Communication method and communication device

Abstract

According to the communication method and the communication device, in a user equipment parameter updating process, a data management network element can take the head of a UPU container as a new type of data set to be stored in a UPU list or can additionally add a field in the UPU list to store the head of the UPU container, and provides the UPU list comprising the head of the UPU container to an authentication network element, so that the UPU container can be authenticated. Therefore, the authentication network element can obtain the message authentication code used for performing integrity protection on the UPU list according to the UPU list comprising the head of the UPU container, and the obtained message authentication code can perform integrity protection on the head of the UPU container, so that the security of information transmission is improved; and the integrity of the first header can be protected on the premise of reducing the change of the message format as much as possible.

Description

Technical Field

[0001] The present application relates to the field of communications, and more specifically, to a communication method and a communication device. Background Art

[0002] The user equipment parameters update (UPU) mechanism refers to a mechanism by which the data management network element updates the user equipment (UE) parameters through the control plane process. After the UE successfully registers with the network, the updated parameters can be securely delivered to the UE through the data management network element. Currently, in the UPU process, the data management network element can send messages to the UE through the control plane, but there is a risk that the information sent by the data management network element to the UE will be tampered with during the transmission process. Summary of the invention

[0003] The present application provides a communication method and a communication device, which help to improve the security of information transmission in the UPU process.

[0004] In a first aspect, a communication method is provided. The method can be executed by a data management network element or a module or unit (such as a chip or circuit) in the data management network element, and the present application does not limit this.

[0005] The method includes: when it is necessary to update the parameters of the terminal device, sending a first request message to an authentication network element, the first request message including the identifier of the terminal device and a first user equipment parameter update UPU list, the first request message being used to request security protection for the first UPU list, the first UPU list including a first data set and a second data set, the first data set including a first type field, a first length field and a first data field, the first type field being used to indicate that the type of the first data set is a data set of the first header carrying a UPU container, the UPU container being used to carry the first UPU list, the first header being used to carry information given by the network to the terminal device, and the first length field being used to indicate The length of the first data set, the first data field is used to carry the first header, the second data set includes a second type field, a second length field and a second data field, the second type field is used to indicate the type of the parameter to be updated, the second length field is used to indicate the length of the second data set, and the second data field is used to carry the parameter to be updated; receiving a first response message from the authentication network element, the first response message includes a first message authentication code and a count value corresponding to the first message authentication code, the first message authentication code is used to perform integrity protection on the first UPU list; sending the first UPU list, the first message authentication code and the count value to the terminal device through the mobile management network element.

[0006] In the above method, the data management network element can place the first header of the UPU container in the first UPU list, and provide the first UPU list including the first header to the authentication network element, so that the authentication network element can obtain a message authentication code for integrity protection of the first UPU list based on the first UPU list. Since the first UPU list includes the first header, the obtained message authentication code can also perform integrity protection on the first header. Compared with the existing UPU process that only performs integrity protection on the UPU list and the count value, the above method can also perform integrity protection on the first header, so that the information given by the network to the terminal device is not easily tampered with, which helps to improve the security of information transmission. In addition, the data management network element can store the first header of the UPU container in the first UPU list as a new type of data set, so that the integrity of the first header can be protected while minimizing changes to the message format.

[0007] In combination with the first aspect, in some implementations, the first header includes at least one of a first flag bit, a second flag bit, and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

[0008] Based on the above method, the integrity protection of the first header can be achieved, so that the terminal device can correctly perform subsequent operations according to the first header, such as whether to read the UPU list, whether to send confirmation information, and whether to re-register.

[0009] In combination with the first aspect or any implementation thereof, in some other implementations, the method further includes: receiving first information from the terminal device, the first information being used to indicate that the terminal device has failed to read the first header from the UPU container.

[0010] In the above method, if the terminal device fails to read the first header from the first UPU list, for example, the terminal device does not support the UPU list of this format, then the terminal device may send a first message to the data management network element, where the first information is used to indicate that the terminal device fails to read the first header from the UPU container, so that the data management network element knows that the terminal device does not support the UPU container of this format, and subsequently the data management network element may no longer send the UPU container of this format to the terminal device.

[0011] In combination with the first aspect or any implementation manner thereof, in some other implementation manners, sending the first UPU list, the first message authentication code and the count value to the terminal device through the mobile management network element includes: sending a notification message to the mobile management network element, the notification message including the first UPU list, the first message authentication code and the count value, the notification message also including second information, the second information is used to determine the second header of the UPU container, the first UPU list, the first message authentication code, the count value and the second information are carried in the notification message in the form of independent information elements, and the second header is used to carry the information given by the network to the terminal device.

[0012] In the above method, the data management network element can send the first UPU list, the first message authentication code, the count value, and the second information as independent information elements in the notification message to the mobility management network element, so that the mobility management network element constructs the UPU container. The data management network element provides the second information to the mobility management network element, so that the mobility management network element can construct the second header of the UPU container according to the second information, thereby realizing the construction of the UPU container.

[0013] In combination with the first aspect or any implementation thereof, in some other implementations, the second information is the second header.

[0014] In combination with the first aspect or any implementation thereof, in some implementations, the notification message includes the UPU container, the UPU container includes the first UPU list, the first message authentication code, the count value and the second header of the UPU container, the second header is used to carry the information from the network to the terminal device, and the second header is outside the first UPU list.

[0015] In a second aspect, a communication method is provided, which can be executed by a terminal device or a module or unit (such as a chip or circuit) in the terminal device, and the present application does not limit this.

[0016] The terms or features in the second aspect or its implementation methods that are the same as those in the first aspect or its implementation methods may refer to the first aspect or its implementation methods, and the technical effects thereof may refer to the technical effects in the first aspect or its implementation methods.

[0017] The method includes: receiving a user equipment parameter update UPU container, the UPU container includes a first UPU list, a first message authentication code and a count value corresponding to the first message authentication code, the first UPU list includes a first data set and a second data set, the first data set includes a first type field, a first length field and a first data field, the first type field is used to indicate that the type of the first data set is a data set carrying the first header of the UPU container, the first header is used to carry information from the network to the terminal device, the first length field is used to indicate the length of the first data set, the first data field is used to carry the first header, the second data set includes a second type field, a second length field and a second data field, the second type field is used to indicate the type of the parameter to be updated of the terminal device, the second length field is used to indicate the length of the second data set, and the second data field is used to carry the parameter to be updated; determining a second message authentication code according to the first UPU list and the count value; when the first message authentication code and the second message authentication code match, obtaining the first header and the parameter to be updated, and performing subsequent operations according to the first header.

[0018] In the above method, the first message authentication code is used to perform integrity protection on the first UPU list in the received UPU container, and the first UPU list of the UPU container includes not only the parameters to be updated of the terminal device, but also the first header of the UPU container, so the first message authentication code can also perform integrity protection on the first header. When the first message authentication code and the second message authentication code match, that is, when the integrity authentication is passed, the terminal device can correctly perform subsequent operations, such as whether to send confirmation information and whether to re-register, etc., according to the first header that has passed the integrity authentication. In addition, the data management network element can store the first header of the UPU container in the first UPU list as a new type of data set, so that the integrity of the first header can be protected while minimizing changes to the message format.

[0019] In combination with the second aspect, in some implementations, the first header includes at least one of a first flag bit, a second flag bit, and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

[0020] In combination with the second aspect or any implementation manner thereof, in some other implementation manners, the subsequent operations performed according to the first header include: when the second flag bit indicates a request for the terminal device to reply with confirmation information, determining the confirmation information according to the count value, the confirmation information including a third message authentication code, and the third message authentication code is used by the data management network element to verify whether the terminal device correctly receives the first UPU list; sending the confirmation information to the data management network element; and / or, when the third flag bit indicates a request for the terminal device to re-register, re-registering.

[0021] In combination with the second aspect or any implementation manner thereof, in some other implementation manners, the method further includes: when the first message authentication code and the second message authentication code do not match, discarding the UPU container.

[0022] In combination with the second aspect or any implementation manner thereof, in some other implementation manners, obtaining the first header includes: obtaining the first header in the first data field according to the first type field; obtaining the parameters to be updated includes: obtaining the parameters to be updated in the second data field according to the second type field.

[0023] In a third aspect, a communication method is provided, which may be executed by a mobile management network element or a module or unit (such as a chip or circuit) in the mobile management network element, and the present application does not limit this.

[0024] The terms or features in the third aspect or its implementation methods that are the same as those in the first aspect or its implementation methods may refer to the first aspect or its implementation methods, and the technical effects thereof may refer to the technical effects in the first aspect or its implementation methods.

[0025] The method includes: receiving a notification message from a data management network element, the notification message including a first UPU list, a first message authentication code, a count value corresponding to the first message authentication code, and a second information, the first UPU list, the first message authentication code, the count value, and the second information are carried in the notification message in the form of independent cells, the first UPU list includes a first data set and a second data set, the first data set includes a first type field, a first length field, and a first data field, the first type field is used to indicate that the type of the first data set is a data set carrying a first header of a UPU container, the UPU container is used to carry the first UPU list, the first header is used to carry information from the network to a terminal device, the first length field is used to indicate the length of the first data set, and the first data field Used to carry the first header, the second data set includes a second type field, a second length field and a second data field, the second type field is used to indicate the type of parameters to be updated of the terminal device, the second length field is used to indicate the length of the second data set, the second data field is used to carry the parameters to be updated, and the second information is used to determine the second header of the UPU container; according to the first UPU list, the first message authentication code, the count value and the second information, generate the UPU container, the UPU container includes the second header, the first UPU list, the first message authentication code and the count value, the second header is outside the first UPU list, and the second header is used to carry information from the network to the terminal device; send the UPU container to the terminal device.

[0026] In the above method, the data management network element can send the first UPU list, the first message authentication code, the count value, and the second information as independent information elements in the notification message to the mobility management network element, so that the mobility management network element constructs the UPU container. The data management network element provides the second information to the mobility management network element, so that the mobility management network element can construct the second header of the UPU container according to the second information, thereby realizing the construction of the UPU container.

[0027] In combination with the third aspect, in some implementations, the second information is the second header.

[0028] In combination with the third aspect or any implementation thereof, in some other implementations, the first header and / or the second header respectively include at least one of a first flag bit, a second flag bit and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

[0029] In a fourth aspect, a communication method is provided, which can be executed by a data management network element or a module or unit (such as a chip or circuit) in the data management network element, and the present application does not limit this.

[0030] The method includes: when it is necessary to update the parameters of the terminal device, sending a first request message to an authentication network element, the first request message including the identifier of the terminal device and a first user equipment parameter update UPU list, the first request message being used to request security protection for the first UPU list, the first UPU list including a data set and a first header of a UPU container, the UPU container being used to carry the first UPU list, the first header being used to carry information from the network to the terminal device, the data set including a type field, a length field and a data field, the type field being used to indicate the type of the parameter to be updated, the length field being used to indicate the length of the data set, and the data field being used to carry the parameter to be updated; receiving a first response message from the authentication network element, the first response message including a first message authentication code and a count value corresponding to the first message authentication code, the first message authentication code being used to perform integrity protection on the first UPU list; and sending the first UPU list, the first message authentication code and the count value to the terminal device via a mobile management network element.

