnected, and tens or even hundreds of billions of IoT devices will be deployed for various applications to improve production efficiency and life comfort. As the number of IoT devices grows rapidly, it is very important to reduce the size, complexity and power consumption of IoT devices.

[0119] RFID is an automatic identification technology that enables non-contact, two-way data communication between tags and readers to achieve the purpose of identifying targets and exchanging data. Tags in RFID systems have low complexity, small form factors, and low energy consumption, so RFID systems have a wide range of applications. However, RFID has a limited reading range, which makes operations time-consuming. Therefore, it is difficult for RFID to achieve large-scale networks with seamless coverage by densely deploying tags.

[0120] It can be seen that the RFID system is currently unable to meet the needs of the future IoT's wide-area coverage of hundreds of billions of devices. Therefore, new IoT technologies are urgently needed to support a device connection number and / or device density that is an order of magnitude higher than the existing IoT, and to realize new use cases and new scenarios in the future IoT. As the number of devices grows toward the hundreds of billions, new IoT technologies are bound to face the problem of rapidly increasing management costs for device information.

[0121] At present, the 5G-authentication and key agreement (5G-AKA) process is usually used between terminal devices and networks to identify and authenticate terminal devices to achieve security protection for terminal devices. However, the signaling interaction of the 5G-AKA process is relatively complex, and it is difficult for low-complexity and low-power terminal devices to complete authentication according to this process.

[0122] Figure 2 The invention is a schematic flow chart of a method for authentication and key negotiation.

[0123] Among them, Figure 2 In the method shown, the terminal device is pre-configured with a key K corresponding to the terminal device, and the network function (NF) is pre-configured with an identifier of the terminal device and a key K corresponding to the identifier.

[0124] It should be understood that the above Figure 1 The core network elements shown in the figure may be collectively referred to as NFs. For example, the NF may be the above Figure 1 NEF network element shown.

[0125] like Figure 2 As shown, the method includes:

[0126] 201. NF sends authentication request information to the terminal device.

[0127] Accordingly, the terminal device receives the authentication request information from the NF.

[0128] The authentication request information includes the identifier of the terminal device and a random number Rand.

[0129] 202. The terminal device generates a message authentication code (MAC) using the key K and the random number Rand.

[0130] For example, after receiving the authentication request information from the NF, the terminal device generates the corresponding MAC according to the Rand in the authentication request information and the pre-configured key K.

[0131] 203. The terminal device sends authentication response information to the NF.

[0132] Accordingly, the NF receives the authentication response information from the terminal device.

[0133] The authentication response information includes the terminal device's identifier, MAC and random number Rand.

[0134] It should be understood that after the terminal device generates the MAC, it sends the MAC to the NF for the NF to authenticate the terminal device.

[0135] 204, NF authenticates the terminal device through MAC.

[0136] It should be understood that after NF receives the authentication response information of the terminal device, it queries the pre-configured key K corresponding to the terminal device stored internally according to the identifier of the terminal device in the authentication response information, and verifies whether the Rand in the authentication response information is the same as the Rand in step 201. If they are the same, NF determines MAC' according to the key K and the random number Rand, and authenticates the terminal device based on MAC and MAC'.

[0137] Before the NF authenticates the terminal device through MAC, the NF can determine whether to execute step 204 through Rand in the authentication response information sent by the terminal device in step 203.

[0138] In a possible implementation, when the Rand in the authentication response information is different from the Rand in the authentication request information, the NF may send a message to the terminal device indicating that the authentication cannot be performed. The message may also be used to indicate that the NF has not sent the authentication request information to the terminal device, that is, the authentication request information corresponding to the terminal device does not exist, or it can be understood that the authentication operation corresponding to the terminal device does not exist. The NF does not need to perform step 204.

[0139] In another possible implementation, when the Rand in the authentication response information is the same as the Rand in the authentication request information, the NF executes step 204. When the NF determines according to step 204 that the MAC and MAC' are different, the NF may send a message indicating authentication failure to the terminal device.

[0140] In another possible implementation, when the Rand in the authentication response information is the same as the Rand in the authentication request information, the NF executes step 204. When the NF determines that the MAC and MAC' are the same according to step 204, the NF may send a message indicating successful authentication to the terminal device.

[0141] according to Figure 2 In the method shown, one terminal device corresponds to one key K, and different terminal devices correspond to different keys K. In order to authenticate the terminal device, the network device will pre-store a large number of terminal device identifiers and the keys K corresponding to each identifier, resulting in very high key management costs on the network side.

[0142] In view of the problems existing in the above-mentioned technology, the present application provides a communication method, which can reduce the key management cost of the network device for the terminal device, reduce the signaling overhead of the terminal device and the power consumption of the terminal device, and improve communication security.

[0143] It should be understood that the terminal device in the embodiment of the present application can be a low-power terminal device, such as a tag. The terminal device in the present application can be an active tag, a passive tag, or a semi-passive tag, which is not specifically limited in the present application.

[0144] Figure 3 It is a schematic flow chart of a communication method provided in an embodiment of the present application.

[0145] 301. The terminal device obtains a first parameter and a first key.

[0146] Among them, the first key corresponds to multiple terminal devices in the group to which the terminal device belongs, that is, multiple terminal devices can share the first key, and the combination of the first parameter and the first key uniquely corresponds to the terminal device, that is, the combination of the first parameter and the first key corresponds one-to-one to the terminal device.

[0147] In a possible implementation, the first key is preconfigured to the terminal device by the system / network device, or is stored in the terminal device by factory settings. The terminal device pre-stores the first key locally, and the terminal device can obtain the first key locally.

[0148] The terminal device may obtain the first parameter through the following method 1 or method 2.

[0149] Mode 1: The terminal device receives the first parameter from the network device, and correspondingly, the network device sends the first parameter to the terminal device.

[0150] For example, the first parameter is an identifier of the terminal device (eg, ID, subscription permanent identifier (SUPI), subscription concealed identifier (SUCI)), or a random number generated by a network device (eg, Rand, nonce).

[0151] Mode 2: The terminal device receives the first parameter from the access network device, and correspondingly, the access network device sends the first parameter to the terminal device.

[0152] For example, the first parameter is an identifier of the terminal device (eg, ID, SUPI, SUCI).

[0153] For another example, the first parameter is a random number generated by the access network device (e.g., Rand, nonce), or a temporary identifier (e.g., TC-RNTI, C-RNTI) assigned by the access network device to the terminal device. The access network device can send the first parameter to the network device for the network device to subsequently authenticate the terminal device. Furthermore, the access network device can also record the correspondence between the first parameter and the identifier of the terminal device, so that the access network device can determine the first parameter according to the identifier of the terminal device before sending the first parameter to the network device.

[0154] 302. The terminal device generates MAC#1 according to the first parameter and the first key.

[0155] Among them, MAC#1 is used by the network device to authenticate the terminal device.

[0156] Optionally, the terminal device first generates a second key according to the first parameter and the first key, and then further determines MAC#1 according to the second key and the first parameter. The second key uniquely corresponds to the terminal device.

[0157] For example, the second key may be determined according to the XOR operation result of the first key and the first parameter, or the second key is generated by the first key and the first parameter through a key derive function (KDF).

[0158] Assume that the first parameter is nonce#1, the key (i.e., the first key) pre-stored in the terminal device is K, the ID of the terminal device is Tag ID, and the algorithm used by the terminal device to determine MAC#1 is the Func algorithm, such as Func (a)(b||c), where a is the key used in the Func algorithm operation, and "||" represents the combination, that is, b and c are concatenated. For example, when b = 010001 and c = 111111, then b||c = 010001111111. The specific example of the terminal device generating MAC#1 is as follows:

[0159] Example 302-1: The terminal device inputs K, nonce#1 and Tag ID into the Func algorithm, then MAC#1 = Func ([K,nonce#1] (Tag ID||nonce#1), or, MAC#1=Func (K) (Tag ID||nonce#1). [K, nonce#1] represents the result of the operation of K and nonce#1, such as the XOR result of K and nonce#1, K⊕nonce#1, or the result KDF(K, nonce#1) generated by KDF algorithm.

[0160] Example 302-2: The terminal device first obtains new K based on the operation result of K and nonce#1. For example, new K is the XOR result of K and nonce#1, that is, new K=K⊕nonce#1; or, new K is the result generated by KDF algorithm for K and nonce#1, that is, newK=KDF(K, nonce#1). Then, the terminal device inputs new K, nonce#1 and Tag ID into Func algorithm, then MAC#1=Func (newK) (Tag ID||nonce#1).

[0161] It should be understood that Func in the above examples 302-1 and 302-2 represents an algorithm for generating a MAC, for example, it may be a hash-based message authentication code 256 (HMAC256) algorithm.

[0162] In one possible implementation, the terminal device determines MAC#1 according to the first parameter, the second parameter and the first key.

[0163] For example, the second parameter is generated by the access network device and sent to the terminal device, and correspondingly, the terminal device receives the second parameter from the access network device. For another example, the second parameter is generated by the network device and sent to the terminal device, and correspondingly, the terminal device receives the second parameter from the network device. Optionally, the network device sends the second parameter to the terminal device through the access network device.

[0164] Optionally, the terminal device first generates a second key according to the first parameter and the first key, and then further determines MAC#1 according to the second key and the second parameter, wherein the second key uniquely corresponds to the terminal device.

[0165] Assuming that the first parameter is nonce#1, the second parameter is nonce#2, and the first key is K, a specific example of the terminal device generating MAC#1 according to nonce#1, nonce#2, and K is as follows:

[0166] Example 302-3: The terminal device inputs K, nonce#1, nonce#2 and Tag ID into the Func algorithm, then MAC#1 = Func ([K,nonce#1] (Tag ID||nonce#2). [K, nonce#1] represents the operation result of K and nonce#1. For details, see the description in Example 302-1.

[0167] Example 302-4: The terminal device first obtains new K based on the calculation result of K and nonce#1, and then inputs new K, nonce#2 and Tag ID into the Func algorithm, then MAC#1=Func (newK) (Tag ID||nonce#2).

[0168] 303. The terminal device sends MAC#1 to the network device.

[0169] Accordingly, the network device receives MAC#1 from the terminal device.

[0170] For example, after the terminal device generates MAC#1, it can directly send MAC#1 to the network device, or the terminal device can send MAC#1 to the network device through the access network device.

[0171] 304, the network device determines MAC#2, and authenticates the terminal device through MAC#1 and MAC#2.

[0172] For example, after receiving MAC#1, the network device further determines MAC#2 and authenticates the terminal device through the relationship between MAC#1 and MAC#2.

[0173] Exemplarily, the network device authenticates the terminal device by determining whether MAC#1 is the same as MAC#2. If MAC#1 is the same as MAC#2, it indicates that the terminal device is successfully authenticated. Optionally, the network device sends a message to the terminal device indicating that the authentication is successful. If MAC#1 is not the same as MAC#2, it indicates that the terminal device fails to authenticate. Optionally, the network device sends a message to the terminal device indicating that the authentication fails.

[0174] Optionally, the network device obtains a third key before determining MAC#2. Then, the network device determines MAC#2 based on the third key and authenticates the terminal device through MAC#1 and MAC#2.

[0175] The network device may determine the third key locally, or the network device may receive the third key from another network element (e.g., a storage network element). The third key may be the same as the first key, or the third key may be determined based on the first key and the first parameter. The specific implementation method of the network device obtaining the third key may refer to Figure 4 Step 411, step 411' to step 413', and step 411" to step 413".

