Communication method and device, electronic equipment and storage medium

Abstract

The invention provides a communication method and device, electronic equipment and a storage medium, and relates to the field of network technologies and security. The method comprises: a UPF network element receiving a connection request sent by a UE, the connection request comprising an identifier of the UE and a key identifier of a target quantum key; obtaining a target quantum key according to a key identifier in the connection request, and further calculating the identifier information of the UE and the identifier information of the UPF network element based on the target quantum key to obtain first authentication information; sending a connection response to the UE, and receiving second authentication information sent by the UE in response to the connection response; and if the first authentication information and the second authentication information are verified to be the same, determining that the UE passes authentication, and establishing connection with the UE. According to the method, calculation and authentication are carried out by introducing the quantum key, so that the security of communication between the UE and the UPF network element is effectively enhanced, the authenticated UE can be ensured to establish connection with the UPF network element, the stability of the network is favorably maintained, and the continuity of services is ensured.

Description

Background Art

[0002] The 3rd Generation Partnership Project (3GPP) introduced Non-Integrated Non-3GPP Access (NIN3A), which can provide a connection between the terminal equipment (UE) and the user plane function network element (UPF), without the need for intermediate network elements, simplifying the connection process. However, due to the lack of authentication between the UE and the UPF network element, the UPF network element and the core network may face security risks, thereby threatening the stability of network resources and ultimately leading to service interruption.

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0004] The present disclosure provides a communication method, a communication device, an electronic device, a computer-readable storage medium, and a computer program product, which at least to some extent overcome the security risk problem caused by the lack of authentication between the UE and the UPF network element.

[0005] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0006] According to one aspect of the present disclosure, a communication method is provided, which is executed by a UPF network element, and the method includes: receiving a connection request sent by a UE; the connection request includes an identifier of the UE and a key identifier of a target quantum key, and the target quantum key is a quantum key injected by a key management system for the UE; obtaining the target quantum key according to the key identifier of the target quantum key; calculating the identifier information of the UE and the identifier information of the UPF network element based on the target quantum key to obtain first authentication information; sending a connection response to the terminal device, and receiving second authentication information sent by the terminal device in response to the connection response; verifying whether the first authentication information and the second authentication information are the same, and if they are the same, determining that the terminal device authentication is passed, and establishing a connection with the terminal device.

[0007] In some embodiments of the present disclosure, obtaining the target quantum key according to the key identifier of the target quantum key includes: sending a key distribution request to the key management system; the key distribution request includes the key identifier of the target quantum key; and receiving the target quantum key returned by the key management system according to the key identifier of the target quantum key.

[0008] In some embodiments of the present disclosure, the identifier of the UE includes a user hidden identifier; wherein the method further includes: sending the user hidden identifier to a unified data management network element so that the unified data management network element decrypts the user hidden identifier to generate a user permanent identifier; and receiving the user permanent identifier returned by the unified data management network element.

[0009] In some embodiments of the present disclosure, the sending a connection response to the UE includes: after receiving the user permanent identifier returned by the unified data management network element, sending the connection response to the UE.

[0010] In some embodiments of the present disclosure, the identification of the UPF network element includes domain name information of the UPF network element; wherein, based on the target quantum key, calculating the identification information of the UE and the identification information of the UPF network element to obtain the first authentication information includes: based on the target quantum key, performing a hash calculation on the user permanent identification and the domain name information to obtain a first hash value.

[0011] In some embodiments of the present disclosure, performing hash calculation on the user permanent identifier and the domain name information based on the target quantum key to obtain a first hash value includes: obtaining the user permanent identifier, length information of the user permanent identifier, the domain name information, and length information of the domain name information; processing the user permanent identifier, the length information of the user permanent identifier, the domain name information, and the length information of the domain name information to obtain processed information; and performing hash calculation on the processed information based on the target quantum key to obtain the first hash value.

[0012] In some embodiments of the present disclosure, the second authentication information is obtained by the UE calculating the identification information of the UE and the identification information of the UPF network element based on the target quantum key.

[0013] According to another aspect of the present disclosure, a communication method is also provided, which is executed by a UE, and the method includes: sending a connection request to a UPF network element; the connection request includes an identifier of the UE and a key identifier of a target quantum key, and the target quantum key is a quantum key injected by a key management system for the UE; receiving a connection response sent by the UPF network element in response to the connection request; in response to the connection response, based on the target quantum key, calculating the identifier information of the UE and the identifier information of the UPF network element to obtain second authentication information, and sending the second authentication information to the UPF network element; if the user plane function network element verifies that the second authentication information is the same as the first authentication information, it is determined that the terminal device authentication is passed, and a connection is established with the user plane function network element.

[0014] In some embodiments of the present disclosure, the identification of the UE includes a permanent user identification, and the identification of the UPF network element includes domain name information of the UPF network element; wherein, based on the target quantum key, calculating the identification information of the UE and the identification information of the UPF network element to obtain the second authentication information includes: based on the target quantum key, performing hash calculation on the user permanent identification and the domain name information to obtain a second hash value.

[0015] In some embodiments of the present disclosure, performing hash calculation on the user permanent identifier and the domain name information based on the target quantum key to obtain a second hash value includes: obtaining the user permanent identifier, length information of the user permanent identifier, the domain name information, and length information of the domain name information; processing the user permanent identifier, the length information of the user permanent identifier, the domain name information, and the length information of the domain name information to obtain processed information; performing hash calculation on the processed information based on the target quantum key to obtain the second hash value.

[0016] In some embodiments of the present disclosure, the first authentication information is obtained by the UPF network element calculating the identification information of the UE and the identification information of the UPF network element based on the target quantum key.

[0017] According to another aspect of the present disclosure, a communication device is also provided, which is applied to a UPF network element, and the device includes: a request receiving module, configured to receive a connection request sent by a UE; the connection request includes an identifier of the UE and a key identifier of a target quantum key, and the target quantum key is a quantum key injected by a key management system for the UE; a quantum key acquisition module, configured to obtain the target quantum key according to the key identifier of the target quantum key; a first authentication information generation module, configured to calculate the identification information of the UE and the identification information of the UPF network element based on the target quantum key to obtain first authentication information; an authentication information receiving module, configured to send a connection response to the UE, and receive second authentication information sent by the UE in response to the connection response; a first connection module, configured to verify whether the first authentication information and the second authentication information are the same, and if they are the same, determine that the UE authentication is passed, and establish a connection with the UE.

