Authentication processing method and device, terminal and network side equipment

Abstract

The invention discloses an authentication processing method and device, a terminal and network side equipment, and belongs to the technical field of communication, and the authentication processing method comprises the steps that a first network function receives first information from a second network function or a third network function; the first network function sends second information to a third network function based on the first information, wherein the second information comprises authentication information; the third network function sends third information to the access network equipment; the access network equipment broadcasts fourth information; the user terminal receives the fourth information and sends fifth information based on the fourth information; and the first network function or the third network function receives the fifth information or the first response parameter, and authenticates the user terminal based on the fifth information or the first response parameter.

Description

Technical Field

[0001] The present application belongs to the field of communication technology, and specifically relates to an authentication processing method, device, terminal and network side equipment. Background Art

[0002] With the development of communication technology, low-power Ambient IoT (AIoT) technology has been introduced into communication systems. The user terminal or device in AIoT can be a tag-like device that is activated by an excitation signal. It is an electronic device with limited capabilities and cannot be authenticated by the traditional authentication process. Therefore, how to authenticate the user terminal in AIoT has become an urgent problem to be solved. Summary of the invention

[0003] The embodiments of the present application provide an authentication processing method, apparatus, terminal and network-side equipment, which can solve the problem of authentication of user terminals in AIoT.

[0004] In a first aspect, an authentication processing method is provided, comprising:

[0005] The first network function receives first information from the second network function or the third network function;

[0006] The first network function sends second information to a third network function based on the first information, the second information including authentication information, the authentication information including a challenge parameter or a random string;

[0007] The third network function sends third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter and the random character string;

[0008] The access network device broadcasts fourth information, where the fourth information includes any one of the authentication information, the challenge parameter, and the random character string;

[0009] The user terminal receives the fourth information, and sends fifth information based on the fourth information, where the fifth information includes a first response parameter, and the first response parameter is generated based on the challenge parameter or the random character string;

[0010] The first network function or the third network function receives the fifth information or the first response parameter, and authenticates the user terminal based on the fifth information or the first response parameter.

[0011] In a second aspect, an authentication processing method is provided, comprising:

[0012] When the user terminal receives the fourth information broadcast by the access network device, the user terminal sends the fifth information based on the fourth information;

[0013] The fourth information includes any one of authentication information, challenge parameters and random character strings;

[0014] The fifth information includes a first response parameter, which is generated based on the challenge parameter or the random character string;

[0015] The authentication information includes the challenge parameter or the random character string.

[0016] In a third aspect, an authentication processing method is provided, comprising:

[0017] The first network function receives first information from the second network function or the third network function;

[0018] The first network function sends second information to a third network function based on the first information, the second information including authentication information, the authentication information including a challenge parameter or a random string;

[0019] The authentication information is generated based on information not related to the user terminal, or the authentication information does not include the second response parameter.

[0020] In a fourth aspect, an authentication processing method is provided, comprising:

[0021] The second network function sends first information to the first network function, where the first information is used to trigger the first network function to send second information to the third network function, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random character string.

[0022] In a fifth aspect, an authentication processing method is provided, comprising:

[0023] The third network function receives second information, the second information includes authentication information, the authentication information includes a challenge parameter or a random string;

[0024] The third network function sends third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter and the random character string;

[0025] The second information is sent by the first network function or the fourth network function.

[0026] In a sixth aspect, an authentication processing method is provided, comprising:

[0027] The fourth network function receives sixth information from the first network function, the sixth information including a challenge parameter or a random string, and a target identifier associated with the user terminal;

[0028] The fourth network function performs at least one of the following based on the sixth information:

[0029] sending a second response parameter to the first network function;

[0030] The user terminal is authenticated.

[0031] In a seventh aspect, an authentication processing method is provided, comprising:

[0032] The access network device receives third information from the third network function, where the third information includes any one of authentication information, challenge parameters, and a random character string;

[0033] The access network device broadcasts fourth information, where the fourth information includes any one of the authentication information, the challenge parameter, and the random character string;

[0034] The authentication information includes a challenge parameter or a random character string.

[0035] In an eighth aspect, an authentication processing system is provided, including a first network function, a second network function, a third network function, an access network device, and a user terminal, wherein:

[0036] The first network function is configured to receive first information from the second network function or the third network function; and send second information to the third network function based on the first information, wherein the second information includes authentication information, and the authentication information includes a challenge parameter or a random string;

[0037] The third network function is used to send third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter and the random character string;

[0038] The access network device is used to broadcast fourth information, where the fourth information includes any one of the authentication information, the challenge parameter and the random character string;

[0039] The user terminal is configured to receive the fourth information, and send fifth information based on the fourth information, wherein the fifth information includes a first response parameter, and the first response parameter is generated based on the challenge parameter or the random character string;

[0040] The first network function or the third network function is used to receive the fifth information or the first response parameter, and authenticate the user terminal based on the fifth information or the first response parameter.

[0041] In a ninth aspect, an authentication processing device is provided, comprising:

[0042] A first sending module, configured to send fifth information based on the fourth information when receiving fourth information broadcast by the access network device;

[0043] The fourth information includes any one of authentication information, challenge parameters and random character strings;

[0044] The fifth information includes a first response parameter, which is generated based on the challenge parameter or the random character string;

[0045] The authentication information includes the challenge parameter or the random character string.

[0046] In a tenth aspect, an authentication processing device is provided, comprising:

[0047] A first receiving module, configured to receive first information from a second network function or a third network function;

[0048] A second sending module, configured to send second information to a third network function based on the first information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string;

[0049] The authentication information is generated based on information not related to the user terminal, or the authentication information does not include the second response parameter.

[0050] In an eleventh aspect, an authentication processing device is provided, comprising:

[0051] The third sending module is used to send first information to the first network function, where the first information is used to trigger the first network function to send second information to the third network function, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string.

[0052] In a twelfth aspect, an authentication processing device is provided, including:

[0053] A second receiving module, configured to receive second information, wherein the second information includes authentication information, and the authentication information includes a challenge parameter or a random character string;

[0054] A fourth sending module, configured to send third information to the access network device, wherein the third information includes any one of the authentication information, the challenge parameter and the random character string;

[0055] The second information is sent by the first network function or the fourth network function.

[0056] In a thirteenth aspect, an authentication processing device is provided, including:

[0057] a third receiving module, configured to receive sixth information from the first network function, wherein the sixth information includes a challenge parameter or a random string, and a target identifier associated with the user terminal;

[0058] A first execution module is configured to execute at least one of the following based on the sixth information:

[0059] sending a second response parameter to the first network function;

[0060] The user terminal is authenticated.

[0061] In a fourteenth aspect, an authentication processing device is provided, including:

[0062] a fourth receiving module, configured to receive third information from a third network function, wherein the third information includes any one of authentication information, a challenge parameter, and a random character string;

[0063] a fifth sending module, configured to broadcast fourth information, wherein the fourth information includes any one of the authentication information, the challenge parameter, and the random character string;

[0064] The authentication information includes a challenge parameter or a random character string.

[0065] In a fifteenth aspect, a terminal is provided, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps of the method described in the second aspect are implemented.

[0066] In a sixteenth aspect, a terminal is provided, comprising a processor and a communication interface, wherein the communication interface is configured to send fifth information based on the fourth information when receiving fourth information broadcast by an access network device;

[0067] The fourth information includes any one of authentication information, challenge parameters and random character strings;

[0068] The fifth information includes a first response parameter, which is generated based on the challenge parameter or the random character string;

[0069] The authentication information includes the challenge parameter or the random character string.

[0070] In the seventeenth aspect, a network side device is provided, which includes a processor and a memory, the memory storing a program or instruction that can be run on the processor, and the program or instruction, when executed by the processor, implements the steps of the method described in the third aspect, or implements the steps of the method described in the fourth aspect, or implements the steps of the method described in the fifth aspect, or implements the steps of the method described in the sixth aspect, or implements the steps of the method described in the seventh aspect.

[0071] In an eighteenth aspect, a network side device is provided, including a processor and a communication interface, wherein:

[0072] When the network side device is the first network function, the communication interface is used to receive first information from the second network function or the third network function; send second information to the third network function based on the first information, the second information includes authentication information, and the authentication information includes a challenge parameter or a random string;

[0073] The authentication information is generated based on information not related to the user terminal, or the authentication information does not include the second response parameter.

[0074] When the network side device is the second network function, the communication interface is used to send first information to the first network function, the first information is used to trigger the first network function to send second information to the third network function, the second information includes authentication information, and the authentication information includes a challenge parameter or a random character string.