[0031] In the above method, the data management network element can place the first header of the UPU container in the first UPU list, and provide the first UPU list including the first header to the authentication network element, so that the authentication network element can obtain a message authentication code for integrity protection of the first UPU list based on the first UPU list. Since the first UPU list includes the first header, the obtained message authentication code can also perform integrity protection on the first header. Compared with the existing UPU process that only performs integrity protection on the UPU list and the count value, the above method can also perform integrity protection on the first header, so that the information given by the network to the terminal device is not easily tampered with, which helps to improve the security of information transmission. In addition, the data management network element can add an additional field in the first UPU list to store the first header of the UPU container, so that the integrity of the first header can be protected while minimizing changes to the message format.

[0032] In combination with the fourth aspect, in some implementations, the first header includes at least one of a first flag bit, a second flag bit, and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

[0033] Based on the above method, the integrity protection of the first header can be achieved, so that the terminal device can correctly perform subsequent operations according to the first header, such as whether to read the UPU list, whether to send confirmation information, and whether to re-register.

[0034] In combination with the fourth aspect or any implementation thereof, in some other implementations, the first header is located at a preset position of the first UPU list.

[0035] In the above method, the data management network element places the first header of the UPU container at a preset position, so that no additional information is required between the data management network element and the terminal device to determine the position of the first header in the first UPU list. The solution is simple and easy to implement, and can protect the integrity of the first header while minimizing changes to the message format.

[0036] In combination with the fourth aspect or any implementation thereof, in some other implementations, the preset position is after the data set, and the data set is the last data set in the first UPU list.

[0037] In the above method, the data management network element places the first header of the UPU container after the last data set of the first UPU list, and can perform integrity protection on the first header while minimizing changes to the message format.

[0038] In combination with the fourth aspect or any implementation thereof, in some implementations, the preset position is before the data set, and the data set is the first data set in the first UPU list.

[0039] In the above method, the data management network element places the first header of the UPU container before the first data set of the first UPU list, and can protect the integrity of the first header while minimizing changes to the message format.

[0040] In combination with the fourth aspect or any implementation manner thereof, in some other implementation manners, the first header is after the data set, and the data set also includes a fourth flag bit, and the fourth flag bit is used to indicate that the first header is after the data set.

[0041] In the above method, the data management network element can place the first header of the UPU container after any data set in the first UPU list, and identify the data set through a flag, so that the receiving end (such as UE) of the first UPU list can locate the data set and obtain the first header after the data set. This solution is flexible and easy to implement, and can protect the integrity of the first header while minimizing changes to the message format.

[0042] In combination with the fourth aspect or any implementation thereof, in some other implementations, the type field and the fourth flag bit are in the same byte, the type field occupies the 1st to 4th bits of the byte, and the fourth flag bit occupies one bit of the 5th to 8th bits of the byte.

[0043] In combination with the fourth aspect or any implementation thereof, in some other implementations, the method further includes: receiving first information from the terminal device, the first information being used to indicate that the terminal device has failed to read the first header from the UPU container.

[0044] In the above method, if the terminal device fails to read the first header from the first UPU list, for example, the terminal device does not support the UPU list of this format, then the terminal device may send a first message to the data management network element, where the first information is used to indicate that the terminal device fails to read the first header from the UPU container, so that the data management network element knows that the terminal device does not support the UPU container of this format, and subsequently the data management network element may no longer send the UPU container of this format to the terminal device.

[0045] In combination with the fourth aspect or any of its implementation methods, in some other implementation methods, sending the first UPU list, the first message authentication code and the count value to the terminal device through the mobile management network element includes: sending a notification message to the mobile management network element, the notification message including the first UPU list, the first message authentication code and the count value.

[0046] In combination with the fourth aspect or any of its implementations, in some other implementations, the notification message also includes second information, the second information is used to determine the second header of the UPU container, the first UPU list, the first message authentication code, the count value and the second information are carried in the notification message as independent elements, and the second header includes the first flag bit, the second flag bit and the third flag bit.

[0047] In the above method, the data management network element can send the first UPU list, the first message authentication code, the count value, and the second information as independent information elements in the notification message to the mobility management network element, so that the mobility management network element constructs the UPU container. The data management network element provides the second information to the mobility management network element, so that the mobility management network element can construct the second header of the UPU container according to the second information, thereby realizing the construction of the UPU container.

[0048] In combination with the fourth aspect or any implementation thereof, in some other implementations, the second information is the second header.

[0049] In combination with the fourth aspect or any of its implementations, in some other implementations, the notification message includes the UPU container, the UPU container includes the first UPU list, the first message authentication code, the count value and the second header of the UPU container, the second header includes the first flag bit, the second flag bit and the third flag bit, and the second header is outside the first UPU list.

[0050] In a fifth aspect, a communication method is provided, which can be executed by a terminal device or a module or unit (such as a chip or circuit) in the terminal device, and the present application does not limit this.

[0051] The terms or features in the fifth aspect or its implementation methods that are the same as those in the fourth aspect or its implementation methods may refer to the fourth aspect or its implementation methods, and the technical effects thereof may refer to the technical effects in the fourth aspect or its implementation methods.

[0052] The method includes: receiving a user equipment parameter update UPU container, the UPU container including a first UPU list, a first message authentication code and a count value corresponding to the first message authentication code, the first UPU list including a data set and a first header of the UPU container, the first header being used to carry information from the network to the terminal device, the data set including a type field, a length field and a data field, the type field being used to indicate the type of the parameter to be updated of the terminal device, the length field being used to indicate the length of the data set, and the data field being used to carry the parameter to be updated; determining a second message authentication code according to the first UPU list and the count value; when the first message authentication code and the second message authentication code match, obtaining the first header and the parameter to be updated, and performing subsequent operations according to the first header.

[0053] In the above method, the first message authentication code is used to perform integrity protection on the first UPU list in the received UPU container, and the first UPU list of the UPU container includes not only the parameters to be updated of the terminal device, but also the first header of the UPU container, so the first message authentication code can also perform integrity protection on the first header. When the first message authentication code and the second message authentication code match, that is, when the integrity authentication is passed, the terminal device can correctly perform subsequent operations, such as whether to send confirmation information and whether to re-register, etc., according to the first header that has passed the integrity authentication. In addition, the data management network element can add an additional field in the first UPU list to store the first header of the UPU container, so that the integrity of the first header can be protected while minimizing changes to the message format.

[0054] In combination with the fifth aspect, in some implementations, the first header includes at least one of a first flag bit, a second flag bit, and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

[0055] In combination with the fifth aspect or any implementation manner thereof, in some other implementation manners, the subsequent operations performed according to the first header include: when the second flag bit indicates a request for the terminal device to reply with confirmation information, determining the confirmation information according to the count value, the confirmation information including a third message authentication code, and the third message authentication code is used by the data management network element to verify whether the terminal device correctly receives the first UPU list; sending the confirmation information to the data management network element; and / or, when the third flag bit indicates a request for the terminal device to re-register, re-registering.

[0056] In combination with the fifth aspect or any implementation thereof, in some other implementations, the method further includes: when the first message authentication code and the second message authentication code do not match, discarding the UPU container.

[0057] In combination with the fifth aspect or any implementation thereof, in some other implementations, the first header is located at a preset position of the first UPU list.

[0058] In combination with the fifth aspect or any implementation thereof, in some other implementations, the preset position is after the data set, and the data set is the last data set in the first UPU list.

[0059] In combination with the fifth aspect or any implementation thereof, in some other implementations, the preset position is before the data set, and the data set is the first data set in the first UPU list.

[0060] In combination with the fifth aspect or any implementation manner thereof, in some other implementation manners, obtaining the first head includes: obtaining the first head according to the preset position.

[0061] In combination with the fifth aspect or any implementation manner thereof, in some other implementation manners, the first header is after the data set, and the data set also includes a fourth flag bit, and the fourth flag bit is used to indicate that the first header is after the data set.

[0062] In combination with the fifth aspect or any implementation thereof, in some other implementations, the type field and the fourth flag bit are in the same byte, the type field occupies the 1st to 4th bits of the byte, and the fourth flag bit occupies one bit of the 5th to 8th bits of the byte.

[0063] In combination with the fifth aspect or any implementation manner thereof, in some other implementation manners, obtaining the first header includes: obtaining the first header after the data set according to the fourth flag bit.

[0064] In a sixth aspect, a communication method is provided, which can be executed by a mobile management network element or a module or unit (such as a chip or circuit) in the mobile management network element, and the present application does not limit this.

[0065] The terms or features in the sixth aspect or its implementation methods that are the same as those in the first aspect or its implementation methods may refer to the fourth aspect or its implementation methods, and the technical effects thereof may refer to the technical effects in the fourth aspect or its implementation methods.

[0066] The method includes: receiving a notification message from a data management network element, the notification message including a first UPU list, a first message authentication code, a count value corresponding to the first message authentication code, and a second information, the first UPU list, the first message authentication code, the count value, and the second information are carried in the notification message in the form of independent cells, the first UPU list includes a data set and a first header of a UPU container, the UPU container is used to carry the first UPU list, the first header is used to carry information from the network to the terminal device, the data set includes a type field, a length field, and a data field, the type field is used to indicate the type of parameters to be updated of the terminal device, The length field is used to indicate the length of the data set, the data field is used to carry the parameters to be updated, the first message authentication code is used to perform integrity protection on the first UPU list, and the second information is used to determine the second header of the UPU container; according to the first UPU list, the first message authentication code, the count value and the second information, the UPU container is generated, the UPU container includes the second header, the first UPU list, the first message authentication code and the count value, the second header is outside the first UPU list, and the second header is used to carry the information given by the network to the terminal device; the UPU container is sent to the terminal device.

[0067] In the above method, the data management network element can send the first UPU list, the first message authentication code, the count value, and the second information as independent information elements in the notification message to the mobility management network element, so that the mobility management network element constructs the UPU container. The data management network element provides the second information to the mobility management network element, so that the mobility management network element can construct the second header of the UPU container according to the second information, thereby realizing the construction of the UPU container.

[0068] In combination with the sixth aspect, in some implementations, the second information is the second header.

[0069] In combination with the sixth aspect or any implementation thereof, in some other implementations, the first header and / or the second header includes at least one of a first flag bit, a second flag bit and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

[0070] In combination with the sixth aspect or any implementation thereof, in some other implementations, the first header is located at a preset position of the first UPU list.

[0071] In combination with the sixth aspect or any implementation thereof, in some other implementations, the preset position is after the data set, and the data set is the last data set in the first UPU list.

[0072] In combination with the sixth aspect or any implementation thereof, in some other implementations, the preset position is before the data set, and the data set is the first data set in the first UPU list.

[0073] In combination with the sixth aspect or any implementation manner thereof, in some other implementation manners, the first header is after the data set, and the data set also includes a fourth flag bit, and the fourth flag bit is used to indicate that the first header is after the data set.

[0074] In combination with the sixth aspect or any of its implementations, in some other implementations, the type field and the fourth flag bit are in the same byte, the type field occupies the 1st to 4th bits of the byte, and the fourth flag bit occupies one bit of the 5th to 8th bits of the byte.