[0018] According to another aspect of the present disclosure, a communication device is also provided, which is applied to a UE, and the device includes: a request sending module, configured to send a connection request to a UPF network element; the connection request includes an identifier of the UE and a key identifier of a target quantum key, and the target quantum key is a quantum key injected by a key management system for the UE; a response receiving module, configured to receive a connection response sent by the UPF network element in response to the connection request; a second authentication information generating module, configured to respond to the connection response and, based on the target quantum key, calculate the identifier information of the UE and the identifier information of the UPF network element to obtain second authentication information; an authentication information sending module, configured to send the second authentication information to the UPF network element; a second connection module, configured to determine that the UE authentication is successful and establish a connection with the UPF network element if the UPF network element verifies that the second authentication information is the same as the first authentication information.

[0019] According to another aspect of the present disclosure, an electronic device is also provided, which includes: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the communication methods described above by executing the executable instructions.

[0020] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the communication method described above is implemented.

[0021] According to another aspect of the present disclosure, a computer program product is provided, including: a computer program or instructions, wherein when the computer program or instructions are executed by a processor, any one of the above communication methods is implemented.

[0022] The communication method provided in the embodiments of the present invention effectively enhances the security of communication between UE and UPF network elements by introducing quantum keys for calculation and authentication; since the authentication information is generated based on the quantum key and needs to be verified between the UE and the UPF network element, the possibility of attacks by attackers is effectively prevented. Even if the attacker can intercept the communication content, he cannot forge valid authentication information to establish a connection; it can ensure that only authenticated UE can establish a connection with the UPF network element, which helps prevent unauthorized access and abuse of network resources, helps maintain the stability and availability of the network, thereby ensuring business continuity and providing users with a reliable and secure network service experience.

[0023] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0025] Figure 1 A schematic diagram of a network architecture of a communication system applicable to an embodiment of the present disclosure is shown;

[0026] Figure 2 A flow chart of a communication method according to an embodiment of the present disclosure is shown;

[0027] Figure 3 A flow chart showing a communication method according to another embodiment of the present disclosure is shown;

[0028] Figure 4 An interaction diagram of a communication method according to an embodiment of the present disclosure is shown;

[0029] Figure 5 A block diagram showing a communication device according to an embodiment of the present disclosure;

[0030] Figure 6 A block diagram showing a communication device according to another embodiment of the present disclosure; and

[0031] Figure 7 A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0032] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0033] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0034] The technical solutions of the embodiments of the present disclosure can be applied to various communication systems, for example, Global System of Mobile communication (GSM) system, Code Division Multiple Access (CDMA) system, Wideband Code Division Multiple Access (WCDMA) system, General Packet Radio Service (GPRS), Long Term Evolution (LTE) system, LTE frequency division duplex system, LTE time division duplex, Universal Mobile Telecommunication System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX) communication system, 5G system or future evolved mobile communication system, etc.

[0035] Figure 1 A schematic diagram of a network architecture of a communication system to which an embodiment of the present disclosure is applicable is shown.

[0036] like Figure 1As shown, the network architecture includes UE, radio access network (Radio Access Network, RAN) equipment, access and mobility management function network element (Access and Mobility Management Function, AMF) network element, session management function (Session Management function, SMF) network element, UPF network element, policy control function (Policy Control Function, PCF) network element, network slice selection function (Network Slice Selection Function, NSSF) network element, network warehouse function (Network Repository Function, NRF) network element, network data analysis (Network Data Analytics Function, NWDAF) network element, unified data management (Unified Data Management, UDM) network element, unified data storage (Unified Data Repository, UDR) network element, authentication server function (Authentication Server Function, AUSF) network element, network exposure function (Network Exposure Function, NEF) network element, application function (Application Function, AF) network element, and data network (Data Network, DN) connected to the operator network.

[0037] UE can be any electronic device, which can be deployed on land, including indoors or outdoors, handheld, wearable or vehicle-mounted; it can also be deployed on the water (such as ships, etc.); it can also be deployed in the air (such as airplanes, balloons and satellites, etc.). UE can communicate with the core network via non-RAN devices and exchange voice and / or data with RAN devices.

[0038] RAN equipment is a device in the network used to access UE to the wireless network, and may include equipment in the access network that communicates with wireless terminals through one or more sectors on the air interface. UE can access the AMF network element through RAN equipment. Specifically, when the UE accesses the AMF network element through the RAN equipment, the UE can access the AMF network element through network-side equipment such as 5G and later versions of base stations (such as 5G NR NB), or base stations in other communication systems (such as eNB base stations).

[0039] The AMF network element is mainly used for UE mobility management, access authentication / authorization, and is also responsible for transmitting user policies between the UE and the PCF network element.

[0040] SMF network elements are mainly used for session management, UE Internet Protocol address allocation and management, selection of endpoints for manageable user plane functions, policy control, or charging function interfaces, and downlink data notification.

[0041] The UPF network element can be used for packet routing and forwarding, or QoS processing of user plane data, etc. User data can be accessed to the DN through this network element.

[0042] The PCF network element is a unified policy framework used to guide network behavior and provide policy rule information for control plane functional network elements (such as AMF network elements and SMF network elements).

[0043] The NSSF network element is mainly used to select appropriate network slices for UE services.

[0044] NRF network elements are mainly used to provide registration and discovery functions for network elements or services provided by network elements.

[0045] NWDAF network elements can collect data from various network functions and perform analysis and prediction.

[0046] The UDM network element is mainly used to manage the UE's contract information. For example, during the authentication process, it performs authentication vector calculation, key deduction, user identity decryption, etc. In the resynchronization process, it verifies AUTS according to the corresponding algorithm and initiates a re-authentication process.

[0047] The UDR network element is mainly used to store structured data information, including contract information, policy information, and network data or business data defined in a standard format.

[0048] The AUSF network element is mainly used to perform security authentication on terminal devices.

[0049] The NEF network element is located between the 5G core network and external third-party application functions, and may also have some internal application functions. It is responsible for managing open network data. All external applications that want to access the internal data of the 5G core network must go through the NEF network element.

[0050] The AF network element is mainly used to convey the requirements of the application side to the network side, such as QoS requirements and user status event subscription.