[0075] When the network side device is a third network function, the communication interface is used to receive second information, the second information includes authentication information, and the authentication information includes a challenge parameter or a random string; send third information to the access network device, the third information includes any one of the authentication information, the challenge parameter and the random string;

[0076] The second information is sent by the first network function or the fourth network function.

[0077] When the network side device is the fourth network function, the communication interface is used to receive sixth information from the first network function, the sixth information including a challenge parameter or a random string, and a target identifier associated with the user terminal; and perform at least one of the following based on the sixth information:

[0078] sending a second response parameter to the first network function;

[0079] The user terminal is authenticated.

[0080] When the network side device is an access network device, the communication interface is used to receive third information from a third network function, the third information including any one of authentication information, challenge parameters and random character strings; broadcast fourth information, the fourth information including any one of the authentication information, the challenge parameters and the random character strings;

[0081] The authentication information includes a challenge parameter or a random character string.

[0082] In the nineteenth aspect, a readable storage medium is provided, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the second aspect are implemented, or the steps of the method described in the third aspect are implemented, or the steps of the method described in the fourth aspect are implemented, or the steps of the method described in the fifth aspect are implemented, or the steps of the method described in the sixth aspect are implemented, or the steps of the method described in the seventh aspect are implemented.

[0083] In the twentieth aspect, a wireless communication system is provided, comprising: a terminal and a network side device, wherein the terminal can be used to execute the steps of the method described in the second aspect, and the network side device can be used to execute the steps of the method described in the third aspect, or implement the steps of the method described in the fourth aspect, or implement the steps of the method described in the fifth aspect, or implement the steps of the method described in the sixth aspect, or implement the steps of the method described in the seventh aspect.

[0084] In the twenty-first aspect, a chip is provided, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instructions to implement the method as described in the second aspect, or the method as described in the third aspect, or the steps of the method as described in the fourth aspect, or the steps of the method as described in the fifth aspect, or the steps of the method as described in the sixth aspect, or the steps of the method as described in the seventh aspect.

[0085] In aspect 22, a computer program / program product is provided, wherein the computer program / program product is stored in a storage medium, and the program / program product is executed by at least one processor to implement the method as described in aspect 2, or the method as described in aspect 3, or the steps of the method as described in aspect 4, or the steps of the method as described in aspect 5, or the steps of the method as described in aspect 6, or the steps of the method as described in aspect 7.

[0086] In an embodiment of the present application, a first network function receives a first message from a second network function or a third network function; the first network function sends a second message to a third network function based on the first message, the second message includes authentication information, and the authentication information includes a challenge parameter or a random string; the third network function sends a third message to an access network device, the third message includes any one of the authentication information, the challenge parameter, and the random string; the access network device broadcasts a fourth message, the fourth message includes any one of the authentication information, the challenge parameter, and the random string; the user terminal receives the fourth message, and sends a fifth message based on the fourth message, the fifth message includes a first response parameter, and the first response parameter is generated based on the challenge parameter or the random string; the first network function or the third network function receives the fifth message or the first response parameter, and authenticates the user terminal based on the fifth message or the first response parameter. In this way, since the user terminal performs authentication based on the third information broadcast by the access network device, there is no need for the user terminal to perform authentication after accessing the network, so as to simplify the authentication process of the user terminal and meet the authentication capability requirements of the user terminal in AIoT, so the embodiment of the present application can effectively realize the authentication of the user terminal in AIoT. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] Figure 1 is a block diagram of a wireless communication system to which the embodiments of the present application can be applied;

[0088] Figure 2 This is one of the flowcharts of an authentication processing method provided in an embodiment of the present application;

[0089] Figure 3 This is a second flow chart of an authentication processing method provided in an embodiment of the present application;

[0090] Figure 4 This is a flowchart of an authentication processing method provided in an embodiment of the present application;

[0091] Figure 5 This is a fourth flow chart of an authentication processing method provided in an embodiment of the present application;

[0092] Figure 6 This is a flowchart of an authentication processing method provided in an embodiment of the present application;

[0093] Figure 7 This is a flowchart of an authentication processing method provided in an embodiment of the present application;

[0094] Figure 8 This is a flowchart of an authentication processing method provided in an embodiment of the present application;

[0095] Fig. 9 This is one of the structural diagrams of an authentication processing device provided in an embodiment of the present application;

[0096] Fig.10 This is a second structural diagram of an authentication processing device provided in an embodiment of the present application;

[0097] Fig.11 This is a third structural diagram of an authentication processing device provided in an embodiment of the present application;

[0098] Fig.12 This is a fourth structural diagram of an authentication processing device provided in an embodiment of the present application;

[0099] Fig.13 This is a fifth structural diagram of an authentication processing device provided in an embodiment of the present application;

[0100] Fig.14 This is the sixth structural diagram of an authentication processing device provided in an embodiment of the present application;

[0101] Fig.15 It is a structural diagram of a communication device provided in an embodiment of the present application;

[0102] Fig.16 is a schematic diagram of the structure of a terminal provided in an embodiment of the present application;

[0103] Fig.17 It is a structural diagram of a network side device provided in an embodiment of the present application;

[0104] Fig.18 It is a structural diagram of another network side device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0105] The terms "first", "second", etc. of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way are interchangeable where appropriate, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of one type, and the number of objects is not limited, for example, the first object can be one or more. In addition, "or" in the present application represents at least one of the connected objects. For example, "A or B" covers three schemes, namely, Scheme 1: including A but not including B; Scheme 2: including B but not including A; Scheme 3: including both A and B. The character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0106] The term "indication" in this application can be a direct indication (or explicit indication) or an indirect indication (or implicit indication). A direct indication can be understood as the sender explicitly informing the receiver of specific information, operations to be performed, or request results in the sent indication; an indirect indication can be understood as the receiver determining the corresponding information according to the indication sent by the sender, or making a judgment and determining the operation to be performed or the request result according to the judgment result.

[0107] It is worth noting that the technology described in the embodiments of the present application is not limited to the Long Term Evolution (LTE) / LTE-Advanced (LTE-A) system, but can also be used in other wireless communication systems, such as Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency Division Multiple Access (OFDMA), Single-carrier Frequency-Division Multiple Access (SC-FDMA) or other systems. The terms "system" and "network" in the embodiments of the present application are often used interchangeably, and the described technology can be used for the systems and radio technologies mentioned above as well as for other systems and radio technologies. The following description describes a New Radio (NR) system for illustrative purposes, and NR terminology is used in most of the following descriptions, but these technologies can also be applied to systems other than NR systems, such as the 6th generation (6 th Generation, 6G) communication system.

[0108] Figure 1A block diagram of a wireless communication system applicable to an embodiment of the present application is shown. The wireless communication system includes a terminal 11 and a network side device 12. Among them, the terminal 11 can be a mobile phone, a tablet computer (Tablet Personal Computer), a laptop computer (Laptop Computer), a notebook computer, a personal digital assistant (Personal Digital Assistant, PDA), a handheld computer, a netbook, an ultra-mobile personal computer (Ultra-mobile Personal Computer, UMPC), a mobile Internet device (Mobile Internet Device, MID), an augmented reality (Augmented Reality, AR), a virtual reality (Virtual Reality, VR) device, a robot, a wearable device (Wearable Device), an aircraft (flight vehicle), a vehicle-mounted device (Vehicle User Equipment, VUE), a ship-mounted device, a pedestrian terminal (Pedestrian User Equipment, PUE), a smart home (home appliances with wireless communication functions, such as refrigerators, televisions, washing machines or furniture, etc.), a game console, a personal computer (Personal Computer, PC), a teller machine or a self-service machine and other terminal side devices. Wearable devices include: smart watches, smart bracelets, smart headphones, smart glasses, smart jewelry (smart bracelets, smart bracelets, smart rings, smart necklaces, smart anklets, smart anklets, etc.), smart wristbands, smart clothing, etc. Among them, the vehicle-mounted device can also be called a vehicle-mounted terminal, a vehicle-mounted controller, a vehicle-mounted module, a vehicle-mounted component, a vehicle-mounted chip or a vehicle-mounted unit, etc. It should be noted that the specific type of the terminal 11 is not limited in the embodiment of the present application. The network side device 12 may include an access network device or a core network device, wherein the access network device may also be referred to as a radio access network (Radio Access Network, RAN) device, a radio access network function or a radio access network unit. The access network device may include a base station, a wireless local area network (Wireless Local Area Network, WLAN) access point (Access Point, AP) or a wireless fidelity (Wireless Fidelity, WiFi) node, etc.Among them, the base station may be referred to as a Node B (NB), an evolved Node B (eNB), a next generation Node B (gNB), a New Radio Node B (NR Node B), an access point, a Relay Base Station (RBS), a Serving Base Station (SBS), a Base Transceiver Station (BTS), a radio base station, a radio transceiver, a Basic Service Set (BSS), an Extended Service Set (ESS), a Home Node B (HNB), a Home Evolved Node B (home evolved Node B), a Transmission Reception Point (TRP) or other appropriate terms in the relevant field. As long as the same technical effect is achieved, the base station is not limited to specific technical vocabulary. It should be noted that in the embodiment of the present application, only the base station in the NR system is used as an example for introduction, and the specific type of the base station is not limited.