[0176] The specific implementation methods of step 303 and step 304 are introduced in four cases below.

[0177] Case 1: MAC#1 of the terminal device is generated based on the first parameter and the first key. Before the network device determines MAC#2, the network device receives MAC#1 and the first parameter (recorded as parameter #1-1) of the terminal device.

[0178] Optionally, the network device receives the first parameter from the terminal device. Correspondingly, the terminal device directly sends the first parameter to the network device, or the terminal device sends the first parameter to the network device through the access network device.

[0179] Optionally, the network device receives the first parameter from the access network device. Correspondingly, the terminal device sends the first parameter to the access network device. For example, the access network device receives the first parameter from the terminal device and sends the first parameter to the network device; or, the access network device receives the identifier from the terminal device, determines the first parameter based on the identifier of the terminal device and the correspondence between the identifier of the terminal device recorded locally and the first parameter, and then sends the first parameter to the network device.

[0180] In case 1, an example of a network device authenticating a terminal device is as follows:

[0181] Example 304-1 When the first parameter is generated by the network device and sent to the terminal device for the terminal device to generate MAC#1, the network device can record the corresponding relationship between the first parameter (recorded as parameter #1-0) and the identifier of the terminal device locally.

[0182] Optionally, after the network device receives parameter #1-1 and the identifier of the terminal device from the terminal device, the network device can further determine the parameter #1-0 corresponding to the identifier of the terminal device recorded locally based on the identifier of the terminal device, and determine whether parameter #1-0 is the same as parameter #1-1. If they are not the same, the network device can send a message to the terminal device indicating that authentication cannot be performed; if they are the same, the network device obtains the third key, generates MAC #2 based on the third key and the first parameter, and authenticates the terminal device through MAC #2 and MAC #1.

[0183] Example 304-2 When the first parameter is generated by the access network device, the access network device can send the terminal device identifier and the first parameter (for example, parameter #1-0) to the network device, and the network device records the correspondence between parameter #1-0 and the terminal device identifier locally.

[0184] It should be understood that after the network device receives parameter #1-1 and the identifier of the terminal device, the network device can Example 304-1 The method introduced in the first step is to determine the corresponding parameter #1-0 through the corresponding relationship between the terminal device identification and the local record, and then further determine whether parameter #1-0 is the same as parameter #1-1, and whether it is necessary to further authenticate the terminal device through MAC #2 and MAC #1. For details, please refer to the above Example 304-1 Introduction in.

[0185] Example 304-3 , when the first parameter is generated by the access network device and the network device does not store the correspondence between the first parameter and the identifier of the terminal device, after the network device receives the first parameter and MAC#1, the network device obtains the third key, determines MAC#2 based on the third key and the first parameter, and authenticates the terminal device through MAC#1 and MAC#2.

[0186] Case 2: MAC#1 of the terminal device is generated based on the first parameter and the first key. Before the network device determines MAC#2, the network device receives MAC#1 of the terminal device and determines the first parameter.

[0187] The first parameter is generated by the network device, and the network device records the correspondence between the first parameter and the identifier of the terminal device locally. The network device receives the MAC#1 of the terminal device and the identifier of the terminal device, and determines the first parameter corresponding to the identifier of the terminal device recorded locally according to the identifier of the terminal device, and then the network device determines MAC#2 according to the third key, the first parameter and the identifier of the terminal device, and authenticates the terminal device through MAC#1 and MAC#2.

[0188] Case three: MAC#1 of the terminal device is generated based on the first parameter, the second parameter and the first key. Before the network device determines MAC#2, the network device receives MAC#1, the first parameter (recorded as parameter #1-1) and the second parameter (recorded as parameter #2-1) of the terminal device.

[0189] Optionally, the network device receives the first parameter and the second parameter from the terminal device, and correspondingly, the terminal device directly sends the first parameter and the second parameter to the network device, or the terminal device sends the first parameter and the second parameter to the network device through the access network device.

[0190] Optionally, the network device receives the first parameter and the second parameter from the access network device, and correspondingly, the access network device sends the first parameter and the second parameter to the network device. The specific implementation method of the access network device sending the first parameter to the network device can refer to the description in Case 1. The access network device sends the second parameter to the network device, which can be that the access network device receives the second parameter from the terminal device and sends the second parameter to the network device; or the access network device receives the identifier from the terminal device, and determines the second parameter based on the identifier of the terminal device and the correspondence between the identifier of the terminal device recorded locally and the second parameter, and then sends the second parameter to the network device.

[0191] It should be understood that the terminal device / access network device can carry the first parameter and the second parameter in the same message and send them to the network device, or can carry the first parameter and the second parameter in different messages and send them to the network device.

[0192] Optionally, the first parameter and the second parameter are carried in the same message, and the first parameter and the second parameter may respectively correspond to different indication information / indication identifiers. For example, the indication information / identifier corresponding to the first parameter is used to instruct the network device to generate a key; the indication information / identifier corresponding to the second parameter is used to instruct the network device to authenticate the terminal device.

[0193] Optionally, the first parameter and the second parameter are carried in the same message, and the first parameter and the second parameter may be located at different positions of the message. For example, the first field of the message includes the first parameter, the second field includes the second parameter, the parameter located in the first field of the message is used to instruct the network device to generate a key, and the parameter located in the second field of the message is used to instruct the network device to authenticate the terminal. The format of the message may be specified by the protocol or configured by the system, and this application does not limit this.

[0194] Optionally, the first parameter and the second parameter are carried in different messages. For example, the first parameter can be carried in a message used to instruct the network device to generate a key, and the second parameter can be carried in a message used to instruct the network device to authenticate the terminal device, such as the second parameter can be carried in a message for sending MAC#1.

[0195] It should be understood that the first parameter and the second parameter may also be sent by the terminal device and the access network device to the network device respectively, for example, the terminal device sends the first parameter to the network device, and the access network device sends the second parameter to the network device; for another example, the access network device sends the first parameter to the network device, and the terminal device sends the second parameter to the network device. This application does not limit this.

[0196] In case three, an example of a network device authenticating a terminal device is as follows:

[0197] Example 304-4 When the second parameter is generated by the network device and sent to the terminal device, the network device may record the corresponding relationship between the second parameter (recorded as parameter #2-0) and the identifier of the terminal device locally.

[0198] Optionally, after the network device receives parameter #2-1 and the identifier of the terminal device, the network device can further determine the locally recorded parameter #2-0 corresponding to the identifier of the terminal device based on the identifier of the terminal device, and determine whether parameter #2-0 is the same as parameter #2-1.

[0199] It should be understood that Example 304-4 Can be compared with the above Example 304-1 or Example 304-2 In combination, when parameter #1-0 is different from parameter #1-1, or parameter #2-0 is different from parameter #2-1, the network device can send a message to the terminal device indicating that authentication cannot be performed. When parameter #1-0 is the same as parameter #1-1, and parameter #2-0 is the same as parameter #2-1, the network device obtains the third key, determines MAC #2 based on the third key, and authenticates the terminal device through MAC #2 and MAC #1.

[0200] It should be understood that Example 304-4 Can be compared with the above Example 304-3 Or in combination with situation 2, when parameter #2-0 is different from parameter #2-1, the network device can send a message to the terminal device indicating that authentication cannot be performed. When parameter #2-0 is the same as parameter #2-1, the network device obtains the third key, generates MAC #2 according to the third key, the first parameter and the identifier of the terminal device, and authenticates the terminal device through MAC #2 and MAC #1.

[0201] Example 304-5When the second parameter is generated by the access network device, the access network device can send the second parameter (for example, parameter #2-0) and the identifier of the terminal device to the network device, and the network device records the correspondence between parameter #2-0 and the identifier of the terminal device locally.

[0202] It should be understood that in the example 304- In case 5, after the network device receives parameter #2-1 and the terminal device's identifier, it can follow the above Example 304-4 The method introduced in the above method determines the corresponding parameter #2-0 through the corresponding relationship between the terminal device identification and the local record, and further determines whether the parameter #2-0 is the same as the parameter #2-1, and whether it is necessary to further authenticate the terminal device through MAC #2 and MAC #1. For details, please refer to the above Example 304-4 Introduction.

[0203] Example 304-6 When the second parameter is generated by the access network device and the network device does not store the corresponding relationship between the second parameter and the identifier of the terminal device, the network device receives the second parameter.

[0204] It should be understood that Example 304-6 Can be compared with the above Example 304-1 or Example 304-2 In combination, when parameter #1-0 is different from parameter #1-1, the network device can send a message to the terminal device indicating that authentication cannot be performed. When parameter #1-0 is the same as parameter #1-1, the network device obtains the third key, determines MAC #2 based on the third key, and authenticates the terminal device through MAC #2 and MAC #1.

[0205] It should be understood that Example 304-6 Can be compared with the above Example 304-3 Or in combination with situation 2, after the network device receives the first parameter, the second parameter and MAC#1, the network device obtains the third key, generates MAC#2 according to the third key, and authenticates the terminal device through MAC#2 and MAC#1.

[0206] Case 4: MAC#1 of the terminal device is generated based on the first parameter, the second parameter and the first key. Before the network device determines MAC#2, the network device determines the second parameter.

[0207] The second parameter is generated by the network device, and the network device records the correspondence between the second parameter and the terminal device identifier locally. After receiving the terminal device identifier, the network device determines the second parameter corresponding to the terminal device identifier recorded locally according to the terminal device identifier.

[0208] It should be understood that situation 4 can be combined with the above Example 304-1 , Example 304-2 , Example 304-3 Any combination of the above can also be combined with situation 2. For specific implementation, please refer to Example 304-6 Description.

[0209] Among them, the first parameter and the second parameter may be the same or different. For example, when the first parameter and the second parameter are both generated by the network device, the first parameter and the second parameter may be the same random number; when the first parameter and the second parameter are both generated by the access network device, the first parameter and the second parameter may be the same random number, or the same temporary identifier (for example, C-RNTI, TC-RNTI). When the first parameter is generated by the access network device and the second parameter is generated by the network device, the first parameter and the second parameter may be the same random number, or the first parameter and the second parameter are the identifiers of the terminal device (for example, ID); when the first parameter is generated by the access network device, the access network device sends the first parameter to the network device, and the network device generates the second parameter based on the first parameter. The first parameter and the second parameter may be the same, and the first parameter and the second parameter may be random numbers, or temporary identifiers.

[0210] according to Figure 3 In the method shown, the terminal device determines MAC#1 by obtaining the first parameter and the first key, and sends MAC#1 to the network device, so that the network device can authenticate the terminal device. The first key pre-stored in the terminal device corresponds to multiple terminal devices in the group to which the terminal device belongs, that is, multiple terminal devices in the group to which the terminal device belongs share the first key. Because the terminal device uses the identifier of the terminal device as input when determining MAC#1 and the network device determines MAC#2, there is a one-to-one correspondence between MAC#1 and the identifier of the terminal device, and between the identifier of the terminal device and MAC#2. Even if multiple terminal devices share the same first key, the network device can still implement authentication for a single terminal device, thereby reducing the cost of the network device managing the keys of the terminal devices while ensuring the effectiveness of the terminal device authentication.

[0211] The following takes the terminal device as Tag, the access network device as RAN, the first key as K, and the network device including a first network element, a storage network element, and a second network element as an example to exemplarily and in detail describe the method provided in the embodiment of the present application.

[0212] Figure 4 It is a schematic flow chart of another communication method provided by the present application.

[0213] 401, pre-store key K.