[0075] In a seventh aspect, a communication device is provided, which is used to execute the method provided by any one of the above aspects or its implementation. Specifically, the device may include units and / or modules, such as a processing unit and / or a transceiver unit, for executing the method provided by any one of the above aspects or its implementation.

[0076] In one implementation, the device is a data management network element, a terminal device, or a mobility management network element. When the device is a data management network element, a terminal device, or a mobility management network element, the transceiver unit may be a transceiver, or an input / output interface, or a communication interface; the processing unit may be at least one processor. Optionally, the transceiver is a transceiver circuit. Optionally, the input / output interface is an input / output circuit.

[0077] In another implementation, the device is a chip, a chip system or a circuit used in a data management network element, a terminal device or a mobile management network element. When the device is a chip, a chip system or a circuit used in a data management network element, a terminal device or a mobile management network element, the transceiver unit may be an input / output interface, an interface circuit, an output circuit, an input circuit, a pin or a related circuit on the chip, the chip system or the circuit; the processing unit may be at least one processor, a processing circuit or a logic circuit.

[0078] In an eighth aspect, a communication device is provided, comprising: a memory for storing programs; and at least one processor for executing computer programs or instructions stored in the memory to execute the method provided by any one of the above aspects or its implementation.

[0079] In one implementation, the apparatus is a data management network element, a terminal device, or a mobility management network element.

[0080] In another implementation, the device is a chip, a chip system or a circuit used in a data management network element, a terminal device or a mobile management network element.

[0081] In a ninth aspect, a communication device is provided, the device comprising: at least one processor and a communication interface, the at least one processor is used to obtain a computer program or instruction stored in a memory through the communication interface to execute the method provided by any one of the above aspects or its implementation. The communication interface can be implemented by hardware or software.

[0082] In one implementation, the device also includes the memory.

[0083] In the tenth aspect, a processor is provided for executing the methods provided in the above aspects.

[0084] For the operations such as sending and acquiring / receiving involved in the processor, if there is no special explanation, or if it does not conflict with its actual function or internal logic in the relevant description, then it can be understood as operations such as processor output and reception, input, etc., and can also be understood as sending and receiving operations performed by the radio frequency circuit and antenna. This application does not limit this.

[0085] In an eleventh aspect, a computer-readable storage medium is provided, which stores a program code for execution by a device, wherein the program code includes a method for executing any one of the above aspects or its implementation.

[0086] In a twelfth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the method provided by any one of the above aspects or its implementation.

[0087] In a thirteenth aspect, a chip is provided, the chip comprising a processor and a communication interface, the processor reads instructions stored in a memory through the communication interface, and executes the method provided by any one of the above aspects or its implementation. The communication interface can be implemented by hardware or software.

[0088] Optionally, as an implementation method, the chip also includes a memory, in which a computer program or instructions are stored, and the processor is used to execute the computer program or instructions stored in the memory. When the computer program or instructions are executed, the processor is used to execute the method provided by any one of the above aspects or its implementation methods.

[0089] Among them, when the method provided by the present application is executed by a chip, the present application does not limit the number of chips that specifically implement the method of the present application. For example, it can be executed by one chip or by two or more chips. Moreover, when the number of chips that implement the method of the present application is two or more, the chip manufacturers are not limited and can be the same manufacturer or different manufacturers.

[0090] In a fourteenth aspect, a communication system is provided, comprising at least one of the data management network element, terminal device or mobile management network element mentioned above.

[0091] In a fifteenth aspect, a computer program is provided, which, when executed on a computer, enables the method provided by any one of the above aspects or its implementation to be executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0092] Figure 1 It is a network architecture diagram applicable to an embodiment of the present application.

[0093] Figure 2 It is a schematic flow chart of the UPU process.

[0094] Figure 3 It is a schematic diagram of the format of the UPU container.

[0095] Figure 4 This is a schematic diagram of the data format of the UPU header.

[0096] Figure 5 This is a diagram of the data format of the UPU list.

[0097] Figure 6 It is a schematic flow chart of the communication method provided by this application.

[0098] Figure 7 is an example of the structure of the first UPU list.

[0099] Figure 8 is another example of the structure of the first UPU list.

[0100] Fig. 9 is another example of the structure of the first UPU list.

[0101] Fig.10 is another example of the structure of the first UPU list.

[0102] Fig.11 It is a structural schematic diagram of the device provided in the embodiment of the present application.

[0103] Fig.12 It is another structural schematic diagram of the device provided in an embodiment of the present application.

[0104] Fig.13 It is a schematic diagram of a chip system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0105] To facilitate understanding of the embodiments of the present application, the following points are explained before introducing the embodiments of the present application.

[0106] "For indicating" or "indicating" may include direct indication and indirect indication, or "for indicating" or "indicating" may be indicated explicitly and / or implicitly. The first, second, and other digital numbers are only used for the convenience of description, and are not used to limit the scope of the embodiments of the present application, such as distinguishing different messages, different information, etc. "Pre-definition" can be implemented by pre-saving corresponding codes, tables or other methods that can be used to indicate relevant information in the device, and the present application does not limit its specific implementation method. The "protocol" involved may refer to a standard protocol in the field of communication, such as the long term evolution (LTE) protocol, the new radio (NR) protocol, and related protocols used in future communication systems, and the present application does not limit this. "Example", "for example", "exemplarily", "as (another) example" and other words are used to indicate examples, illustrations or explanations. Any embodiment or design described as an "example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or design schemes. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized. "At least one" means one or more, and "more" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can mean: a, or b, or c, or a and b, or a and c, or b and c, or a, b and c. Where a, b and c can be single or plural, respectively. The descriptions of network element A sending a message, information or data to network element B, and network element B receiving a message, information or data from network element A, are intended to explain to which network element the message, information or data is to be sent, but do not limit whether they are sent directly or indirectly via other network elements. Descriptions such as "when...", "under the circumstances of...", "if" and "if" all mean that the device will make corresponding processing under certain objective circumstances, but do not limit the time, nor do they require the device to have a judgment action when implementing, nor do they mean that there are other limitations.

[0107] In addition, the network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field can know that with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0108] A communication system to which the embodiments of the present application can be applied is described below.

[0109] The embodiments of the present application can be applied to various communication systems, such as LTE system, frequency division duplex (FDD) system, time division duplex (TDD) system, universal mobile telecommunication system (UMTS), world-wide interoperability for microwave access (WiMAX) communication system, fifth generation (5G) communication system, etc. th generation, 5G) system or NR system, sixth generation (6 th The 5G mobile communication system described in this application includes a 5G mobile communication system of a non-standalone (NSA) or a 5G mobile communication system of a standalone (SA). The communication system may also be a public land mobile network (PLMN) network, a device-to-device (D2D) communication system, a machine-to-machine (M2M) communication system, an Internet of Things (IoT) communication system, a vehicle to everything (V2X) communication system, an uncrewed aerial vehicle (UAV) communication system or other communication systems.

[0110] For example, Figure 1 A network architecture diagram applicable to an embodiment of the present application is shown. Figure 1 As shown, the network architecture may specifically include three parts, namely, the terminal equipment part, the data network (DN) and the operator network part. The functions of the network elements of each part are briefly described below.

[0111] The terminal equipment part may include a terminal device, which may also be referred to as a user equipment (UE). The terminal equipment in the present application is a device with wireless transceiver function, which can communicate with one or more core network (CN) devices via an access network device (or also referred to as an access device) in a radio access network (RAN) 140. The terminal equipment may also be referred to as an access terminal, a terminal, a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a user agent or a user device, etc. The terminal equipment may be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it may also be deployed on the water (such as a ship, etc.); it may also be deployed in the air (such as an airplane, a balloon, and a satellite, etc.). The terminal equipment may be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a smart phone, a mobile phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), etc. Alternatively, the terminal device may also be a handheld device with wireless communication function, a computing device or other device connected to a wireless modem, a vehicle-mounted device, a wearable device, a drone device or an Internet of Things, a terminal in the Internet of Vehicles, a 5G network and any form of terminal in the future network, a relay user device or a terminal in the future evolved 6G network, etc. Among them, the relay user device may be, for example, a 5G residential gateway (RG). For example, the terminal device may be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc. The terminal device here refers to a 3GPP terminal. The embodiments of the present application do not limit the specific technology and specific device form adopted by the terminal device.

[0112] The data network, also known as the packet data network (PDN), is usually a network located outside the operator network, such as a third-party network. Of course, in some implementations, the DN can also be deployed by the operator, that is, the DN is part of the PLMN. The operator network can access multiple data network DNs, and a variety of services can be deployed on the data network DN, which can provide data and / or voice services to terminal devices. The terminal device can also access the data network DN through the operator network, use the operator services deployed on the data network DN, and / or services provided by a third party.

[0113] The operator network part includes but is not limited to the (radio) access network ((radio) access network, (R)AN) part and the core network (core network, CN) part.

[0114] (R)AN can be regarded as a sub-network of the operator network, and is an implementation system between the service node and the terminal device in the operator network. To access the operator network, the terminal device first passes through the (R)AN, and then can be connected to the service node of the operator network through the (R)AN. The access network device (RAN device) in the embodiment of the present application is a device that provides wireless communication functions for the terminal device, and can also be called a network device. The RAN device includes but is not limited to: the next generation node base station (gNB) in the 5G system, the evolved node B (evolved node B, eNB) in the long term evolution (LTE), the radio network controller (RNC), the node B (node ​​B, NB), the base station controller (base station controller, BSC), the base transceiver station (base transceiver station, BTS), the home base station (for example, home evolved node B, or home node B, HNB), the base band unit (base band unit, BBU), the transmission point (transmitting and receiving point, TRP), the transmission point (transmitting point, TP), the small base station device (pico), the mobile switching center, or the network equipment in the future network, etc. In systems using different wireless access technologies, the names of devices having access network device functions may be different. The embodiments of the present application do not limit the specific technology and specific device form used by the access network device.

[0115] The CN part includes but is not limited to the following network functions (NF): user plane function (UPF), network exposure function (NEF), network function repository function (NRF), policy control function (PCF), UDM, UDR, network data analysis function (NWDAF), authentication server function (AUSF), access and mobility management function (AMF), session management function (SMF) and application function (AF).

[0116] The following is a brief description of the NF functions included in CN.

[0117] 1. UPF is the gateway for communication between the operator network and the data network DN. It mainly provides user plane functions such as forwarding and processing of user messages, connection with DN, session anchor point, and quality of service (QoS) policy execution.

[0118] 2. NEF is a control plane function, which is mainly used to securely open the services and capabilities provided by 3GPP network functions to the outside world (such as AF). NEF also allows authenticated and authorized application functions to securely provide information in the 3GPP network.

[0119] 3. NRF is a control plane function that can be used to maintain real-time information of network functions and services in the network.

[0120] 4. PCF is the control plane function, which supports a unified policy framework to govern network behavior, provide policy rules to other control functions, contract information related to policy decisions, etc.

[0121] 5. UDM is a control plane function, which is mainly responsible for storing the contract data of contracted users in the operator network.

[0122] 6. UDR is a control plane function, which is mainly responsible for data storage and retrieval. For example, it provides the functions of storing and retrieving contract data for UDM, storing and retrieving policy data for PCF, storing and retrieving user's NF group ID information, etc.