[0109] The core network equipment may include but is not limited to at least one of the following: core network node, core network function, mobility management entity (Mobility Management Entity, MME), access mobility management function (Access and Mobility Management Function, AMF), session management function (Session Management Function, SMF), user plane function (User Plane Function, UPF), policy control function (Policy Control Function, PCF), policy and charging rules function unit (Policy and Charging Rules Function, PCRF), edge application service discovery function (Edge Application Server Discovery Function, EASDF), unified data management (Unified Data Management, UDM), unified data storage (Unified Data Repository, UDR), home user server (Home Subscriber Server, HSS), centralized network configuration (CNC), network storage function (Network Repository Function, NRF), network exposure function (Network Exposure Function, NEF), local NEF (Local NEF, or L-NEF), binding support function (Binding Support Function, BSF), application function (Application Function, AF), etc. It should be noted that in the embodiments of the present application, only the core network device in the NR system is introduced as an example, and the specific type of the core network device is not limited.

[0110] For ease of understanding, some contents involved in the embodiments of the present application are described below:

[0111] The authentication process of traditional user terminals is as follows: the user terminal first accesses the network side device, initiates the establishment of a Radio Resource Control (RRC) connection, and then sends a Non-Access Stratum (NAS) message carrying the terminal identifier. The network side device then searches for the context or contract information of the terminal, obtains the authentication vector, and authenticates the terminal based on the authentication vector. After successful authentication, the terminal is allowed to establish a connection and provide network services. The authentication process includes two-way authentication (the terminal authenticates the network, and the network side device authenticates the terminal) and one-way authentication (the network side device authenticates the terminal).

[0112] Since the authentication process of a traditional user terminal requires the terminal to perform multiple RRC interactions and NAS interactions to complete the authentication, which is not possible for a low-power user device with limited capabilities, an authentication processing method of the present application is proposed.

[0113] The following is a detailed description of the authentication processing method provided in the embodiment of the present application through some embodiments and their application scenarios in combination with the accompanying drawings.

[0114] Reference Figure 2 , the present application embodiment provides an authentication processing method, such as Figure 2 As shown, the authentication processing method includes:

[0115] Step 201, a first network function receives first information from a second network function or a third network function;

[0116] Step 202: The first network function sends second information to a third network function based on the first information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string;

[0117] Step 203: The third network function sends third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter, and the random character string;

[0118] Step 204: the access network device broadcasts fourth information, where the fourth information includes any one of the authentication information, the challenge parameter, and the random character string;

[0119] Step 205: The user terminal receives the fourth information, and sends fifth information based on the fourth information, where the fifth information includes a first response parameter, and the first response parameter is generated based on the challenge parameter or the random character string;

[0120] Step 206: The first network function or the third network function receives the fifth information or the first response parameter, and authenticates the user terminal based on the fifth information or the first response parameter.

[0121] In the embodiment of the present application, the first network function can be understood as a tag information storage function, UDM, UDR, or authentication server function (AUSF), the second network function can be understood as NEF or AF, the third network function can be understood as AMF, and when the first network function is AUSF, the fourth network function can be understood as a tag information storage function, UDM, or UDR. The user terminal can also be referred to as a terminal.

[0122] Optionally, the transmission behavior between different network functions can be understood as direct or indirect transmission. For example, the first network function sending the second information to the third network function based on the first information can be understood as the first network function sending the second information to the third network function directly or indirectly based on the first information.

[0123] Optionally, after the third network function receives the second information, it may send the entire content of the second information to the access network device, or send part of the content of the second information to the access network device, or send content generated or derived from the second information to the access network device, or determine which access network devices to send the content of the second information based on the content of the second information. In other words, the third information may include part or all of the content of the second information. For example, sending authentication information, or sending a challenge parameter (Challenge) or a random string (RAND) in the authentication information.

[0124] Optionally, in some embodiments, the first information may be used to determine the terminal to be authenticated. In some embodiments, the first information may be information or content that has no association with the user terminal.

[0125] Optionally, the access network device may carry the fourth information via an excitation signal; or may carry the fourth information via a system information (SI) message. In this case, the access network device may send an excitation signal and broadcast the fourth information via an SI message.

[0126] Optionally, after receiving the excitation signal, the user device detects the fourth information from the excitation signal, or monitors the broadcast message and detects the fourth information from the broadcast message (such as an SI message), and can send the fifth information based on the fourth information, so that the first network function or the third network function can authenticate the user terminal.

[0127] It should be noted that in the embodiments of the present application, specific transmission behaviors may include the following cases according to different network functions:

[0128] Case 1: NEF sends the first information to UDM / UDR, UDM / UDR sends the second information to AMF through AUSF, AMF sends the third information to the access network device, and the access network device broadcasts the fourth information; the user terminal sends the fifth information or the first response parameter to AMF, AMF (or through AUSF) sends the fifth information or the first response parameter to UDM / UDR, and then UDM / UDR performs authentication.

[0129] Case 2: NEF / AF sends the first information to (or through UDM / UDR to) AUSF, AUSF sends the second information to AMF, AMF sends the third information to the access network device, and the access network device broadcasts the fourth information; the user terminal sends the fifth information or the first response parameter to AMF, AMF sends the fourth information or the first response parameter to AUSF, which is then authenticated by AUSF, or AUSF sends the sixth information to UDM / UDR, UDM / UDR sends the authentication result to AUSF after authentication, or UDM / UDR sends the second response parameter to AUSF, which is then authenticated by AUSF.

[0130] Case 3: For the above cases 1 and 2, NEF can be replaced by AMF.

[0131] Case 4: For the above cases 1 and 2, after AMF receives the fifth information, AMF also performs authentication.

[0132] It should be understood that the authentication of the user terminal includes: determining whether the current user terminal is a terminal device that needs to be authenticated, such as whether the corresponding ID belongs to the group corresponding to the group ID, or whether it is in one or more received terminal device IDs, and then verifying the first response parameter. If successful, the authentication is successful.

[0133] Optionally, the user terminal may calculate the first response parameter based on the challenge parameter or the random character string and a stored key.

[0134] In an embodiment of the present application, a first network function receives a first message from a second network function or a third network function; the first network function sends a second message to a third network function based on the first message, the second message includes authentication information, and the authentication information includes a challenge parameter or a random string; the third network function sends a third message to an access network device, the third message includes any one of the authentication information, the challenge parameter, and the random string; the access network device broadcasts a fourth message, the fourth message includes any one of the authentication information, the challenge parameter, and the random string; the user terminal receives the fourth message, and sends a fifth message based on the fourth message, the fifth message includes a first response parameter, and the first response parameter is generated based on the challenge parameter or the random string; the first network function or the third network function receives the fifth message or the first response parameter, and authenticates the user terminal based on the fifth message or the first response parameter. In this way, since the user terminal performs authentication based on the third information broadcast by the access network device, there is no need for the user terminal to perform authentication after accessing the network, so as to simplify the authentication process of the user terminal and meet the authentication capability requirements of the user terminal in AIoT, so the embodiment of the present application can effectively realize the authentication of the user terminal in AIoT.

[0135] Optionally, in some embodiments, the first information includes at least one of a user identifier, a group identifier, a device identifier and area information (such as geographic area information, a tracking area identifier list (TAI list) etc.).

[0136] In the embodiment of the present application, the above-mentioned identification identifier may be an identifier formed by intercepting a part of the user identifier, group identifier or device identifier, and is used by the user terminal to determine whether it is related to it.

[0137] Optionally, in some embodiments, the second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0138] It should be noted that, in an embodiment of the present application, the above-mentioned second information may include the entire content of the first information, or the second information may be generated based on the first information. For example, the area information in the second information may be generated according to at least one of the user identifier, group identifier and device identifier in the first information. In this case, the second information may include only the area information or include the area information and the corresponding identifier, or the corresponding identifier (that is, at least one of the user identifier, group identifier and device identifier) ​​may be obtained according to the area information in the first information. At least one of the user identifier, group identifier and device identifier in the second information, in this case, the second information may include only the obtained identifier, or may include the obtained identifier and area information (from the first information or derived from the area information in the first information, such as deriving the tracking area identifier list from the geographic area information).