[0214] In one possible implementation, the storage network element and the tag may both be pre-configured with a key K, and the storage network element and the tag store the pre-configured key K in their own devices, that is, the pre-stored key. The storage network element and the tag may be pre-configured with a key K by a network device or system, or may be pre-configured with a key K at the factory, and this application does not make specific limitations on this.

[0215] Optionally, the pre-stored key K is a group key, that is, the key K corresponds to a tag group, the tag group includes multiple tags, and the pre-stored keys of the multiple tags are all key K. Before storing the network element and the tag pre-configured with the key, the network device / system can divide the multiple tags into the same group, and the tags divided into the same group can be located in the service area of ​​the same access network device, or in the coverage range of the same signal / beam, or belong to a specific area, or the first identifier (such as ID, IP address) of the tag in the same group is within the preset range of the network device / system.

[0216] As an example, the range to which the first identifier of the tag of the same group belongs corresponds to a tag number segment. As shown in Table 1, the tag number segment can be a range of TagID (for example: 100000-200000), or a range of binary or hexadecimal encoding of TagID (for example: ab38274c2a1-ab38fffffff), or a range of Tag IP address (for example: 119.112.19.1-119.255.255.255), etc.

[0217] Table 1

[0218]

[0219]

[0220] Taking Table 1 as an example, when the number segment to which the Tag ID belongs is within the number segment of 100000 to 200000, the pre-stored key K of the Tag identified by the Tag ID is 8267509ab247fff6bc238e. When the number segment to which the Tag IP address belongs is within the number segment of 119.112.19.1 to 119.255.255.255, the pre-stored key K of the Tag identified by the IP address is 1726499ab247fff6bc238e.

[0221] As another example, a tag number segment can correspond to multiple groups, that is, tags belonging to the same tag number segment can be divided into multiple groups, and the pre-stored keys of the tags belonging to the same group are the same. For example, the number segments to which Tag ID#1, Tag ID#2, and Tag ID#3 belong are all within the number segment of 100000 to 200000, and Tag#1 identified by Tag ID#1 is within the service range of access network device#1, then Tag#1 belongs to group#1, and the pre-stored key is K#1; Tag#2 identified by Tag ID#2 and Tag#3 identified by Tag ID#3 are within the service range of access network device#2, then Tag#2 and Tag#3 belong to group#2, and the pre-stored key is K#2.

[0222] When a network device manages keys of multiple Tag IDs, configuring the same group key for multiple Tag IDs can reduce the key management cost of the network device.

[0223] Optionally, each tag corresponds to a key K. Each key K corresponds to a tag ID, that is, each tag is configured with a different key, for example, each tag number segment includes a tag. As shown in Table 2:

[0224] Table 2

[0225] NO Tag ID Key K 1 A0001 247fff6bc23 2 A0002 247fff6bc2f 3 A0005 247fff6bc2d 4 A0007 247fff6bc21

[0226] As shown in Table 2 above, the key K pre-stored in the tag with the tag ID A0002 is 247fff6bc2f; the key K pre-stored in the tag with the tag ID A0005 is 247fff6bc2d; and the key K pre-stored in the tag with the tag ID A0007 is 247fff6bc21.

[0227] In another possible implementation, the storage network element is pre-configured with a key K, and the tag is pre-configured with a key k, where k is determined by K through a one-way generation algorithm. The storage network element stores the pre-configured key K in its own device, and the tag stores the pre-configured key k in its own device. The storage network element may be pre-configured with a key K by a network device or system, or may be pre-configured with a key K at the factory; the tag may be pre-configured with a key k by a network device or system, or may be pre-configured with a key k at the factory, and this application does not make any specific restrictions on this.

[0228] It should be understood that the one-way generation algorithm can only obtain k through K, and cannot obtain K through k. K can be called a subkey, and K can be called a master key. That is, the subkey is pre-stored in the Tag, and the master key is pre-stored in the storage network element.

[0229] As an example, the one-way generation algorithm includes a KDF algorithm, where k=KDF(K, Tag ID).

[0230] As another example, the master key K is a key pool, and the master key K determines the subkey k through a one-way generation algorithm. If Tag is {b1, b2, …, bi}, i ≤ Pool-len, bi∈{0 or 1}. Let the master key be a vector K = {a_1, a_2, …, a_j}^T, where each a_j is an n-bit number (i.e., an n-digit key), for example, a_j is a 128-bit key. Define the function USEKEY() as follows:

[0231] USEKEY(a_j,0)=0;

[0232] USEKEY(a_j,1)=a_j

[0233] Then k = USEKEY(a1,b1)⊕USEKEY(a2,b2)⊕,…,⊕USEKEY(a_n,b_n), as shown in Table 3:

[0234] Table 3

[0235] Master Key K Tag ID Subkey k a_1 1 a_1 a_2 1 a_2 a_3 0 0 a_4 1 a_4 …… …… ……

[0236] It should be understood that the steps of storing the network element and the tag pre-storing the key in itself according to the pre-configured key are not in order. That is, the storage network element and the tag can pre-store the key at the same time; or, the storage network element pre-stores the key before the tag pre-stores the key; or, the storage network element pre-stores the key after the tag pre-stores the key, and this application does not make specific restrictions on this.

[0237] It should also be understood that when the key pre-stored in the storage network element is the master key (e.g., key K), the key pre-stored in the tag is the sub-key (e.g., key k), where key k is determined by key K through a one-way generation algorithm, and the key k is different from key K. Even if the attacker captures a small number of tags, the attacker cannot obtain key K pre-stored in the network device, that is, the attacker cannot obtain key K through key k, thereby improving the security of the tag key.

[0238] 402, the first network element pre-stores the billing tag number segment.

[0239] Among them, the first network element can be an access management network element AMF, or a tag management network element (tag management function, TMF), and TMF is used to manage tags.

[0240] For example, TMF can be deployed in Figure 1In the illustrated architecture, TMF and RAN, and TMF and UE can communicate directly or indirectly. For example, there is an interface between TMF and RAN, and they can interact directly. Further, TMF can interact with Tag through RAN. Optionally, TMF and Tag can also communicate directly through an interface. TMF can be deployed separately or integrated with AMF, which is not limited in this application. For another example, TMF can also be integrated with RAN.

[0241] Optionally, the TMF and AF network elements may communicate directly or indirectly. For example, there is an interface between the TMF and the NEF, and the TMF may interact with the AF through the NEF.

[0242] It should be understood that different companies have different management rights for Tag number segments. The first network element can determine and store the Tag number segments corresponding to each company according to the specific needs of each company. The Tag number segment is used by the first network element to determine whether a certain Tag belongs to the management scope of the company. If not, the first network element will not provide service response to it.

[0243] As an example, Table 4 shows the storage relationship between companies and tag number segments:

[0244] Table 4

[0245]

[0246] As shown in Table 4 above, the tag number range corresponding to ABX company is 100000~200000, that is, ABX company is mainly responsible for managing tags within the range of 100000~200000. The business function of tags corresponding to the tag number range of 100000~200000 is inventory, and the business code is (0). The tag number range corresponding to the company with company code = 92756 is ab38274c2a1~ab38fffffff, that is, the company with company code 92756 is mainly responsible for managing tags within the range of ab38274c2a1~ab38fffffff. The business function of tags corresponding to the tag number range of ab38274c2a1~ab38fffffff is temperature measurement, and the business code is (1). The tag number range corresponding to XXXX Digital Services Co., Ltd. is 119.112.19.1 to 119.255.255.255, which means that XXXX Digital Services Co., Ltd. is mainly responsible for managing tags within the range of 119.112.19.1 to 119.255.255.255. The service function of the tag corresponding to the tag number range of 119.112.19.1 to 119.255.255.255 is positioning, and the service code is (2).

[0247] It should be understood that the above steps 401 and 402 do not distinguish between the steps before and after, 401 can be executed before 402, 401 can be executed after 402, or 401 can be executed at the same time as 402, and this application does not make any specific limitation on this.

[0248] It should also be understood that step 402 is an optional step. The first network element may be pre-configured with a charging Tag number segment, and the pre-configured charging Tag number segment is stored locally, that is, there is no need to perform step 402 to pre-store the charging Tag number segment.

[0249] 403. The second network element sends a service demand request message #1 to the first network element.

[0250] The second network element may be an AF.

[0251] In a possible implementation, the second network element may directly send the service demand request message #1 to the first network element, or the second network element may send the service demand request message #1 to the first network element through the NEF network element.

[0252] It should be understood that the business demand request information #1 may include an inventory demand request, a temperature measurement demand request, or a positioning demand request, etc.

[0253] As an example, the second network element sends a service requirement request message #1 including an inventory requirement to the first network element, so as to request the first network element to perform an inventory on a specific Tag service.

[0254] It should also be understood that the service demand request message #1 includes at least one of service indication information, Tag ID, and AF ID.

[0255] In one possible implementation, when the service demand request message #1 includes service indication information, the service indication information may include one or more of a service description, a service function (for example, inventory, temperature measurement, positioning, etc.), and a service code (for example, code 0 or code 1). This application does not make any specific limitations on this.

[0256] It should be understood that the service indication information sent by the second network element can be used to determine the corresponding Tag ID. Assume that the specific service description included in the service indication information includes service #1, where the specific service managed by Tag #1 is service #2, and the specific service managed by Tag #2 is service #1, that is, it can be determined that the Tag ID corresponding to the service indication information in the service demand request message #1 is the ID of Tag #2.

[0257] As another possible implementation, when the service demand request message #1 includes a Tag ID, the Tag ID may be an ID set, such as Tag ID={100001, 100002, 110000}; or the Tag ID may be a number segment of the Tag ID, such as TagID=100000-200000.

[0258] As another possible implementation method, when the service demand request message #1 includes an AF ID, the AFID may be identification information of the AF, or an IP address that sends the service demand request message #1. For example, when the IP address that sends the service demand request message #1 indicates the IP address of the AF, it may indicate that the AF ID is carried.

[0259] It should be understood that when the service indication information #1 sent by the second network element includes the AF ID, the first network element can determine the corresponding Tag ID according to the AFID.

[0260] 404. The first network element sends a service demand request message #2 to the RAN.

[0261] Correspondingly, the RAN receives the service demand request message #2 sent by the first network element.

[0262] In a possible implementation, before the first network element sends the service demand request message #2 to the RAN, the first network element can determine the RAN ID according to the service demand request message #1. The first network element then sends the service demand request message #2 to the corresponding RAN according to the determined RAN ID.

[0263] The content of the service requirement request message #2 may be the same as or different from the content of the service requirement request message #1.

[0264] For example, the business demand request message #1 includes an inventory demand request and a first parameter, and the business demand request message #2 can directly forward the information included in the business demand request message #1, that is, the business demand request message #2 includes the inventory demand request and the first parameter.

[0265] For another example, the service requirement request message #1 includes an inventory requirement request, and the service requirement request message #2 may include the inventory requirement request in the service requirement request message #1 and a first parameter generated by the first network element.

[0266] In another possible implementation, after the first network element receives the service demand request message #1 sent by the second network element, the first network element determines the Tag ID according to the service demand request message #1. The first network element determines the RAN ID corresponding to the Tag according to the Tag ID.

[0267] It should be understood that there is a corresponding relationship between the Tag ID and the RAN ID. The corresponding relationship can be preconfigured in the first network element. Among them, the same Tag number segment corresponds to one or more RANs; or the same Tag number segment corresponds to one RAN, which is not specifically limited in this application.

[0268] As an example, the first network element determines the corresponding Tag ID according to at least one of the service indication information, TagID, and AF ID included in the service demand request message #1. The first network element further determines the RAN corresponding to the Tag ID according to the determined Tag ID and the corresponding relationship between the TagID and the RAN.