[0123] 7. AUSF is a control plane function, usually used for primary authentication, i.e. authentication between terminal equipment (subscribed users) and operator networks.

[0124] 8. AMF is a control plane function, which is mainly responsible for the access control and mobility management of terminal devices accessing the operator's network, such as mobile state management, allocation of user temporary identity, authentication and authorization of users, etc.

[0125] 9. SMF is a control plane function, which is mainly responsible for session management (such as session establishment, modification and release), selection and control of UPF network functions, service and session continuity (SSC) mode selection, roaming and other session-related functions.

[0126] 10. AF is a control plane function used to provide application layer information. AF is mainly divided into two categories: the first category is based on operator deployment and is considered to be an AF trusted by the operator. This type of AF can directly interact with other network functions in the network; the second category is AF that the operator does not allow direct access to network functions, such as third-party AF. This type of AF can interact through other network functions in the NEF network.

[0127] Figure 1 Where Nnef, Nnrf, Npcf, Nudm, Nudr, Nausf, Namf, Nsmf, N1, N2, N3, N4, N6 and N9 are interface serial numbers. For example, the meaning of the above interface serial numbers can refer to the meaning defined in the 3GPP standard protocol, and this application does not limit the meaning of the above interface serial numbers. It should be noted that, Figure 1 The interface names between the various network functions in the system architecture are only examples. In specific implementations, the interface names of the system architecture may also be other names, which are not limited in this application. In addition, the names of the messages (or signaling) transmitted between the above network elements are only examples and do not constitute any limitation on the functions of the messages themselves. Figure 1 In the network architecture shown, each network element can communicate with each other through an interface. The interface between each network element can be a point-to-point interface or a service-oriented interface, which is not limited in this application.

[0128] It should be understood that the network architecture shown above is only an exemplary description, and the network architecture applicable to the embodiments of the present application is not limited thereto. Any network architecture that can realize the functions of the above-mentioned network elements is applicable to the embodiments of the present application.

[0129] It should also be understood that Figure 1 The functions or network elements such as AMF, SMF, UPF, PCF, UDM, AUSF, UDR, NEF, NRF, AF shown in the specification can be understood as network elements used to implement different functions, for example, they can be combined into network slices as needed. These network elements can be independent devices, or they can be integrated into the same device to implement different functions, or they can be network elements in hardware devices, or they can be software functions running on dedicated hardware, or they can be virtualized functions instantiated on a platform (for example, a cloud platform). This application does not limit the specific form of the above network elements.

[0130] It should also be understood that the above naming is only defined for the convenience of distinguishing different functions and should not constitute any limitation to this application. This application does not exclude the possibility of using other naming in 6G networks and other future networks. For example, in a 6G network, some or all of the above network elements may use the terminology in 5G, or may use other names, etc.

[0131] To facilitate understanding of the embodiments of the present application, some terms involved in the embodiments of the present application are first explained.

[0132] 1.UE parameters update (UPU)

[0133] The UPU mechanism refers to the mechanism by which UDM updates UE parameters through the control plane process. After the UE successfully registers with the 5G system, the updated parameters can be securely delivered to the UE through UDM. In the process of securely delivering updated parameters to the UE by UDM, UDM needs to rely on the security parameters calculated by AUSF (such as the UPU-MAC-I mentioned below). AUSF 、UPU-XMAC-I UE Therefore, before executing the UPU process, AUSF needs to complete the latest master authentication and store the latest K AUSF .

[0134] Figure 2 It is a schematic flow chart of the UPU process.

[0135] After the UE is successfully authenticated and registered with the 5G system, the UDM can decide to proceed with the UPU process at any time. The UPU security process can be as follows Figure 2 shown.

[0136] Step 201, UDM decides to execute UPU.

[0137] Exemplarily, when the UE registers to the 5G system, the UDM decides to perform UPU through the control plane. Then, the UDM prepares a UPU list, wherein the UPU list may include parameters protected by a security grouping mechanism and / or UE parameters whose final consumer is a mobile equipment (ME). Wherein, if the final consumer of the UE parameters to be updated (e.g., updated routing ID data) is a universal subscriber identity module (USIM), then the UDM should use a security grouping mechanism to protect these parameters to update these parameters stored on the USIM.

[0138] Steps 202-203, UDM calls the Nausf_UPUProtection service operation and sends the UPU list to AUSF via the Nausf_UPUProtection service operation message to obtain the message authentication code AUSF (UPU-MAC-I AUSF ) and count value UPU (Counter UPU ).

[0139] For example, the Nausf_UPUProtection message in step 202 includes the SUPI and UPU list of the UE, and the Nausf_UPUProtection response message in step 203 carries the UPU-MAC-I AUSF and Counter UPU .

[0140] Optionally, if the UDM requires the UE to respond to the successful security check of the received UPU list, the UDM may carry an ACK indication in the Nausf_UPUProtection message to indicate that the UDM needs the expected UPU-XMAC-I. UE The AUSF can carry UPU-XMAC-I in the Nausf_UPUProtection response message UE .

[0141] AUSF can be based on K AUSF The key is calculated to get UPU-MAC-I AUSF , K AUSF K stored after completing the latest master authentication AUSF . In calculating UPU-MAC-I AUSF When the input parameters can include the UPU list and Counter provided by UDM UPU, so that through UPU-MAC-I AUSF , UE can verify the UPU list and Counter UPU Integrity during transmission. UE , UDM can verify whether the UE has received the UPU list correctly.

[0142] Step 204, UDM shall call Nudm_SDM_Notification service operation to send UPU list, UPU-MAC-I AUSF and Counter UPU Sent to AMF.

[0143] If AMF supports UPU transparent container, the Nudm_SDM_Notification message includes UPU transparent container, which includes UPU list, UPU-MAC-I AUSF and Counter UPU .

[0144] If AMF does not support UPU transparent container, the Nudm_SDM_Notification message contains UPU list, UPU-MAC-I in the access and mobile subscription data. AUSF and Counter UPU An independent information element (IE).

[0145] Optionally, if the UDM requires the UE to respond with a successful security check confirmation of the UPU list it received, the UDM shall temporarily store the UPU-XMAC-I UE .

[0146] Step 205, after receiving the Nudm_SDM_Notification message, the AMF sends a downlink (DL) non-access stratum (NAS) transport message (DL NAS transport) to the UE.

[0147] If a UPU transparent container is received from the UDM in step 204, the AMF forwards the UPU transparent container to the UE, that is, includes the received UPU transparent container in the DL NAS transport message.

[0148] If the UDM provides the UPU list, UPU-MAC-I in step 204, AUSF and Counter UPUIf the independent cell is a UPU list, then AMF will AUSF and Counter UPU Construct a UPU transparent container and include the constructed UPU transparent container in the DL NAS transport message.

[0149] Step 206, after receiving the DL NAS transport message, the UE verifies the UPU-MAC-I AUSF .

[0150] Exemplarily, the UE receives the UPU list and the Counter UPU , using AUSF to calculate UPU-MAC-I AUSF UPU-MAC-I is calculated in the same way AUSF , and verify the calculated UPU-MAC-I AUSF UPU-MAC-I in the UPU transparent container in the DL NAS transport message AUSF Whether it matches.

[0151] If the two match, UPU-MAC-I AUSF If the authentication is successful and the UPU list includes parameters protected by the security packet mechanism, the ME forwards these security packets to the USIM.

[0152] If the two match, UPU-MAC-I AUSF If the verification is successful and the UPU list includes parameters that are not protected by the security grouping mechanism, the ME updates its stored parameters according to the parameters received in the UPU list.

[0153] Step 207: If the UDM has requested the UE to confirm the successful security check of the UPU list, and the UE has successfully verified and updated the UPU list provided by the UDM, the UE may send an uplink (UL) NAS Transport message to the serving AMF and carry the UPU-MAC-I in the UL NAS Transport message. UE .

[0154] Among them, UE receives Counter UPU , using UPU-XMAC-I calculated with AUSF UE UPU-MAC-I is calculated in the same way UE UPU-MAC-I UE Can be placed in a transparent container.

[0155] Step 208: If a UPU-MAC-I is received in the UL NAS transmission message, UE If a transparent container is present, AMF sends a Nudm_SDM_Info message with the transparent container to UDM.

[0156] Step 209: If the UDM has requested the UE to confirm the successful security check of the UPU list, the UDM will receive the received UPU-MAC-I UE The UPU-XMAC-I temporarily stored in step 204 UE The comparison is performed to determine whether the UE has received the UPU list correctly.

[0157] For a more detailed description of the UPU process, please refer to the relevant standard protocol.

[0158] 2. UPU container

[0159] The UPU container may also be referred to as a UPU transparent container. When sent from the network to the UE, the purpose of the UPU container is to provide the UE with a UPU list and an optional ACK request and / or re-registration request. When sent from the UE to the network, the purpose of the UPU container is to indicate to the UE an acknowledgement of the successful receipt of the UE parameter update transparent container.

[0160] The format of the UPU sent from the network to the UE is described below.

[0161] Figure 3 It is a schematic diagram of the format of the UPU container.

[0162] When sent from the network to the UE, the UPU container includes the UPU transparent container information element identifier (UE parameters update transparent container IEI), the length of the UPU transparent container content (length of UE parameters update transparent container contents), the UPU header (UE parameters update header), the UPU-MAC-I AUSF , count value UPU (Counter UPU ) and UPU list (UE parameters update list), the bytes occupied by each part are shown in the figure. Among them:

[0163] 1) UPU transparent container cell identifier: an identifier of a UPU container, used to uniquely identify a UPU container.

[0164] 2) Length of the UPU transparent container content: indicates the length of the UPU container.

[0165] 3) UPU header: indicates the header of the UPU container.

[0166] Figure 4 This is a diagram of the data format of the UPU header. Figure 4 As shown, the UPU header may include a UPU data type (UPU data type) flag, an ACK flag, a re-registration (REG) flag, and 5 idle bits. The UPU data type flag, the ACK flag, the REG flag, and the 5 idle bits respectively occupy the 1st to 8th bits of the byte where the UPU header is located. Among them, the UPU data type flag is used to indicate that the UPU container carries a UPU list or carries confirmation information of successfully receiving the UPU list. In other words, the UPU data type flag is used to indicate whether the UPU container exists in a downlink UPU message or an uplink UPU message. The ACK flag is used to indicate whether the UE is requested to reply to the confirmation information. The REG flag is used to indicate whether the UE is requested to re-register.

[0167] 4)UPU-MAC-I AUSF : The message authentication code of the UPU container is used to protect the integrity of the transmitted content.

[0168] 5) Counter UPU : Count value, used as a freshness parameter to protect the message transmission process from replay attacks.

[0169] 6) UPU list: used to carry parameters to be updated, also known as UPU data. This article uniformly uses the UPU list for description.