[0139] It should be noted that, in some embodiments, before the first network function receives the first information from the second network function, the method further includes:

[0140] The second network function receives seventh information from the application function, the seventh information including at least one of a user identifier, a group identifier, a device identifier, and area information;

[0141] The first information is the seventh information or the first information is determined based on the seventh information.

[0142] Optionally, in some embodiments, the method further comprises at least one of the following:

[0143] In the case where the second information includes area information, the third network function determines the access network device based on the area information;

[0144] In a case where the second information includes a user identifier, the third network function determines the access network device based on the user identifier;

[0145] In the case where the second information includes a group identifier, the third network function determines the access network device based on the group identifier.

[0146] In a case where the second information includes a device identifier, the third network function determines the access network device based on the device identifier.

[0147] Optionally, in some embodiments, the third information further includes a tag authentication indication and at least one of second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0148] In an embodiment of the present application, the above-mentioned target information is generated by the first target information. For example, the area information can be generated based on various identifiers in the first target information, or the corresponding identifier (i.e., at least one of the user identifier, group identifier, and device identifier) ​​can be obtained based on the area information in the first target information.

[0149] Optionally, in some embodiments, when the third information includes area information (such as a tracking area identifier list TAI list), the access network device broadcasts the fourth information including:

[0150] The access network device determines or selects a target cell based on the area information;

[0151] The access network device broadcasts the fourth information in the target cell.

[0152] Optionally, in some embodiments, the access network device broadcasting the fourth information includes:

[0153] The access network device broadcasts the fourth information based on the authentication information or the third information. For example, if the received message contains authentication information, the fourth information is broadcast. Alternatively, the access network device is configured with a cell serving the Internet of Things business. Upon receiving the authentication information or the third information, the fourth information is broadcast in the above-mentioned cell serving the Internet of Things business.

[0154] In an embodiment of the present application, the access network device may generate the fourth information to be broadcast based on the authentication information, and determine in which cells the fourth information is broadcast based on other information in the third information.

[0155] Optionally, in some embodiments, the fourth information further includes at least one of a group identifier, a user identifier, a device identifier and an identification identifier.

[0156] Optionally, in some embodiments, the fifth information further includes at least one of the target identifiers associated with the user terminal, and the target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

[0157] It should be noted that in the embodiment of the present application, when the fourth information carries a group identifier, the fifth information may or may not carry the group identifier; when the fourth information carries a user identifier, the fifth information may or may not carry the user identifier; when the fourth information carries a device identifier, the fifth information may or may not carry the device identifier.

[0158] Optionally, in some embodiments, authenticating the user terminal based on the fifth information or the first response parameter includes:

[0159] The first network function sends sixth information to the fourth network function, where the sixth information includes the challenge parameter or the random string, and a target identifier associated with the user terminal;

[0160] The fourth network function sends a second response parameter or an authentication result to the first network function based on the sixth information;

[0161] In a case where the fourth network function sends a second response parameter to the first network function, the first network function determines an authentication result based on the first response parameter and the second response parameter;

[0162] The target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

[0163] In the embodiment of the present application, the first network function is AUSF, and the fourth network function is UDM. The specific transmission behaviors are as follows: NEF / AF sends the first information to AUSF, AUSF sends the second information to AMF, AMF sends the third information to the access network device, and the access network device broadcasts the fourth information; the user terminal sends the fifth information or the first response parameter to AMF, AMF sends the fifth information or the first response parameter to AUSF, AUSF sends the sixth information to UDM, UDM sends the authentication result or the second response parameter to AUSF, and AUSF performs authentication when UDM sends the second response parameter to AUSF.

[0164] Optionally, in some embodiments, the authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

[0165] In the embodiment of the present application, the authentication information is not generated based on the information related to the user terminal, for example, the authentication information includes the challenge parameter or random number mentioned above, and also includes the network authentication parameter, but the network authentication parameter is generated based on the group key or network private key, and can also be generated based on the group key or network private key and the challenge parameter or random number mentioned above. The second response parameter is used for the first network function to authenticate the user terminal, and specifically, the second response parameter can be calculated based on the challenge parameter or the random number and the saved key or group key related to the user terminal.

[0166] Optionally, in some embodiments, the authentication information further includes a network authentication parameter, and the network authentication parameter is used for the user terminal to authenticate the network.

[0167] In an embodiment of the present application, the above-mentioned network authentication parameters can be authentication token (AUTN) parameters generated by a key corresponding to a group identifier or a user terminal identifier, or an authentication token generated by a network key (or a network key and the above-mentioned challenge parameter or a random number). The network key can be a key agreed upon by the network and the IoT device operator (the key is downloaded by the network device operator or pre-set on the IoT terminal), or it can be a private key of the network (the IoT terminal obtains the public key of the network through an offline channel and verifies the network parameters based on the public key). The terminal can verify whether the network is a legitimate network based on the AUTN parameters. Since the network authentication parameters are carried in the authentication information, the terminal can authenticate the network and improve the security of communication.

[0168] Optionally, in some embodiments, after the user terminal receives the fourth information and sends fifth information based on the fourth information, the method further includes:

[0169] The third network function receives the fifth information from the user terminal;

[0170] The third network function sends the fifth information or the first response parameter to the first network function.

[0171] In the embodiment of the present application, the third network function may also perform authentication on the user terminal. After receiving the fifth information, the third network function may authenticate the user terminal and may send all or part of the fifth information to the first network function for authentication by the first network function.

[0172] Optionally, in some embodiments, after the first network function authenticates the user terminal based on the fifth information or the first response parameter, the method further includes:

[0173] The first network function sends an authentication result to the third network function or the second network function.

[0174] In an embodiment of the present application, after receiving the above-mentioned authentication result, the third network function can send the authentication result to the user terminal. When the authentication result is successful, the user terminal can perform subsequent information sending and receiving operations, and the network operates the user terminal to receive and send messages.

[0175] Optionally, refer to Figure 3 , the present application embodiment also provides an authentication processing method, such as Figure 3 As shown, the authentication processing method includes:

[0176] Step 301: When receiving fourth information broadcast by an access network device, the user terminal sends fifth information based on the fourth information;

[0177] The fourth information includes any one of authentication information, challenge parameters and random character strings;

[0178] The fifth information includes a first response parameter, which is generated based on the challenge parameter or the random character string;

[0179] The authentication information includes the challenge parameter or the random character string.

[0180] Optionally, the fourth information further includes at least one of a group identifier, a user identifier, a device identifier, and an identification identifier, and sending the fifth information based on the fourth information includes:

[0181] In a case where the user terminal is associated with at least one of the group identifier, the user identifier, the device identifier and the identification identifier, the user terminal sends the fifth information.

[0182] Optionally, the fifth information further includes at least one of target identifiers associated with the user terminal, and the target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

[0183] Optionally, the authentication information further includes a network authentication parameter, and the sending the fifth information based on the fourth information includes:

[0184] In a case where the fourth information includes the authentication information, the user terminal authenticates the network based on the network authentication parameter;

[0185] When the authentication is successful, the user terminal sends the fifth information.

[0186] Reference Figure 4 The present application also provides an authentication processing method, such as Figure 4 As shown, the authentication processing method includes:

[0187] Step 401, a first network function receives first information from a second network function or a third network function;

[0188] Step 402: The first network function sends second information to a third network function based on the first information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string;

[0189] The authentication information is generated based on information not related to the user terminal, or the authentication information does not include the second response parameter.

[0190] Optionally, the first information includes at least one of a user identifier, a group identifier, a device identifier and area information.

[0191] Optionally, the second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier and area information.

[0192] Optionally, the authentication information further includes a network authentication parameter, and the network authentication parameter is used for the user terminal to authenticate the network.

[0193] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0194] Optionally, the method further comprises:

[0195] The first network function receives fifth information or a first response parameter from the user terminal, where the fifth information includes the first response parameter, and the first response parameter is generated based on the challenge parameter or the random string;

[0196] The first network function authenticates the user terminal based on the fifth information or the first response parameter.

[0197] Optionally, the method further comprises:

[0198] The first network function receives fifth information or a first response parameter from the user terminal, where the fifth information includes the first response parameter, and the first response parameter is generated based on the challenge parameter or the random string;

[0199] The first network function sends sixth information to the fourth network function, where the sixth information includes the challenge parameter or the random string, and a target identifier associated with the user terminal;

[0200] The first network function receives a second response parameter or an authentication result from a fourth network function, wherein the second response parameter or the authentication result is determined based on the sixth information;

[0201] In a case where the first network function receives a second response parameter from a fourth network function, the first network function determines an authentication result based on the first response parameter and the second response parameter;

[0202] The target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

[0203] Optionally, refer to Figure 5 The present application also provides an authentication processing method, such as Figure 5 As shown, the authentication processing method includes:

[0204] Step 501: A second network function sends first information to a first network function, where the first information is used to trigger the first network function to send second information to a third network function, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string.