[0269] It should be understood that when the service demand request message #1 includes a Tag ID, the first network element can directly determine which Tags need to be requested to execute the service based on the Tag ID in the service demand request message #1, and further send the service demand request message #2 to the RAN corresponding to the Tag that executes the service.

[0270] It should also be understood that when the service demand request message #1 includes service indication information, the first network element preconfigures the correspondence between the specific service indication and the Tag ID, so the first network element can determine the Tag to be requested based on the service indication information and further determine the corresponding RAN.

[0271] It should also be understood that when the service demand request message #1 includes an AF ID, the first network element can implicitly determine the service type based on the AF ID and the service corresponding to the AF, and then determine which tags need to be requested to execute the service based on the service type, and further send the service demand request message #2 to the RAN corresponding to the Tag that executes the service.

[0272] As an example, Table 5 shows the pre-configured correspondence between the Tag ID and the identification information of the RAN:

[0273] Table 5

[0274]

[0275] The identification information of the RAN may include a RAN ID (eg, 11) or an IP address of the RAN (eg, 119.112.19.1).

[0276] As shown in Table 5 above, when the number segment to which the Tag ID belongs is in the range of 100000 to 200000, the corresponding RAN ID is 11; when the number segment to which the TAG ID belongs is in the range of ab38274c2a1 to ab38fffffff, the corresponding RAN ID is 119.112.19.1; when the number segment to which the TAG ID belongs is in the range of 10.10.255.1 to 10.10.255.255, the corresponding RANID is 119.112.19.2, 119.112.19.3, and 119.112.19.4.

[0277] It should be understood that the identification information of the RAN corresponding to the number segment to which the Tag ID belongs may be an ID, an IP address, or a group of IP addresses, and this application does not make any specific limitation on this.

[0278] 405, RAN triggers the Tag to access the RAN.

[0279] For example, after the RAN receives the service demand request message sent by the first network element, the RAN triggers the tag in the corresponding jurisdiction (or called service area), and the tag in the jurisdiction is ready to access the RAN.

[0280] It should be understood that there are many ways for RAN to trigger the tags within its jurisdiction to prepare to access RAN. For example, RAN triggers the tags to prepare to access RAN by emitting electromagnetic beams to the tags within its jurisdiction. For another example, RAN triggers the tags to prepare to access RAN by emitting an excitation signal to all tags within its jurisdiction. For another example, RAN triggers the tags to prepare to access RAN by sending service demand request information to all tags within its jurisdiction.

[0281] In a possible implementation manner, the RAN triggers the Tag to prepare for accessing the RAN, which may be the case where the RAN triggers the Tag to prepare for random access.

[0282] It should be understood that the Tag device in the embodiment of the present application can be a passive device or a semi-passive device. Most of the current wireless communication devices are powered by batteries, and the batteries need to be replaced or charged manually, which leads to high maintenance costs, harms the environment, and even poses safety hazards. Passive devices or semi-passive devices do not rely on battery power and can better meet the scenarios of dense deployment of IoT devices. In step 405 of the present application, when the Tag is a passive device or a semi-passive device, the RAN can send an excitation signal to the Tag to provide energy for the Tag, thereby supporting the application of passive / semi-passive devices.

[0283] It should also be understood that when the Tag device in the embodiment of the present application is an active device, step 405 is an optional step. Assuming that the Tag device is an active device, the Tag device can periodically request access to the RAN according to a system pre-configured message; or the Tag device can request access to the RAN according to the service demand request message sent by the RAN in step 405.

[0284] 406. Tag sends message #1 to RAN.

[0285] It should be understood that message #1 is used to request access to the access network device.

[0286] In one possible implementation, the message #1 may be a msg1 message of a random access process (or initial access process) of a terminal device, and the msg1 message is a random access request (random accsss preamble), or the message #1 may be a mag3 message of an initial access process of a terminal device, and the msg3 message is a radio resource control connection request message (radio resource controlconnection request), or a handover command completion message (handover command completion).

[0287] As an example, assuming that the Tag is a passive device, after the Tag receives an excitation signal or an electromagnetic wave beam sent by the RAN, the Tag may send the message #1 to the RAN by means of a reflected signal.

[0288] 407. RAN sends the first parameter to Tag.

[0289] Accordingly, the Tag receives the first parameter sent from the RAN.

[0290] For example, after the Tag in the jurisdiction of the RAN establishes a connection, or during the process of the Tag establishing a connection, the RAN sends the first parameter to the Tag.

[0291] In a possible implementation, when step 406 is a random access request message in a random access process, step 407 may be a random access response message, or a random access connection establishment message. For example, the first parameter may be carried in a random access response message corresponding to msg2 in the random access process, or in an RRC connection establishment success message corresponding to msg4 in the random access process. For details, please refer to the prior art.

[0292] It should be understood that the first parameter can be carried in msg2 or msg4 in the random access process without being sent separately through signaling, thereby saving the communication interaction process, reducing signaling overhead, and reducing power consumption of the terminal device.

[0293] In a possible implementation, the first parameter may be a Tag ID or a temporary identifier (Temp ID) determined by the RAN. Both the Tag ID and the Temp ID may be used as the first parameter to form a combination uniquely corresponding to the Tag with the first key and used to generate MAC#1.

[0294] Exemplarily, when the first parameter sent by the RAN to the Tag is carried in the msg4 message, the first parameter may be a cell radio network temporary identifier (C-RNTI).

[0295] Exemplarily, when the first parameter sent by the RAN to the Tag is carried in the msg2 message, the first parameter may be a temporary cell-radio network temporary identifier (TC-RNTI).

[0296] It should be understood that when the first parameter sent by the RAN to the Tag is carried in the msg4 message / msg2 message, the first parameter may also be a random number.

[0297] The RAN may also record the relationship between the terminal device and the first parameter through the Temp ID.

[0298] It should be understood that the RAN may send the first parameter and the Temp ID to the Tag together, or send them separately, and this application does not limit this.

[0299] As an example, assuming that RAN uses Temp ID as the first parameter, ie, Temp ID=first parameter, RAN directly sends Temp ID, and the first parameter is also Temp ID, ie, the first parameter has the same value as that of Temp ID.

[0300] It should be understood that when the RAN uses the Temp ID as the first parameter, the RAN does not need to introduce new parameters and is implemented based on existing RAN parameters, thereby improving the efficiency of air interface transmission.

[0301] As another example, assuming that the first parameter determined by the RAN is different from the Temp ID, the RAN sends the first parameter and the Temp ID to the Tag.

[0302] 408. Tag determines MAC#1 according to the first parameter and the pre-stored key K.

[0303] For example, after the Tag receives the first parameter sent from the RAN, the Tag determines new K according to the first parameter and the pre-stored key K. After the Tag determines new K, it determines MAC#1 according to the new K and the first parameter.

[0304] As an example, assuming that the first parameter is nonce#1, the Tag determines newK according to the first parameter and the pre-stored key K. The Tag may use an XOR algorithm to determine new K. That is, new K=K⊕nonce#1.

[0305] As another example, assuming that the first parameter is nonce#1, the Tag determines new K according to the first parameter and the pre-stored key K. The Tag may use a KDF (key derive function) algorithm to determine new K. That is, new K=KDF(K, nonce#1).

[0306] Furthermore, after the Tag determines new K according to the first parameter and the pre-stored key K, MAC#1 is generated according to the new K, Tag ID and nonce#1.

[0307] As an example, MAC#1 = Func (newK) (Tag ID||nonce#1) where Func can be the HMAC256 algorithm.

[0308] The MAC#1 is generated based on the pre-stored key K and the first parameter. (newK) Unlike Func, Func (newK) It is based on the fact that new K is the key used when the Func algorithm is used for calculation. When Func is the HMAC algorithm, new K is the key used when the HMAC is calculated.

[0309] It should be understood that MAC#1 can be generated based on Tag ID and nonce#1, for example, the input algorithm parameter is (Tag ID||nonce#1), or MAC#1 can be generated for the entire message, that is, the input algorithm parameter is the entire request information of step 409, and this application does not make a sole limitation on this.

[0310] It should also be understood that other algorithms may be used to calculate MAC, and this application does not make any specific limitation on this.

[0311] Optionally, in step 408, Tag can directly generate MAC#1 based on the first parameter and the pre-stored key K, that is, there is no need to generate a new K first and then generate MAC#1 using the new K and the first parameter. Figure 3Step 302 in the method shown is not repeated here.

[0312] 409. Tag sends MAC#1 to RAN.

[0313] Accordingly, RAN receives MAC#1 sent from Tag.

[0314] In a possible implementation, the MAC#1 may be carried in a request message in which the Tag requests the network device to authenticate the Tag. The request message includes the MAC#1.

[0315] In another possible implementation, when the terminal device successfully requests access to the access network device, the terminal device may also send access success indication information to the access network device, and the access success indication information may include MAC#1. As an example, when the process in which the terminal device requests access to the access network device is a random access process (or called an initial access process), the MAC#1 sent by the terminal device to the access network device may be carried in a msg5 message in the random access process, and the msg5 message is an RRC connection setup completion message.

[0316] It should be understood that the Tag can also send the temp ID and Tag ID to the RAN. Among them, MAC#1, temp ID and Tag ID can be carried in the same message and sent to the RAN at the same time, and MAC#1, temp ID and Tag ID can also be carried in different messages and sent to the RAN, which is not specifically limited in this application.

[0317] 410. RAN sends MAC#1 to the first network element.

[0318] Correspondingly, the first network element receives MAC#1 sent from the RAN.

[0319] For example, after receiving MAC#1 sent from the Tag, the RAN forwards the MAC#1 to the first network element for the first network element to authenticate the terminal device.

[0320] Before sending MAC#1 to the first network element, the RAN may determine the first parameter according to the correspondence between the identifier of the Tag and the first parameter. For example, the RAN determines the first parameter according to the local record and the identifier of the Tag.

[0321] It should be understood that when the RAN sends the first parameter to the Tag, the RAN may record the correspondence between the first parameter and the Tag locally; or, after the RAN sends the first parameter to the Tag, the RAN may record the correspondence between the first parameter and the Tag locally. The RAN records the correspondence between the first parameter and the Tag in the following two ways:

[0322] Mode 1: RAN records the relationship between the Tag and the first parameter through the Tag ID.

[0323] Each Tag ID corresponds to a first parameter.

[0324] For example, the ID of Tag#1 is ID#1, the ID of Tag#2 is ID#2, and the ID of Tag#3 is ID#3. Assuming that the RAN determines that in step 407, the first parameter sent by the RAN to Tag#1 is nonce#1; the first parameter sent to Tag#2 is nonce#2; and the first parameter sent to Tag#3 is nonce#3, then the RAN can record the relationship between Tag#1 and nonce#1 through ID#1, that is, the first parameter corresponding to Tag#1 is nonce#1; ID#2 records the relationship between Tag#2 and nonce#2, that is, the first parameter corresponding to Tag#2 is nonce#2; and ID#3 records the relationship between Tag#3 and nonce#3, that is, the first parameter corresponding to Tag#3 is nonce#3.

[0325] Mode 2: RAN records the relationship between the Tag and the first parameter through the Temp ID.