[0051] It should be understood that the above-mentioned network elements or functions can be network elements in hardware devices, software functions running on dedicated hardware, or virtualized functions instantiated on a platform (e.g., a cloud platform).

[0052] It should be understood that the naming in the embodiments of the present disclosure is only defined for the convenience of distinguishing different functions and should not constitute any limitation to the present disclosure. The present disclosure does not exclude the possibility of adopting other naming in 5G networks and other future networks. For example, in a 6G network, some or all of the above-mentioned network elements may use the terminology in 5G, or other names may be used. In addition, the name of the message (or signaling) transmitted between the above-mentioned network elements is only an example and does not constitute any limitation on the function of the message itself.

[0053] It should be understood that the above-mentioned network architecture applied to the embodiment of the present disclosure is only an example, and the network architecture applicable to the embodiment of the present disclosure is not limited to this. Any network architecture that can realize the functions of the above-mentioned network elements is applicable to the embodiment of the present disclosure.

[0054] The network architecture and business scenarios described in the embodiments of the present disclosure are intended to more clearly illustrate the technical solutions of the embodiments of the present disclosure, and do not constitute a limitation on the technical solutions provided by the embodiments of the present disclosure. A person of ordinary skill in the art can appreciate that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present disclosure are also applicable to similar technical problems.

[0055] Figure 2 A flow chart of a communication method according to an embodiment of the present disclosure is shown. Figure 2 The method provided in the embodiment may be executed by a UPF network element. Figure 2 As shown, the method includes the following steps.

[0056] Step S210, receiving a connection request sent by the UE; the connection request includes an identifier of the UE and a key identifier of a target quantum key, and the target quantum key is a quantum key injected by the key management system for the UE.

[0057] The UPF network element receives a connection request from the UE, which contains the UE identifier and the key identifier of the target quantum key. The UE identifier is used to uniquely identify the UE; the target quantum key is injected into the UE by the key management system, which is highly secure and unpredictable and can be used for subsequent secure communications. The key identifier of the target quantum key is used to uniquely identify the target quantum key.

[0058] In this step, the UPF network element receives the connection request from the UE, which is the initial step before establishing the connection between the UE and the UPF network element to facilitate subsequent security verification and connection establishment.

[0059] Step S220, obtaining the target quantum key according to the key identifier of the target quantum key.

[0060] The UPF network element obtains the target quantum key according to the key identifier of the target quantum key provided in the connection request. In a possible implementation, the UPF network element obtains the target quantum key from a key management system, or the UPF network element obtains the target quantum key from local storage.

[0061] In this step, the UPF network element obtains the target quantum key in order to use the target quantum key for calculation and authentication in subsequent steps to ensure the security of communication.

[0062] Step S230: Based on the target quantum key, the identification information of the UE and the identification information of the UPF network element are calculated to obtain the first authentication information.

[0063] The UPF network element uses the target quantum key to calculate and process the identification information of the UE and the identification information of the UPF network element to generate the first authentication information, thereby ensuring the confidentiality and integrity of the information. The calculation method may be a specific algorithm based on the quantum key, which has a high degree of security and anti-cracking capability, or a pre-set calculation algorithm, which may be set according to business requirements, and the present disclosure does not limit this.

[0064] Step S240: Send a connection response to the UE, and receive second authentication information sent by the UE in response to the connection response.

[0065] After receiving the connection request sent by the UE, the UPF network element sends a connection response to the UE. After receiving the connection response sent by the UPF network element, the UE obtains the second authentication information in response to the connection response and sends the second authentication information to the UPF network element, and then the UPF network element receives the second authentication information sent by the UE.

[0066] In some embodiments of the present disclosure, the second authentication information is obtained by the UE calculating the identification information of the UE and the identification information of the UPF network element based on the target quantum key.

[0067] Among them, the first authentication information is obtained by the UPF network element calculating the UE's identification information and the UPF network element's identification information based on the target quantum key pair, and the second authentication information is obtained by the UE calculating the UE's identification information and the UPF network element's identification information based on the target quantum key pair.

[0068] In the disclosed embodiment, the first authentication information and the second authentication information are generated by the communicating parties based on the same quantum key and computing logic. Therefore, it is difficult for an attacker to forge valid authentication information to deceive either party, thereby protecting the security of communication. The communicating parties can share a quantum key and perform calculations and verifications based on the quantum key, without the need to generate and exchange different keys for each authentication process.

[0069] Step S250, verifying whether the first authentication information and the second authentication information are the same, if they are the same, determining that the terminal device is authenticated, and establishing a connection with the terminal device.

[0070] After receiving the second authentication information sent by the UE, the UPF network element verifies the first authentication information and the second authentication information. If the first authentication information and the second authentication information are the same, it is confirmed that the UE authentication is successful, and then a connection is established with the UE. If the first authentication information and the second authentication information are different, it is confirmed that the UE authentication is not successful.

[0071] In the communication method provided by the embodiment of the present disclosure, a UPF network element receives a connection request from a UE, where the request includes an identifier of the UE and a key identifier of a target quantum key, where the target quantum key is injected for the UE by a key management system and has a high degree of security and unpredictability; after receiving the connection request sent by the UE, the UPF network element obtains the corresponding target quantum key according to the key identifier in the connection request, and then uses the obtained target quantum key to calculate and process the identifier information of the UE and its own identifier to generate first authentication information, which ensures the confidentiality and integrity of the information; the UPF network element sends a connection response to the UE, so that the UE generates second authentication information based on the same quantum key and calculation logic and sends it to the UPF network element, so that the UPF network element verifies it; if the UPF network element verifies that the first authentication information is the same as the received second authentication information, it is considered that the UE has passed the authentication, and a secure connection is established with the UE.

[0072] In this way, by introducing quantum keys for calculation and authentication, the security of communication between UE and UPF network elements is effectively enhanced; since the authentication information is generated based on the quantum key and needs to be verified between the UE and the UPF network element, the possibility of attacks by attackers is effectively prevented. Even if the attacker can intercept the communication content, he cannot forge valid authentication information to establish a connection; it can ensure that only authenticated UE can establish a connection with the UPF network element, which helps prevent unauthorized access and abuse of network resources, and helps maintain the stability and availability of the network, thereby ensuring business continuity and providing users with a reliable and secure network service experience.