[0205] Optionally, the first information includes at least one of a user identifier, a group identifier, a device identifier and area information.

[0206] Optionally, the second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier and area information.

[0207] Optionally, the authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

[0208] Optionally, the authentication information further includes a network authentication parameter, and the network authentication parameter is used for the user terminal to authenticate the network.

[0209] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0210] Optionally, refer to Figure 6 The present application also provides an authentication processing method, such as Figure 6 As shown, the authentication processing method includes:

[0211] Step 601: The third network function receives second information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string;

[0212] Step 602: The third network function sends third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter, and the random character string;

[0213] The second information is sent by the first network function or the fourth network function.

[0214] Optionally, the method further comprises:

[0215] The third network function receives fifth information from the user terminal, where the fifth information includes a first response parameter, where the first response parameter is generated based on the challenge parameter or the random character string;

[0216] The third network function sends the fifth information or the first response parameter to the first network function, or authenticates the user terminal based on the first response parameter.

[0217] Optionally, after the third network function sends the fifth information or the first response parameter to the first network function, the method further includes:

[0218] The third network function receives the authentication result from the first network function.

[0219] Optionally, before the third network function receives the second information, the method further includes:

[0220] The third network function sends first information to the first network function, where the first information is used to trigger the first network function to send the second information.

[0221] Optionally, the authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

[0222] Optionally, the second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier and area information.

[0223] Optionally, the method further comprises at least one of the following:

[0224] In the case where the second information includes area information, the third network function determines the access network device based on the area information;

[0225] In a case where the second information includes a user identifier, the third network function determines the access network device based on the user identifier;

[0226] In a case where the second information includes a group identifier, the third network function determines the access network device based on the group identifier;

[0227] In a case where the second information includes a device identifier, the third network function determines the access network device based on the device identifier.

[0228] Optionally, the third information further includes a tag authentication indication and at least one of second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier and area information.

[0229] Optionally, the authentication information further includes a network authentication parameter, and the network authentication parameter is used for the user terminal to authenticate the network.

[0230] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0231] Optionally, refer to Figure 7 , the present application embodiment also provides an authentication processing method, such as Figure 7 As shown, the authentication processing method includes:

[0232] Step 701: The fourth network function receives sixth information from the first network function, where the sixth information includes a challenge parameter or a random string, and a target identifier associated with a user terminal;

[0233] Step 702: The fourth network function performs at least one of the following based on the sixth information:

[0234] sending a second response parameter to the first network function;

[0235] The user terminal is authenticated.

[0236] Optionally, after authenticating the user terminal, the method further includes:

[0237] Sending an authentication result to the first network function.

[0238] Optionally, refer to Figure 8 , the present application embodiment also provides an authentication processing method, such as Figure 8 As shown, the authentication processing method includes:

[0239] Step 801: The access network device receives third information from a third network function, where the third information includes any one of authentication information, a challenge parameter, and a random character string;

[0240] Step 802: the access network device broadcasts fourth information, where the fourth information includes any one of the authentication information, the challenge parameter, and the random character string;

[0241] The authentication information includes a challenge parameter or a random character string.

[0242] Optionally, the access network device broadcasting the fourth information includes:

[0243] The access network device broadcasts the fourth information based on the authentication information or the third information.

[0244] Optionally, the fourth information also includes at least one of a group identifier, a user identifier, a device identifier and an identification identifier.

[0245] Optionally, the third information further includes a tag authentication indication and at least one of second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier and area information.

[0246] Optionally, when the third information includes area information, the access network device broadcasting the fourth information based on the third information includes:

[0247] The access network device determines or selects a target cell based on the area information;

[0248] The access network device broadcasts the fourth information in the target cell.

[0249] Optionally, the authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

[0250] Optionally, the authentication information further includes a network authentication parameter, and the network authentication parameter is used for the user terminal to authenticate the network.

[0251] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0252] The embodiment of the present application also provides an authentication processing system, characterized in that it includes a first network function, a second network function, a third network function, an access network device and a user terminal, wherein:

[0253] The first network function is configured to receive first information from the second network function or the third network function; and send second information to the third network function based on the first information, wherein the second information includes authentication information, and the authentication information includes a challenge parameter or a random string;

[0254] The third network function is used to send third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter and the random character string;

[0255] The access network device is used to broadcast fourth information, where the fourth information includes any one of the authentication information, the challenge parameter and the random character string;

[0256] The user terminal is configured to receive the fourth information, and send fifth information based on the fourth information, wherein the fifth information includes a first response parameter, and the first response parameter is generated based on the challenge parameter or the random character string;

[0257] The first network function or the third network function is used to receive the fifth information or the first response parameter, and authenticate the user terminal based on the fifth information or the first response parameter.

[0258] Optionally, the first information includes at least one of a user identifier, a group identifier, a device identifier and area information.

[0259] Optionally, the second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier and area information.

[0260] Optionally, the third network function is further configured to perform at least one of the following:

[0261] In a case where the second information includes area information, determining the access network device based on the area information;

[0262] In a case where the second information includes a user identifier, determining the access network device based on the user identifier;

[0263] In the case where the second information includes a group identifier, determining the access network device based on the group identifier

[0264] In a case where the second information includes a device identifier, the access network device is determined based on the device identifier.

[0265] Optionally, the third information further includes a tag authentication indication and at least one of second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier and area information.

[0266] Optionally, when the third information includes area information, the access network device is specifically configured to:

[0267] Determine or select a target cell based on the area information;

[0268] The fourth information is broadcast in the target cell.

[0269] Optionally, the access network device is specifically used for:

[0270] The access network device broadcasts the fourth information based on the authentication information or the third information.

[0271] Optionally, the fourth information also includes at least one of a group identifier, a user identifier, a device identifier and an identification identifier.

[0272] Optionally, the fifth information further includes at least one of target identifiers associated with the user terminal, and the target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

[0273] Optionally, the authentication processing system further includes a fourth network function:

[0274] The first network function is specifically used to send sixth information to the fourth network function, where the sixth information includes the challenge parameter or the random string, and a target identifier associated with the user terminal;

[0275] The fourth network function is used to send a second response parameter or an authentication result to the first network function based on the sixth information;

[0276] In a case where the fourth network function sends a second response parameter to the first network function, the first network function is configured to determine an authentication result based on the first response parameter and the second response parameter;

[0277] The target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

[0278] Optionally, the authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

[0279] Optionally, the authentication information further includes a network authentication parameter, and the network authentication parameter is used for the user terminal to authenticate the network.

[0280] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0281] Optionally, the third network function is further used to receive the fifth information from the user terminal; and send the fifth information or the first response parameter to the first network function.

[0282] Optionally, the first network function is further used to send an authentication result to the third network function or the second network function.

[0283] The authentication processing method provided in the embodiment of the present application can be executed by an authentication processing device. In the embodiment of the present application, the authentication processing device provided in the embodiment of the present application is described by taking the authentication processing method executed by the authentication processing device as an example.

[0284] Reference Fig. 9 , the present application embodiment also provides an authentication processing device, such as Fig. 9 As shown, the authentication processing device 900 includes:

[0285] A first sending module 901 is configured to send fifth information based on the fourth information when receiving fourth information broadcast by the access network device;

[0286] The fourth information includes any one of authentication information, challenge parameters and random character strings;

[0287] The fifth information includes a first response parameter, which is generated based on the challenge parameter or the random character string;

[0288] The authentication information includes the challenge parameter or the random character string.

[0289] Optionally, the fourth information also includes at least one of a group identifier, a user identifier, a device identifier and an identification identifier, and the first sending module 901 is specifically used to send the fifth information when the user terminal is associated with at least one of the group identifier, the user identifier, the device identifier and the identification identifier.

[0290] Optionally, the fifth information further includes at least one of target identifiers associated with the user terminal, and the target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

[0291] Optionally, the authentication information also includes network authentication parameters, and the first sending module 901 is specifically used to

[0292] In a case where the fourth information includes the authentication information, authenticating the network based on the network authentication parameter;

[0293] When the authentication is successful, the fifth information is sent.

[0294] Reference Fig.10 , the present application embodiment also provides an authentication processing device, such as Fig.10 As shown, the authentication processing device 1000 includes:

[0295] A first receiving module 1001 is used to receive first information from a second network function or a third network function;

[0296] A second sending module 1002 is configured to send second information to a third network function based on the first information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string;

[0297] The first receiving module 1001 is further configured to receive fifth information or a first response parameter from a user terminal, where the fifth information includes the first response parameter, and the first response parameter is generated based on the challenge parameter or the random string;

[0298] The authentication information is generated based on information not related to the user terminal, or the authentication information does not include the second response parameter.