[0326] For example, assuming that the RAN determines in step 407 that the first parameter sent by the RAN to Tag#1 is nonce#1; the first parameter sent to Tag#2 is nonce#2; and the first parameter sent to Tag#3 is nonce#3, the RAN may record the relationship between Tag#1 and nonce#1 through Temp#1, that is, the first parameter corresponding to Temp#1 is nonce#1 to express that the first parameter corresponding to Tag#1 is nonce#1; the RAN may record the relationship between Tag#2 and nonce#2 through Temp#2, that is, the first parameter corresponding to Temp#2 is nonce#2 to express that the first parameter corresponding to Tag#2 is nonce#2; and the RAN may record the relationship between Tag#3 and nonce#3 through Temp#3, that is, the first parameter corresponding to Temp#3 is nonce#3 to express that the first parameter corresponding to Tag#3 is nonce#3.

[0327] For another example, the relationship between Tag and the first parameter is shown in Table 6:

[0328] Table 6

[0329] Temp ID First parameter 1001 5423abff 1002 34ffff 1003 1003 (same as Temp ID)

[0330] Among them, when the Temp ID of Tag#1 determined by the access network device is 1001, that is, the access network device determines that the first parameter of Tag#1 is 5423abff, and records the first parameter of Tag#1 as 5423abff through 10001; when the Temp ID of Tag#2 determined by the access network device is 1002, that is, the access network device determines that the first parameter of Tag#2 is 34ffff, and records the first parameter of Tag#2 as 34ffff through 10002; when the Temp ID of Tag#3 determined by the access network device is 1003, that is, the access network device determines that the first parameter of Tag#3 is 1003 (that is, the same as the Temp ID), and records the first parameter of Tag#3 as 1003 through 1003. In one possible implementation, after receiving the MAC#1 of the Tag, the RAN determines the first parameter corresponding to the Tag based on the identifier of the terminal device and the correspondence between the terminal device and the first parameter recorded by the RAN, and sends the first parameter to the first network element for the first network element to determine MAC#2 and complete the authentication of the Tag. In another possible implementation, after receiving the Temp ID and MAC#1 sent by the Tag, the RAN queries the correspondence between the terminal device and the first parameter recorded by itself based on the Temp ID, and determines the first parameter corresponding to the Tag (for example, nonce#1), and sends the nonce#1 to the first network element for the first network element to determine MAC#2 and complete the authentication of the Tag.

[0331] It should be understood that the RAN may also send information such as Tag ID and the first parameter to the first network element. The Tag ID, the first parameter and MAC#1 may be carried in the same message and sent to the first network element at the same time, or the MAC#1, the first parameter and the Tag ID may be carried in different messages and sent to the first network element, which is not specifically limited in this application.

[0332] When the first network element has the function of a storage network element, or the first network element is integrated with the storage network element, such as Figure 4 The method shown further comprises:

[0333] 411. The first network element obtains the third key.

[0334] In a possible implementation, the first network element locally stores a correspondence between the Tag ID and the pre-stored key K, that is, the first network element is pre-configured with the key K, for example, when the first network element and the storage network element are deployed in an integrated manner. After the first network element receives MAC#1, the first parameter, and the Tag ID sent by the access network device, it can determine the corresponding pre-stored key K according to the Tag ID, and then obtain the third key according to the pre-stored key K.

[0335] As an example, the first network element determines the corresponding pre-stored key K according to the Tag ID, wherein the manner in which the first network element determines the pre-stored key K corresponding to the Tag through the Tag ID can refer to Table 1 or Table 2 in the above step 401. After the first network element determines the pre-stored key K corresponding to the Tag ID, the third key is determined according to the first parameter and the pre-stored key K, that is, the third key is generated according to the first parameter and the pre-stored key K.

[0336] The algorithm used by the first network element to determine the third key through the pre-stored key K and the first parameter is the same as the algorithm used by the Tag to determine newK in step 408. For example, if the Tag determines new K using an XOR algorithm in step 408, the first network element will also use an XOR algorithm to determine the third key.

[0337] As an example, the first network element determines the corresponding pre-stored key K according to the Tag ID, wherein the manner in which the first network element determines the pre-stored key K corresponding to the Tag through the Tag ID can refer to Table 1 or Table 2 in the above step 401. After the first network element determines the pre-stored key K corresponding to the Tag ID, the pre-stored key K is the third key, that is, the third key is the same as the pre-stored key K.

[0338] In another possible implementation, the key pre-stored in the Tag, that is, the first key, is a subkey k, and the key corresponding to the Tag pre-stored in the first network element is a master key K. That is, MAC#1 is generated by the Tag according to the subkey k and the first parameter. The first network element determines the pre-stored key K corresponding to the Tag stored in the first network element according to the Tag ID, for example, determines the pre-configured key k of the Tag according to the pre-configured one-way generation algorithm and the pre-stored key K. After the first network element determines the key k corresponding to the Tag ID through the one-way generation algorithm, it obtains the third key according to the first parameter and the key k.

[0339] As an example, the first network element may also obtain the third key through the following steps 411' to 413'. For example, when the first network element does not have the function of a storage network element, that is, the first network element and the storage network element are deployed separately.

[0340] 411', the first network element sends a key request message to the storage network element.

[0341] Correspondingly, the storage network element receives the key request information sent from the first network element.

[0342] The key request information includes the first parameter and the Tag ID. The key request information is a message for requesting a key used for authenticating the Tag.

[0343] 412', the storage network element determines the third key according to the key request information.

[0344] For example, after receiving the key request information sent by the first network element, the storage network element determines the third key according to the key request information.

[0345] In a possible implementation, when the first key pre-configured with the Tag and the key corresponding to the Tag configured by the storage network element are both key K, the storage network element determines the corresponding pre-stored key K according to the Tag ID in the key request information, wherein the method for determining the third key can refer to the corresponding relationship shown in Table 1 or Table 2 in the above step 401 to determine the pre-stored key K corresponding to the Tag ID. After the storage network element determines the pre-stored key K corresponding to the Tag ID, it determines the third key according to the first parameter and the pre-stored key K in the key request information.

[0346] It should be understood that the specific algorithm used by the storage network element to determine the third key according to the first parameter in the key request information and the pre-stored key K is the same as the algorithm used by Tag to determine newK in step 408 .

[0347] In one possible implementation, when the first key pre-configured with the Tag and the key corresponding to the Tag configured with the storage network element are both key K, the storage network element determines the corresponding pre-stored key K according to the Tag ID in the key request information. The storage network element determines the third key according to the pre-stored key K, that is, the third key is the same as the pre-stored key K.

[0348] In a possible implementation, when the key pre-stored in the Tag, that is, the first key, is a subkey k, and the key corresponding to the Tag pre-stored in the storage network element is a master key K, the storage network element determines the corresponding pre-stored key K according to the Tag ID, and further determines the key k pre-configured for the Tag according to the pre-stored key K and the one-way generation algorithm according to the pre-configured one-way generation algorithm. After the storage network element determines the key k corresponding to the Tag ID through the one-way generation algorithm, it determines the third key according to the first parameter and the key k.

[0349] 413', the storage network element sends the third key to the first network element.

[0350] Correspondingly, the first network element receives the third key sent from the storage network element.

[0351] For example, after the storage network element determines the third key according to the key request information, it sends the third key to the first network element.

[0352] As another example, the first network element may also obtain the third key through the following steps 411"-413".

[0353] 411", the first network element sends a key request message to the storage network element.

[0354] Correspondingly, the storage network element receives the key request information sent from the first network element.

[0355] The key request information includes the first parameter and the Tag ID. The key request information is used to request a pre-configured key corresponding to the Tag, that is, a pre-stored key K, from the storage network element.

[0356] 412”, the storage network element determines the first key corresponding to the Tag according to the key request information, and sends the first key to the first network element.

[0357] For example, after receiving the key request information sent by the first network element, the storage network element determines the pre-stored key K (eg, the first key) corresponding to the Tag stored in the storage network element according to the Tag ID, and sends the first key to the first network element.

[0358] The storage network element determines the corresponding first key according to the Tag ID in the key request information. The first key can be determined by referring to the corresponding relationship shown in Table 1 or Table 2 in the above step 401 to determine the pre-stored key K corresponding to the Tag ID.

[0359] 413", the first network element determines the third key according to the pre-stored key K.

[0360] For example, after receiving the pre-stored key K sent by the storage network element, the first network element determines the third key according to the first parameter received from the access network device.

[0361] It should be understood that the way the first network element determines the third key according to the pre-stored key K is similar to the method in step 411 and the method in step 412' for the storage network element to determine the third key. For details, please refer to the above detailed description.

[0362] The above steps 411'-413' introduce a method for the first network element to obtain the third key from the storage network element; steps 411"-413" introduce a method for the first network element to obtain the first key from the storage network element, and the first network element to determine the third key based on the first key; step 411 introduces a method for the first network element to directly determine the third key based on the first key and the first parameter. The first network element can obtain the third key through multiple methods, which improves the flexibility of the solution.

[0363] Optionally, before the first network element obtains the third key, the first parameter and / or the second parameter may also be judged. For the specific implementation method, please refer to the description of step 304, which will not be repeated here.

[0364] 414. The first network element authenticates the validity of MAC#1 according to the third key.

[0365] For example, after the first network element obtains the third key, it determines MAC#2 according to the third key. It should be understood that the algorithm used by the first network element to generate MAC#2 according to the third key is the same as the algorithm used by the Tag to generate MAC#1 according to the first key in step 408. When the MAC#2 generated by the first network element is the same as the MAC#1 generated by the Tag, it means that the MAC#1 is valid, that is, it can be understood that the Tag authentication is successful.

[0366] It should be understood that when the first network element determines that the MAC#1 of the tag is valid, the following steps may also be performed:

[0367] 415. The first network element determines whether the tag is a number segment authorized by the operator.

[0368] It should be understood that after the first network element determines that the Tag authentication is successful, the first network element determines whether the Tag ID corresponding to the Tag belongs to the billing Tag number segment pre-stored by the first network element in step 402 .

[0369] In a possible implementation, the Tag ID is within the charging Tag number segment pre-stored in the first network element, ie, the verification is passed, and the Tag ID satisfies the authorization, the first network element triggers the subsequent charging process, and executes step 416 .

[0370] In another possible implementation, the Tag ID is not in the billing Tag number segment pre-stored by the first network element, and the first network element filters the Tag and does not perform any operation on the Tag. The first network element continues to verify other Tags.

[0371] It should be understood that step 415 is an optional step. The first network element may not determine whether the Tag is an operator-authorized number segment, that is, after the first network element verifies that MAC#1 is valid according to the third key, it may directly execute step 416.

[0372] 416. The first network element sends the Tag ID to the second network element.

[0373] Correspondingly, the second network element receives the Tag ID sent by the first network element.

[0374] For example, assuming that the service demand request message in step 403 includes an inventory demand, after the first network element authenticates that MAC#1 is valid, the first network element records the Tag in the inventory result and sends the Tag ID to the second network element as a response to step 403, that is, the first network element does not need to execute the above step 415; or, when the first network element authenticates that MAC#1 is valid, and the first network element determines that the Tag ID is within the pre-stored billing number segment, the first network element records the Tag in the inventory result and sends the Tag ID to the second network element as a response to step 403.

[0375] In a possible implementation manner, the first network element sends an inventory result to the second network element, where the inventory result includes a Tag ID.

[0376] It should be understood that the one-way generation algorithm of the subkey corresponding to the number segment or type to which the Tag identifier belongs and the algorithm for determining the new K can be pre-configured to the Tag, the first network element and the storage network element in a pre-configured manner, or indicated to the Tag, the first network element and the storage network element through certain indication information. This application does not make any specific limitations on this.