[0170] Figure 5 This is a diagram of the data format of the UPU list. Figure 5As shown, the UPU list consists of several UPU data sets (data sets), each UPU data set includes a UPU data set type field (UE parameters update dataset type), a UPU data set length field (length of UE parameters update data set), a UPU data set field (UE parameters update data set), and 4 idle bits. Among them, the UPU data set type field is used to indicate the type of the UPU data set (or the type of UE parameters carried by the UPU data set) and occupies 4 bits. The currently used type number range is 0001-0100. The UPU data set length field is used to indicate the length of the UPU data set. The UPU data set field, also known as the UPU data field, is used to carry data (i.e., parameters to be updated). The 4 idle bits occupy the same byte as the UPU data set type field. Specifically, the UPU data type field occupies the 1st to 4th bits of the byte, and the 5th to 8th bits of the byte are idle bits.

[0171] From the above content, it can be seen that in the current UPU process, when calculating UPU-MAC-I AUSF When the input parameters include UPU list and Counter UPU , that is, for UPU list and Counter UPU Integrity protection is performed, in other words, the contents after the 21st byte of the UPU container are integrity protected. However, the header of the UPU container (i.e., the UPU header field) is not protected, and the UPU header is at risk of being tampered with during transmission.

[0172] In view of the above problems, the present application proposes a communication method and a communication device, in order to achieve integrity protection of the UPU header under the premise of minimizing changes to the message format. Specifically, the present application can copy a copy of the header of the UPU container and put it in the UPU list. Since the current UPU process has already performed integrity protection on the UPU list, the header of the UPU container can also be protected by copying a copy of the header of the UPU container and putting it in the UPU list.

[0173] The following is a description of the method embodiments of the present application.

[0174] Figure 6The method 600 may be performed by a UE or a module or unit in a UE, a mobility management network element or a module or unit in a mobility management network element, an authentication network element or a module or unit in an authentication network element, and a data management network element or a module or unit in a data management network element. For the convenience of description, the following uniformly uses UE, mobility management network element, authentication network element and data management network element for description.

[0175] It should be noted that the mobility management network element, the authentication network element, and the data management network element may have different names in different communication systems, and this application is not limited to them. Figure 1 In the 5G system shown, the mobility management network element may be AMF, the authentication network element may be AUSF, and the data management network element may be UDM.

[0176] Method 600 includes at least part of the following.

[0177] Step 601: When it is necessary to update the parameters of the UE, the data management network element sends a first request message to the authentication network element, or the authentication network element receives the first request message from the data management network element.

[0178] The first request message includes an identifier of the UE and a first UPU list, wherein the first UPU list includes parameters to be updated of the UE, and the first request message is used to request security protection for the first UPU list. In addition to including the parameters to be updated of the UE, the first UPU list of the embodiment of the present application also includes a first header of a UPU container, wherein the UPU container is a container for carrying the first UPU list.

[0179] The first header is used to carry information from the network (or data management network element) to the UE, and the UE can perform corresponding operations according to the information in the first header. Exemplarily, the first header may include at least one of a first flag bit, a second flag bit, and a third flag bit. Among them, the first flag bit is used to indicate that the UPU container carries a UPU list or carries confirmation information of successfully receiving the UPU list. For example, the first flag bit is a UPU data type flag bit. When the UPU data type flag bit is 0, it indicates that the UPU container carries a UPU list. When the UPU data type flag bit is 0, it indicates that the UPU container carries confirmation information of successfully receiving the UPU list. Step 601 corresponds to the situation where the first flag bit is used to indicate that the UPU container carries the UPU list. The second flag bit is used to indicate whether to request the UE to reply to the confirmation information or whether to request ACK. For example, the second flag bit is an ACK flag bit. The third flag bit is used to indicate whether to request the UE to re-register or whether to request re-registration. For example, the third flag bit is a REG flag bit.

[0180] Exemplarily, the data management network element may call the Nausf_UPUProtection service operation request to perform security protection on the first UPU list, that is, the first request message may be a Nausf_UPUProtection message, the UE identifier may be the SUPI of the UE, and the first message authentication code may be UPU-MAC-I AUSF , the count value can be Counter UPU .

[0181] Optionally, step 602 may be included before step 601, that is, the data management network element determines to update the parameters of the UE, in other words, the data management network element decides to execute the UPU process for the UE. After the UE is successfully authenticated and registered with the network, the data management network element may decide to perform the UPU process at any time.

[0182] There are many structures of the first UPU list in the embodiment of the present application, which are not limited.

[0183] In a possible implementation manner, the first header is stored in the first UPU list as a new type of data set.

[0184] Exemplarily, the structure of the first UPU list in this implementation may be as shown in the following first structure.

[0185] 1) The first structure

[0186] The first UPU list includes a first data set and a second data set.

[0187] The first data set includes a first type field, a first length field, and a first data field. The first type field is used to indicate that the type of the first data set is a data set that carries the first header, or in other words, the first type field is used to indicate the first type, the first type indicates that the first data set is used to carry the first header, and the first type is different from the type of the currently used data set, so as to distinguish it from the type of the currently used data set, so that the UE can find the data set that carries the first header. The first length field is used to indicate the length of the first data set. The first data field is used to carry the first header.

[0188] The second data set includes a second type field, a second length field, and a second data field. The second type field is used to indicate the type of the second data set, or the type of the parameter to be updated. The second length field is used to indicate the length of the second data set. The second data field is used to carry the parameter to be updated. Exemplarily, the parameter to be updated can be any one of the following data: routing ID update data, default configured NSSAI update data, disaster roaming information update data, or ME routing ID update data.

[0189] It should be noted that the embodiments of the present application do not limit whether the first UPU list also includes other data sets. The first UPU list may include only the first data set and the second data set, or may include data sets other than the first data set and the second data set.

[0190] Figure 7 is an example of the structure of the first UPU list.

[0191] like Figure 7 As shown, the first UPU list is composed of several UPU data sets, and each UPU data set contains the following three fields: UPU data set type field, UPU data set length field and UPU data set field. The UPU data set type field can correspond to the type field of the data set mentioned above, the UPU data set length field can correspond to the length field of the data set mentioned above, and the UPU data set field can correspond to the data field of the data set mentioned above. Among them, the UPU data set type field is used to indicate the type of the UPU data set, occupying the 1st to 4th bits of a byte, and the 5th to 8th bits of the byte are idle bits, and the value of the idle bit can be 0. The UPU data set length field is used to indicate the length of the UPU data set, occupying one byte. The UPU data set field is used to carry the data in the UPU data set, that is, the parameters to be updated, and can occupy several bytes.

[0192] Figure 7 In the example, the first header is carried in the UPU data set m. Figure 7As shown, the value of the UPU data set type field of UPU data set m is a type number of 4 bits that has not been used. Assuming that the type numbers currently used are 0001-0100, the value of the UPU data set type field of the mth data set can be a type number other than 0001-0100. The UPU data set field of UPU data set m stores the first header. The value of the UPU data set length field of UPU data set m is the length of UPU data set m.

[0193] It should be noted that the UPU data set m can be any one of several data sets included in the first UPU list.

[0194] In another possible implementation, an additional field may be added to the first UPU list to store the first header.

[0195] Specifically, the first UPU list includes a data set and a first header. The data set includes a type field, a length field, and a data field, wherein the type field of the data set is used to indicate the type of the data set, the length field of the data set is used to indicate the length of the data set, and the data field of the data set is used to carry the data in the data set, that is, the parameters to be updated. The data set described here may be a data set adjacent to the first header. For the convenience of description, the data set described here will be referred to as the third data set hereinafter.

[0196] Optionally, the first header may be at a preset position of the first UPU list. Exemplarily, the structure of the first UPU list in this implementation may be as shown in the second structure and the third structure below.

[0197] 2) The second structure

[0198] The preset position is after the third data set, and the third data set may be the last data set of all data sets included in the first UPU list. In other words, the first header is after the last data set of the first UPU list. The last data of the first UPU list may refer to the data set corresponding to the last number after all data sets included in the UPU are numbered in sequence.

[0199] Figure 8 is another example of the structure of the first UPU list.

[0200] like Figure 8As shown, the first UPU list consists of n UPU data sets and a first header, and the n UPU data sets are numbered from 1 to n, and UPU data set n is the third data set, that is, the last data set of the UPU data. Each UPU data set of the UPU data contains the following three fields: a UPU data set type field, a UPU data set length field, and a UPU data set field. The UPU data set type field may correspond to the type field of the data set mentioned above, the UPU data set length field may correspond to the length field of the data set mentioned above, and the UPU data set field may correspond to the data field of the data set mentioned above. Among them, the UPU data set type field is used to indicate the type of the UPU data set, occupying the 1st to 4th bits of a byte, and the 5th to 8th bits of the byte are idle bits, and the value of the idle bit can be 0. The UPU data set length field is used to indicate the length of the UPU data set, occupying one byte. The UPU data set field is used to carry the data in the UPU data set, that is, the parameters to be updated, and may occupy several bytes. The first header may be located one byte after UPU data set n (that is, the last UPU data set).

[0201] 3) The third structure

[0202] The preset position is before the third data set, and the third data set may be the first data set of all data sets included in the first UPU list. In other words, the first header is before the first data set in the first UPU list. The first data in the first UPU list may refer to the data set corresponding to the first number after all data sets included in the UPU are numbered in sequence.

[0203] For example, if the UPU container starts from the 23rd byte and is the first UPU list, the first header may be located at the 23rd byte of the UPU container.

[0204] Fig. 9 is another example of the structure of the first UPU list.

[0205] like Fig. 9As shown, the first UPU list consists of n UPU data sets and a first header, and the n UPU data sets are numbered from 1 to n. UPU data set 1 is the third data set, that is, the first data set of UPU data. Each UPU data set of UPU data contains the following three fields: UPU data set type field, UPU data set length field and UPU data set field. The UPU data set type field can correspond to the type field of the data set mentioned above, the UPU data set length field can correspond to the length field of the data set mentioned above, and the UPU data set field can correspond to the data field of the data set mentioned above. Among them, the UPU data set type field is used to indicate the type of the UPU data set, occupying the 1st to 4th bits of a byte, and the 5th to 8th bits of the byte are idle bits, and the value of the idle bit can be 0. The UPU data set length field is used to indicate the length of the UPU data set, occupying one byte. The UPU data set field is used to carry the data in the UPU data set, that is, the parameters to be updated, and can occupy several bytes. The first header can be located in a byte before UPU data set 1 (that is, the first UPU data set).

[0206] Optionally, the first header may be after any data set in the first UPU list, that is, the third data set may be any data set in the first UPU list. In this case, the third data set may be identified by a flag bit so that the receiving end of the first UPU list (such as UE) may locate the third data set and obtain the first header after the third data set. Exemplarily, the structure of the first UPU list under this implementation may be as shown in the fourth structure below.

[0207] 4) The fourth structure

[0208] The first header is after the third data set. Here, the third data set includes, in addition to the type field, the length field, and the data field, a fourth flag bit, which is used to indicate that there is a first header after the third data set or to indicate that there is no first header after the third data set. For example, when the fourth flag bit takes a value of 1, it indicates that there is a first header after the third data set; when the fourth flag bit takes a value of 0, it indicates that there is no first header after the third data set. Step 601 may correspond to the situation where the fourth flag bit is used to indicate that there is a first header after the third data set.

[0209] Exemplarily, the fourth flag bit may occupy an idle bit in the third data set.

[0210] It should be noted that if the third data set is the last data set of the first UPU list, the first header can be after the data set. If the third data set is a data set other than the last data set of the UPU data set, the first header is after the third data set and before the fourth data set, and the fourth data set is the first data set after the third data set in the order.