[0073] In some embodiments of the present disclosure, obtaining a target quantum key according to a key identifier of the target quantum key includes: sending a key distribution request to a key management system; wherein the key distribution request includes the key identifier of the target quantum key; and receiving the target quantum key returned by the key management system according to the key identifier of the target quantum key.

[0074] The key management system refers to a system used to manage quantum keys. The key identifier of the target quantum key is used to uniquely identify the target quantum key. The UPF network element sends a key distribution request with the key identifier to the key management system. After receiving the key distribution request, the key management system obtains the corresponding target quantum key and then sends the target quantum key to the UPF network element. Finally, the UPF network element obtains the target quantum key sent by the key management system.

[0075] In the communication method provided by the embodiment of the present disclosure, the UPF network element requests the key management system to distribute the target quantum key according to the key identifier of the target quantum key, thereby ensuring that only the UPF network element that knows the key identifier can obtain the corresponding target quantum key, thereby enhancing the security and accuracy of key distribution.

[0076] In some embodiments of the present disclosure, the UE identifier includes a user hidden identifier. The communication method further includes: sending the user hidden identifier to a UDM network element so that the UDM network element decrypts the user hidden identifier to generate a user permanent identifier; and receiving the user permanent identifier returned by the UDM network element.

[0077] The UE identifier includes a user hidden identifier, which can be used to hide the user permanent identifier during the communication process, thereby enhancing the user's privacy protection. Exemplarily, the user hidden identifier can be a subscription concealed identifier (SUCI), and the user permanent identifier can be a subscription permanent identifier (SUPI). SUCI is a hidden form of SUPI, which is used for transmission in the network to protect the user's privacy. SUCI contains sufficient information so that a specific entity in the network, such as a UDM network element, can decrypt it when necessary to restore the SUPI.

[0078] In the disclosed embodiment, the connection request sent by the UE to the UPF network element includes a user hidden identifier; after receiving the connection request, the UPF network element identifies the user hidden identifier in the connection request and sends the user hidden identifier to the UDM network element; after receiving the user hidden identifier, the UDM network element will use a pre-agreed decryption algorithm or key to decrypt the identifier, and the decryption process will restore the user permanent identifier, and then send the user permanent identifier to the UDM network element; finally, the UPF network element obtains the user permanent identifier sent by the UDM network element so as to perform subsequent processing using the user permanent identifier.

[0079] In one possible implementation, the communication link between the UDM network element and the UPF network element is encrypted, such as by using strong encryption algorithms and protocols. In other words, a strict access control policy can be implemented on the UPF network element to ensure that only authorized UPF network elements can access the user's permanent identification, thereby preventing the user's permanent identification from being intercepted or tampered with during transmission.

[0080] The communication method provided by the embodiment of the present disclosure effectively enhances user privacy protection and improves communication security by introducing user hidden identification and a secure decryption process.

[0081] In some embodiments of the present disclosure, sending a connection response to the UE includes: after receiving the user permanent identifier returned by the UDM network element, sending a connection response to the UE.

[0082] In the disclosed embodiment of the present invention, if the UPF network element obtains the user permanent identification returned by the UDM network element, it means that the UPF network element can perform a further authentication process, and then send a connection response to the UE, so that the UE generates second authentication information based on the target quantum key and sends it to the UPF network element, so that the UPF network element authenticates the UE.

[0083] In some embodiments of the present disclosure, the identification of the UPF network element includes the domain name information of the UPF network element. The step of calculating the identification information of the UE and the identification information of the UPF network element based on the target quantum key to obtain the first authentication information includes: performing a hash calculation on the user permanent identification and the domain name information based on the target quantum key to obtain a first hash value.

[0084] In the disclosed embodiment, the identifier of the UPF network element includes the domain name information of the UPF network element, such as the domain name address of the UPF network element. The UPF network element uses the target quantum key to perform a hash calculation on the user permanent identifier and the domain name information of the UPF network element to obtain a first hash value, i.e., the first authentication information.

[0085] In some embodiments of the present disclosure, performing a hash calculation on a user permanent identifier and domain name information based on a target quantum key to obtain a first hash value includes: obtaining a user permanent identifier, length information of the user permanent identifier, domain name information, and length information of the domain name information; processing the user permanent identifier, the length information of the user permanent identifier, the domain name information, and the length information of the domain name information to obtain processed information; performing a hash calculation on the processed information based on the target quantum key to obtain a first hash value.

[0086] In the disclosed embodiment, the UPF network element obtains the user permanent identification of the UE, the length information of the user permanent identification, the domain name information of the UPF network element and the length information of the domain name information, processes the information to obtain processed information, and then uses the target quantum key to perform hash calculation on the processed information to obtain a first hash value.

[0087] In a possible implementation, the UPF network element performs hash calculation using the following formula to obtain a first hash value:

[0088] MAC_upf=HMAC_SHA256(Qk, P0||L0||P1||L1) (1)

[0089] In formula (1), MAC_upf represents the first hash value calculated by the UPF network element, Qk represents the target quantum key, P0 represents the user permanent identifier, such as SUPI, L0 represents the length of the user permanent identifier, P1 represents the domain name information of the UPF network element, such as the domain name address, and L1 represents the length of the domain name information.

[0090] Among them, HMAC-SHA256 is a Hash-based Message Authentication Code (HMAC) algorithm that uses the SHA-256 algorithm as a hash function. In formula (1), the UPF network element concatenates P0, L0, P1, and L1 to obtain the concatenated information. For example, P0=username@realm.com, then L0=18, P1=domain.com, then L1=10, and the concatenated information P0||L0||P1||L1=username@realm.com18domain.com10. Then, the HMAC-SHA256 algorithm is used to perform a hash calculation on the concatenated information with the target quantum key Qk as the root key to obtain the first hash value MAC_upf.

[0091] It should be noted that the embodiments of the present disclosure can adjust the information used in the hash calculation as needed. For example, in addition to the user permanent identification and the domain name information of the UPF network element, other relevant information can be added as needed for hash calculation to further enhance the security of authentication or meet specific business needs. Of course, other algorithms can also be used for hash calculation according to actual needs, and the present disclosure does not limit this.