[0377] according to Figure 4 In the method shown, the first key used by the Tag to generate the MAC is in the form of a group key, that is, multiple Tags can be pre-configured with the same key, or the first key can correspond to the number segment to which the Tag identifier belongs, and the number segment includes one or more Tags, avoiding one key for each Tag, thereby reducing the cost of network equipment to manage the Tag keys.

[0378] At the same time, according to Figure 4 The method shown configures the first parameter for generating MAC#1 for the Tag during the random access process of the Tag. The Tag generates MAC#1 through the first parameter and the first key, and sends the MAC#1 to the access network device for subsequent network devices to authenticate the Tag. First, during the random access process of the Tag, the access network device configures the first parameter to the Tag. In the prior art, it is necessary to start the relevant authentication process after the random access of the terminal device is successful (for example, after the terminal device successfully accesses the network device, the network device sends the parameters for generating the key to the terminal device through a separate signaling). It can be seen that compared with the prior art, the method in the present application reduces signaling interaction, saves the communication resources of the Tag, and reduces the authentication cost of the Tag. Secondly, the Tag first calculates the pre-stored key and the first parameter, and then generates MAC#1 with the first parameter, instead of directly generating MAC#1 through the pre-stored key, which can improve the communication security of the Tag.

[0379] in, Figure 4In the method shown, the key (first key) that may be pre-configured with the terminal device is in the form of a subkey. The key pre-configured with the network device is the master key, and the key pre-configured with the terminal device is the subkey obtained by the master key through a one-way generation algorithm. By pre-configuring the subkey for the terminal device, communication security can be guaranteed. If the attacker captures the pre-configured key of the terminal device, the attacker cannot obtain the complete key (master key) corresponding to the terminal device, thereby improving the key security performance of the terminal device and ensuring communication security.

[0380] Optional, according to the above Figure 4 In the method shown, before step 411, step 411' or step 411", Figure 4 The method shown may also include:

[0381] The first network element determines that the Tag ID is a number segment authorized by the operator.

[0382] It should be understood that before obtaining the third key, the first network element first determines whether the Tag ID belongs to the billing Tag number segment pre-stored by the first network element. If the Tag ID is within the billing Tag number segment pre-stored by the first network element, that is, the first network element determines that the Tag is an operator-authorized number, then the subsequent steps 411, 411' or 411" will continue to be executed. If the Tag ID does not belong to the billing Tag number segment pre-stored by the first network element, that is, the first network element determines that the Tag is not an operator-authorized number, then the first network element does not execute step 411, step 411' or step 411", as well as subsequent steps.

[0383] By determining whether the Tag ID belongs to the billing Tag number segment pre-stored by the first network element before the first network element obtains the third key, it is avoided that the first network element needs to perform authentication operations on the terminal device when the Tag ID does not belong to the billing Tag number segment pre-stored by the first network element, thereby saving resource overhead of network devices.

[0384] Figure 5 It is a schematic flowchart of another communication method provided in an embodiment of the present application.

[0385] 501, pre-store key K.

[0386] 502, the first network element pre-stores the billing tag number segment.

[0387] It should also be understood that the above steps 501 and 502 are similar to the above steps 502. Figure 4 Step 401 is similar to step 402, and details can be found in the detailed description of step 401 and step 402 above, which will not be repeated here.

[0388] 503. The second network element sends a key generation request message #1 to the first network element.

[0389] The second network element may be an AF.

[0390] In a possible implementation manner, the second network element may directly send the key generation request message #1 to the first network element, or the second network element may send the key generation request message #1 to the first network element through the NEF network element.

[0391] It should be understood that the second network element sends the key generation request message #1 to the first network element, and the key generation request message #1 includes at least one of the Tag ID and the AF ID.

[0392] The key generation request message may further include a first parameter generated by the second network element, where the first parameter is used for generating a key for the Tag.

[0393] The AF ID in the key generation request message #1 is used to determine the corresponding Tag ID. For more information, see Figure 4 The instructions in step 403 in.

[0394] 504. The first network element sends a key generation request message #2 to the RAN.

[0395] Correspondingly, the RAN receives a key generation request message #2 from the first network element.

[0396] For example, after the first network element determines the RAN corresponding to the Tag according to the key generation request message #1, it sends the key generation request message #2 to the corresponding RAN.

[0397] In a possible implementation, after the first network element receives the key generation request message #1 sent by the second network element, the first network element determines the Tag ID according to the key generation request message #1. The first network element determines the RAN ID corresponding to the Tag according to the determined Tag ID, and sends a key request message #2 to the RAN.

[0398] It should be understood that there is a corresponding relationship between the Tag ID and the RAN ID. The corresponding relationship can be preconfigured in the first network element. Among them, the same Tag number segment corresponds to one or more RANs; or the same Tag number segment corresponds to one RAN, which is not specifically limited in this application.

[0399] It should also be understood that the first network element determines the RAN ID according to the key generation request message #1; Figure 4 In step 404 of the first network element determining the RAN ID according to the service demand request message is similar, and the details can be referred to above Figure 4 The detailed examples in are not repeated here.

[0400] It should also be understood that when the key generation request message #1 includes the first parameter, the first network element can carry the first parameter in the key generation request message #2 and send it to the RAN; when the key generation request message #1 does not include the first parameter, the first network element can generate the first parameter and send the first parameter to the RAN through the key generation request message #2.

[0401] 505, RAN triggers Tag to prepare to access RAN.

[0402] For example, after the RAN receives the key generation request message #2 sent from the first network element, the RAN triggers the tag within the corresponding jurisdiction (or area), and the tag within the jurisdiction is ready to access the RAN.

[0403] 506. Tag sends message #1 to RAN.

[0404] It should be understood that message #1 is used to request access to the access network device.

[0405] It should also be understood that steps 504 to 506 are similar to the above Figure 4 Steps 404 to 406 are similar and will not be repeated here.

[0406] 507. RAN sends the first parameter to Tag.

[0407] Accordingly, the Tag receives the first parameter sent from the RAN.

[0408] For example, after a Tag in the jurisdiction of the RAN establishes a connection, the RAN sends a first parameter to the Tag, and the first parameter is used for the Tag to generate MAC#1.

[0409] In a possible implementation, when step 506 is a random access request message in a random access process, step 507 may be a random access response message, or a random access connection establishment message (eg, random access process msg 2 or msg4).

[0410] It should be understood that the first parameter can be carried in msg2 or msg4 in the random access process without being sent separately through signaling, thereby saving the communication interaction process, reducing signaling overhead, and reducing power consumption of the terminal device.

[0411] In a possible implementation, the first parameter may be a Tag ID or a temporary identifier (Temp ID) determined by the RAN. Both the Tag ID and the Temp ID may be used as the first parameter to form a combination uniquely corresponding to the Tag with the first key and generate MAC#1.

[0412] Exemplarily, when the first parameter sent by the RAN to the Tag is carried in the msg4 message, the first parameter may be a cell radio network temporary identifier (C-RNTI).

[0413] The Temp ID may also be used by the RAN to record the relationship between the terminal device and the first parameter.

[0414] It should be understood that the RAN may send the temporary identifier to the Tag together with the first parameter, or send it separately.

[0415] As an example, assuming that RAN uses Temp ID as the first parameter, ie, Temp ID=first parameter, RAN directly sends Temp ID, and the first parameter is also Temp ID, ie, the first parameter has the same value as that of Temp ID.

[0416] It should be understood that when the RAN uses the Temp ID as the first parameter, the RAN does not need to introduce new parameters and is implemented based on existing RAN parameters, thereby improving the efficiency of air interface transmission.

[0417] As another example, assuming that the first parameter determined by the RAN is different from the Temp ID, the RAN sends the first parameter and the Temp ID to the Tag.

[0418] It should be understood that when step 507 is combined with the above Figure 4 The process is similar to step 407 in , for details, please refer to the example in the above step 407, which will not be repeated here.

[0419] It should also be understood that when the key generation request message #2 received by the RAN includes the first parameter, the RAN forwards the first parameter in the key generation request message #2 to the Tag; when the key generation request message #2 received by the RAN does not include the first parameter, the RAN generates the first parameter and sends the first parameter to the Tag.

[0420] 508. Tag determines new K according to the first parameter.

[0421] For example, after the Tag receives the first parameter sent from the RAN, the Tag determines new K according to the first parameter (eg nonce#1) and the pre-stored key of the Tag (the first key).

[0422] As an example, the Tag determines new K according to the first parameter (eg, nonce#1) and the pre-stored key K. The Tag may use an XOR algorithm to determine new K. That is, new K=K⊕nonce#1.

[0423] As another example, the tag determines new K according to the first parameter (eg nonce#1) and the pre-stored key K. The tag may use a KDF (key derive function) algorithm to determine new K. That is, new K=KDF(K, nonce#1).

[0424] It should be understood that step 508 is similar to the above Figure 4 In step 408 of , Tag determines new K according to the pre-stored key of Tag and the first parameter. For details, please refer to the detailed introduction in the above step 408.

[0425] 509. RAN sends first indication information to the first network element.

[0426] The first indication information is used to indicate to the first network element how many first parameters the RAN has successfully allocated, so as to facilitate counting and verification by the network device.

[0427] In a possible implementation manner, the first indication information is used to indicate that the RAN has successfully allocated a first quantity of first parameters.

[0428] It should be understood that due to the uncertainty of air interface transmission, when there are a large number of key generation requests, the network device may send multiple first parameters. When the network device sends multiple first parameters, through step 510, after RAN sends the first parameter to the Tag, RAN will send the first indication information to the first network element in the network device, and the first network element can maintain the counter so that the first network element can count how many Tags have successfully generated keys. It should be understood that after a period of time, if the total number of the counter of the first network element is too small, the first network element will determine that the current Tag response is insufficient, and the event can be further used to determine whether the first parameter needs to be reconfigured through AF.

[0429] As an example, RAN sends 10,000 first parameters to different terminal devices. RAN finally determines that 2,000 terminal devices have successfully generated the first key, and RAN sends the first number (e.g., 2,000) to the network device. Assuming that the network device determines that the number of first key generation for the tag does not reach 50% of the configured first parameter, it will further pass the event through AF to determine whether it is necessary to re-allocate the first parameter for the tag later.

[0430] It should also be understood that step 509 is an optional step.

[0431] 510. AF sends a service demand request message #1 to the first network element.

[0432] The service demand request message #1 may be used to indicate an inventory requirement, a temperature measurement requirement or a positioning requirement. The AF may send the service demand request message #1 to the first network element through the NEF.

[0433] In one possible implementation, the service demand request message #1 may include a second parameter (eg, nonce #2), which may be used by the terminal device to generate MAC #1 and by the network device to authenticate the validity of MAC #1.

[0434] It should be understood that the two parameters may be the same as or different from the first parameter. Among them, when the first parameter and the second parameter are both generated by the first network element, the first parameter and the second parameter may be the same, and the first parameter and the second parameter may be random numbers; when the first parameter and the second parameter are both generated by the access network device, the first parameter and the second parameter may be the same, and the first parameter and the second parameter may be random numbers / temporary identifiers; when the first parameter is generated by the access network device, the access network device sends the first parameter to the first network element, and the first network element generates the second parameter according to the first parameter, that is, the first parameter and the second parameter may be the same, and the first parameter and the second parameter may be random numbers / temporary identifiers; when the first parameter and the second parameter are both generated by the AF, the first parameter and the second parameter may be the same, and the first parameter and the second parameter may be random numbers.

[0435] 511. The first network element sends a service demand request message #2 to the RAN according to the service demand request message #1.