[0211] Fig.10 is another example of the structure of the first UPU list.

[0212] like Fig.10 As shown, the first UPU list consists of n UPU data sets and a first header, and the n UPU data sets are numbered from 1 to n.

[0213] Each UPU data set in the first UPU list contains the following three fields: UPU data set type field, UPU data set length field and UPU data set field. The UPU data set type field may correspond to the type field of the data set mentioned above, the UPU data set length field may correspond to the length field of the data set mentioned above, and the UPU data set field may correspond to the data field of the data set mentioned above. Among them, the UPU data set type field is used to indicate the type of the UPU data set, occupying the 1st to 4th bits of a byte, and the 5th to 8th bits of the byte are idle bits, and the value of the idle bit can be 0. The UPU data set length field is used to indicate the length of the UPU data set, occupying one byte. The UPU data set field is used to carry the data in the UPU data set, that is, the parameters to be updated, and may occupy several bytes.

[0214] Fig.10 Take the third data set as UPU data set m as an example. One of the four idle bits of UPU data set m is used as the fourth flag bit ( Fig.10 Taking the first idle bit as an example), it is used to indicate that there is a first header after the UPU data set m.

[0215] In an embodiment of the present application, the third data set includes a fourth flag bit, which helps to ensure the compatibility of the UPU container during the transmission process. It can be understood that, through the value of the fourth flag bit, the receiving device of the UPU container (such as UE) can be informed whether there is a first header after the third data set. If the fourth flag bit indicates that there is no first header after the third data set, then the receiving device of the UPU container processes the UPU container according to the existing process. If the fourth flag bit indicates that there is a first header after the third data set, then the receiving device of the UPU container processes the UPU container according to the process mentioned in this application, which can take into account the transmission of the existing UPU container and the UPU container provided by the embodiment of the present application.

[0216] In addition, the method of identifying the third data set by the fourth flag bit can also be applied to the case where the third data set is a designated or fixed data set in the first UPU list, without limitation. If the third data set is a designated data set or a fixed data set, the fourth flag bit is optional, that is, the third data set may have a fourth flag bit or may not have a fourth flag bit. Taking the case where the third data set is fixed as the last data set as an example, since the third data set is fixed as the last data set, even if the last data set does not include the fourth flag bit, the transmitter of the first UPU list can also fixedly place the first header after the last data set of the first UPU list, and the receiver of the first UPU list can also fixedly read the first header placed after the last data set of the first UPU list.

[0217] The embodiments of the present application do not limit the specific manner in which the data management network element constructs the first UPU list.

[0218] A possible implementation method is that when the first UPU list adopts the above-mentioned first structure, the data management network element may first construct a header of a UPU container for carrying the first UPU list (for the convenience of description, the header is referred to as the second header); the data management network element constructs multiple data sets. Specifically, the data management network element constructs data sets other than the first data set (such as the second data set) among the multiple data sets in an existing manner. When constructing the first data set among the multiple data sets, the data management network element sets the type of the first data set to the first type, which is used to indicate that a copy version of the second header is stored in the data field of the first data set (for the convenience of description, the copy version is referred to as the first header), stores the first header in the data field of the first data set, and then calculates the length of the first data set, and stores the obtained length in the length field of the first data set; then the data management network element assembles the multiple data sets into the first UPU list.

[0219] Another possible implementation method is that when the first UPU list adopts the second structure mentioned above, the data management network element can first construct a header of the UPU container for carrying the first UPU list (for the convenience of description, this header is called the second header); the data management network element constructs one or more data sets in an existing manner; after the data management network element assembles all the data sets together, it copies the second header (the copied version is the first header) and attaches it to the last data set, thereby obtaining the first UPU list.

[0220] Another possible implementation method is that when the first UPU list adopts the third structure mentioned above, the data management network element can first construct a header of the UPU container for carrying the first UPU list (for the convenience of description, this header is called the second header); the data management network element constructs one or more data sets in an existing manner; after the data management network element assembles all the data sets together, it copies the second header (the copied version is the first header) and appends it before the first data set, thereby obtaining the first UPU list.

[0221] Another possible implementation method is that when the first UPU list adopts the fourth structure mentioned above, the data management network element may first construct a header of a UPU container for carrying the first UPU list (for the convenience of description, this header is referred to as the second header); the data management network element constructs one or more data sets in an existing manner; the data management network element assembles all data sets together; the data management network element arbitrarily selects a data set, copies a copy of the second header (the copied version is the first header) and appends it to the selected data set, and selects one from the free bits of the selected data set as the fourth flag bit, and sets the fourth flag bit to 1 to indicate that the data set is followed by the first header.

[0222] It should be noted that the above-mentioned construction method of the first UPU list is only exemplary, and the first UPU list of the embodiment of the present application can also be constructed by other methods without limitation.

[0223] In addition, it should be noted that if the data management network element requires the UE to respond to the successful security check of the first UPU list it received, the data management network element may also carry ACK indication information in the first request message to indicate that the data management network element needs a fourth message authentication code, wherein the fourth message authentication code is used by the data management network element to verify whether the UE has correctly received the first UPU list. Exemplarily, when the data management network element obtains security parameters from the authentication network element by calling the Nausf_UPUProtection service operation, the fourth message authentication code may be UPU-XMAC-I UE .

[0224] Step 603: The authentication network element sends a first response message to the data management network element, or in other words, the data management network element receives the first response message from the authentication network element.

[0225] The first response message includes a first message authentication code and a count value corresponding to the first message authentication code, wherein the first message authentication code is used to perform integrity protection on the first UPU list. The count value is used to prevent replay attacks. The count value corresponding to the first message authentication code can be understood as the count value used when calculating the first message authentication code.

[0226] Exemplarily, after the authentication network element receives the first request message, the authentication network element can obtain the corresponding count value according to the received UE identifier, and calculate the first message authentication code according to the received first UPU list and the obtained count value, and then send the first message authentication code and the count value to the data management network element through the first response message. The way in which the authentication network element calculates the first message authentication code according to the received first UPU list and the count value corresponding to the UE can refer to Appendix A.19 of the standard protocol TS33.501, which will not be described in detail here.

[0227] It should be noted that if the data management network element indicates to the authentication network element that the data management network element needs a fourth message authentication code, the authentication network element also calculates the fourth message authentication code and includes the fourth message authentication code in the first response message. After receiving the first response message, the data management network element may store the fourth message authentication code to subsequently verify whether the UE has correctly received the first UPU list. The way in which the authentication network element calculates the fourth message authentication code can refer to Appendix A.20 of the standard protocol TS33.501, which will not be described in detail here.

[0228] For example, when the data management network element calls the Nausf_UPUProtection service operation, the first response message may be a Nausf_UPUProtection response message, and the first message authentication code may be UPU-MAC-I AUSF , the count value can be Counter UPU , the fourth message authentication code may be UPU-XMAC-I UE .

[0229] Step 604: the data management network element sends a notification message to the mobility management network element, or in other words, the mobility management network element receives a notification message from the data management network element.

[0230] The notification message includes a first UPU list, a first message authentication code and a count value.

[0231] If the mobility management network element supports UPU container, the data management network element constructs the UPU container according to the first UPU list, the first message authentication code and the count value, and includes the UPU container in the notification message. Exemplarily, the structure of the UPU container can be as follows: Figure 3 As shown, it includes a UPU container cell identifier, the length of the UPU container content, a UPU header, a first message authentication code, a count value and a first UPU list, wherein the first UPU list includes a first header, and the UPU header can correspond to the second header described above.

[0232] If the mobile management network element does not support UPU containers, the first UPU list, the first message authentication code and the count value can be sent to the mobile management network element as independent information elements in the notification message so that the mobile management network element can construct the UPU container. For example, they can be sent to the mobile management network element as independent information elements in the access and mobility subscription data. Optionally, the notification message also includes second information for determining the second header so that the mobile management network element can correctly construct the UPU container. Optionally, the second information can be the second header, that is, the data management network element can provide the constructed UPU header to the mobile management network element. Optionally, the second information can be the information required to construct the second header, such as whether to request the UE to reply to the confirmation information, whether to request the UE to re-register, etc.

[0233] Exemplarily, the notification message may be a Nudm_SDM_Notification message.

[0234] Step 605: The mobility management network element sends a UPU container to the UE.

[0235] If the UPU container is received from the data management network element in step 604, the mobility management network element forwards the UPU container to the UE.

[0236] If the data management network element provides the first UPU list, the first message authentication code and the independent information element of the count value in step 604, the mobility management network element constructs the UPU container according to the first UPU list, the first message authentication code and the count value. Optionally, if the data management network element also provides the second information, the mobility management network element constructs the UPU container according to the first UPU list, the first message authentication code, the count value and the second header.

[0237] Exemplarily, the mobility management network element may send a UPU container to the UE via a DL NAS transport message.

[0238] Step 606: The UE verifies the message verification code.

[0239] Exemplarily, the UE calculates the second message authentication code according to the received first UPU list and the count value in the same manner as the authentication network element calculates the first message authentication code, and performs integrity authentication on the UE according to the first message authentication code and the second message authentication code.

[0240] If the first message authentication code and the second message authentication code do not match, that is, the integrity authentication fails, the UE discards the received UPU container. In a possible implementation, the UE may also send a UPU uplink message to the data management network element through the mobility management network element to notify the data management network element that the integrity authentication of the first UPU list has failed. Exemplarily, the UE may carry a fifth message authentication code in the UPU uplink message, and the fifth message authentication code may be obtained based on the count value used when the last integrity authentication succeeded.

[0241] If the first message authentication code and the second message authentication code match, that is, the integrity authentication is successful, then the UE obtains the first header in the first UPU list and performs subsequent operations based on the first header. As an example, when the third flag bit of the first header indicates a request for the UE to re-register, the UE re-registers. As another example, when the second flag bit of the first header indicates a request for the UE to reply with confirmation information, the UE can determine the confirmation information based on the received count value, wherein the confirmation information includes the third message authentication code, and the third message authentication code is used by the data management network element to verify whether the UE has correctly received the first UPU list, and then the UE sends a confirmation message to the data management network element, as described specifically in steps 607 to 608 below.

[0242] It should be noted that, when the first message authentication code and the second message authentication code match, the UE can directly use the first header as the header of the UPU container, or the UE can compare the first header with the second header outside the first UPU list. When the first header is the same as the second header, the UE uses the first header or the second header as the header of the UPU container. When the first header is different from the second header, the UE uses the first header as the header of the UPU container.

[0243] In addition, if the UE fails to read the first header from the first UPU list, for example, the UE does not support the UPU list of this format, then the UE may send a first message to the data management network element, and the first message is used to indicate that the UE fails to read the first header from the UPU container, so that the data management network element knows that the UE does not support the UPU container of this format, and the subsequent data management network element may no longer send the UPU container of this format to the UE. Exemplarily, the UE may carry the first information through the Res field in the UPU uplink message, and the first information may be the cause of the failure. The cause of the failure may be, for example, a format parsing failure, etc.

[0244] The embodiments of the present application do not limit the specific method in which the UE obtains the first header.