[0092] In the communication method provided by the embodiment of the present disclosure, the UPF network element obtains a first hash value by introducing a target quantum key for hash calculation. Due to the unique physical properties of the quantum key, higher security is provided, which helps to prevent security threats such as attacker attacks and data leakage. Considering that the user permanent identification of the UE and the domain name information of the UPF network element are unique and specific, this information is combined with the length information for hash calculation to generate a unique first hash value as the first authentication information. This processing method improves the accuracy and uniqueness of subsequent UPF network element authentication and reduces the risk of misauthentication. In addition, by including the length information of the user permanent identification and the length information of the domain name information in the hash calculation, it can adapt to input data of different lengths, thereby increasing flexibility and compatibility.

[0093] Figure 3 A flow chart of a communication method according to another embodiment of the present disclosure is shown. Figure 3 The method provided in the embodiment may be executed by a UE. Figure 3 As shown, the method includes the following steps.

[0094] Step S310, sending a connection request to the UPF network element; the connection request includes the UE identifier and the key identifier of the target quantum key, and the target quantum key is the quantum key injected by the key management system for the UE.

[0095] The UE sends a connection request to the UPF network element, which contains the UE's identifier and the key identifier of the target quantum key. The UE's identifier is used to uniquely identify the UE; the target quantum key is injected into the UE by the key management system, which is highly secure and unpredictable and can be used for subsequent secure communications. The key identifier of the target quantum key is used to uniquely identify the target quantum key.

[0096] In this step, the UE sends a connection request to the UPF network element, which is the initial step before establishing a connection between the UE and the UPF network element so that the UPF network element can perform subsequent security verification and connection establishment.

[0097] Step S320, receiving a connection response sent by the UPF network element in response to the connection request.

[0098] After the UPF network element receives the connection request sent by the UE, it sends a connection response to the UE in response to the connection request, so that the UE receives the connection response sent by the UPF network element.

[0099] Step S330, in response to the connection response, based on the target quantum key, the identification information of the UE and the identification information of the UPF network element are calculated to obtain the second authentication information, and the second authentication information is sent to the UPF network element.

[0100] After the UE receives the connection response sent by the UPF network element, the UE uses the target quantum key to calculate the identification information of the UE and the identification information of the UPF network element, generates second authentication information, and sends the second authentication information to the UPF network element. The calculation method can be a specific algorithm based on the quantum key, which has a high degree of security and anti-cracking ability, or a pre-set calculation algorithm, which can be set according to business requirements, and this disclosure does not limit this.

[0101] Step S340: If the UPF network element verifies that the second authentication information is the same as the first authentication information, it is determined that the UE authentication is successful and a connection is established with the UPF network element.

[0102] After the UPF network element receives the second authentication information sent by the UE, it verifies the first authentication information generated by itself and the second authentication information. If the first authentication information and the second authentication information are the same, it is confirmed that the UE authentication is successful, such as the UPF network element sends an authentication success message to the UE, and then the UE establishes a connection with the UPF network element. If the first authentication information and the second authentication information are different, it is confirmed that the UE authentication is unsuccessful, such as the UPF network element sends an authentication failure message to the UE.

[0103] In the communication method provided by the embodiment of the present disclosure, a UE sends a connection request to a UPF network element, where the request includes an identifier of the UE and a key identifier of a target quantum key, where the target quantum key is injected by a key management system for the UE and has a high degree of security and unpredictability; after the UE receives a connection response returned by the UPF network element, the UE calculates and processes the identifier information of the UE and the identifier information of the UPF network element based on the target quantum key to generate second authentication information, and then sends the second authentication information to the UPF network element, so that the UPF network element verifies the first authentication information generated by itself and the second authentication information sent by the UE; if the UPF network element verifies that the first authentication information and the second authentication information are the same, it is considered that the UE has passed the authentication, and thus the UE establishes a secure connection with the UPF network element.

[0104] In this way, by introducing quantum keys for calculation and authentication, the security of communication between UE and UPF network elements is effectively enhanced; since the authentication information is generated based on the quantum key and needs to be verified between the UE and the UPF network element, the possibility of attacks by attackers is effectively prevented. Even if the attacker can intercept the communication content, he cannot forge valid authentication information to establish a connection; it can ensure that only authenticated UE can establish a connection with the UPF network element, which helps prevent unauthorized access and abuse of network resources, and helps maintain the stability and availability of the network, thereby ensuring business continuity and providing users with a reliable and secure network service experience.

[0105] In some embodiments of the present disclosure, the first authentication information is obtained by the UPF network element by calculating the identification information of the UE and the identification information of the UPF network element based on the target quantum key.

[0106] The first authentication information is obtained by the UPF network element by calculating the identification information of the UE and the identification information of the UPF network element based on the target quantum key. The above embodiment has described the generation process of the first authentication information in detail, which will not be repeated here. And the second authentication information is obtained by the UE by calculating the identification information of the UE and the identification information of the UPF network element based on the target quantum key.

[0107] In the disclosed embodiment, the first authentication information and the second authentication information are generated by the communicating parties based on the same quantum key and computing logic. Therefore, it is difficult for an attacker to forge valid authentication information to deceive either party, thereby protecting the security of communication. The communicating parties can share a quantum key and perform calculations and verifications based on the quantum key, without the need to generate and exchange different keys for each authentication process.

[0108] In some embodiments of the present disclosure, the UE identifier includes a user permanent identifier, and the UPF network element identifier includes domain name information of the UPF network element. The method of calculating the UE identifier and the UPF network element identifier based on the target quantum key to obtain the second authentication information includes: performing hash calculation on the user permanent identifier and the domain name information based on the target quantum key to obtain the second hash value.

[0109] In the disclosed embodiment, the UE identifier includes a user permanent identifier, and the UPF network element identifier includes domain name information of the UPF network element, such as a domain name address of the UPF network element. The UE uses the target quantum key to perform a hash calculation on the user permanent identifier and the domain name information of the UPF network element to obtain a second hash value, i.e., the second authentication information.

[0110] In some embodiments of the present disclosure, based on the target quantum key, a hash calculation is performed on the user permanent identification and the domain name information to obtain a second hash value, including: obtaining the user permanent identification, the length information of the user permanent identification, the domain name information, and the length information of the domain name information; processing the user permanent identification, the length information of the user permanent identification, the domain name information, and the length information of the domain name information to obtain processed information; and performing a hash calculation on the processed information based on the target quantum key to obtain a second hash value.

[0111] In the disclosed embodiment, the UE obtains the user permanent identification of the UE, the length information of the user permanent identification, the domain name information of the UPF network element and the length information of the domain name information, processes the information to obtain processed information, and then uses the target quantum key to perform hash calculation on the processed information to obtain a second hash value.