[0299] Optionally, the first information includes at least one of a user identifier, a group identifier, a device identifier and area information.

[0300] Optionally, the second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier and area information.

[0301] Optionally, the authentication information further includes a network authentication parameter, and the network authentication parameter is used for the user terminal to authenticate the network.

[0302] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0303] Optionally, the authentication processing device 1000 further includes a first authentication module.

[0304] The first receiving module 1001 is further used to: receive fifth information or a first response parameter from a user terminal, the fifth information includes the first response parameter, and the first response parameter is generated based on the challenge parameter or the random string;

[0305] The first authentication module is used to authenticate the user terminal based on the fifth information or the first response parameter.

[0306] Optionally, the authentication processing device 1000 further includes a first authentication module.

[0307] The first receiving module 1001 is further used to: receive fifth information or a first response parameter from a user terminal, the fifth information includes the first response parameter, and the first response parameter is generated based on the challenge parameter or the random string;

[0308] The second sending module 1002 is further used to: send sixth information to the fourth network function, where the sixth information includes the challenge parameter or the random string, and a target identifier associated with the user terminal;

[0309] The first receiving module 1001 is further used to: receive a second response parameter or an authentication result from a fourth network function, where the second response parameter or the authentication result is determined based on the sixth information;

[0310] The first authentication module is configured to determine an authentication result based on the first response parameter and the second response parameter when receiving a second response parameter from a fourth network function;

[0311] The second response parameter is generated based on the challenge parameter or the random character string, and the target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

[0312] Reference Fig.11 , the present application embodiment also provides an authentication processing device, such as Fig.11 As shown, the authentication processing device 1100 includes:

[0313] The third sending module 1101 is used to send first information to the first network function, where the first information is used to trigger the first network function to send second information to the third network function, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string.

[0314] Optionally, the first information includes at least one of a user identifier, a group identifier, a device identifier and area information.

[0315] Optionally, the second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier and area information.

[0316] Optionally, the authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

[0317] Optionally, the authentication information further includes a network authentication parameter, and the network authentication parameter is used for the user terminal to authenticate the network.

[0318] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0319] Reference Fig.12 , the present application embodiment also provides an authentication processing device, such as Fig.12 As shown, the authentication processing device 1200 includes:

[0320] The second receiving module 1201 is used to receive second information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string;

[0321] The fourth sending module 1202 is used to send third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter and the random character string;

[0322] The second information is sent by the first network function or the fourth network function.

[0323] Optionally, the authentication processing device 1200 further includes a second execution module.

[0324] The second receiving module 1201 is further configured to receive fifth information from a user terminal, where the fifth information includes a first response parameter, and the first response parameter is generated based on the challenge parameter or the random character string;

[0325] The second execution module is used to send the fifth information or the first response parameter to the first network function, or to authenticate the user terminal based on the first response parameter.

[0326] Optionally, the second receiving module 1201 is further used to receive an authentication result from the first network function.

[0327] Optionally, the fourth sending module 1202 is further used to send first information to the first network function, where the first information is used to trigger the first network function to send the second information.

[0328] Optionally, the authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

[0329] Optionally, the second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier and area information.

[0330] Optionally, the authentication processing device 1200 further includes a determination module, configured to perform at least one of the following:

[0331] In a case where the second information includes area information, determining the access network device based on the area information;

[0332] In a case where the second information includes a user identifier, determining the access network device based on the user identifier;

[0333] In a case where the second information includes a group identifier, determining the access network device based on the group identifier;

[0334] In a case where the second information includes a device identifier, the access network device is determined based on the device identifier.

[0335] Optionally, the third information further includes a tag authentication indication and at least one of second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier and area information.

[0336] Optionally, the authentication information further includes a network authentication parameter, and the network authentication parameter is used for the user terminal to authenticate the network.

[0337] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0338] Reference Fig.13 , the present application embodiment also provides an authentication processing device, such as Fig.13 As shown, the authentication processing device 1300 includes:

[0339] The third receiving module 1301 is used to receive sixth information from the first network function, where the sixth information includes a challenge parameter or a random string, and a target identifier associated with the user terminal;

[0340] The first execution module 1302 is configured to execute at least one of the following based on the sixth information:

[0341] sending a second response parameter to the first network function;

[0342] The user terminal is authenticated.

[0343] Optionally, the first execution module 1302 is further used to send an authentication result to the first network function.

[0344] Reference Fig.14 , the present application embodiment also provides an authentication processing device, such as Fig.14 As shown, the authentication processing device 1400 includes:

[0345] The fourth receiving module 1401 is used to receive third information from a third network function, where the third information includes any one of authentication information, challenge parameters and a random character string;

[0346] A fifth sending module 1402, configured to broadcast fourth information, where the fourth information includes any one of the authentication information, the challenge parameter, and the random character string;

[0347] The authentication information includes a challenge parameter or a random character string.

[0348] Optionally, the fifth sending module 1402 is specifically configured to:

[0349] The fourth information is broadcast based on the authentication information or the third information.

[0350] Optionally, the fourth information also includes at least one of a group identifier, a user identifier, a device identifier and an identification identifier.

[0351] Optionally, the third information further includes a tag authentication indication and at least one of second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier and area information.

[0352] Optionally, when the third information includes area information, the fifth sending module 1402 is specifically configured to:

[0353] Determine or select a target cell based on the area information;

[0354] The fourth information is broadcast in the target cell.

[0355] Optionally, the authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

[0356] Optionally, the authentication information further includes a network authentication parameter, and the network authentication parameter is used for the user terminal to authenticate the network.

[0357] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0358] The authentication processing device in the embodiment of the present application can be an electronic device, such as an electronic device with an operating system, or a component in an electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal, or it can be other devices other than a terminal. Exemplarily, the terminal can include but is not limited to the types of terminals 11 listed above, and other devices can be servers, network attached storage (NAS), etc., which are not specifically limited in the embodiment of the present application.

[0359] The authentication processing device provided in the embodiment of the present application can achieve Figures 3 to 8 The various processes implemented by the method embodiment and achieving the same technical effect are not described here to avoid repetition.

[0360] like Fig.15 As shown, an embodiment of the present application also provides a communication device 1500, including a processor 1501 and a memory 1502, and the memory 1502 stores a program or instruction that can be executed on the processor 1501. When the program or instruction is executed by the processor 1501, the various steps of the above-mentioned authentication processing method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0361] The embodiment of the present application also provides a terminal, including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the following Figure 3The steps in the method embodiment shown. This terminal embodiment corresponds to the above-mentioned terminal side method embodiment, and each implementation process and implementation method of the above-mentioned method embodiment can be applied to this terminal embodiment and can achieve the same technical effect. Specifically, Fig.16 A schematic diagram of the hardware structure of a terminal for implementing an embodiment of the present application.

[0362] The terminal 1600 includes but is not limited to: a radio frequency unit 1601, a network module 1602, an audio output unit 1603, an input unit 1604, a sensor 1605, a display unit 1606, a user input unit 1607, an interface unit 1608, a memory 1609 and at least some of the components of the processor 1610.

[0363] Those skilled in the art will appreciate that the terminal 1600 may also include a power source (such as a battery) for supplying power to each component, and the power source may be logically connected to the processor 1610 through a power management system, thereby implementing functions such as managing charging, discharging, and power consumption management through the power management system. Fig.16 The terminal structure shown in the figure does not constitute a limitation on the terminal. The terminal may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently, which will not be described in detail here.

[0364] It should be understood that in the embodiment of the present application, the input unit 1604 may include a graphics processing unit (GPU) 16041 and a microphone 16042, and the graphics processor 16041 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The display unit 1606 may include a display panel 16061, and the display panel 16061 may be configured in the form of a liquid crystal display, an organic light emitting diode, etc. The user input unit 1607 includes a touch panel 16071 and at least one of other input devices 16072. The touch panel 16071 is also called a touch screen. The touch panel 16071 may include two parts: a touch detection device and a touch controller. Other input devices 16072 may include, but are not limited to, a physical keyboard, function keys (such as a volume control button, a switch button, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0365] In the embodiment of the present application, after receiving downlink data from the network side device, the RF unit 1601 can transmit the data to the processor 1610 for processing; in addition, the RF unit 1601 can send uplink data to the network side device. Generally, the RF unit 1601 includes but is not limited to an antenna, an amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, etc.