[0245] In a possible implementation, when the first UPU list adopts the first structure described above, the UE obtains the first header from the first data field of the first data set according to the first type field.

[0246] Another possible implementation method is that when the first UPU list adopts the second structure and the third structure mentioned above, the UE obtains the first header from the third data set according to the preset position. For example, if the preset position is 8 bits after the last data set and adjacent to the last data set, the UE can find the last data set and read the 8 bits after the data set, or the UE can directly read the last 8 bits of the first UPU list and use the read content as the first header. For another example, if the preset position is 8 bits before the first data set and adjacent to the first data set, the UE can find the first data set and read the 8 bits before the data set, or the UE can directly read the first 8 bits of the first UPU list and use the read content as the first header.

[0247] In another possible implementation, when the first UPU list adopts the fourth structure, the UE finds the third data set in the first UPU list according to the fourth flag, and reads the first header from the data field of the third data set. For example, the UE reads the UPU data from the UPU container, traverses all data sets, locates the third data set with the first header attached by the fourth flag, and then points the needle to the end position of the third data set with the first header attached, reads 8 bits from this position, and uses the read content as the first header.

[0248] Step 607, if the UDM has requested the UE to confirm the successful security check of the first UPU list (such as the UE determines that the UE needs to confirm the successful security check of the first UPU list based on the ACK flag in the header of the determined UPU container), and the UE has successfully verified and updated the first UPU list provided by the UDM, then the UE can send a UPU uplink message to the mobile management network element and carry a third message authentication code in the UPU uplink message.

[0249] The third message authentication code is used by the data management network element to verify whether the UE has correctly received the first UPU list. Exemplarily, the third message authentication code may be UPU-MAC-I UE .

[0250] Exemplarily, the UE calculates the third message authentication code according to the received count value in the same manner as the authentication network element calculates the fourth message authentication code. The manner in which the UE calculates the third message authentication code can refer to Appendix A.20 of the standard protocol TS33.501, which will not be described in detail here.

[0251] Exemplarily, the UPU uplink message may be carried in a UL NAS Transport message, and the third message authentication code may be carried in a transparent container.

[0252] Step 608: If the transparent container with the third message authentication code is received, the mobility management network element may send a user information message with the transparent container to the data management network element.

[0253] Exemplarily, the user information message may be a Nudm_SDM_Info message.

[0254] After receiving the user information message, the data management network element may compare the received third message authentication code with the fourth message authentication code stored in step 603 to determine whether the UE has correctly received the first UPU list.

[0255] It should be noted that the first information and the third message authentication code may be carried in the same uplink UPU message, that is, the first information is also sent through steps 607 and 608. The first information and the third message authentication code may also be carried in different uplink UPU messages without limitation.

[0256] It should also be noted that the numbering of the above-mentioned first UPU list is only for the convenience of description and distinction, and the first UPU list can also be replaced by the UPU list.

[0257] Combination of the above Figures 6 to 10 , describes in detail the method embodiment provided by the present application, and will be combined with Figures 11 to 13 , describing an apparatus embodiment of the present application.

[0258] It can be understood that in order to realize the functions in the above embodiments, Figures 11 to 13 The device includes hardware structures and / or software modules corresponding to the execution of each function. It should be easily appreciated by those skilled in the art that, in combination with the units and method steps of each example described in the embodiments disclosed in this application, this application can be implemented in the form of hardware or a combination of hardware and computer software.

[0259] Fig.11 and Fig.12 The schematic diagram of the structure of possible devices provided by the embodiments of the present application. These devices can be used to implement the functions of the UE, mobility management network element, authentication network element or data management network element in the above method embodiments, and thus can also achieve the beneficial effects possessed by the above method embodiments.

[0260] like Fig.11 As shown, the device 10 includes a transceiver unit 11 and a processing unit 12 .

[0261] When the device 10 is used to implement Figure 6 When the device 10 is used to implement the UE function, the transceiver unit 11 is used to execute the UE's transceiver steps, such as step 605 and step 607, and the processing unit 12 is used to execute the UE's processing steps, such as step 606. Figure 6When the device 10 is used to implement the function of the mobile management network element, the transceiver unit 11 is used to execute the transceiver steps of the mobile management network element, such as step 604, step 605, step 607 and step 608, and the processing unit 12 is used to execute the processing steps of the mobile management network element. Figure 6 When the device 10 is used to implement the function of the authentication network element, the transceiver unit 11 is used to execute the transceiver steps of the authentication network element, such as step 601 and step 603, and the processing unit 12 is used to execute the processing steps of the authentication network element. Figure 6 When the function of the data management network element is performed, the transceiver unit 11 is used to execute the sending and receiving steps of the data management network element, such as step 601, step 603, step 604 and step 608, and the processing unit 12 is used to execute the processing steps of the data management network element, such as step 602, etc.

[0262] For a more detailed description of the transceiver unit 11 and the processing unit 12, reference may be made to the relevant description in the above method embodiment, which will not be described again here.

[0263] like Fig.12 As shown, the device 20 includes a processor 21. The processor 21 is coupled to a memory 23, and the memory 23 is used to store instructions. When the device 20 is used to implement the method described above, the processor 21 is used to execute the instructions in the memory 23 to implement the functions of the processing unit 12 described above.

[0264] Optionally, the device 20 further includes a memory 23 .

[0265] Optionally, the device 20 further includes an interface circuit 22. The processor 21 and the interface circuit 22 are coupled to each other. It is understood that the interface circuit 22 may be a transceiver or an input / output interface. When the device 20 is used to implement the method described above, the processor 21 is used to execute instructions to implement the functions of the processing unit 12, and the interface circuit 22 is used to implement the functions of the transceiver unit 11.

[0266] Exemplarily, when the device 20 is a chip applied to a UE, a mobile management network element, an authentication network element, or a data management network element, the chip implements the functions of the UE, the mobile management network element, the authentication network element, or the data management network element in the above method embodiments. The chip receives information from other modules (such as a radio frequency module or an antenna) in the UE, the mobile management network element, the authentication network element, or the data management network element, and the information is sent by other devices to the UE, the mobile management network element, the authentication network element, or the data management network element; or, the chip sends information to other modules (such as a radio frequency module or an antenna) in the UE, the mobile management network element, the authentication network element, or the data management network element, and the information is sent by the UE, the mobile management network element, the authentication network element, or the data management network element to other devices.

[0267] Fig.13Schematic diagram of a chip system 30 provided in an embodiment of the present application. The chip system 30 (or also referred to as a processing system) includes a logic circuit 31 and an input / output interface 32.

[0268] Among them, the logic circuit 31 can be a processing circuit in the chip system 30. The logic circuit 31 can be coupled to the storage unit and call the instructions in the storage unit so that the chip system 30 can implement the methods and functions of each embodiment of the present application. The input / output interface 32 can be an input / output circuit in the chip system 30, outputting information processed by the chip system 30, or inputting data or signaling information to be processed into the chip system 30 for processing.

[0269] As a solution, the chip system 30 is used to implement the operations performed by the UE, the mobility management network element, the authentication network element or the data management network element in the above method embodiments.

[0270] For example, the logic circuit 31 is used to implement the processing-related operations performed by the UE, mobile management network element, authentication network element or data management network element in the above method embodiments; the input / output interface 32 is used to implement the sending and / or receiving-related operations performed by the UE, mobile management network element, authentication network element or data management network element in the above method embodiments.

[0271] The present application also provides a communication device, including a processor, the processor is coupled to a memory, the memory is used to store computer programs or instructions and / or data, the processor is used to execute the computer programs or instructions stored in the memory, or read the data stored in the memory to execute the methods in the above method embodiments. Optionally, the processor is one or more. Optionally, the communication device includes a memory. Optionally, the memory is one or more. Optionally, the memory is integrated with the processor, or is separately arranged.

[0272] The present application also provides a chip, including a processor, the processor and a memory are coupled, the memory is used to store computer programs or instructions, and the processor is used to execute the computer programs or instructions stored in the memory to implement the methods performed by the UE, the mobile management network element, the authentication network element or the data management network element in the above-mentioned method embodiments.

[0273] The present application also provides a computer-readable storage medium on which are stored computer instructions for implementing the methods executed by the UE, mobility management network element, authentication network element or data management network element in the above-mentioned method embodiments.

[0274] The present application also provides a computer program product, comprising instructions, which, when executed by a computer, implement the methods performed by the UE, the mobility management network element, the authentication network element or the data management network element in the above-mentioned method embodiments.

[0275] The present application also provides a communication system, which includes at least one of the UE, mobility management network element, authentication network element or data management network element in the above embodiments.

[0276] The explanation of the relevant contents and beneficial effects of any of the above-mentioned devices can be referred to the corresponding method embodiments provided above, which will not be repeated here.

[0277] It is understood that the processor in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0278] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an erasable programmable read-only memory, an electrically erasable programmable read-only memory, a register, a hard disk, a mobile hard disk, a compact disc read-only memory (CD-ROM) or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC. In addition, the ASIC can be located in a UE, a mobile management network element, an authentication network element, or a data management network element. Of course, the processor and the storage medium can also be present as discrete components in a UE, a mobile management network element, an authentication network element, or a data management network element.

[0279] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instruction is loaded and executed on a computer, the process or function described in the embodiment of the present application is executed in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device or other programmable device. The computer program or instruction may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program or instruction may be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server, data center, etc. that integrates one or more available media. The available medium may be a magnetic medium, for example, a floppy disk, a hard disk, a tape; it may also be an optical medium, for example, a digital video disc; it may also be a semiconductor medium, for example, a solid-state hard disk.

[0280] In the various embodiments of the present application, unless otherwise specified or provided for in any logical conflict, the terms and / or descriptions between the different embodiments are consistent and may be referenced to each other, and the technical features in the different embodiments may be combined to form new embodiments according to their inherent logical relationships.

[0281] Unless otherwise stated, all technical and scientific terms used in the embodiments of the present application have the same meaning as those generally understood by those skilled in the art of the technical field of the present application. The terms used in this application are only for the purpose of describing specific embodiments and are not intended to limit the scope of the present application. It should be understood that the above is for illustration, and the examples above are only to help those skilled in the art understand the embodiments of the present application, rather than to limit the application embodiments to the specific numerical values ​​or specific scenarios illustrated. It is obvious that various equivalent modifications or changes can be made by those skilled in the art according to the examples given above, and such modifications and changes also fall within the scope of the embodiments of the present application.

[0282] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A communication method, characterized in that: The method comprises: In the case where the parameters of the terminal device need to be updated, a first request message is sent to the authentication network element, the first request message includes the identifier of the terminal device and the first user equipment parameter update UPU list, the first request message is used to request security protection for the first UPU list, the first UPU list includes a first data set and a second data set, the first data set includes a first type field, a first length field and a first data field, the first type field is used to indicate that the type of the first data set is a data set carrying the first header of a UPU container, the UPU container is used to carry the first UPU list, the first header is used to carry information from the network to the terminal device, the first length field is used to indicate the length of the first data set, the first data field is used to carry the first header, the second data set includes a second type field, a second length field and a second data field, the second type field is used to indicate the type of the parameter to be updated, the second length field is used to indicate the length of the second data set, and the second data field is used to carry the parameter to be updated; receiving a first response message from the authentication network element, the first response message including a first message authentication code and a count value corresponding to the first message authentication code, the first message authentication code being used to perform integrity protection on the first UPU list; The first UPU list, the first message authentication code and the count value are sent to the terminal device through a mobile management network element.