[0112] In a possible implementation, the UE performs hash calculation using the following formula to obtain a second hash value:

[0113] MAC_ue=HMAC_SHA256(Qk, P0||L0||P1||L1) (2)

[0114] In formula (2), MAC_ue represents the second hash value calculated by the UE, Qk represents the target quantum key, P0 represents the user permanent identifier, such as SUPI, L0 represents the length of the user permanent identifier, P1 represents the domain name information of the UPF network element, such as the domain name address, and L1 represents the length of the domain name information.

[0115] In formula (2), the UE concatenates P0, L0, P1 and L1 to obtain the concatenated information. For example, if P0=username@realm.com, then L0=18, P1=domain.com, then L1=10, and the concatenated information P0||L0||P1||L1=username@realm.com18domain.com10. Then, the UE uses the HMAC-SHA256 algorithm to perform hash calculation on the concatenated information with the target quantum key Qk as the root key to obtain the second hash value MAC_ue.

[0116] It should be noted that the embodiments of the present disclosure can adjust the information used in the hash calculation as needed. For example, in addition to the user permanent identification and the domain name information of the UPF network element, other relevant information can be added as needed for hash calculation to further enhance the security of authentication or meet specific business needs. Of course, other algorithms can also be used for hash calculation according to actual needs, and the present disclosure does not limit this.

[0117] In the communication method provided by the embodiment of the present disclosure, the UE obtains the second hash value by introducing the target quantum key for hash calculation. Due to the unique physical properties of the quantum key, it provides higher security and helps to prevent security threats such as attacker attacks and data leakage. Considering that the user permanent identification of the UE and the domain name information of the UPF network element are unique and specific, this information is combined with the length information for hash calculation to generate a unique second hash value as the second authentication information. This processing method improves the accuracy and uniqueness of subsequent UPF network element authentication and reduces the risk of misauthentication. In addition, by including the length information of the user permanent identification and the length information of the domain name information in the hash calculation, it can adapt to input data of different lengths, thereby increasing flexibility and compatibility.

[0118] Figure 4 An interaction diagram of a communication method according to an embodiment of the present disclosure is shown. Figure 4As shown, the interaction process of the communication method of the embodiment of the present disclosure includes the following steps.

[0119] Step S401: The user brings the UE to a key injection point to inject a target quantum key Qk, and simultaneously records the key identifier Key_ID of the target quantum key Qk.

[0120] Among them, the key injection point is managed by the key management system, so it can be considered that the key management system injects the target quantum key Qk for the UE.

[0121] Step S402: The UE sends a connection request Connect Request to the UPF network element, wherein the connection request Connect Request includes a user hidden identifier SUCI and a key identifier Key_ID.

[0122] Step S403: After receiving the connection request Connect Request, the UPF network element requests the key management system to distribute the target quantum key Qk based on the Key_ID.

[0123] Step S404: The UPF network element forwards the hidden user identity SUCI to the UDM network element for decryption to obtain the permanent user identity SUPI.

[0124] In step S405, after the UPF network element obtains the user permanent identification SUPI, it sends a connection response to the UE, and performs a hash calculation based on the target quantum key Qk to obtain a first hash value MAC_upf. The specific calculation method is shown in the above formula (1) and will not be repeated here.

[0125] Step S406: After the UE receives the connection response sent by the UPF network element, it performs hash calculation based on the target quantum key Qk to obtain a second hash value MAC_ue. The specific calculation method is shown in the above formula (2) and will not be repeated here.

[0126] Step S407: After completing the calculation, the UE sends the second hash value MAC_ue to the UPF network element.

[0127] Step S408, the UPF network element verifies whether the second hash value MAC_ue is equal to the first hash value MAC_upf. If the two are consistent, it is confirmed that the UE identity authentication is successful and the two parties establish a connection.

[0128] The communication method provided by the embodiment of the present disclosure effectively enhances the security of communication between UE and UPF network elements by introducing quantum keys for calculation and authentication; since the authentication information is generated based on the quantum key and needs to be verified between the UE and the UPF network element, the possibility of attacks by attackers is effectively prevented. Even if the attacker can intercept the communication content, he cannot forge valid authentication information to establish a connection; it can ensure that only authenticated UE can establish a connection with the UPF network element, which helps prevent unauthorized access and abuse of network resources, helps maintain the stability and availability of the network, thereby ensuring business continuity and providing users with a reliable and secure network service experience.

[0129] It should be noted that the acquisition, storage, use, and processing of data in the technical solution disclosed in this disclosure are in compliance with the relevant provisions of national laws and regulations, and various types of data such as personal identity data, operation data, behavioral data, etc. related to individuals, customers, and groups obtained in the embodiments of this disclosure have all been authorized.

[0130] Based on the same inventive concept, the present disclosure also provides a communication device in the following embodiments. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0131] Figure 5 A block diagram of a communication device according to an embodiment of the present disclosure is shown. Figure 5 As shown, the communication device 500 is applied to a UPF network element, and includes: a request receiving module 510, a quantum key acquisition module 520, a first authentication information generation module 530, an authentication information receiving module 540 and a first connection module 550.

[0132] Among them, the request receiving module 510 is configured to: receive a connection request sent by the UE; the connection request includes the UE identifier and the key identifier of the target quantum key, and the target quantum key is the quantum key injected by the key management system for the UE. The quantum key acquisition module 520 is configured to: obtain the target quantum key according to the key identifier of the target quantum key. The first authentication information generation module 530 is configured to: calculate the identification information of the UE and the identification information of the UPF network element based on the target quantum key to obtain the first authentication information. The authentication information receiving module 540 is configured to: send a connection response to the UE, and receive the second authentication information sent by the UE in response to the connection response. The first connection module 550 is configured to: verify whether the first authentication information and the second authentication information are the same. If they are the same, it is determined that the UE authentication is passed and a connection is established with the UE.

[0133] In some embodiments of the present disclosure, the quantum key acquisition module 520 is further configured to: send a key distribution request to a key management system; the key distribution request includes a key identifier of a target quantum key; and receive a target quantum key returned by the key management system according to the key identifier of the target quantum key.