[0366] The memory 1609 can be used to store software programs or instructions and various data. The memory 1609 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instruction required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory 1609 may include a volatile memory or a non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDRSDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM) and a direct memory bus random access memory (DRRAM). The memory 1609 in the embodiment of the present application includes but is not limited to these and any other suitable types of memory.

[0367] The processor 1610 may include one or more processing units; optionally, the processor 1610 integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor 1610.

[0368] The radio frequency unit 1601 is configured to send fifth information based on the fourth information when receiving the fourth information broadcast by the access network device;

[0369] The fourth information includes any one of authentication information, challenge parameters and random character strings;

[0370] The fifth information includes a first response parameter, which is generated based on the challenge parameter or the random character string;

[0371] The authentication information includes the challenge parameter or the random character string.

[0372] It can be understood that the implementation process of each implementation method mentioned in this embodiment can refer to the relevant description of the user terminal side method embodiment and achieve the same or corresponding technical effect. To avoid repetition, it will not be repeated here.

[0373] The embodiment of the present application also provides a network side device, including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the following Figure 8 The steps of the method embodiment shown. This network side device embodiment corresponds to the above network side device method embodiment, and each implementation process and implementation mode of the above method embodiment can be applied to this network side device embodiment and can achieve the same technical effect.

[0374] Specifically, the embodiment of the present application also provides a network side device. Fig.17 As shown, the network side device 1700 includes: an antenna 1701, a radio frequency device 1702, a baseband device 1703, a processor 1704 and a memory 1705. The antenna 1701 is connected to the radio frequency device 1702. In the uplink direction, the radio frequency device 1702 receives information through the antenna 1701 and sends the received information to the baseband device 1703 for processing. In the downlink direction, the baseband device 1703 processes the information to be sent and sends it to the radio frequency device 1702. The radio frequency device 1702 processes the received information and sends it out through the antenna 1701.

[0375] The method executed by the network-side device in the above embodiment may be implemented in the baseband device 1703, which includes a baseband processor.

[0376] The baseband device 1703 may include, for example, at least one baseband board on which a plurality of chips are arranged. Fig.17 As shown, one of the chips is, for example, a baseband processor, which is connected to the memory 1705 through a bus interface to call the program in the memory 1705 to execute the network device operations shown in the above method embodiment.

[0377] The network side device may further include a network interface 1706, which is, for example, a Common Public Radio Interface (CPRI).

[0378] Specifically, the network side device 1700 of the embodiment of the present application further includes: instructions or programs stored in the memory 1705 and executable on the processor 1704, and the processor 1704 calls the instructions or programs in the memory 1705 to execute Fig.14 The methods executed by the modules shown achieve the same technical effects, and therefore will not be described here in detail to avoid repetition.

[0379] Specifically, the embodiment of the present application also provides a network side device. Fig.18 As shown, the network side device 1800 includes: a processor 1801, a network interface 1802 and a memory 1803. The network interface 1802 is, for example, a common public radio interface (CPRI).

[0380] Specifically, the network side device 1800 of the embodiment of the present application further includes: instructions or programs stored in the memory 1803 and executable on the processor 1801, and the processor 1801 calls the instructions or programs in the memory 1803 to execute Figures 10 to 13 The methods executed by the modules shown achieve the same technical effects, and therefore will not be described here in detail to avoid repetition.

[0381] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned authentication processing method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0382] The processor is the processor in the terminal described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk. In some examples, the readable storage medium may be a non-transient readable storage medium.

[0383] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned authentication processing method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0384] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0385] The embodiment of the present application further provides a computer program / program product, which is stored in a storage medium. The computer program / program product is executed by at least one processor to implement the various processes of the above-mentioned authentication processing method embodiment and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0386] An embodiment of the present application also provides a wireless communication system, including: a terminal and a network side device, wherein the terminal can be used to execute the steps of the authentication processing method of the user terminal side as described above, and the network side device can be used to execute the steps of the authentication processing method of the network side device as described above.

[0387] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises one..." does not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the method and device in the embodiment of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0388] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of a computer software product plus a necessary general hardware platform, and of course, can also be implemented by hardware. The computer software product is stored in a storage medium (such as ROM, RAM, disk, CD, etc.), including several instructions to enable a terminal or a network-side device to execute the methods described in each embodiment of the present application.

[0389] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms of implementation methods without departing from the purpose of the present application and the scope of protection of the claims, and these implementation methods are all within the protection of the present application.

Claims

1. An authentication processing method, characterized in that: include: The first network function receives first information from the second network function or the third network function; The first network function sends second information to a third network function based on the first information, the second information including authentication information, the authentication information including a challenge parameter or a random string; The third network function sends third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter and the random character string; The access network device broadcasts fourth information, where the fourth information includes any one of the authentication information, the challenge parameter, and the random character string; The user terminal receives the fourth information, and sends fifth information based on the fourth information, where the fifth information includes a first response parameter, and the first response parameter is generated based on the challenge parameter or the random character string; The first network function or the third network function receives the fifth information or the first response parameter, and authenticates the user terminal based on the fifth information or the first response parameter.

2. The method according to claim 1, characterized in that The first information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

3. The method according to claim 1 or 2, characterized in that: The second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

4. The method according to claim 3, characterized in that The method further comprises at least one of the following: In the case where the second information includes area information, the third network function determines the access network device based on the area information; In a case where the second information includes a user identifier, the third network function determines the access network device based on the user identifier; In the case where the second information includes a group identifier, the third network function determines the access network device based on the group identifier. In a case where the second information includes a device identifier, the third network function determines the access network device based on the device identifier.

5. The method according to any one of claims 1 to 4, characterized in that: The third information also includes at least one of a tag authentication indication and second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

6. The method according to claim 5, characterized in that In the case where the third information includes the area information, the access network device broadcasting the fourth information includes: The access network device determines or selects a target cell based on the area information; The access network device broadcasts the fourth information in the target cell.

7. The method according to any one of claims 1 to 6, characterized in that: The access network device broadcasts the fourth information including: The access network device broadcasts the fourth information based on the authentication information or the third information.

8. The method according to any one of claims 1 to 7, characterized in that: The fourth information also includes at least one of a group identifier, a user identifier, a device identifier, and an identification identifier.

9. The method according to any one of claims 1 to 8, characterized in that: The fifth information also includes at least one of the target identifiers associated with the user terminal, and the target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

10. The method according to claim 1 or 9, characterized in that: The authenticating the user terminal based on the fifth information or the first response parameter includes: The first network function sends sixth information to the fourth network function, where the sixth information includes the challenge parameter or the random string, and a target identifier associated with the user terminal; The fourth network function sends a second response parameter or an authentication result to the first network function based on the sixth information; In a case where the fourth network function sends a second response parameter to the first network function, the first network function determines an authentication result based on the first response parameter and the second response parameter; The target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

11. The method according to any one of claims 1 to 10, characterized in that: The authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

12. The method according to any one of claims 1 to 11, characterized in that: The authentication information also includes network authentication parameters, and the network authentication parameters are used for the user terminal to authenticate the network.

13. The method according to claim 12, characterized in that The network authentication parameters are generated based on information not related to the user terminal.

14. The method according to any one of claims 1 to 13, characterized in that: After the user terminal receives the fourth information and sends fifth information based on the fourth information, the method further includes: The third network function receives the fifth information from the user terminal; The third network function sends the fifth information or the first response parameter to the first network function.

15. The method according to any one of claims 1 to 14, characterized in that After the first network function authenticates the user terminal based on the fifth information or the first response parameter, the method further includes: The first network function sends an authentication result to the third network function or the second network function.

16. An authentication processing method, characterized in that: include: When the user terminal receives the fourth information broadcast by the access network device, the user terminal sends the fifth information based on the fourth information; The fourth information includes any one of authentication information, challenge parameters and random character strings; The fifth information includes a first response parameter, which is generated based on the challenge parameter or the random character string; The authentication information includes the challenge parameter or the random character string.

17. The method according to claim 16, characterized in that The fourth information further includes at least one of a group identifier, a user identifier, a device identifier, and an identification identifier, and sending the fifth information based on the fourth information includes: In a case where the user terminal is associated with at least one of the group identifier, the user identifier, the device identifier and the identification identifier, the user terminal sends the fifth information.

18. The method according to claim 16 or 17, characterized in that The fifth information also includes at least one of the target identifiers associated with the user terminal, and the target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

19. The method according to any one of claims 16 to 18, characterized in that The authentication information further includes a network authentication parameter, and the sending of the fifth information based on the fourth information includes: In a case where the fourth information includes the authentication information, the user terminal authenticates the network based on the network authentication parameter; When the authentication is successful, the user terminal sends the fifth information.