[0436] For example, after the first network element receives the service requirement request message #1 sent from the AF, the first network element determines the second parameter according to the service requirement request message #1. The first network element sends a service requirement request message #2 to the RAN, and the service requirement request message #2 includes the second parameter.

[0437] In a possible implementation manner, when the first network element determines that the received service demand request message #1 includes the second parameter, the first network element may directly forward the service demand request message #1 to the RAN.

[0438] In another possible implementation, when the service requirement request message #1 received by the first network element does not include the second parameter, the first network element generates the second parameter itself, and carries the generated second parameter and the received service requirement request message #1 in the service requirement request message #2 and sends it to the RAN.

[0439] It should be understood that the second parameter is used in the authentication process of the Tag.

[0440] It should also be understood that the first network element sends the service demand request #2 message to the RAN, which can be sent to one or more RANs in the form of broadcast / multicast, or can be sent to one or more RANs in the form of unicast, and this application does not make specific limitations on this.

[0441] It should also be understood that step 511 should be executed after the above step 508. The first network element can determine that all key generation requests of all tags are executed based on the number of key random numbers counted in the above step 510, so as to avoid omission of inventory services and cause the tags to fail to work properly.

[0442] It should also be understood that the above step 508 is an optional step. When the above step 508 is not executed, the triggering event of step 511 is not subject to conditional restrictions and has nothing to do with whether the above steps are executed, that is, as long as the Tag stores new K as the key, step 511 can be triggered at any time.

[0443] 512, RAN sends a service requirement request message #3 to Tag.

[0444] Correspondingly, Tag receives the service demand request message #3 sent by RAN.

[0445] For example, upon receiving the service requirement request message #3 sent from the first network element, the RAN forwards the service requirement request message #3 to the corresponding Tag, where the service requirement request message #3 includes the second parameter. It should be understood that the RAN sends the service requirement request message #3 to the Tag in the form of broadcast / multicast to one or more Tags, or in the form of unicast to one or more Tags, which is not specifically limited in this application.

[0446] Among them, multiple tags can use the same second parameter without affecting the authentication of the tags.

[0447] The second parameter may be generated by the second network element, or the second parameter may be generated by the first network element, or the second parameter may be generated by the RAN.

[0448] It should be understood that the service requirement request message #3 may include the second parameter sent by the RAN to the Tag, or the second parameter sent by the RAN to the Tag may be sent by the RAN through a separate signaling, or the second parameter may be carried in other information and sent to the Tag. This application does not make specific limitations on this.

[0449] In a possible implementation manner, if the Tag maintains a connection with the RAN, the second parameter sent by the RAN to the Tag may be carried in a downlink RRC message, which is not limited in this application.

[0450] In another possible implementation, if the Tag is in a deregistered state, or the Tag enters shutdown mode, or the Tag loses / disconnects from the RAN, the RAN and the Tag need to re-execute steps 505 and 506, and then execute step 512 after the connection is established.

[0451] 513, Tag sends MAC#1 to RAN.

[0452] Accordingly, RAN receives MAC#1 sent from Tag.

[0453] For example, after receiving the service demand request message #3, the Tag further determines MAC#1 according to the second parameter and the new K generated in step 508. The Tag sends MAC#1 to the RAN, and the MAC#1 is used for the network device to authenticate the tag.

[0454] The Tag may also send the Temp ID, the second parameter, and the Tag ID to the RAN.

[0455] As an example, the Tag generates MAC#1 according to the second parameter (e.g., nonce#2) and new K. The Tag generates MAC#1 according to the second parameter and the Tag ID. Figure 4 In step 408 in FIG. 1 , Tag generates MAC#1 based on the first parameter (e.g., nonce#1) and the pre-stored key K. For details, see Figure 4 Detailed description in step 408.

[0456] 514. RAN sends MAC#1 and the first parameter to the first network element.

[0457] Correspondingly, the first network element receives MAC#1 and the first parameter sent by the RAN. For example, after the RAN receives MAC#1 and the temp ID sent by the Tag, it determines the first parameter corresponding to the Tag according to the Temp ID. The RAN sends MAC#1 and the first parameter to the first network element.

[0458] Before the RAN sends MAC#1 and the first parameter to the first network element, the RAN may determine the first parameter according to the correspondence between the Tag identifier and the first parameter. For example, the RAN determines the first parameter according to a local record and the Tag identifier.

[0459] It should be understood that in step 507, when the RAN sends the first parameter to the Tag, the RAN may record the correspondence between the first parameter and the Tag locally; or, after step 507, the RAN may record the correspondence between the first parameter and the Tag locally. Figure 4 The two methods described in step 410 are similar and will not be described again here.

[0460] Among them, when the second parameter is generated by RAN, RAN can also record the correspondence between the second parameter and the Tag locally in the above manner, obtain the second parameter corresponding to the Tag from the local, and send the second parameter to the first network element; or, the terminal device sends the second parameter to RAN, and RAN forwards the second parameter to the first network element; or, the terminal device does not send the second parameter to RAN, and the second parameter is generated by the first network element or the second network element, then RAN may not send the second parameter to the first network element. When the first network element has the function of storing network elements, such as Figure 5 The method shown further comprises:

[0461] 515. The first network element obtains the third key according to the first parameter.

[0462] It should be understood that step 515 and Figure 4 The process is similar to step 411 in , and will not be described again here.

[0463] Optionally, the first network element may also obtain the third key through the following steps 515'-517'. For example, when the first network element does not have the function of a storage network element, that is, the first network element and the storage network element are deployed separately.

[0464] 515', the first network element sends a key request message to the storage network element.

[0465] 516', the storage network element determines the third key according to the key request information.

[0466] 517', the storage network element sends the third key to the first network element.

[0467] It should be understood that the above steps 515' to 517' are similar to the above steps 515' to 517'. Figure 4 Steps 411' to 413' are similar, and can be found in the above Figure 4 The detailed introduction in , will not be repeated here.

[0468] As another example, the first network element may also obtain the third key through the following steps 515"-517".

[0469] 515”, the first network element sends a key request message to the storage network element.

[0470] 516”, the storage network element determines the first key corresponding to the Tag according to the key request information, and sends the first key to the first network element.

[0471] 517", the first network element determines the third key according to the key request information.

[0472] It should be understood that the above steps 515" to 517" are the same as the above steps. Figure 4 Steps 411" to 413" are similar to those in the above. Figure 4 The detailed introduction in , will not be repeated here.

[0473] 518. The first network element authenticates the validity of MAC#1 according to the third key.

[0474] The specific implementation of the above step 518 can refer to the above Figure 4 Step 414 in will not be described again here.

[0475] It should be understood that when the first network element determines that the MAC of the Tag is valid, the following steps are performed:

[0476] 519. The first network element determines whether the tag is a number segment authorized by the operator.

[0477] 520. The first network element sends a Tag ID to the second network element.

[0478] The specific implementation of the above steps 519-520 can refer to the above Figure 4 Steps 415-416 in the above are not described in detail here.

[0479] according to Figure 5 The method shown in the figure decouples the key generation process and the authentication process of the Tag, that is, Figure 5 As shown in , steps 501 to 509 are the key generation process, and steps 510 to 520 are the authentication process. In specific operations, after the key generation process of the tag is executed once, the authentication process of the tag can be executed multiple times according to the instruction message of the network device, thereby avoiding the need for the tag to regenerate the key every time the network device sends a service demand request message (for example, the network device performs an inventory operation), thereby saving communication resources and reducing the authentication cost of the tag, that is, it can ensure that the low-power and low-cost tag completes the key generation and authentication.

[0480] It should be noted that the above Figure 4 and Figure 5 In the method shown, the first network element may have the function of storing the network element, and the second network element may also have the function of storing the network element. When the first network element has the function of storing the network element, the first network element may perform the above Figure 4 and Figure 5 When the second network element has the function of a storage network element, the second network element can perform the above steps. Figure 4 and Figure 5 The relevant steps performed by the storage network element in the.

[0481] Above, combined Figure 3 and Figure 5 The communication method provided by the embodiment of the present application is described in detail. The above communication method is mainly introduced from the perspective of interaction between the terminal device and the network device. It can be understood that in order to realize the above functions, the terminal device includes a hardware structure and / or software module corresponding to each function.

[0482] Those skilled in the art should be aware that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is performed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0483] The following combination Figures 6 to 8 The communication device provided by the present application is described in detail. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment. Therefore, the content not described in detail can be referred to the method embodiment above, and some content will not be repeated for the sake of brevity.

[0484] The embodiment of the present application can divide the functional modules of the transmitting end device or the receiving end device according to the above method example. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation. The following is an example of dividing each functional module corresponding to each function.

[0485] Figure 6 1 is a schematic block diagram of a communication device 10 provided in an embodiment of the present application. The device 10 includes a transceiver module 11 and a processing module 12. The transceiver module 11 can implement corresponding communication functions, and the processing module 12 is used to perform data processing, or in other words, the transceiver module 11 is used to perform operations related to receiving and sending, and the processing module 12 is used to perform other operations besides receiving and sending. The transceiver module 11 can also be called a communication interface or a communication unit.

[0486] Optionally, the device 10 may further include a storage module 13, which may be used to store instructions and / or data. The processing module 12 may read the instructions and / or data in the storage module so that the device implements the actions of the devices in the aforementioned method embodiments.

[0487] In one design, the apparatus 10 may correspond to the terminal device (eg, Tag) in the above method embodiment, or a component of the terminal device (eg, a chip).

[0488] The device 10 can implement the steps or processes executed by the terminal device in the above method embodiment, wherein the transceiver module 11 can be used to execute the transceiver related operations of the terminal device in the above method embodiment, and the processing module 12 can be used to execute the processing related operations of the terminal device in the above method embodiment.

[0489] It should be understood that the specific process of each unit executing the above corresponding steps has been described in detail in the above method embodiment, and for the sake of brevity, it will not be repeated here.

[0490] In another design, the apparatus 10 may correspond to the access network device in the above method embodiment, or a component (such as a chip) of the access network device.

[0491] It should be understood that the specific process of each unit executing the above corresponding steps has been described in detail in the above method embodiment, and for the sake of brevity, it will not be repeated here.

[0492] In yet another design, the device 10 may correspond to the first network element in the above method embodiment, or a component (such as a chip) of the first network element.

[0493] It should be understood that the specific process of each unit executing the above corresponding steps has been described in detail in the above method embodiment, and for the sake of brevity, it will not be repeated here.

[0494] In yet another design, the device 10 may correspond to the storage network element in the above method embodiment, or be a component (such as a chip) of the storage network element.

[0495] It should be understood that the specific process of each unit performing the above corresponding steps has been described in detail in the above method embodiment, and for the sake of brevity, it will not be repeated here.

[0496] It should also be understood that the device 10 here is embodied in the form of a functional module. The term "module" here may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a dedicated processor or a group processor, etc.) and a memory for executing one or more software or firmware programs, a merged logic circuit and / or other suitable components that support the described functions. In an optional example, those skilled in the art may understand that the device 10 may be specifically a mobile management network element in the above-mentioned embodiment, and may be used to execute the various processes and / or steps corresponding to the mobile management network element in the above-mentioned method embodiments; or, the device 10 may be specifically a terminal device in the above-mentioned embodiment, and may be used to execute the various processes and / or steps corresponding to the terminal device in the above-mentioned method embodiments. To avoid repetition, it will not be repeated here.