[0134] In some embodiments of the present disclosure, the UE's identifier includes a user hidden identifier, and the communication device 500 also includes a user identifier acquisition module 560, which is configured to: send the user hidden identifier to the UDM network element so that the UDM network element decrypts the user hidden identifier to generate a user permanent identifier; and receive the user permanent identifier returned by the UDM network element.

[0135] In some embodiments of the present disclosure, the authentication information receiving module 540 is further configured to: after receiving the user permanent identifier returned by the UDM network element, send a connection response to the UE.

[0136] In some embodiments of the present disclosure, the identifier of the UPF network element includes the domain name information of the UPF network element; the first authentication information generation module 530 is also configured to: based on the target quantum key, perform hash calculation on the user permanent identifier and domain name information to obtain a first hash value.

[0137] In some embodiments of the present disclosure, the first authentication information generation module 530 is further configured to: obtain a user permanent identifier, length information of the user permanent identifier, domain name information, and length information of the domain name information; process the user permanent identifier, length information of the user permanent identifier, domain name information, and length information of the domain name information to obtain processed information; perform hash calculation on the processed information based on the target quantum key to obtain a first hash value.

[0138] In some embodiments of the present disclosure, the second authentication information is obtained by the UE calculating the identification information of the UE and the identification information of the UPF network element based on the target quantum key.

[0139] Figure 6 FIG. 2 is a block diagram of a communication device according to another embodiment of the present disclosure. Figure 6 As shown, the communication device 600 is applied to UE, and includes: a request sending module 610 , a response receiving module 620 , a second authentication information generating module 630 , an authentication information sending module 640 and a second connection module 650 .

[0140] The request sending module 610 is configured to: send a connection request to the UPF network element; the connection request includes the UE's identifier and the key identifier of the target quantum key, and the target quantum key is the quantum key injected by the key management system for the UE. The response receiving module 620 is configured to: receive a connection response sent by the UPF network element in response to the connection request. The second authentication information generation module 630 is configured to: in response to the connection response, calculate the UE's identifier information and the UPF network element's identifier information based on the target quantum key to obtain the second authentication information. The authentication information sending module 640 is configured to: send the second authentication information to the UPF network element. The second connection module 650 is configured to: if the UPF network element verifies that the second authentication information is the same as the first authentication information, it is determined that the UE authentication is passed and a connection is established with the UPF network element.

[0141] In some embodiments of the present disclosure, the UE identifier includes a user permanent identifier, the UPF network element identifier includes domain name information of the UPF network element, and the second authentication information generation module 630 is further configured to: perform hash calculation on the user permanent identifier and the domain name information based on the target quantum key to obtain a second hash value.

[0142] In some embodiments of the present disclosure, the second authentication information generation module 630 is further configured to: obtain the user permanent identification, the length information of the user permanent identification, the domain name information, and the length information of the domain name information; process the user permanent identification, the length information of the user permanent identification, the domain name information, and the length information of the domain name information to obtain processed information; perform hash calculation on the processed information based on the target quantum key to obtain a second hash value.

[0143] In some embodiments of the present disclosure, the first authentication information is obtained by the UPF network element by calculating the identification information of the UE and the identification information of the UPF network element based on the target quantum key.

[0144] It should be noted that the examples and application scenarios implemented by the modules in the above-mentioned device embodiment are the same as those of the corresponding steps in the method embodiment, but are not limited to the contents disclosed in the above-mentioned method embodiment. It should be noted that the above-mentioned modules as part of the device can be executed in a computer system such as a set of computer executable instructions.

[0145] Those skilled in the art will appreciate that various aspects of the present disclosure may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation that combines hardware and software aspects, which may be collectively referred to herein as a "circuit," "module," or "system."

[0146] Based on the same inventive concept, an electronic device is also provided in an embodiment of the present disclosure, the electronic device comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above communication methods by executing the executable instructions. Since the principle of solving the problem in the electronic device embodiment is similar to that in the above method embodiment, the implementation of the electronic device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0147] Refer to the following Figure 7 An electronic device 700 according to this embodiment of the present disclosure is described. Figure 7 The electronic device 700 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0148] like Figure 7 As shown, the electronic device 700 is in the form of a general computing device. The components of the electronic device 700 may include but are not limited to: at least one processing unit 710, at least one storage unit 720, and a bus 730 connecting different system components (including the storage unit 720 and the processing unit 710).

[0149] The storage unit stores a program code, and the program code can be executed by the processing unit 710, so that the processing unit 710 executes the steps according to various exemplary embodiments of the present disclosure described in the above "Exemplary Method" section of this specification. For example, the processing unit 710 can execute the following steps of the above method embodiment: step S210, receiving a connection request sent by the UE; the connection request includes the UE identifier and the key identifier of the target quantum key, and the target quantum key is a quantum key injected by the key management system for the UE; step S220, obtaining the target quantum key according to the key identifier of the target quantum key; step S230, based on the target quantum key, calculating the identification information of the UE and the identification information of the UPF network element to obtain the first authentication information; step S240, sending a connection response to the UE, and receiving the second authentication information sent by the UE in response to the connection response; step S250, verifying whether the first authentication information and the second authentication information are the same, if they are the same, determining that the UE authentication is passed, and establishing a connection with the UE.

[0150] The storage unit 720 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 7201 and / or a cache storage unit 7202 , and may further include a read-only storage unit (ROM) 7203 .

[0151] The storage unit 720 may also include a program / utility 7204 having a set (at least one) of program modules 7205, such program modules 7205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0152] Bus 730 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0153] The electronic device 700 may also communicate with one or more external devices 740 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 700, and / or communicate with any device that enables the electronic device 700 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 750. Furthermore, the electronic device 700 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 760. As shown, the network adapter 760 communicates with other modules of the electronic device 700 via a bus 730. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0154] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0155] Based on the same inventive concept, a computer-readable storage medium is also provided in the embodiment of the present disclosure, on which a computer program is stored, and when the computer program is executed by a processor, any one of the above communication methods is implemented. Since the principle of solving the problem in the embodiment of the computer-readable storage medium is similar to that in the above method embodiment, the implementation of the embodiment of the computer-readable storage medium can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0156] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0157] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0158] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0159] In a specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0160] Based on the same inventive concept, a computer program product is also provided in the embodiments of the present disclosure, including a computer program product, including: a computer program or an instruction, wherein when the computer program or the instruction is executed by a processor, the communication method of any one of the above method embodiments is implemented. Since the principle of solving the problem in the computer program product embodiment is similar to that in the above method embodiment, the implementation of the computer program product embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0161] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0162] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0163] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0164] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A communication method, characterized in that: The method is performed by a user plane function network element, and the method includes: Receiving a connection request sent by a terminal device; the connection request includes an identifier of the terminal device and a key identifier of a target quantum key, where the target quantum key is a quantum key injected into the terminal device by a key management system; Obtaining the target quantum key according to the key identifier of the target quantum key; Based on the target quantum key, calculating the identification information of the terminal device and the identification information of the user plane function network element to obtain first authentication information; Sending a connection response to the terminal device, and receiving second authentication information sent by the terminal device in response to the connection response; Verify whether the first authentication information and the second authentication information are the same. If they are the same, determine that the terminal device is authenticated and establish a connection with the terminal device.