2. The method according to claim 1, characterized in that The first header includes at least one of a first flag bit, a second flag bit and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: Receive first information from the terminal device, where the first information is used to indicate that the terminal device fails to read the first header from the UPU container.

4. The method according to any one of claims 1 to 3, characterized in that The sending the first UPU list, the first message authentication code, and the count value to the terminal device through the mobility management network element includes: A notification message is sent to the mobile management network element, wherein the notification message includes the first UPU list, the first message authentication code and the count value, and the notification message also includes second information, wherein the second information is used to determine the second header of the UPU container, and the first UPU list, the first message authentication code, the count value and the second information are carried in the notification message in the form of independent cells, and the second header is used to carry the information from the network to the terminal device.

5. A communication method, characterized in that: The method comprises: Receive a user equipment parameter update UPU container, the UPU container including a first UPU list, a first message authentication code and a count value corresponding to the first message authentication code, the first UPU list including a first data set and a second data set, the first data set including a first type field, a first length field and a first data field, the first type field is used to indicate that the type of the first data set is a data set carrying the first header of the UPU container, the first header is used to carry information from the network to the terminal device, the first length field is used to indicate the length of the first data set, the first data field is used to carry the first header, the second data set includes a second type field, a second length field and a second data field, the second type field is used to indicate the type of the parameter to be updated of the terminal device, the second length field is used to indicate the length of the second data set, and the second data field is used to carry the parameter to be updated; Determine a second message authentication code according to the first UPU list and the count value; When the first message authentication code matches the second message authentication code, the first header and the parameter to be updated are obtained, and subsequent operations are performed according to the first header.

6. The method according to claim 5, characterized in that The first header includes at least one of a first flag bit, a second flag bit and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

7. The method according to claim 5 or 6, characterized in that: The acquiring the first header includes: acquiring the first header in the first data field according to the first type field; The acquiring the parameter to be updated includes: acquiring the parameter to be updated in the second data field according to the second type field.

8. A communication method, characterized in that: The method comprises: In the case where the parameters of the terminal device need to be updated, a first request message is sent to the authentication network element, where the first request message includes the identifier of the terminal device and the first user equipment parameter update UPU list, where the first request message is used to request security protection for the first UPU list, where the first UPU list includes a data set and a first header of a UPU container, where the UPU container is used to carry the first UPU list, where the first header is used to carry information given by the network to the terminal device, where the data set includes a type field, a length field, and a data field, where the type field is used to indicate the type of the parameter to be updated, where the length field is used to indicate the length of the data set, and where the data field is used to carry the parameter to be updated; receiving a first response message from the authentication network element, the first response message including a first message authentication code and a count value corresponding to the first message authentication code, the first message authentication code being used to perform integrity protection on the first UPU list; The first UPU list, the first message authentication code and the count value are sent to the terminal device through a mobile management network element.

9. The method according to claim 8, characterized in that The first header includes at least one of a first flag bit, a second flag bit and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

10. The method according to claim 8 or 9, characterized in that: The first header is located at a preset position of the first UPU list.

11. The method according to claim 10, characterized in that The preset position is after the data set, and the data set is the last data set in the first UPU list.

12. The method according to claim 10, characterized in that The preset position is before the data set, and the data set is the first data set in the first UPU list.

13. The method according to claim 8 or 9, characterized in that: The first header is located after the data set. The data set further includes a fourth flag bit, and the fourth flag bit is used to indicate that the first header is located after the data set.

14. The method according to claim 13, characterized in that The type field and the fourth flag bit are in the same byte, the type field occupies the 1st to 4th bits of the byte, and the fourth flag bit occupies one bit among the 5th to 8th bits of the byte.

15. The method according to any one of claims 8 to 14, characterized in that The method further comprises: Receive first information from the terminal device, where the first information is used to indicate that the terminal device fails to read the first header from the UPU container.

16. The method according to any one of claims 8 to 15, characterized in that The sending the first UPU list, the first message authentication code, and the count value to the terminal device through the mobility management network element includes: A notification message is sent to the mobile management network element, wherein the notification message includes the first UPU list, the first message authentication code and the count value, and the notification message also includes second information, wherein the second information is used to determine the second header of the UPU container, and the first UPU list, the first message authentication code, the count value and the second information are carried in the notification message in the form of independent cells, and the second header is used to carry the information from the network to the terminal device.

17. A communication method, characterized in that: The method comprises: Receive a user equipment parameter update UPU container, the UPU container including a first UPU list, a first message authentication code, and a count value corresponding to the first message authentication code, the first UPU list including a data set and a first header of the UPU container, the first header is used to carry information from the network to the terminal device, the data set includes a type field, a length field, and a data field, the type field is used to indicate the type of the parameter to be updated of the terminal device, the length field is used to indicate the length of the data set, and the data field is used to carry the parameter to be updated; Determine a second message authentication code according to the first UPU list and the count value; When the first message authentication code matches the second message authentication code, the first header and the parameter to be updated are obtained, and subsequent operations are performed according to the first header.

18. The method according to claim 17, characterized in that The first header includes at least one of a first flag bit, a second flag bit and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

19. The method according to claim 17 or 18, characterized in that The first header is located at a preset position of the first UPU list.

20. The method according to claim 19, characterized in that The preset position is after the data set, and the data set is the last data set in the first UPU list.

21. The method according to claim 19, characterized in that The preset position is before the data set, and the data set is the first data set in the first UPU list.

22. The method according to any one of claims 19 to 21, characterized in that The obtaining the first header includes: According to the preset position, the first head is obtained.

23. The method according to claim 17 or 18, characterized in that The first header is located after the data set. The data set further includes a fourth flag bit, and the fourth flag bit is used to indicate that the first header is located after the data set.

24. The method according to claim 3, characterized in that The type field and the fourth flag bit are in the same byte, the type field occupies the 1st to 4th bits of the byte, and the fourth flag bit occupies one bit among the 5th to 8th bits of the byte.

25. The method according to claim 23 or 24, characterized in that The obtaining the first header includes: According to the fourth flag bit, the first header after the data set is obtained.

26. A communication method, characterized in that: The method comprises: In the case where the parameters of the terminal device need to be updated, the data management network element sends a first request message to the authentication network element, the first request message includes the identifier of the terminal device and the first user equipment parameter update UPU list, the first request message is used to request security protection for the first UPU list, the first UPU list includes a first data set and a second data set, the first data set includes a first type field, a first length field and a first data field, the first type field is used to indicate that the type of the first data set is a data set carrying the first header of a UPU container, the UPU container is used to carry the first UPU list, the first header is used to carry information from the network to the terminal device, the first length field is used to indicate the length of the first data set, the first data field is used to carry the first header, the second data set includes a second type field, a second length field and a second data field, the second type field is used to indicate the type of the parameter to be updated, the second length field is used to indicate the length of the second data set, and the second data field is used to carry the parameter to be updated; The authentication network element obtains a count value according to the identifier of the terminal device, and determines a first message authentication code according to the first UPU list and the count value, where the first message authentication code is used to perform integrity protection on the first UPU list; The authentication network element sends a first response message to the data management network element, where the first response message includes the first message authentication code and the count value; The data management network element sends the first UPU list, the first message authentication code and the count value to the terminal device through the mobile management network element.

27. The method according to claim 26, characterized in that The first header includes at least one of a first flag bit, a second flag bit and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

28. The method according to claim 26 or 27, characterized in that The data management network element sends the first UPU list, the first message authentication code, and the count value to the terminal device through the mobility management network element, including: The data management network element sends a notification message to the mobility management network element, where the notification message includes the first UPU list, the first message authentication code, and the count value, and the notification message also includes second information, where the second information is used to determine the second header of the UPU container, and the first UPU list, the first message authentication code, the count value, and the second information are carried in the notification message in the form of independent information elements; The mobility management network element generates the UPU container according to the first UPU list, the first message authentication code, the count value and the second information, the UPU container including the second header, the first UPU list, the first message authentication code and the count value, the second header is outside the first UPU list, and the second header is used to carry information given by the network to the terminal device; The mobility management network element sends the UPU container to the terminal device.

29. A communication method, characterized in that: The method comprises: In the case where the parameters of the terminal device need to be updated, the data management network element sends a first request message to the authentication network element, the first request message includes the identifier of the terminal device and the first user equipment parameter update UPU list, the first request message is used to request security protection for the first UPU list, the first UPU list includes a data set and a first header of a UPU container, the UPU container is used to carry the first UPU list, the first header is used to carry information from the network to the terminal device, the data set includes a type field, a length field and a data field, the type field is used to indicate the type of the parameter to be updated, the length field is used to indicate the length of the data set, and the data field is used to carry the parameter to be updated; The authentication network element obtains a count value according to the identifier of the terminal device, and determines a first message authentication code according to the first UPU list and the count value, where the first message authentication code is used to perform integrity protection on the first UPU list; The authentication network element sends a first response message to the data management network element, where the first response message includes the first message authentication code and the count value; The data management network element sends the first UPU list, the first message authentication code and the count value to the terminal device through the mobile management network element.

30. The method according to claim 29, characterized in that The first header includes at least one of a first flag bit, a second flag bit and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

31. The method according to claim 29 or 30, characterized in that The data management network element sends the first UPU list, the first message authentication code, and the count value to the terminal device through the mobility management network element, including: The data management network element sends a notification message to the mobility management network element, where the notification message includes the first UPU list, the first message authentication code, and the count value, and the notification message also includes second information, where the second information is used to determine the second header of the UPU container, and the first UPU list, the first message authentication code, the count value, and the second information are carried in the notification message in the form of independent information elements; The mobility management network element generates the UPU container according to the first UPU list, the first message authentication code, the count value and the second information, the UPU container including the second header, the first UPU list, the first message authentication code and the count value, the second header is outside the first UPU list, and the second header is used to carry information given by the network to the terminal device; The mobility management network element sends the UPU container to the terminal device.

32. A communication device, characterized in that: The method comprises a module or a unit for executing the method as claimed in any one of claims 1 to 31.

33. A communication device, characterized in that: It includes a processor and an interface circuit, wherein the interface circuit is used to receive signals from other communication devices outside the communication device and transmit them to the processor or send signals from the processor to other communication devices outside the communication device, and the processor is used to implement the method as described in any one of claims 1 to 31 through a logic circuit or executing code instructions.

34. The communication device according to claim 33, characterized in that The communication device is a chip or a chip system.

35. A computer-readable storage medium, characterized in that: The storage medium stores a computer program or instruction, and when the computer program or instruction is executed by the communication device, the method according to any one of claims 1 to 31 is implemented.

36. A computer program product, characterized in that It comprises a computer program which, when being executed, implements the method according to any one of claims 1 to 31.

37. A communication system, characterized in that: include: A data management network element for executing the method according to any one of claims 1 to 4, and a terminal device for executing the method according to any one of claims 5 to 7; or A data management network element for executing the method as claimed in any one of claims 8 to 16, and a terminal device for executing the method as claimed in any one of claims 17 to 25.

Images