[0497] The device 10 of each of the above schemes has the function of implementing the corresponding steps performed by the device (such as the first network element, the terminal device, the access network device, etc.) in the above method. This function can be implemented by hardware, or by hardware executing the corresponding software implementation. The hardware or software includes one or more modules corresponding to the above functions; for example, the transceiver module can be replaced by a transceiver (for example, the sending unit in the transceiver module can be replaced by a transmitter, and the receiving unit in the transceiver module can be replaced by a receiver), and other units, such as the processing module, can be replaced by a processor to respectively perform the transceiver operations and related processing operations in each method embodiment.

[0498] In addition, the transceiver module 11 may also be a transceiver circuit (for example, may include a receiving circuit and a sending circuit), and the processing module may be a processing circuit.

[0499] Figure 7 2 is a schematic diagram of another communication device 20 provided in an embodiment of the present application. The device 20 includes a processor 21, and the processor 21 is used to execute a computer program or instruction stored in a memory 22, or read data / signaling stored in the memory 22 to execute the method in each method embodiment above. Optionally, there are one or more processors 21.

[0500] Alternatively, if Figure 7 As shown, the device 20 also includes a memory 22, which is used to store computer programs or instructions and / or data. The memory 22 can be integrated with the processor 21, or can also be separately set. Optionally, the memory 22 is one or more.

[0501] Alternatively, if Figure 7As shown, the device 20 further includes a transceiver 23, and the transceiver 23 is used for receiving and / or sending signals. For example, the processor 21 is used to control the transceiver 23 to receive and / or send signals.

[0502] As a solution, the device 20 is used to implement the operations performed by the terminal device in the above various method embodiments.

[0503] As another solution, the device 20 is used to implement the operations performed by the first network element in each of the above method embodiments.

[0504] As another solution, the device 20 is used to implement the operations performed by the access network device in the above method embodiments.

[0505] As another solution, the device 20 is used to implement the operations performed by the storage network element in the above method embodiments.

[0506] It should be understood that the processor mentioned in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0507] It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory and / or a non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM). For example, RAM can be used as an external cache. By way of example and not limitation, RAM includes the following forms: static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0508] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0509] It should also be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0510] Figure 8 Schematic diagram of a chip system 30 provided in an embodiment of the present application. The chip system 30 (or also referred to as a processing system) includes a logic circuit 31 and an input / output interface 32.

[0511] Among them, the logic circuit 31 can be a processing circuit in the chip system 30. The logic circuit 31 can be coupled to the storage network element and call the instructions in the storage network element so that the chip system 30 can implement the methods and functions of each embodiment of the present application. The input / output interface 32 can be an input / output circuit in the chip system 30, outputting information processed by the chip system 30, or inputting data or signaling information to be processed into the chip system 30 for processing.

[0512] As a solution, the chip system 30 is used to implement the operations performed by the first network element, the terminal device, and the access network device in the above method embodiments.

[0513] For example, the logic circuit 31 is used to implement the processing-related operations performed by the first network element, the terminal device, and the access network device in the above method embodiments; the input / output interface 32 is used to implement the sending and / or receiving-related operations performed by the first network element, the terminal device, and the access network device in the above method embodiments.

[0514] An embodiment of the present application also provides a computer-readable storage medium on which computer instructions for implementing the methods executed by the first network element, the terminal device, and the access network device in the above-mentioned method embodiments are stored.

[0515] For example, when the computer program is executed by a computer, the computer can implement the methods performed by the first network element, the terminal device, and the access network device in each embodiment of the above method.

[0516] An embodiment of the present application also provides a computer program product, comprising instructions, which, when executed by a computer, implement the methods performed by the first network element, the terminal device, and the access network device in the above-mentioned method embodiments.

[0517] An embodiment of the present application also provides a communication system, including the aforementioned first network element and access network equipment.

[0518] The explanation of the relevant contents and beneficial effects of any of the above-mentioned devices can be referred to the corresponding method embodiments provided above, which will not be repeated here.

[0519] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0520] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. For example, the computer can be a personal computer, a server, or a network device, etc. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media integrations. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)). For example, the aforementioned available medium includes, but is not limited to, various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0521] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A communication method, characterized in that: The method is applied to a terminal device, comprising: Acquire a first parameter and a first key, where the first key corresponds to a plurality of terminal devices in the group to which the terminal device belongs, and a combination of the first parameter and the first key uniquely corresponds to the terminal device; Generate a message authentication code MAC according to the first parameter and the first key; The MAC is sent to a network device, where the MAC is used by the network device to authenticate the terminal device.

2. The method according to claim 1, characterized in that The combination of the first parameter and the first key uniquely corresponds to the terminal device, including: A second key generated according to the first parameter and the first key uniquely corresponds to the terminal device; The generating a message authentication code MAC according to the first parameter and the first key includes: The MAC is generated based on the second key and the first parameter.

3. The method according to claim 1, characterized in that The generating a message authentication code MAC according to the first parameter and the first key includes: The MAC is generated according to the first parameter, the first key, and a second parameter, where the second parameter comes from an access network device, or the second parameter comes from the network device.

4. The method according to claim 3, characterized in that The combination of the first parameter and the first key uniquely corresponds to the terminal device, including: A second key generated according to the first parameter and the first key uniquely corresponds to the terminal device; Generating the MAC according to the first parameter, the first key and the second parameter includes: The MAC is generated based on the second key and the second parameter.

5. The method according to any one of claims 1 to 4, characterized in that The obtaining of the first parameter comprises: The first parameter is received from an access network device.

6. The method according to claim 5, characterized in that Before receiving the first parameter from the access network device, the method further includes: Sending a message to the access network device for requesting access to the access network device; The obtaining of the first parameter comprises: An access response message is received from the access network device, where the access response message includes the first parameter.

7. The method according to claim 6, characterized in that Before sending a message for requesting access to the access network device to the access network device, the method further includes: An excitation signal is received from the access network device, where the excitation signal is used to provide energy for the terminal device.

8. The method according to any one of claims 1 to 7, characterized in that The method further comprises: A first identifier of the terminal device is sent to the network device, where the first identifier is used by the network device to determine the first key corresponding to the group to which the terminal device belongs when authenticating the terminal device.

9. The method according to any one of claims 1 to 8, characterized in that The method further comprises: sending the first parameter to the network device; or, A second identifier of the terminal device is sent to the access network device, where the second identifier is used by the access network device to determine the first parameter.

10. The method according to any one of claims 3 to 9, characterized in that: The method further comprises: sending the second parameter to the network device; or, A second identifier of the terminal device is sent to the access network device, where the second identifier is used by the access network device to determine the second parameter.

11. A communication method, characterized in that: include: receiving a first message authentication code MAC from a terminal device, where the first MAC is generated according to a first parameter and a first key, where the first key corresponds to a plurality of terminal devices in a group to which the terminal device belongs, and a combination of the first parameter and the first key uniquely corresponds to the terminal device; Acquire a third key, where the third key is the same as the first key, or the third key is generated according to the first key and the first parameter; Generate a second MAC according to the third key; The terminal device is authenticated according to the second MAC and the first MAC.

12. The method according to claim 11, characterized in that The obtaining of the third key comprises: The third key is received from a storage network element, where the storage network element is used to store the correspondence between the group to which the terminal device belongs and the first key.

13. The method according to claim 12, characterized in that Before receiving the third key from the storage network element, the method further includes: Obtaining an identification of the terminal device; The identifier of the terminal device is sent to the storage network element, where the identifier of the terminal device is used by the storage network element to determine the first key corresponding to the group to which the terminal device belongs.

14. The method according to claim 13, characterized in that The third key is generated according to the first key and the first parameter. Before receiving the third key from the storage network element, the method further includes: Obtaining the first parameter; The first parameter is sent to the storage network element, where the first parameter is used by the storage network element to generate the third key according to the first key.

15. The method according to claim 11, characterized in that The third key is generated according to the first key and the first parameter. Before obtaining the third key, the method includes: Obtaining an identifier of the terminal device and the first parameter; Sending the identifier of the terminal device to a storage network element, where the identifier of the terminal device is used by the storage network element to determine the first key corresponding to the group to which the terminal device belongs; receiving the first key from the storage network element; The obtaining of the third key comprises: The third key is generated according to the first key and the first parameter.

16. The method according to any one of claims 11 to 15, characterized in that The first MAC is generated according to the first parameter, the first key, and a second parameter, and the method further includes: Obtaining the second parameter; Generating a second MAC according to the third key includes: The second MAC is generated according to the third key and the second parameter.

17. The method according to claim 16, characterized in that The obtaining of the second parameter comprises: The second parameter is received from the access network device.

18. The method according to claim 16 or 17, characterized in that Before receiving the first message authentication code MAC from the terminal device, the method further includes: Send the second parameter to the terminal device.

19. A communication method, characterized in that: The method is applied to access network equipment, including: Sending a first parameter to a terminal device, where a combination of the first parameter and a first key uniquely corresponds to the terminal device, and the first key corresponds to a plurality of terminal devices in a group to which the terminal device belongs; Receiving a message authentication code MAC from the terminal device, where the MAC is generated by the terminal device according to the first key and the first parameter; The MAC is sent to a network device, where the MAC is used by the network device to authenticate the terminal device.

20. The method according to claim 19, characterized in that Before sending the first parameter to the terminal device, the method further includes: generating the first parameter; The method further comprises: The first parameter is sent to the network device.

21. The method according to claim 20, characterized in that Before sending the first parameter to the network device, the method further includes: receiving an identification from the terminal device; Determine the first parameter according to the correspondence between the identifier of the terminal device and the first parameter; or, The first parameter is received from the terminal device.

22. The method according to any one of claims 19 to 21, characterized in that The method further comprises: A second parameter is sent to the terminal device, where the second parameter is used to generate the MAC.

23. The method according to claim 22, characterized in that Before sending the second parameter to the terminal device, the method further includes: The second parameter is received from the network device.

24. The method according to any one of claims 19 to 23, characterized in that Before sending the first parameter to the terminal device, the method further includes: Receiving a request message from the terminal device for requesting access to the access network device; The sending the first parameter to the terminal device comprises: An access response message is sent to the terminal device, where the access response message includes the first parameter.

25. The method according to claim 24, characterized in that Before receiving a request message from the terminal device for requesting access to the access network device, the method further includes: An excitation signal is sent to the terminal device, where the excitation signal is used to provide energy for the terminal device.

26. A communication device, characterized in that: The device comprises a module for executing the method according to any one of claims 1 to 10, or the device comprises a module for executing the method according to any one of claims 11 to 18, or the device comprises a module for executing the method according to any one of claims 19 to 25.

27. A communication device, characterized in that: include Memory for storing computer programs; A processor for executing the computer program stored in the memory so that the communication device performs the method of any one of claims 1 to 10; or, so that the communication device performs the method of any one of claims 11 to 18; or, so that the communication device performs the method of any one of claims 19 to 25.

28. A communication system, characterized in that: It comprises an access network device and a first network element, wherein the first network element is used to execute the method as described in any one of claims 11 to 18, and the access network device is used to execute the method as described in any one of claims 19 to 25.

29. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, which, when executed on a computer, cause the computer to execute the method as claimed in any one of claims 1 to 10; or, cause the computer to execute the method as claimed in any one of claims 11 to 18; or, cause the computer to execute the method as claimed in any one of claims 19 to 25.

30. A computer program product, characterized in that The computer program product comprises a computer program or instructions for executing the method as claimed in any one of claims 1 to 10; or, the computer program product comprises a computer program or instructions for executing the method as claimed in any one of claims 11 to 18; or, the computer program product comprises a computer program or instructions for executing the method as claimed in any one of claims 19 to 25.

Images