2. The method according to claim 1, characterized in that The step of obtaining the target quantum key according to the key identifier of the target quantum key comprises: Sending a key distribution request to the key management system; the key distribution request includes a key identifier of the target quantum key; Receive the target quantum key returned by the key management system according to the key identifier of the target quantum key.

3. The method according to claim 1, characterized in that The identifier of the terminal device includes a user hidden identifier; Wherein, the method further comprises: Sending the hidden user identifier to a unified data management network element so that the unified data management network element decrypts the hidden user identifier to generate a permanent user identifier; Receive the user permanent identifier returned by the unified data management network element.

4. The method according to claim 3, characterized in that The sending a connection response to the terminal device includes: After receiving the user permanent identification returned by the unified data management network element, the connection response is sent to the terminal device.

5. The method according to claim 3, characterized in that: The identifier of the user plane function network element includes domain name information of the user plane function network element; The step of calculating the identification information of the terminal device and the identification information of the user plane function network element based on the target quantum key to obtain the first authentication information includes: Based on the target quantum key, a hash calculation is performed on the user permanent identifier and the domain name information to obtain a first hash value.

6. The method according to claim 5, characterized in that The step of performing hash calculation on the user permanent identifier and the domain name information based on the target quantum key to obtain a first hash value includes: Obtaining the user permanent identifier, the length information of the user permanent identifier, the domain name information, and the length information of the domain name information; Processing the user permanent identifier, the length information of the user permanent identifier, the domain name information, and the length information of the domain name information to obtain processed information; Performing a hash calculation on the processed information based on the target quantum key to obtain the first hash value.

7. The method according to any one of claims 1 to 6, characterized in that: The second authentication information is obtained by the terminal device calculating the identification information of the terminal device and the identification information of the user plane function network element based on the target quantum key.

8. A communication method, characterized in that: The method is performed by a terminal device, and the method includes: Sending a connection request to a user plane functional network element; the connection request includes an identifier of the terminal device and a key identifier of a target quantum key, where the target quantum key is a quantum key injected into the terminal device by a key management system; receiving a connection response sent by the user plane function network element in response to the connection request; In response to the connection response, calculating the identification information of the terminal device and the identification information of the user plane function network element based on the target quantum key to obtain second authentication information, and sending the second authentication information to the user plane function network element; If the user plane function network element verifies that the second authentication information is the same as the first authentication information, it is determined that the terminal device authentication is successful, and a connection is established with the user plane function network element.

9. The method according to claim 8, characterized in that The identifier of the terminal device includes a permanent user identifier, and the identifier of the user plane function network element includes domain name information of the user plane function network element; The step of calculating the identification information of the terminal device and the identification information of the user plane function network element based on the target quantum key to obtain the second authentication information includes: Based on the target quantum key, a hash calculation is performed on the user permanent identifier and the domain name information to obtain a second hash value.

10. The method according to claim 9, characterized in that The step of performing hash calculation on the user permanent identifier and the domain name information based on the target quantum key to obtain a second hash value includes: Obtaining the user permanent identifier, the length information of the user permanent identifier, the domain name information, and the length information of the domain name information; Processing the user permanent identifier, the length information of the user permanent identifier, the domain name information, and the length information of the domain name information to obtain processed information; Performing a hash calculation on the processed information based on the target quantum key to obtain the second hash value.

11. The method according to any one of claims 8 to 10, characterized in that: The first authentication information is obtained by the user plane function network element by calculating the identification information of the terminal device and the identification information of the user plane function network element based on the target quantum key.

12. A communication device, characterized in that: The device is applied to a user plane function network element, and the device includes: A request receiving module is configured to receive a connection request sent by a terminal device; the connection request includes an identifier of the terminal device and a key identifier of a target quantum key, and the target quantum key is a quantum key injected into the terminal device by a key management system; A quantum key acquisition module, configured to obtain the target quantum key according to the key identifier of the target quantum key; A first authentication information generating module is configured to calculate the identification information of the terminal device and the identification information of the user plane function network element based on the target quantum key to obtain first authentication information; an authentication information receiving module, configured to send a connection response to the terminal device, and receive second authentication information sent by the terminal device in response to the connection response; The first connection module is configured to verify whether the first authentication information and the second authentication information are the same. If they are the same, it is determined that the terminal device is authenticated and a connection is established with the terminal device.

13. A communication device, characterized in that: The device is executed by a terminal device, and the device includes: A request sending module is configured to send a connection request to a user plane function network element; the connection request includes an identifier of the terminal device and a key identifier of a target quantum key, and the target quantum key is a quantum key injected by a key management system for the terminal device; a response receiving module, configured to receive a connection response sent by the user plane function network element in response to the connection request; A second authentication information generating module is configured to calculate, in response to the connection response, the identification information of the terminal device and the identification information of the user plane function network element based on the target quantum key to obtain second authentication information; an authentication information sending module, configured to send the second authentication information to the user plane function network element; The second connection module is configured to determine that the terminal device authentication is successful and establish a connection with the user plane function network element if the user plane function network element verifies that the second authentication information is the same as the first authentication information.

14. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the communication method described in any one of claims 1 to 7 or the communication method described in any one of claims 8 to 11 by executing the executable instructions.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the communication method described in any one of claims 1 to 7, or executes the communication method described in any one of claims 8 to 11.

16. A computer program product comprising: A computer program or instruction, characterized in that when the computer program or instruction is executed by a processor, it implements the communication method described in any one of claims 1 to 7, or executes the communication method described in any one of claims 8 to 11.

Images