20. An authentication processing method, characterized in that: include: The first network function receives first information from the second network function or the third network function; The first network function sends second information to a third network function based on the first information, the second information including authentication information, the authentication information including a challenge parameter or a random string; The authentication information is generated based on information not related to the user terminal, or the authentication information does not include the second response parameter.

21. The method according to claim 20, characterized in that The first information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

22. The method according to claim 20 or 21, characterized in that The second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

23. The method according to any one of claims 20 to 22, characterized in that The authentication information also includes network authentication parameters, and the network authentication parameters are used by the user terminal to authenticate the network.

24. The method according to claim 23, characterized in that The network authentication parameters are generated based on information not related to the user terminal.

25. The method according to any one of claims 20 to 24, characterized in that The method further comprises: The first network function receives fifth information or a first response parameter from the user terminal, where the fifth information includes the first response parameter, and the first response parameter is generated based on the challenge parameter or the random string; The first network function authenticates the user terminal based on the fifth information or the first response parameter.

26. The method according to any one of claims 20 to 25, characterized in that The method further comprises: The first network function receives fifth information or a first response parameter from the user terminal, where the fifth information includes the first response parameter, and the first response parameter is generated based on the challenge parameter or the random string; The first network function sends sixth information to the fourth network function, where the sixth information includes the challenge parameter or the random string, and a target identifier associated with the user terminal; The first network function receives a second response parameter or an authentication result from a fourth network function, wherein the second response parameter or the authentication result is determined based on the sixth information; In a case where the first network function receives a second response parameter from a fourth network function, the first network function determines an authentication result based on the first response parameter and the second response parameter; The second response parameter is generated based on the challenge parameter or the random character string, and the target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

27. An authentication processing method, characterized in that: include: The second network function sends first information to the first network function, where the first information is used to trigger the first network function to send second information to the third network function, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random character string.

28. The method according to claim 27, characterized in that The first information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

29. The method according to claim 27 or 28, characterized in that The second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

30. The method according to any one of claims 27 to 29, characterized in that The authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

31. The method according to any one of claims 27 to 30, characterized in that The authentication information also includes network authentication parameters, and the network authentication parameters are used by the user terminal to authenticate the network.

32. The method according to claim 31, characterized in that The network authentication parameters are generated based on information not related to the user terminal.

33. An authentication processing method, characterized in that: include: The third network function receives second information, the second information includes authentication information, the authentication information includes a challenge parameter or a random string; The third network function sends third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter and the random character string; The second information is sent by the first network function or the fourth network function.

34. The method according to claim 33, characterized in that The method further comprises: The third network function receives fifth information from the user terminal, where the fifth information includes a first response parameter, where the first response parameter is generated based on the challenge parameter or the random character string; The third network function sends the fifth information or the first response parameter to the first network function, or authenticates the user terminal based on the first response parameter.

35. The method according to claim 34, characterized in that After the third network function sends the fifth information or the first response parameter to the first network function, the method further includes: The third network function receives the authentication result from the first network function.

36. The method according to any one of claims 33 to 35, characterized in that Before the third network function receives the second information, the method further includes: The third network function sends first information to the first network function, where the first information is used to trigger the first network function to send the second information.

37. The method according to any one of claims 33 to 36, characterized in that The authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

38. The method according to any one of claims 33 to 37, characterized in that The second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

39. The method according to claim 38, characterized in that The method further comprises at least one of the following: In the case where the second information includes area information, the third network function determines the access network device based on the area information; In a case where the second information includes a user identifier, the third network function determines the access network device based on the user identifier; In a case where the second information includes a group identifier, the third network function determines the access network device based on the group identifier; In a case where the second information includes a device identifier, the third network function determines the access network device based on the device identifier.

40. The method according to any one of claims 33 to 39, characterized in that The third information also includes at least one of a tag authentication indication and second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

41. The method according to any one of claims 33 to 40, characterized in that The authentication information also includes network authentication parameters, and the network authentication parameters are used for the user terminal to authenticate the network.

42. The method according to claim 41, characterized in that The network authentication parameters are generated based on information not related to the user terminal.

43. An authentication processing method, characterized in that: include: The fourth network function receives sixth information from the first network function, the sixth information including a challenge parameter or a random string, and a target identifier associated with the user terminal; The fourth network function performs at least one of the following based on the sixth information: sending a second response parameter to the first network function; The user terminal is authenticated.

44. The method according to claim 43, characterized in that After authenticating the user terminal, the method further includes: Sending an authentication result to the first network function.

45. An authentication processing method, characterized in that: include: The access network device receives third information from the third network function, where the third information includes any one of authentication information, challenge parameters, and a random character string; The access network device broadcasts fourth information, where the fourth information includes any one of the authentication information, the challenge parameter, and the random character string; The authentication information includes a challenge parameter or a random character string.

46. ​​The method according to claim 45, characterized in that The access network device broadcasts the fourth information including: The access network device broadcasts the fourth information based on the authentication information or the third information.

47. The method according to claim 45 or 46, characterized in that The fourth information also includes at least one of a group identifier, a user identifier, a device identifier, and an identification identifier.

48. The method according to any one of claims 45 to 47, characterized in that The third information also includes at least one of a tag authentication indication and second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

49. The method according to claim 48, characterized in that In the case where the third information includes area information, the access network device broadcasting the fourth information based on the third information includes: The access network device determines or selects a target cell based on the area information; The access network device broadcasts the fourth information in the target cell.

50. The method according to any one of claims 45 to 48, characterized in that The authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

51. The method according to any one of claims 45 to 50, characterized in that The authentication information also includes network authentication parameters, and the network authentication parameters are used for the user terminal to authenticate the network.

52. The method according to claim 51, characterized in that The network authentication parameters are generated based on information not related to the user terminal.

53. An authentication processing system, characterized in that: It includes a first network function, a second network function, a third network function, an access network device and a user terminal, wherein: The first network function is configured to receive first information from the second network function or the third network function; and send second information to the third network function based on the first information, wherein the second information includes authentication information, and the authentication information includes a challenge parameter or a random string; The third network function is used to send third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter and the random character string; The access network device is used to broadcast fourth information, where the fourth information includes any one of the authentication information, the challenge parameter and the random character string; The user terminal is configured to receive the fourth information, and send fifth information based on the fourth information, wherein the fifth information includes a first response parameter, and the first response parameter is generated based on the challenge parameter or the random character string; The first network function or the third network function is used to receive the fifth information or the first response parameter, and authenticate the user terminal based on the fifth information or the first response parameter.

54. An authentication processing device, characterized in that: include: A first sending module, configured to send fifth information based on the fourth information when receiving fourth information broadcast by the access network device; The fourth information includes any one of authentication information, challenge parameters and random character strings; The fifth information includes a first response parameter, which is generated based on the challenge parameter or the random character string; The authentication information includes the challenge parameter or the random character string.

55. An authentication processing device, characterized in that: include: A first receiving module, configured to receive first information from a second network function or a third network function; A second sending module, configured to send second information to a third network function based on the first information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string; The authentication information is generated based on information not related to the user terminal, or the authentication information does not include the second response parameter.

56. An authentication processing device, characterized in that: include: The third sending module is used to send first information to the first network function, where the first information is used to trigger the first network function to send second information to the third network function, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string.

57. An authentication processing device, characterized in that: include: A second receiving module, configured to receive second information, wherein the second information includes authentication information, and the authentication information includes a challenge parameter or a random character string; A fourth sending module, configured to send third information to the access network device, wherein the third information includes any one of the authentication information, the challenge parameter and the random character string; The second information is sent by the first network function or the fourth network function.

58. An authentication processing device, characterized in that: include: a third receiving module, configured to receive sixth information from the first network function, wherein the sixth information includes a challenge parameter or a random string, and a target identifier associated with the user terminal; A first execution module is configured to execute at least one of the following based on the sixth information: sending a second response parameter to the first network function; The user terminal is authenticated.

59. An authentication processing device, characterized in that: include: a fourth receiving module, configured to receive third information from a third network function, wherein the third information includes any one of authentication information, a challenge parameter, and a random character string; a fifth sending module, configured to broadcast fourth information, wherein the fourth information includes any one of the authentication information, the challenge parameter, and the random character string; The authentication information includes a challenge parameter or a random character string.

60. A terminal, characterized in that: It comprises a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the authentication processing method as described in any one of claims 16 to 19 are implemented.

61. A network side device, characterized in that: It includes a processor and a memory, the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the authentication processing method as described in any one of claims 20 to 52 are implemented.

62. A readable storage medium, characterized in that The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the authentication processing method as described in any one of claims 16 to 52 are implemented.

Images